]> git.ipfire.org Git - thirdparty/apache/httpd.git/commit
mod_ssl: add compatibility with OpenSSL 3.0.0
authorYann Ylavic <ylavic@apache.org>
Fri, 24 Apr 2020 16:09:02 +0000 (16:09 +0000)
committerYann Ylavic <ylavic@apache.org>
Fri, 24 Apr 2020 16:09:02 +0000 (16:09 +0000)
commit316aea784d9423688ea38943d95d1d2b614fc921
tree7ac34435edba49660bdb50f8cb97cd041f93ba59
parentbf3eb5a3e3ebf983398f27e598f2e2289a75e6dc
mod_ssl: add compatibility with OpenSSL 3.0.0

Wrappers around deprecated API:
* X509_STORE_load_locations() => modssl_X509_STORE_load_locations(),
* CTX_load_verify_locations() => modssl_CTX_load_verify_locations(),
* ERR_peek_error_line_data()  => modssl_ERR_peek_error_data(),
* DH_bits(dh)                 => BN_num_bits(DH_get0_p(dh)).

Provide a compatible version of ssl_callback_SessionTicket() which does not
use the deprecated HMAC_CTX and HMAC_Init_ex(), replaced by EVP_MAC_CTX and
EVP_MAC_CTX_set_params() respectively. This requires adapting struct
modssl_ticket_key_t to replace hmac_secret[] with OSSL_PARAM mac_params[],
created once at load time still.
The callback is registered by SSL_CTX_set_tlsext_ticket_key_evp_cb() instead
of SSL_CTX_set_tlsext_ticket_key_cb().

Since BIO_eof() may now be called openssl-3 state machine, the never-called
assertion in bio_filter_in_ctrl() does not hold anymore, and we have to
handle BIO_CTRL_EOF. For any other cmd, we continue to AP_DEBUG_ASSERT(0) and
log an error, yet the return value is changed from -1 to 0 which is the usual
unhandled value.

Note that OpenSSL 3.0.0 is still in alpha stage as of now, the API shouldn't
change though, neither breakage to 1.x.x API.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1876934 13f79535-47bb-0310-9956-ffa450edef68
modules/ssl/ssl_engine_init.c
modules/ssl/ssl_engine_io.c
modules/ssl/ssl_engine_kernel.c
modules/ssl/ssl_engine_log.c
modules/ssl/ssl_private.h