summaryrefslogtreecommitdiff
path: root/modules/ssl
Commit message (Collapse)AuthorAgeFilesLines
* forward-port the latest versions of mod_ssl and mod_setenvif from the 2.3 ↵Brian Pane2005-10-0614-254/+392
| | | | | | trunk to the async-dev branch so t/TEST will work once again git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/async-dev@306538 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_util_ssl.c (SSL_X509_STORE_create): Catch errorsJoe Orton2005-09-011-4/+7
| | | | | | | | | | | returned by X509_LOOKUP_add_dir or X509_LOOKUP_load_file to detect malformed or misconfigured CRLs. Clear error stack beforehand to ensure reported errors are relevant. PR: 36438 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@265702 13f79535-47bb-0310-9956-ffa450edef68
* Fix CVE CAN-2005-2700:Joe Orton2005-08-301-2/+2
| | | | | | | | | | | | | | * modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that renegotiation is performed for a transition from "SSLVerifyClient optional" to "SSLVerifyClient require". The boolean "verify_old & SSL_VERIFY_PEER_STRICT" is true if the old context merely has optional verification configured, since the definition of SSL_VERIFY_PEER_STRICT is (SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_PEER). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264800 13f79535-47bb-0310-9956-ffa450edef68
* Noticed in the development of fips-enabled mod_ssl, when we areWilliam A. Rowe Jr2005-08-291-3/+12
| | | | | | | | configured to support exactly one protocol, use that explicit server and client mechansim to handshake with the client or proxied machine, rather than the generic SSLv23_[client|server]_method(). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264621 13f79535-47bb-0310-9956-ffa450edef68
* Doxygen fixup / cleanupIan Holsman2005-08-285-96/+138
| | | | | | | | | submited by: Neale Ranns neale ranns.org reviewed by: Ian Holsman git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@263931 13f79535-47bb-0310-9956-ffa450edef68
* A very minor, but particularly annoying whitespace fix. It took me 15 minutesColm MacCarthaigh2005-08-251-1/+1
| | | | | | | | to try and parse what was going on :-) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@240089 13f79535-47bb-0310-9956-ffa450edef68
* For generated files, strip off an absolute pathMartin Kraemer2005-08-021-1/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@226993 13f79535-47bb-0310-9956-ffa450edef68
* Commit (forgotten) generated files for changed in ssl_expr_parse.y and ↵Martin Kraemer2005-08-023-1149/+694
| | | | | | ssl_expr_scan.l git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@226990 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/mod_ssl.c (ssl_hook_pre_config): Initialize allJoe Orton2005-08-011-0/+1
| | | | | | | | | algorithms in OpenSSL; enables PKCS#8 keyfile support. PR: 35469 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@226777 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_expr_eval.c (ssl_expr_eval_oid): Remove unusedJoe Orton2005-07-253-2/+2
| | | | | | | | | | variable. * modules/ssl/ssl_private.h, modules/ssl/mod_ssl.h (ssl_extlist_by_oid): Move prototype to ssl_private.h. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@224722 13f79535-47bb-0310-9956-ffa450edef68
* Allow extraction of the values of SSL certificate extensions intoMartin Kraemer2005-07-223-22/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | environment variables, so that their value can be used by any module that is aware of environment variables, as in: SetEnvIf OID("2.16.840.1.113730.1.13") "(.*) Generated (Certificate)" ca=$1 sets ca=TinyCA if the cert was issued by TinyCA. Similarly, SetenvIf OID("2.16.840.1.113730.1.13") "(.*)" NetscapeComment=$1 will set $NetscapeComment to the whole string. It is technically allowed to have multiple instances of an extension field, all with the same oid. In this case, the environment variable will be set to the list of all fields, separated by commas. The [PATCH] uses a cross-module call from mod_setenvif to mod_ssl (the latter may also be missing: in this case the variable will never be set). It calls a common function in the ssl module that is also used for the SSLRequire directive's test. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@220307 13f79535-47bb-0310-9956-ffa450edef68
* Collaborative work: (Thanks, dreid!)Martin Kraemer2005-07-204-2/+75
| | | | | | | | | | | | | | | | | | | Implement OID checking for mod_ssl. This code allows for checking of arbitrary client certificate extensions by OID, in a syntax like: SSLRequire "BaDCA Generated Certificate" in Oid("2.16.840.1.113730.1.13") \ || "committers" in Oid("1.3.6.1.4.1.18060.1") Note the following: * A given OID can occur multiple times in one cert, with different values. Therefore the OID function compares the left-hand string against each of the OID values, until a complete match is found. If none patches, the result is FALSE * The left hand side can be another expression, so can be a reference to a variable or an file() invocation etc. * The OID is also just a reference to a string, or function, or whatever. * My manual description is very short. Someone else please help improve the description git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@219940 13f79535-47bb-0310-9956-ffa450edef68
* Good suggestion from a private Email. name changes.Jim Jagielski2005-07-083-4/+4
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209827 13f79535-47bb-0310-9956-ffa450edef68
* No UCHAR, per JoeWilliam A. Rowe Jr2005-07-081-1/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209823 13f79535-47bb-0310-9956-ffa450edef68
* Fix case where buggy OpenSSL internal cache continually grows.Jim Jagielski2005-07-084-3/+7
| | | | | | | | So don't bother to store it, but still force OpenSSL to provide a Session ID. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209821 13f79535-47bb-0310-9956-ffa450edef68
* Joe strongly objected to this outgoing style; use this incomingWilliam A. Rowe Jr2005-07-084-30/+23
| | | | | | | style for const modifiers so the reader can still follow that the data is [const] unsigned char * git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209795 13f79535-47bb-0310-9956-ffa450edef68
* The macro is simply not worth it; each of these various occurancesWilliam A. Rowe Jr2005-07-074-12/+30
| | | | | | | | | differ as openssl has modified pointer constness from bump to bump. This needs testing on Netware, it builds clean on 0.9.6m, 0.9.7d, 0.9.7g, and 0.9.8-final on Win32. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209675 13f79535-47bb-0310-9956-ffa450edef68
* Wrap this type in a macro since it seems to be bouncing fromWilliam A. Rowe Jr2005-07-063-7/+15
| | | | | | | | 0.9.7g to 0.9.7h in const'ness. PR: 34520 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209530 13f79535-47bb-0310-9956-ffa450edef68
* Add SSL_COMPRESS_METHOD variable (included in +StdEnvVars) to noteWilliam A. Rowe Jr2005-07-062-0/+38
| | | | | | | | | | the negotiated compression. Reviewed by: wrowe, Maxime Petazzoni Submitted by: Georg v. Zezschwitz <gvz 2scale.de> git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209469 13f79535-47bb-0310-9956-ffa450edef68
* Dev Studio automatically adds the intermediate and final directoryWilliam A. Rowe Jr2005-07-061-8/+8
| | | | | | | | | paths to each custom build target. However, the time stamps of these directories will trigger a rebuild in bison where sources haven't changed. These targets are not necessary, as these generated files reside in the current directory (which, obviously, already exists.) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209466 13f79535-47bb-0310-9956-ffa450edef68
* Accomodate API changes to OpenSSL 0.9.8 (now in beta).William A. Rowe Jr2005-07-061-0/+7
| | | | | | | Submitted by: Georg v. Zezschwitz <gvz@2scale.de> git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209465 13f79535-47bb-0310-9956-ffa450edef68
* - If the Protocol has not been set, do not crash. Long term, we need to ↵Paul Querna2005-06-241-1/+2
| | | | | | ensure that the protocol is set in all cases, and in all MPMs. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@201576 13f79535-47bb-0310-9956-ffa450edef68
* Don't try to rebuild the shipping files.Bradley Nicholes2005-06-201-2/+12
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@191578 13f79535-47bb-0310-9956-ffa450edef68
* Update remaining 2004 copyright notices.Joe Orton2005-06-144-4/+8
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190592 13f79535-47bb-0310-9956-ffa450edef68
* Merge the listen-protocol sandbox branch to trunk.Paul Querna2005-06-141-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | I will be adding documentation for the new directives hopefully in the next day or so. * server/core.c: Added 'Protocol' to the core module config Added ap_{set,get}_server_protocol API. Added new directive: 'AcceptFilter'. Enable 'httpready' by default on systems that support it. Use dataready filters for others. * server/listen.c: Attempt to inherit protocols from Listener Records to Server configs. The 'Listen' directive can now optionally take a protocol arg Move bits that determined which accept filter is applied to core.c. Added bits to find the correct accept filter based on the core's configuration. * include/{ap_listen.h,http_core.h}: Add Protocol to respective structures. * include/http_core.h: Add the accf_map table to the core_server_config structure * include/ap_mmn.h: Minor MMN Bump for the new interfacces. * modules/ssl/ssl_engine_init.c: Use the new protocol framework to enable mod_ssl for 'https' websites. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190563 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (ssl_io_filter_init): Initialize theJoe Orton2005-06-101-0/+1
| | | | | | | | | nobuffer flag to zero since the structure is palloc'ed not pcalloc'ed. PR: 35279 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@189971 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_dh.c: Adjust the embedded perl code such thatJoe Orton2005-06-081-40/+42
| | | | | | | | it generates the current C code again (after some refactoring a while ago); and regenerate the file. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@189570 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_kernel.c (ssl_callback_SSLVerify_CRL): FixJoe Orton2005-06-031-1/+1
| | | | | | | | | | off-by-one. PR: 35081 Submitted by: Marc Stern <mstern csc.com> git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@179781 13f79535-47bb-0310-9956-ffa450edef68
* Reintroduce stack frame construction with /Oy- (removal was implied by /O2).William A. Rowe Jr2005-05-151-1/+1
| | | | | | | | | This makes binaries far easier to debug, during operation and for post-crash .dmp analysis. Do not alter /Gs optimizations per brane. Reviewed by: stoddard, brane git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170253 13f79535-47bb-0310-9956-ffa450edef68
* Fix issue where mod_ssl does not pick up the ssl-unclean-shutdownJoe Orton2005-04-193-40/+32
| | | | | | | | | | | | | | | | | setting when configured e.g. as a reverse proxy: * modules/ssl/ssl_private.h: Remove ssl_hook_Translate. * modules/ssl/ssl_engine_kernel.c (ssl_hook_ReadReq): Merge in ssl_hook_Translate. (ssl_hook_Translate): Remove. * modules/ssl/mod_ssl.c (ssl_register_hooks): Ensure that _ReadReq hook runs after mod_setenvif.c; don't register translate_name hook. PR: 34452 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@161958 13f79535-47bb-0310-9956-ffa450edef68
* Build mod_ssl for the NetWare platformBradley Nicholes2005-04-181-0/+289
| | | | | | | Submitted by: Guenter Knauf <fuankg@apache.org> git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@161813 13f79535-47bb-0310-9956-ffa450edef68
* Second fat-fingered typo in 24 hrs. Balance parens, this now compiles.William A. Rowe Jr2005-03-171-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@157947 13f79535-47bb-0310-9956-ffa450edef68
* Clean up emit for size truncation. Division here ensures we fit nicely.William A. Rowe Jr2005-03-171-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@157946 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/mod_ssl.h: Add ssl_ext_lookup optional hook declaration.Joe Orton2005-02-153-0/+68
| | | | | | | | | | | | * modules/ssl/ssl_engine_vars.c (ssl_ext_lookup): New function. (ssl_var_register): Register optional function. * modules/ssl/ssl_private.h (ssl_ext_lookup): Add prototype. Submitted by: David Reid, Joe Orton git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153933 13f79535-47bb-0310-9956-ffa450edef68
* Move the POSIX reg* implementations into the ap_* namespace;Joe Orton2005-02-113-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | internalise the ap_reg*<->PCRE wrapper: * configure.in: Add srclib/pcre to the include path. * include/ap_regex.h: Renamed from include/pcreposix.h. Prefix all constants with AP_; prefix all functions and types with ap_. Define AP_DECLARE to nothing if necessary. Remove regcomp error codes. * include/httpd.h: Include ap_regex.h not pcreposix.h. (ap_pregcomp, ap_regexec, ap_regfree): s/regex_t/ap_regex_t/. (ap_regexec, ap_regerror): Prototypes moved to ap_regex.h. * server/util.c (regex_cleanup, ap_pregcomp, ap_pregsub, ap_pregfree): Adjust for ap_ prefixed types. (ap_regexec, ap_regerror): Removed. * server/Makefile.in: Build util_pcre.c. * server/util_pcre.c: Copied from srclib/pcre/pcreposix.c; remove use of PCRE-internals to do error mapping; rename types to add AP_/ap_ prefixes as above. Use APR includes. (ap_regerror): Use apr_snprintf. * srclib/pcre/Makefile.in: Don't build pcreposix.c into libpcre.la. * modules/*: Update to use new type and constant names. PR: 27750 (part one) Submitted by: Andres Salomon <dilinger voxel.net>, Joe Orton git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153384 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Move theJoe Orton2005-02-101-14/+14
| | | | | | | | SSLUsername-controlled assignment of r->user above the SSLRequire checks so that the "username" gets logged if SSLRequire denies access. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153280 13f79535-47bb-0310-9956-ffa450edef68
* Remove formatting characters from ap_log_error() calls. TheseJeff Trawick2005-02-091-2/+2
| | | | | | | | | | were escaped as fallout from CAN-2003-0020. Submitted by: Eric Covener <ecovener gmail.com> Reviewed by: Jeff Trawick git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153105 13f79535-47bb-0310-9956-ffa450edef68
* Change where we set r->user if we're setting it from a David Reid2005-02-051-11/+14
| | | | | | | client certificate. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@151493 13f79535-47bb-0310-9956-ffa450edef68
* Update copyright year to 2005 and standardize on current copyright owner line.Justin Erenkrantz2005-02-0425-25/+50
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@151408 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (bio_filter_out_flush): Fail if theJoe Orton2005-01-141-0/+4
| | | | | | | | | connection was reset. PR: 32699 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@125166 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/mod_ssl.c: Declare new config directivesJoe Orton2005-01-144-15/+58
| | | | | | | | | | | | | | | | | | | | | | | SSLCADNRequestFile and SSLCADNRequestPath. * modules/ssl/ssl_private.h (modssl_pk_server_t): Add ca_name_path, ca_name_file fields. * modules/ssl/ssl_engine_init.c (ssl_init_ctx_verify): If either of SSLCADNRequestFile or SSLCADNRequestPath are configured, load the CA DN list sent in the CertificateRequest from those certificates. * modules/ssl/ssl_engine_config.c (modssl_ctx_init_server): Use pcalloc to zero-initialize the entire modssl_pk_server_t structure. (ssl_config_server_new): Merge the ca_name_* fields. (ssl_cmd_SSLCADNRequestPath, ssl_cmd_SSLCADNRequestFile): New functions. PR: 32848 Submitted by: Tim Taylor <tim.taylor dfas.mil> git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@125165 13f79535-47bb-0310-9956-ffa450edef68
* It's perferable to use a debug build of ssleay32/libeay32, but offerWilliam A. Rowe Jr2005-01-051-2/+2
| | | | | | | | a fallback if they are built as release libraries for creating mod_ssl in debug mode. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@124284 13f79535-47bb-0310-9956-ffa450edef68
* FINALLY Correct ap_http_method()! It is NOT a method, it's a SCHEME!William A. Rowe Jr2005-01-022-3/+3
| | | | | | | | | | Bumped mmn, and ap module cookie, for this function rename. It's not a deprecation, as ap_http_method would be a lovely function name sometime in the future: to determine what the function name implies. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@123882 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (bio_filter_out_flush): Revert theJoe Orton2004-12-151-2/+0
| | | | | | | passed-brigade-reuse "fix" which is currently unnecessary. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@111962 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (ssl_io_filter_cleanup): Fix segfaultsJoe Orton2004-12-151-3/+0
| | | | | | | | from using ap_log_cerror from a c->pool cleanup; the debug message triggers too often anyway so just remove it. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@111959 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_kernel.c (ssl_callback_SSLVerify): UseJoe Orton2004-12-081-1/+2
| | | | | | | | | | | X509_STORE_CTX_get_ex_data() and SSL_get_ex_data_X509_STORE_CTX_idx() to use the correct ex_data index from the context in pathological cases where SSL_get_ex_data_X509_STORE_CTX_idx() does not return 0. PR: 32529 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@111241 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (ssl_io_filter_Upgrade): Simplify theJoe Orton2004-12-071-38/+25
| | | | | | | | Upgrade header check; allow upgrades on any method; don't drop the ap_pass_brigade return value. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@111159 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_io.c (ssl_io_filter_Upgrade): Remove theJoe Orton2004-12-021-13/+0
| | | | | | | unnecessary check of the Connection request header. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@109499 13f79535-47bb-0310-9956-ffa450edef68
* Use a case insensitive compare when looking for 'Upgrade'.Paul Querna2004-12-021-1/+1
| | | | | | | The first client I tested was sending 'upgrade'. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@109447 13f79535-47bb-0310-9956-ffa450edef68
* * modules/ssl/ssl_engine_mutex.c (ssl_mutex_on, ssl_mutex_off):Joe Orton2004-11-251-2/+2
| | | | | | | Improve error messages. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@106573 13f79535-47bb-0310-9956-ffa450edef68
View Lorry Controller Status