From: Joe Orton Date: Wed, 3 Feb 2010 14:59:03 +0000 (+0000) Subject: Regenerate docs. X-Git-Tag: 2.3.6~525 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8635df00ef24dbfca08f6d686fc67f40ca914769;p=thirdparty%2Fapache%2Fhttpd.git Regenerate docs. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@906077 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/directives.html.en b/docs/manual/mod/directives.html.en index 6dc9bdf04ac..443b0d0f7d5 100644 --- a/docs/manual/mod/directives.html.en +++ b/docs/manual/mod/directives.html.en @@ -455,6 +455,7 @@
  • SSLCryptoDevice
  • SSLEngine
  • SSLHonorCipherOrder
    • +
  • SSLInsecureRenegotiation
  • SSLOCSPDefaultResponder
  • SSLOCSPEnable
  • SSLOCSPOverrideResponder
    • diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index 0fcbde51440..dd0e7ae8661 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -55,6 +55,7 @@ to provide the cryptography engine.

  • SSLCryptoDevice
  • SSLEngine
  • SSLHonorCipherOrder
    • +
  • SSLInsecureRenegotiation
  • SSLOCSPDefaultResponder
  • SSLOCSPEnable
  • SSLOCSPOverrideResponder
    • @@ -111,6 +112,7 @@ compatibility variables.

    SSL_PROTOCOL string The SSL protocol version (SSLv2, SSLv3, TLSv1) SSL_SESSION_ID string The hex-encoded SSL session id SSL_SESSION_RESUMED string Initial or Resumed SSL Session. Note: multiple requests may be served over the same (Initial or Resumed) SSL session if HTTP KeepAlive is in use +SSL_SECURE_RENEG string true if secure renegotiation is supported, else false SSL_CIPHER string The cipher specification name SSL_CIPHER_EXPORT string true if cipher is an export cipher SSL_CIPHER_USEKEYSIZE number Number of cipher bits (actually used) @@ -653,6 +655,39 @@ server's preference will be used instead.

    SSLHonorCipherOrder on

    + +
    top
    +

    SSLInsecureRenegotiation Directive

    + + + + + + + +
    Description:Option to enable support for insecure renegotiation
    Syntax:SSLInsecureRenegotiation flag
    Context:server config, virtual host
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in httpd 2.3 and later, if using OpenSSL 1.0.0 Beta 5 or later
    +

    As originally specified, all versions of the SSL and TLS protocols +(up to and including TLS/1.2) were vulnerable to a Man-in-the-Middle +attack +(CVE-2009-3555) +during a renegotiation. This vulnerability allowed an attacker to +"prefix" a chosen plaintext to the HTTP request as seen by the web +server. A protocol extension was developed which fixed this +vulnerability if supported by both client and server.

    + +

    If mod_ssl is linked against OpenSSL version 1.0.0 +Beta 5 or later, by default renegotiation is only supported with +clients supporting the new protocol extension. If this directive is +enabled, renegotiation will be allowed with old (unpatched) clients. +SSL connections will be vulnerable to the prefix attack as described +above if this directive is enabled. The SSL_SECURE_RENEG +variable can be used to determine whether secure renegotiation is +supported for a given SSL connection.

    + +

    Example

    +SSLInsecureRenegotiation on +

    +
    top

    SSLOCSPDefaultResponder Directive

    diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en index d295d2a901b..c936ec8cc7d 100644 --- a/docs/manual/mod/quickreference.html.en +++ b/docs/manual/mod/quickreference.html.en @@ -770,101 +770,102 @@ handshake SSLCryptoDevice engine builtin sEEnable use of a cryptographic hardware accelerator SSLEngine on|off|optional off svESSL Engine Operation Switch SSLHonorCiperOrder flagsvEOption to prefer the server's cipher preference order -SSLOCSDefaultResponder urisvESet the default responder URI for OCSP validation -SSLOCSPEnable flagsvEEnable OCSP validation of the client certificate chain -SSLOCSPOverrideResponder flagsvEForce use of the default responder URI for OCSP validation -SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options -SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private +SSLInsecureRenegotiation flagsvEOption to enable support for insecure renegotiation +SSLOCSDefaultResponder urisvESet the default responder URI for OCSP validation +SSLOCSPEnable flagsvEEnable OCSP validation of the client certificate chain +SSLOCSPOverrideResponder flagsvEForce use of the default responder URI for OCSP validation +SSLOptions [+|-]option ...svdhEConfigure various SSL engine run-time options +SSLPassPhraseDialog type builtin sEType of pass phrase dialog for encrypted private keys -SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions -SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates +SSLProtocol [+|-]protocol ... all svEConfigure usable SSL protocol versions +SSLProxyCACertificateFile file-pathsvEFile of concatenated PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for +SSLProxyCACertificatePath directory-pathsvEDirectory of PEM-encoded CA Certificates for Remote Server Auth -SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for +SSLProxyCARevocationFile file-pathsvEFile of concatenated PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for +SSLProxyCARevocationPath directory-pathsvEDirectory of PEM-encoded CA CRLs for Remote Server Auth -SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificates CN field +SSLProxyCheckPeerCN on|off on svEWhether to check the remote server certificates CN field -SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired +SSLProxyCheckPeerExpire on|off on svEWhether to check if remote server certificate is expired -SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL +SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H +svdhECipher Suite available for negotiation in SSL proxy handshake -SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch -SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy -SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded client certificates and keys to be used by the proxy -SSLProxyProtocol [+|-]protocol ... all svEConfigure usable SSL protocol flavors for proxy usage -SSLProxyVerify level none svdhEType of remote server Certificate verification -SSLProxyVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Remote Server +SSLProxyEngine on|off off svESSL Proxy Engine Operation Switch +SSLProxyMachineCertificateFile filenamesEFile of concatenated PEM-encoded client certificates and keys to be used by the proxy +SSLProxyMachineCertificatePath directorysEDirectory of PEM-encoded client certificates and keys to be used by the proxy +SSLProxyProtocol [+|-]protocol ... all svEConfigure usable SSL protocol flavors for proxy usage +SSLProxyVerify level none svdhEType of remote server Certificate verification +SSLProxyVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Remote Server Certificate verification -SSLRandomSeed context source -[bytes]sEPseudo Random Number Generator (PRNG) seeding +SSLRandomSeed context source +[bytes]sEPseudo Random Number Generator (PRNG) seeding source -SSLRenegBufferSize bytes 131072 dhESet the size for the SSL renegotiation buffer -SSLRequire expressiondhEAllow access only when an arbitrarily complex +SSLRenegBufferSize bytes 131072 dhESet the size for the SSL renegotiation buffer +SSLRequire expressiondhEAllow access only when an arbitrarily complex boolean expression is true -SSLRequireSSLdhEDeny access when SSL is not used for the +SSLRequireSSLdhEDeny access when SSL is not used for the HTTP request -SSLSessionCache type none sEType of the global/inter-process SSL Session +SSLSessionCache type none sEType of the global/inter-process SSL Session Cache -SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires +SSLSessionCacheTimeout seconds 300 svENumber of seconds before an SSL session expires in the Session Cache -SSLStrictSNIVHostCheck on|off off svEWhether to allow non SNI clients to access a name based virtual +SSLStrictSNIVHostCheck on|off off svEWhether to allow non SNI clients to access a name based virtual host. -SSLUserName varnamesdhEVariable name to determine user name -SSLVerifyClient level none svdhEType of Client Certificate verification -SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client +SSLUserName varnamesdhEVariable name to determine user name +SSLVerifyClient level none svdhEType of Client Certificate verification +SSLVerifyDepth number 1 svdhEMaximum depth of CA Certificates in Client Certificate verification -StartServers numbersMNumber of child server processes created at startup -StartThreads numbersMNumber of threads created on startup -Substitute s/pattern/substitution/[infq]dhXPattern to filter the response content -SuexecUserGroup User GroupsvEUser and group for CGI programs to run as -ThreadLimit numbersMSets the upper limit on the configurable number of threads +StartServers numbersMNumber of child server processes created at startup +StartThreads numbersMNumber of threads created on startup +Substitute s/pattern/substitution/[infq]dhXPattern to filter the response content +SuexecUserGroup User GroupsvEUser and group for CGI programs to run as +ThreadLimit numbersMSets the upper limit on the configurable number of threads per child process -ThreadsPerChild numbersMNumber of threads created by each child process -ThreadStackSize sizesMThe size in bytes of the stack used by threads handling +ThreadsPerChild numbersMNumber of threads created by each child process +ThreadStackSize sizesMThe size in bytes of the stack used by threads handling client connections -TimeOut seconds 300 svCAmount of time the server will wait for +TimeOut seconds 300 svCAmount of time the server will wait for certain events before failing a request -TraceEnable [on|off|extended] on sCDetermines the behaviour on TRACE +TraceEnable [on|off|extended] on sCDetermines the behaviour on TRACE requests -TransferLog file|pipesvBSpecify location of a log file -TypesConfig file-path conf/mime.types sBThe location of the mime.types file -UnDefine parameter-namesCUndefine the existence of a variable -UnsetEnv env-variable [env-variable] -...svdhBRemoves variables from the environment -UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and +TransferLog file|pipesvBSpecify location of a log file +TypesConfig file-path conf/mime.types sBThe location of the mime.types file +UnDefine parameter-namesCUndefine the existence of a variable +UnsetEnv env-variable [env-variable] +...svdhBRemoves variables from the environment +UseCanonicalName On|Off|DNS Off svdCConfigures how the server determines its own name and port -UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own name and +UseCanonicalPhysicalPort On|Off Off svdCConfigures how the server determines its own name and port -User unix-userid #-1 sBThe userid under which the server will answer +User unix-userid #-1 sBThe userid under which the server will answer requests -UserDir directory-filename [directory-filename] ... -svBLocation of the user-specific directories -VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run +UserDir directory-filename [directory-filename] ... +svBLocation of the user-specific directories +VHostCGIMode On|Off|Secure On vXDetermines whether the virtualhost can run subprocesses, and the privileges available to subprocesses. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to subprocesses created by a virtual host. -VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. -VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. -VHostSecure On|Off On vXDetermines whether the server runs with enhanced security +VHostGroup unix-groupidvXSets the Group ID under which a virtual host runs. +VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ...vXAssign arbitrary privileges to a virtual host. +VHostSecure On|Off On vXDetermines whether the server runs with enhanced security for the virtualhost. -VHostUser unix-useridvXSets the User ID under which a virtual host runs. -VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root +VHostUser unix-useridvXSets the User ID under which a virtual host runs. +VirtualDocumentRoot interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root +VirtualDocumentRootIP interpolated-directory|none none svEDynamically configure the location of the document root for a given virtual host -<VirtualHost +<VirtualHost addr[:port] [addr[:port]] - ...> ... </VirtualHost>sCContains directives that apply only to a specific + ...> ... </VirtualHost>sCContains directives that apply only to a specific hostname or IP address -VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for +VirtualScriptAlias interpolated-directory|none none svEDynamically configure the location of the CGI directory for a given virtual host -VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the cgi directory for +VirtualScriptAliasIP interpolated-directory|none none svEDynamically configure the location of the cgi directory for a given virtual host -XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit +XBitHack on|off|full off svdhBParse SSI directives in files with the execute bit set