I added a few more fixes, and there are still more that might
need a doxygen expert.
PR: 48061
Submitted by: Brad Hards
Reviewed by: poirier
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@830527 13f79535-47bb-0310-9956-ffa450edef68
* modules/ssl/ssl_util_stapling.c: New file.
* modules/ssl/config.m4, modules/ssl/mod_ssl.dsp: Build it.
* modules/ssl/ssl_toolkit_compat.h: Define HAVE_OCSP_STAPLING if
OpenSSL is of suitable version (>= 0.9.8g) and capability (TLS
extension support enabled).
* modules/ssl/mod_ssl.c: Add config directives.
* modules/ssl/ssl_private.h: Add prototypes for new functions.
(SSLModConfigRec): Add fields for stapling socache instance and
associated mutex.
(modssl_ctx_t): Add config fields for stapling.
* modules/ssl/ssl_engine_init.c (ssl_init_Module, ssl_init_Child):
Call the stapling initialization functions.
* modules/ssl/ssl_engine_config.c: Add config hooks.
* modules/ssl/ssl_scache.c: Create, initialize and destroy the socache
instance for OCSP responses.
Submitted by: Dr Stephen Henson <shenson oss-institute.org>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@829619 13f79535-47bb-0310-9956-ffa450edef68
SSL_CLIENT_I_DN, SSL_SERVER_S_DN, SSL_SERVER_I_DN back to the environment
variables to be set by mod_ssl.
Submitted by: Peter Sylvester <peter.sylvester edelweb.fr>
Reviewed by: rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@820401 13f79535-47bb-0310-9956-ffa450edef68
modssl_dispatch_ocsp_request): Take timeout as argument, as pass through.
* modules/ssl/ssl_engine_ocsp.c (verify_ocsp_status): Pass server timeout
to modssl_dispatch_ocsp_request.
Submitted by: Dr Stephen Henson <shenson oss-institute.org>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@815719 13f79535-47bb-0310-9956-ffa450edef68
* modules/ssl/ssl_engine_io.c (bio_filter_in_read): Flush pending
output unconditionally since OpenSSL is known to not flush correctly
at all times, and it should be cheap even in cases where it is
unnecessary.
PR: 46952
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@788715 13f79535-47bb-0310-9956-ffa450edef68
implementation of BIO_CTRL_PENDING and BIO_CTRL_WPENDING, to return
zero and pending-bytes-to-write respectively.
PR: 46952
Submitted by: David Smith <David.Smith cern.ch>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@787722 13f79535-47bb-0310-9956-ffa450edef68
the _UID variable to NID_userId, where defined by OpenSSL.
PR: 45107
Submitted by: Michael Ströder <michael stroeder.com>,
Peter Sylvester <peter.sylvester edelweb.fr>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@787683 13f79535-47bb-0310-9956-ffa450edef68
stricter checking of remote server certificates.
(docs/manual/mod/mod_ssl.xml)
Documentation of SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN.
(modules/proxy/mod_proxy_http.c)
Set the hostname of the request URL as note on the connection.
(modules/ssl/ssl_private.h)
Add proxy_ssl_check_peer_expire and proxy_ssl_check_peer_cn fields to
the SSLSrvConfigRec.
(modules/ssl/ssl_engine_config.c)
Directives stuff for SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN.
(modules/ssl/ssl_engine_io.c)
Check whether the remote servers certificate is expired / if there is a
mismatch between the requested hostanme and the remote server certificates
CN field.
Be able to parse ASN1 times.
(modules/ssl/mod_ssl.c)
Directives stuff for SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@760866 13f79535-47bb-0310-9956-ffa450edef68
of integral parts which share global variables, functions, and macros
with the rest of httpd.
Converted now:
prefork, worker, event, simple, WinNT*
*WinNT hasn't been built or tested, and relies on a hack to include the
WinNT mpm.h to disable Unixy MPM support routines in mpm_common.c
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@757853 13f79535-47bb-0310-9956-ffa450edef68
adjust the remaining part of mod_ssl to use this server_rec instead of
c->base_server.
modules/ssl/ssl_private.h:
- server_rec member to SSLConnRec struct
- Add macros to extract data from connection_rec
mySrvFromConn(c)
mySrvConfigFromConn(c)
myModConfigFromConn(c)
modules/ssl/ssl_engine_io.c
modules/ssl/ssl_util_ocsp.c
modules/ssl/ssl_engine_kernel.c
modules/ssl/mod_ssl.c
modules/ssl/ssl_engine_log.c
- Use the new macros to extract data fron connection_rec
and use the server_rec stored in SSLConnRec instead of
c->base_server whereever appropriate.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@757463 13f79535-47bb-0310-9956-ffa450edef68
function which was never included in OpenSSL:
* acinclude.m4: Remove test for fictional function.
* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Remove code.
* modules/ssl/ssl_engine_config.c (MODSSL_SET_CA): Remove unused
macro. (ssl_cmd_SSLCACertificatePath,
ssl_cmd_SSLCACertificateFile): Fail if per-dir-CA is configured.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@757380 13f79535-47bb-0310-9956-ffa450edef68
and the functions that manipulate it. Make httpd trunk compile against OpenSSL HEAD
as well as OpenSSL 0.9.8j. Also, get rid of some warnings.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@748396 13f79535-47bb-0310-9956-ffa450edef68
* include/ap_socache.h (ap_socache_provider_t::store): Take a pool.
(ap_socache_provider_t::retrieve): Guarantee APR_NOTFOUND for a
"not found" result.
(ap_socache_provider_t::remove): Return an apr_status_t.
* modules/cache/mod_socache_dc.c, modules/cache/mod_socache_dbm.c,
modules/cache/mod_socache_shmcb,
modules/cache/mod_socache_memcache.c: Adjust accordingly.
* modules/ssl/ssl_scache.c (ssl_scache_store): Pass pool to
sesscache->store.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@726059 13f79535-47bb-0310-9956-ffa450edef68
using socache provider config defaults by omitting the arguments, so
e.g. "SSLSessionCache shmcb" or even "SSLSessionCache default"
should now DTRT.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@726034 13f79535-47bb-0310-9956-ffa450edef68
DNs with duplicate tags:
* modules/ssl/ssl_engine_vars.c:
Augment the ssl_var_lookup_ssl_cert_dn_rec table with a flag
to indicate whether RDNs of the given NID should be extracted
to the environment.
(extract_dn, modssl_var_extract_dns): New functions.
* modules/ssl/ssl_private.h (modssl_var_extract_dns): Add prototype.
* modules/ssl/ssl_engine_kernel.c: Remove SSL_*_DN_ from the list
of variables to insert into the environment.
(ssl_hook_Fixup): Use modssl_var_extract_dns to insert the
SSL_*_DN_ variables efficiently and accurately, handling
certs with duplicate RDN tags correctly.
PR: 45875
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@724717 13f79535-47bb-0310-9956-ffa450edef68
interface.
(ssl_io_filter_input): For GETLINE mode, pull lines directly from
the char_buffer if possible, to avoid unnecessarily copying the
entire buffer once per invocation.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@683283 13f79535-47bb-0310-9956-ffa450edef68
