From 4c3f6758db63e4ea82a4a7cfd1eeafb5dadd84a0 Mon Sep 17 00:00:00 2001 From: Rainer Jung Date: Sun, 5 Aug 2012 13:48:40 +0000 Subject: [PATCH] mod_ssl: Add new directive SSLCompression to disable TLS-level compression. PR 53219. Backport of r1345319 and r1348656 from trunk. Submitted by: Bjoern Jacke , sf Reviewed by: rjung, trawick Backported by: rjung git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369585 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ STATUS | 6 ------ docs/manual/mod/mod_ssl.xml | 16 ++++++++++++++++ modules/ssl/mod_ssl.c | 3 +++ modules/ssl/ssl_engine_config.c | 23 +++++++++++++++++++++++ modules/ssl/ssl_engine_init.c | 12 ++++++++++++ modules/ssl/ssl_private.h | 9 +++++++++ 7 files changed, 66 insertions(+), 6 deletions(-) diff --git a/CHANGES b/CHANGES index 40acf06fcc..003b69c7a3 100644 --- a/CHANGES +++ b/CHANGES @@ -7,6 +7,9 @@ Changes with Apache 2.4.3 possible XSS for a site where untrusted users can upload files to a location with MultiViews enabled. [Niels Heinen ] + *) mod_ssl: Add new directive SSLCompression to disable TLS-level + compression. PR 53219. [Björn Jacke , Stefan Fritsch] + *) mod_lua: Add a few missing request_rec fields. Rename remote_ip to client_ip to match conn_rec. [Stefan Fritsch] diff --git a/STATUS b/STATUS index 4647700058..a991c7009b 100644 --- a/STATUS +++ b/STATUS @@ -88,12 +88,6 @@ RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] - * mod_ssl: Add SSLCompression directive. - trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1345319 and - http://svn.apache.org/viewvc?view=revision&revision=1348656 - 2.4.x patch: http://people.apache.org/~rjung/patches/ssl-compression-directive-2_4.patch - +1: rjung, sf, trawick - note: fix httpd compatibility info in docs when backporting PATCHES PROPOSED TO BACKPORT FROM TRUNK: [ New proposals should be added at the end of the list ] diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index db93b21038..1fe51c8317 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -2389,4 +2389,20 @@ be protected with file permissions similar to those used for + +SSLCompression +Disallow compression on the SSL level +SSLCompression on|off +SSLCompression on +server config +virtual host +Available in httpd 2.4.3 and later, if using OpenSSL 0.9.8 or later; +virtual host scope available if using OpenSSL 1.0.0 or later + + +

This directive allows to disable compression on the SSL level.

+ + + + diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c index fe7aeae5f7..0872da8a82 100644 --- a/modules/ssl/mod_ssl.c +++ b/modules/ssl/mod_ssl.c @@ -138,6 +138,9 @@ static const command_rec ssl_config_cmds[] = { "('[+-][" SSL_PROTOCOLS "] ...' - see manual)") SSL_CMD_SRV(HonorCipherOrder, FLAG, "Use the server's cipher ordering preference") + SSL_CMD_SRV(Compression, FLAG, + "Enable SSL level compression" + "(`on', `off')") SSL_CMD_SRV(InsecureRenegotiation, FLAG, "Enable support for insecure renegotiation") SSL_CMD_ALL(UserName, TAKE1, diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c index 6aab7641d6..15993f16cc 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c @@ -207,6 +207,9 @@ static SSLSrvConfigRec *ssl_config_server_new(apr_pool_t *p) #ifdef HAVE_FIPS sc->fips = UNSET; #endif +#ifndef OPENSSL_NO_COMP + sc->compression = UNSET; +#endif modssl_ctx_init_proxy(sc, p); @@ -328,6 +331,9 @@ void *ssl_config_server_merge(apr_pool_t *p, void *basev, void *addv) #ifdef HAVE_FIPS cfgMergeBool(fips); #endif +#ifndef OPENSSL_NO_COMP + cfgMergeBool(compression); +#endif modssl_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy); @@ -663,6 +669,23 @@ static const char *ssl_cmd_check_file(cmd_parms *parms, } +const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag) +{ +#if !defined(OPENSSL_NO_COMP) + SSLSrvConfigRec *sc = mySrvConfig(cmd->server); +#ifndef SSL_OP_NO_COMPRESSION + const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); + if (err) + return "This version of openssl does not support configuring " + "compression within sections."; +#endif + sc->compression = flag ? TRUE : FALSE; + return NULL; +#else + return "Setting Compression mode unsupported; not implemented by the SSL library"; +#endif +} + const char *ssl_cmd_SSLHonorCipherOrder(cmd_parms *cmd, void *dcfg, int flag) { #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index 4ba3181f2c..7c1217376c 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -622,6 +622,18 @@ static void ssl_init_ctx_protocol(server_rec *s, } #endif + +#ifndef OPENSSL_NO_COMP + if (sc->compression == FALSE) { +#ifdef SSL_OP_NO_COMPRESSION + /* OpenSSL >= 1.0 only */ + SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION); +#elif OPENSSL_VERSION_NUMBER >= 0x00908000L + sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); +#endif + } +#endif + #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION if (sc->insecure_reneg == TRUE) { SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h index 1ce069eb77..f2fb7d5240 100644 --- a/modules/ssl/ssl_private.h +++ b/modules/ssl/ssl_private.h @@ -180,6 +180,11 @@ #define HAVE_TLSV1_X #endif +#if !defined(OPENSSL_NO_COMP) && !defined(SSL_OP_NO_COMPRESSION) \ + && OPENSSL_VERSION_NUMBER < 0x00908000L +#define OPENSSL_NO_COMP +#endif + /* mod_ssl headers */ #include "ssl_util_ssl.h" @@ -673,6 +678,9 @@ struct SSLSrvConfigRec { #ifdef HAVE_FIPS BOOL fips; #endif +#ifndef OPENSSL_NO_COMP + BOOL compression; +#endif }; /** @@ -727,6 +735,7 @@ const char *ssl_cmd_SSLCARevocationPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLHonorCipherOrder(cmd_parms *cmd, void *dcfg, int flag); +const char *ssl_cmd_SSLCompression(cmd_parms *, void *, int flag); const char *ssl_cmd_SSLVerifyClient(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLVerifyDepth(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLSessionCache(cmd_parms *, void *, const char *);