mirror of
https://github.com/apache/httpd.git
synced 2025-08-06 11:06:17 +00:00
507e66cc67
Streamline ephemeral key handling: - drop support for ephemeral RSA keys (only allowed/needed for export ciphers) - drop pTmpKeys from the per-process SSLModConfigRec, and remove the temp key generation at startup (unnecessary for DHE/ECDHE) - unconditionally disable null and export-grade ciphers by always prepending "!aNULL:!eNULL:!EXP:" to any cipher suite string - do not configure per-connection SSL_tmp_*_callbacks, as it is sufficient to set them for the SSL_CTX - set default curve for ECDHE at startup, obviating the need for a per-handshake callback, for the time being (and also configure SSL_OP_SINGLE_ECDH_USE, previously left out) For additional background, see https://mail-archives.apache.org/mod_mbox/httpd-dev/201309.mbox/%3C52358ED1.2070704@velox.ch%3E Follow-up fixes for r1526168: - drop SSL_TMP_KEY_* constants from ssl_private.h, too - make sure we also disable aNULL, eNULL and EXP ciphers for per-directory SSLCipherSuite directives - apply the same treatment to SSLProxyCipherSuite Increase minimum required OpenSSL version to 0.9.8a (in preparation for the next mod_ssl commit, which will rely on the get_rfcX_prime_Y functions added in that release): - remove obsolete #defines / macros - in ssl_private.h, regroup definitions based on whether they depend on TLS extension support or not - for ECC and SRP support, set HAVE_X and change the rather awkward #ifndef OPENSSL_NO_X lines accordingly For the discussion prior to taking this step, see https://mail-archives.apache.org/mod_mbox/httpd-dev/201309.mbox/%3C524275C7.9060408%40velox.ch%3E Improve ephemeral key handling (companion to r1526168): - allow to configure custom DHE or ECDHE parameters via the SSLCertificateFile directive, and adapt its documentation accordingly (addresses PR 49559) - add standardized DH parameters from RFCs 2409 and 3526, use them based on the length of the certificate's RSA/DSA key, and add a FAQ entry for clients which limit DH support to 1024 bits (such as Java 7 and earlier) - move ssl_dh_GetParamFromFile() from ssl_engine_dh.c to ssl_util_ssl.c, and add ssl_ec_GetParamFromFile() - drop ssl_engine_dh.c from mod_ssl For the standardized DH parameters, OpenSSL version 0.9.8a or later is required, which was therefore made a new minimum requirement in r1527294. PR 55616 (add missing APLOGNO), part 2 Submitted by: kbrand Reviewed/backported by: jim git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1542327 13f79535-47bb-0310-9956-ffa450edef68
58 lines
1.9 KiB
Plaintext
58 lines
1.9 KiB
Plaintext
dnl Licensed to the Apache Software Foundation (ASF) under one or more
|
|
dnl contributor license agreements. See the NOTICE file distributed with
|
|
dnl this work for additional information regarding copyright ownership.
|
|
dnl The ASF licenses this file to You under the Apache License, Version 2.0
|
|
dnl (the "License"); you may not use this file except in compliance with
|
|
dnl the License. You may obtain a copy of the License at
|
|
dnl
|
|
dnl http://www.apache.org/licenses/LICENSE-2.0
|
|
dnl
|
|
dnl Unless required by applicable law or agreed to in writing, software
|
|
dnl distributed under the License is distributed on an "AS IS" BASIS,
|
|
dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
dnl See the License for the specific language governing permissions and
|
|
dnl limitations under the License.
|
|
|
|
dnl # start of module specific part
|
|
APACHE_MODPATH_INIT(ssl)
|
|
|
|
dnl # list of module object files
|
|
ssl_objs="dnl
|
|
mod_ssl.lo dnl
|
|
ssl_engine_config.lo dnl
|
|
ssl_engine_init.lo dnl
|
|
ssl_engine_io.lo dnl
|
|
ssl_engine_kernel.lo dnl
|
|
ssl_engine_log.lo dnl
|
|
ssl_engine_mutex.lo dnl
|
|
ssl_engine_pphrase.lo dnl
|
|
ssl_engine_rand.lo dnl
|
|
ssl_engine_vars.lo dnl
|
|
ssl_scache.lo dnl
|
|
ssl_util_stapling.lo dnl
|
|
ssl_util.lo dnl
|
|
ssl_util_ssl.lo dnl
|
|
ssl_engine_ocsp.lo dnl
|
|
ssl_util_ocsp.lo dnl
|
|
"
|
|
dnl # hook module into the Autoconf mechanism (--enable-ssl option)
|
|
APACHE_MODULE(ssl, [SSL/TLS support (mod_ssl)], $ssl_objs, , most, [
|
|
APACHE_CHECK_OPENSSL
|
|
if test "$ac_cv_openssl" = "yes" ; then
|
|
if test "x$enable_ssl" = "xshared"; then
|
|
# The only symbol which needs to be exported is the module
|
|
# structure, so ask libtool to hide everything else:
|
|
APR_ADDTO(MOD_SSL_LDADD, [-export-symbols-regex ssl_module])
|
|
fi
|
|
else
|
|
enable_ssl=no
|
|
fi
|
|
])
|
|
|
|
# Ensure that other modules can pick up mod_ssl.h
|
|
APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
|
|
|
|
dnl # end of module specific part
|
|
APACHE_MODPATH_FINISH
|
|
|