Graham Leggett [Thu, 24 Jun 2021 10:27:49 +0000 (10:27 +0000)]
dbm: Split the loading of a dbm driver from the opening of a dbm file. When
an attempt to load a dbm driver fails, log clearly which driver triggered
the error (not "default"), and what the error was.
Stefan Eissing [Fri, 11 Jun 2021 10:45:25 +0000 (10:45 +0000)]
*) mod_ssl: tighten the handling of ALPN for outgoing (proxy)
connections. If ALPN protocols are provided and sent to the
remote server, the received protocol selected is inspected
and checked for a match. Without match, the peer handshake
fails.
An exception is the proposal of "http/1.1" where it is
accepted if the remote server did not answer ALPN with
a selected protocol. This accomodates for hosts that do
not observe/support ALPN and speak http/1.x be default.
Stefan Eissing [Tue, 8 Jun 2021 14:37:44 +0000 (14:37 +0000)]
*) core/mod_proxy/mod_ssl:
Adding `outgoing` flag to conn_rec, indicating a connection is
initiated by the server to somewhere, in contrast to incoming
connections from clients.
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
as outgoing and is used by mod_proxy instead of the previous
optional function `ssl_engine_set`. This enables other SSL
module to secure proxy connections.
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
`ssl_proxy_enable` are now provided by the core to have backward
compatibility with non-httpd modules that might use them. mod_ssl
itself no longer registers these functions, but keeps them in its
header for backward compatibility.
The core provided optional function wrap any registered function
like it was done for `ssl_is_ssl`.
Yann Ylavic [Fri, 4 Jun 2021 13:21:28 +0000 (13:21 +0000)]
mpm_prefork: mask signals during ap_run_child_init().
This prevents threads potentially created from the child_init hooks (e.g.
mod_watchdog workers) to catch signals needed by the MPM, like here:
https://travis-ci.com/github/apache/httpd/jobs/510821148#L5356.
Joe Orton [Fri, 21 May 2021 09:58:14 +0000 (09:58 +0000)]
mod_ssl: Switch to using OpenSSL's automatic internal DH parameter
generation from OpenSSL 1.1.0 and later. The
SSL_set_tmp_dh_callback() API is deprecated from OpenSSL 3.0 onwards.
Should not be a user-visible change (except mod_ssl gets smaller).
* modules/ssl/ssl_private.h,
modules/ssl/ssl_engine_kernel.c,
modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks):
Drop internal DH parameter generation and callback for OpenSSL 1.1+,
use SSL_CTX_set_dh_auto(, 1) instead.
Stefan Eissing [Tue, 18 May 2021 14:42:52 +0000 (14:42 +0000)]
* mod_log_config/mod_ssl: moved the log_handlers registered by mod_ssl
into mod_log_config itself. These now use the global `ap_ssl_var_lookup()`
functions and work for all running SSL modules.
The dependency from mod_ssl to mod_log_config and its header is removed.
mod_ssl now provides the content of "{errstr}c" as variable "SSL_CLIENT_VERIFY_ERRSTR".
This change should be fully compatible to all deployed configurations.
Joe Orton [Mon, 17 May 2021 11:56:32 +0000 (11:56 +0000)]
* server/mpm/event/event.c,
server/mpm/simple/simple_run.c,
support/htcacheclean.c: Adjust use of APR_RING macros to
ensure the APR_RING_HEAD is always embedded in a containing
structure, to avoid warnings with GCC 11. (apr_ring.h also
suggests this is best practice)
See also: https://bugzilla.redhat.com/show_bug.cgi?id=1957353
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98503
msgid <814cca2a-1992-3fae-bb0e-c84b3d09b73b@gmail.com>
Github: closes #186
Yann Ylavic [Sun, 16 May 2021 21:49:49 +0000 (21:49 +0000)]
mod_ssl: coalesce using a bucket brigade and the setaside/reinstate mechanism.
ssl_io_filter_coalesce() now uses apr_brigade_write() to save its retained data
in a heap bucket, and ap_filter_{setaside,reinstate}_brigade() to declare them
to the output filters' write completion mechanism.
This prevents MPM event to miss them when it enters write completion state, and
will allow the tunneling loop of mod_proxy to flush them in a following commit
too.
Stefan Eissing [Thu, 22 Apr 2021 10:17:02 +0000 (10:17 +0000)]
mod_md: make sure its post-config hook runs before mod_watchdog. if
not, mod_watchdog thinks it has nothing to do, if no one else installs
any watchdog instance.
Stefan Eissing [Tue, 20 Apr 2021 12:16:05 +0000 (12:16 +0000)]
core/ap_ssl_*: changes after review by rpluem
- removed no longer needed (char*) casts when looking
up ssl variables.
- move 'goto cleanup;' on separate source line
- fixed check for wrong optional function in ap_run_ssl_var_lookup
- remove ap_bytes_t again from httpd.h and passes now ocsp
identifier as separate const char* and apr_size_t. This
follows more how such data is passed in the rest of the
server.
Stefan Eissing [Tue, 13 Apr 2021 11:12:00 +0000 (11:12 +0000)]
*) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This
allows modules to access and provide OCSP response data without being tied
of each other. The data is exchanged in standard, portable formats (PEM encoded
certificates and DER encoded responses), so that the actual SSL/crypto
implementations used by the modules are independant of each other.
Registration and retrieval happen in the context of a server (server_rec)
which modules may use to decide if they are configured for this or not.
The area of changes:
1. core: defines 2 functions in include/http_ssl.h, so that modules may
register a certificate, together with its issuer certificate for OCSP
response provisioning and ask for current response data (DER bytes) later.
Also, 2 hooks are defined that allow modules to implement this OCSP
provisioning.
2. mod_ssl uses the new functions, in addition to what it did already, to
register its certificates this way. If no one is interested in providing
OCSP, it falls back to its own (if configured) stapling implementation.
3. mod_md registers itself at the core hooks for OCSP provisioning. Depending
on configuration, it will accept registrations of its own certificates only,
all certficates or none.
mod_socache_shmcb: be safe from socache_shmcb_destroy() late call.
ssl_init_Module() in post_config early registers ssl_init_ModuleKill(), which
will then run after all the next cleanups registered later in post_config, thus
any shm_cleanup() registered from ssl_scache_init::socache_shmcb_init().
This can cause a double SHM cleanup when apr_shm_destroy() is called from
ssl_init_ModuleKill() as pconf is cleared.
Fix this in mod_socache_shmcb by registering a socache_shmcb_cleanup() after
the SHM is created, and by letting socache_shmcb_destroy() run the cleanup,
such that shm_cleanup() is always and ever called only once.
Ideally apr_shm_create() would be consistent accross platforms to register its
shm_cleanup() on the pool but that's not the case for now (I'm on it), so httpd
has to call apr_shm_destroy() explicitely from several places (we'll be able to
remove ssl_scache_kill() and other similar cleanups once the minimal APR
version required by httpd is fixed..).
We could also fix this by registering ssl_init_ModuleKill() late(r) in
ssl_init_Module(), though the more robust mod_socache_shmcb the better for
all the modules..
Joe Orton [Fri, 19 Mar 2021 15:15:36 +0000 (15:15 +0000)]
mod_ssl: Add base64-encoded DER certificate variables as alternative
to PEM, to avoid newline mangling issues when using PEM in header
values.
* modules/ssl/ssl_private.h (SSL_OPT_EXPORTCB64DATA): New constant.
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_data):
New function, replacing ssl_var_lookup_ssl_cert_PEM.
(ssl_var_lookup_ssl): Use it, and add _B64CERT variants of
SSL_{CLIENT,SERVER}_CERT.
(ssl_var_lookup_ssl_cert_chain): Use it.
* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLOptions): Support
"ExportBase64CertData" argument.
* modules/ssl/ssl_engine_kernel.c (extract_to_env): New function.
(ssl_hook_Fixup): Use it, also export _B64CERT variables if
SSL_OPT_EXPORTCB64DATA is set; simplify the client cert chain
handling.
Joe Orton [Tue, 16 Mar 2021 15:31:58 +0000 (15:31 +0000)]
* modules/generators/mod_cgid.c (cgid_server): Register cleanup for
socket earlier to avoid possible leaks on error paths. (highlighted
by Coverity scan)
Stefan Eissing [Tue, 9 Mar 2021 12:55:55 +0000 (12:55 +0000)]
Using the new ap_ssl_conn_is_ssl() and ap_ssl_var_lookup() in all internal modules.
* leaving mod_nw_ssl and mod_ssl itself untouched
* removing mod_ssl.h includes where no longer necessary
* some modules might skip post_config hooks, but those were left in, even when empty now.
Stefan Eissing [Mon, 8 Mar 2021 18:05:50 +0000 (18:05 +0000)]
*) mod_md: v2.4.0 with improvements and bugfixes
- MDPrivateKeys allows the specification of several types. Beside "RSA" plus
optional key lengths elliptic curves can be configured. This means you can
have multiple certificates for a Managed Domain with different key types.
With ```MDPrivateKeys secp384r1 rsa2048``` you get one ECDSA and one RSA
certificate and all modern client will use the shorter ECDSA, while older
client will get the RSA certificate.
Many thanks to @tlhackque who pushed and helped on this.
- Support added for MDomains consisting of a wildcard. Configuring
```MDomain *.host.net``` will match all virtual hosts matching that pattern
and obtain one certificate for it (assuming you have 'dns-01' challenge
support configured). Addresses #239.
- Removed support for ACMEv1 servers. The only known installation used to
be Let's Encrypt which has disabled that version more than a year ago for
new accounts.
- Andreas Ulm (<https://github.com/root360-AndreasUlm>) implemented the
```renewing``` call to ```MDMessageCmd``` that can deny a certificate
renewal attempt. This is useful in clustered installations, as
discussed in #233).
- New event ```challenge-setup:<type>:<domain>```, triggered when the
challenge data for a domain has been created. This is invoked before the
ACME server is told to check for it. The type is one of the ACME challenge
types. This is invoked for every DNS name in a MDomain.
- The max delay for retries has been raised to daily (this is like all
retries jittered somewhat to avoid repeats at fixed time of day).
- Certain error codes reported by the ACME server that indicate a problem
with the configured data now immediately switch to daily retries. For
example: if the ACME server rejects a contact email or a domain name,
frequent retries will most likely not solve the problem. But daily retries
still make sense as there might be an error at the server and un-supervised
certificate renewal is the goal. Refs #222.
- Test case and work around for domain names > 64 octets. Fixes #227.
When the first DNS name of an MD is longer than 63 octets, the certificate
request will not contain a CN field, but leave it up to the CA to choose one.
Currently, Lets Encrypt looks for a shorter name in the SAN list given and
fails the request if none is found. But it is really up to the CA (and what
browsers/libs accept here) and may change over the years. That is why
the decision is best made at the CA.
- Retry delays now have a random +/-[0-50]% modification applied to let
retries from several servers spread out more, should they have been
restarted at the same time of day.
- Fixed several places where the 'badNonce' return code from an ACME server
was not handled correctly. The test server 'pebble' simulates this behaviour
by default and helps nicely in verifying this behaviour. Thanks, pebble!
- Set the default `MDActivationDelay` to 0. This was confusing to users that
new certificates were deemed not usably before a day of delay. When clocks are
correct, using a new certificate right away should not pose a problem.
- When handling ACME authorization resources, the module no longer requires
the server to return a "Location" header, as was necessary in ACMEv1.
Fixes #216.
- Fixed a theoretical uninitialized read when testing for JSON error responses
from the ACME CA. Reported at <https://bz.apache.org/bugzilla/show_bug.cgi?id=64297>.
- ACME problem reports from CAs that include parameters in the Content-Type
header are handled correctly. (Previously, the problem text would not be
reported and retries could exist CA limits.)
- Account Update transactions to V2 CAs now use the correct POST-AS-GET method.
Previously, an empty JSON object was sent - which apparently LE accepted,
but others reject.
Joe Orton [Wed, 3 Mar 2021 14:53:12 +0000 (14:53 +0000)]
Synch from mod_md github:
mod_md: tolerate missing revokeCert or keyChange resource
RFC 8555 §7.1 states:
The server MUST provide "directory" and "newNonce" resources.
But RFC 8555 makes no explicit statement anywhere whether other
resources are, or are not, required (with the exception of
"newAuthz" which is optional).
Therefore it is possible that some ACME server implementations may
omit some resources; in particular those that are not an essential
part of the "order" workflow. Indeed, I am working with one such
server implementation, which does not at this time implement
"keyChange". mod_md refuses to interact with this server because it
is checking that a certain set of resources are defined in the
directory object - despite some of those resources not currently
being used.
Update the check to require only "newNonce", "newAccount" and
"newOrder". Omit from the check and therefore tolerate the absense
of resources which are not always required: "revokeCert" and
"keyChange".
If mod_md implements revocation and/or key rollover in the future,
the availability of those features should be predicated on the
server's advertised capabilities.
projects / thirdparty / apache / httpd.git / log
