mirror of
https://github.com/apache/httpd.git
synced 2026-01-13 05:41:23 +00:00
0c9cd095ce
proposed OpenSSL 4.0 API. Notes from PR #551: This build only supports ECH "shared-mode" where mod_ssl does the ECH decryption and also hosts both the ECH `public-name` and `backend` web sites. ## Build > [!NOTE] > ECH is not yet a part of an OpenSSL release, our current goal is that ECH be > part of an OpenSSL 4.0 release in spring 2026. There is client and server ECH code in the OpenSSL ECH feature branch at [https://github.com/openssl/openssl/tree/feature/ech](https://github.com/openssl/openssl/tree/feature/ech). At present, ECH-enabling apache2 therefore requires building from source, using the OpenSSL ECH feature branch. ## Code changes - All code changes are within `modules/ssl` and are protected via `#ifdef HAVE_OPENSSL_ECH`. That's defined in `ssl_private.h` if the included `ssl.h` defines `SSL_OP_ECH_GREASE`. - There're a bunch of changes to add the new `SSLECHKeyDir` directive that are mosly obvious. - We load the keys from `SSLECHKeyDir` using the `load_echkeys()` function in `ssl_engine_init.c`. That also ECH-enables the `SSL_CTX` when keys are loaded, which triggers ECH decryption as needed. > [!NOTE] > `load_echkeys()` will include the public component all loaded keys in the ECH > `retry-configs` in the fallback scenario. If desired, we could add a naming > convention or additional configuration setting to distinguish which to > include in `retry-configs` or not. For now, we assume that'd better be done > in a subsequent PR, if experience shows the feature is really useful/needed. > (We can envisage some odd deployments where that might be the case, but not > clear those'd really happen - it'd seem to need loads of key pairs or else > some that are never published in the DNS that we don't want to expose to > random clients - neither seems compelling.) - We add a callback to `SSL_CTX_ech_set_callback` also in `ssl_engine_init.c`. - We add calls to set the `SSL_ECH_STATUS` etc. variables to the environment (for PHP etc) in `ssl_engine_kernel.c` and also do the logging of ECH outcomes (to the error log). Submitted by: sftcd <stephen.farrell cs.tcd.ie>, rpluem Github: closes #551 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1928357 13f79535-47bb-0310-9956-ffa450edef68