PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- *) mod_ssl: Updates to support OpenSSL 3.x
- trunk patch: https://svn.apache.org/r1519264
- https://svn.apache.org/r1737657
- https://svn.apache.org/r1876934
- https://svn.apache.org/r1876936
- https://svn.apache.org/r1876938
- https://svn.apache.org/r1890067
- https://svn.apache.org/r1890076
- https://svn.apache.org/r1891138
- https://svn.apache.org/r1893876
- https://svn.apache.org/r1893964
- https://svn.apache.org/r1894716
- https://svn.apache.org/r1895774
- backport PR: https://github.com/apache/httpd/pull/258
- 2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/258.patch
- or https://people.apache.org/~jorton/mod_ssl-openssl3.patch
- +1: jorton, minfrin, ylavic
- *) mod_http2: fixes PR65731 and https://github.com/icing/mod_h2/issues/212
- trunk patch: na, fixed on 2.4.x source base
- backport PR: https://github.com/apache/httpd/pull/281
- +1: icing, minfrin, ylavic
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
[ New proposals should be added at the end of the list ]
w.r.t. num_buckets > 1 and ease merging of r1895553, with r1895550 for
correctness of active_daemons used in r1895553 and r1895630.
+ *) mod_http2: fixes PR65731 and https://github.com/icing/mod_h2/issues/212
+ trunk patch: na, fixed on 2.4.x source base
+ backport PR: https://github.com/apache/httpd/pull/281
+ +1: icing, minfrin
+
+ *) mod_ssl: Updates to support OpenSSL 3.x
+ trunk patch: https://svn.apache.org/r1519264
+ https://svn.apache.org/r1737657
+ https://svn.apache.org/r1876934
+ https://svn.apache.org/r1876936
+ https://svn.apache.org/r1876938
+ https://svn.apache.org/r1890067
+ https://svn.apache.org/r1890076
+ https://svn.apache.org/r1891138
+ https://svn.apache.org/r1893876
+ https://svn.apache.org/r1893964
+ https://svn.apache.org/r1894716
+ https://svn.apache.org/r1895774
+ backport PR: https://github.com/apache/httpd/pull/258
+ 2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/258.patch
+ or https://people.apache.org/~jorton/mod_ssl-openssl3.patch
+ +1: jorton, minfrin
+
PATCHES/ISSUES THAT ARE BEING WORKED
[ New entries should be added at the START of the list ]
const nghttp2_frame *frame, void *userp)
{
h2_session *session = (h2_session *)userp;
- h2_stream *s = NULL;
+ h2_stream *s;
/* We may see HEADERs at the start of a stream or after all DATA
* streams to carry trailers. */
if (s) {
/* nop */
}
- else if (session->local.accepting) {
+ else {
s = h2_session_open_stream(userp, frame->hd.stream_id, 0);
}
return s? 0 : NGHTTP2_ERR_START_STREAM_NOT_ALLOWED;
now = apr_time_now();
session->have_read = session->have_written = 0;
- /* PR65731: we may get a new connection to process while the
- * MPM already is stopping. For example due to having reached
- * MaxRequestsPerChild limit.
- * Since this is supposed to handle things gracefully, we need to:
- * a) fully initialize the session before GOAWAYing
- * b) give the client the chance to submit at least one request
- */
- if (session->state != H2_SESSION_ST_INIT /* no longer intializing */
- && session->local.accepted_max > 0 /* have gotten at least one stream */
- && session->local.accepting /* have not already locally shut down */
+ if (session->local.accepting
&& !ap_mpm_query(AP_MPMQ_MPM_STATE, &mpm_state)) {
if (mpm_state == AP_MPMQ_STOPPING) {
dispatch_event(session, H2_SESSION_EV_MPM_STOPPING, 0, NULL);
* @macro
* Version number of the http2 module as c string
*/
-#define MOD_HTTP2_VERSION "1.15.26"
+#define MOD_HTTP2_VERSION "1.15.24"
/**
* @macro
* release. This is a 24 bit number with 8 bits for major number, 8 bits
* for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
*/
-#define MOD_HTTP2_VERSION_NUM 0x010f1a
+#define MOD_HTTP2_VERSION_NUM 0x010f18
#endif /* mod_h2_h2_version_h */
void h2_workers_graceful_shutdown(h2_workers *workers)
{
workers->shutdown = 1;
+ workers->min_workers = 1;
workers->max_idle_duration = apr_time_from_sec(1);
+ h2_fifo_term(workers->mplxs);
wake_non_essential_workers(workers);
}
return 1;
}
+#endif
/*
* Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
return NULL; /* impossible to reach. */
}
-#endif
static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
server_rec *s)
modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
-#if MODSSL_USE_OPENSSL_PRE_1_1_API
init_dh_params();
-#else
+#if !MODSSL_USE_OPENSSL_PRE_1_1_API
init_bio_methods();
#endif
{
SSL_CTX *ctx = mctx->ssl_ctx;
-#if MODSSL_USE_OPENSSL_PRE_1_1_API
- /* Note that for OpenSSL>=1.1, auto selection is enabled via
- * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */
SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH);
-#endif
SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
#endif
}
-static APR_INLINE
-int modssl_CTX_load_verify_locations(SSL_CTX *ctx,
- const char *file,
- const char *path)
-{
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- if (!SSL_CTX_load_verify_locations(ctx, file, path))
- return 0;
-#else
- if (file && !SSL_CTX_load_verify_file(ctx, file))
- return 0;
- if (path && !SSL_CTX_load_verify_dir(ctx, path))
- return 0;
-#endif
- return 1;
-}
-
static apr_status_t ssl_init_ctx_verify(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
"Configuring client authentication");
- if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
- mctx->auth.ca_cert_path)) {
+ if (!SSL_CTX_load_verify_locations(ctx,
+ mctx->auth.ca_cert_file,
+ mctx->auth.ca_cert_path))
+ {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
"Unable to configure verify locations "
"for client authentication");
return APR_SUCCESS;
}
-static APR_INLINE
-int modssl_X509_STORE_load_locations(X509_STORE *store,
- const char *file,
- const char *path)
-{
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- if (!X509_STORE_load_locations(store, file, path))
- return 0;
-#else
- if (file && !X509_STORE_load_file(store, file))
- return 0;
- if (path && !X509_STORE_load_path(store, path))
- return 0;
-#endif
- return 1;
-}
-
static apr_status_t ssl_init_ctx_crl(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
"Configuring certificate revocation facility");
- if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file,
- mctx->crl_path)) {
+ if (!store || !X509_STORE_load_locations(store, mctx->crl_file,
+ mctx->crl_path)) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
"Host %s: unable to configure X.509 CRL storage "
"for certificate revocation", mctx->sc->vhost_id);
return 0;
}
-static APR_INLINE int modssl_DH_bits(DH *dh)
-{
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- return DH_bits(dh);
-#else
- return BN_num_bits(DH_get0_p(dh));
-#endif
-}
-
-/* SSL_CTX_use_PrivateKey_file() can fail either because the private
- * key was encrypted, or due to a mismatch between an already-loaded
- * cert and the key - a common misconfiguration - from calling
- * X509_check_private_key(). This macro is passed the last error code
- * off the OpenSSL stack and evaluates to true only for the first
- * case. With OpenSSL < 3 the second case is identifiable by the
- * function code, but function codes are not used from 3.0. */
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
-#else
-#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB(ec) != ERR_LIB_X509 \
- || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
- && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
- && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
-#endif
-
static apr_status_t ssl_init_server_certs(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
int i;
X509 *cert;
- DH *dh;
+ DH *dhparams;
#ifdef HAVE_ECC
EC_GROUP *ecparams = NULL;
int nid;
}
else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
SSL_FILETYPE_PEM) < 1)
- && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
+ && (ERR_GET_FUNC(ERR_peek_last_error())
+ != X509_F_X509_CHECK_PRIVATE_KEY)) {
ssl_asn1_t *asn1;
const unsigned char *ptr;
*/
certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
if (certfile && !modssl_is_engine_id(certfile)
- && (dh = ssl_dh_GetParamFromFile(certfile))) {
- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey()
- * for OpenSSL 3.0+. */
- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
+ && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
"Custom DH parameters (%d bits) for %s loaded from %s",
- modssl_DH_bits(dh), vhost_id, certfile);
- DH_free(dh);
+ DH_bits(dhparams), vhost_id, certfile);
+ DH_free(dhparams);
}
-#if !MODSSL_USE_OPENSSL_PRE_1_1_API
- else {
- /* If no parameter is manually configured, enable auto
- * selection. */
- SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1);
- }
-#endif
#ifdef HAVE_ECC
/*
char buf[TLSEXT_TICKET_KEY_LEN];
char *path;
modssl_ticket_key_t *ticket_key = mctx->ticket_key;
- int res;
if (!ticket_key->file_path) {
return APR_SUCCESS;
}
memcpy(ticket_key->key_name, buf, 16);
- memcpy(ticket_key->aes_key, buf + 32, 16);
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
memcpy(ticket_key->hmac_secret, buf + 16, 16);
- res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
- ssl_callback_SessionTicket);
-#else
- ticket_key->mac_params[0] =
- OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16);
- ticket_key->mac_params[1] =
- OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0);
- ticket_key->mac_params[2] =
- OSSL_PARAM_construct_end();
- res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx,
- ssl_callback_SessionTicket);
-#endif
- if (!res) {
+ memcpy(ticket_key->aes_key, buf + 32, 16);
+
+ if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
+ ssl_callback_SessionTicket)) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
"Unable to initialize TLS session ticket key callback "
"(incompatible OpenSSL version?)");
return ssl_die(s);
}
- modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
+ X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
for (n = 0; n < ncerts; n++) {
int i;
}
-#if MODSSL_USE_OPENSSL_PRE_1_1_API
- free_dh_params();
-#else
+#if !MODSSL_USE_OPENSSL_PRE_1_1_API
free_bio_methods();
#endif
+ free_dh_params();
return APR_SUCCESS;
}
static int bio_filter_out_read(BIO *bio, char *out, int outl)
{
/* this is never called */
- bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
- "BUG: %s() should not be called", "bio_filter_out_read");
- AP_DEBUG_ASSERT(0);
return -1;
}
static int bio_filter_out_gets(BIO *bio, char *buf, int size)
{
/* this is never called */
- bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
- "BUG: %s() should not be called", "bio_filter_out_gets");
- AP_DEBUG_ASSERT(0);
return -1;
}
static int bio_filter_out_puts(BIO *bio, const char *str)
{
/* this is never called */
- bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
- "BUG: %s() should not be called", "bio_filter_out_puts");
- AP_DEBUG_ASSERT(0);
return -1;
}
static int bio_filter_in_write(BIO *bio, const char *in, int inl)
{
- bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
- "BUG: %s() should not be called", "bio_filter_in_write");
- AP_DEBUG_ASSERT(0);
return -1;
}
static int bio_filter_in_puts(BIO *bio, const char *str)
{
- bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
- "BUG: %s() should not be called", "bio_filter_in_puts");
- AP_DEBUG_ASSERT(0);
return -1;
}
static int bio_filter_in_gets(BIO *bio, char *buf, int size)
{
- bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
- "BUG: %s() should not be called", "bio_filter_in_gets");
- AP_DEBUG_ASSERT(0);
return -1;
}
static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
{
- bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
- switch (cmd) {
-#ifdef BIO_CTRL_EOF
- case BIO_CTRL_EOF:
- return inctx->rc == APR_EOF;
-#endif
- default:
- break;
- }
- ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
- "BUG: bio_filter_in_ctrl() should not be called with cmd=%i",
- cmd);
- return 0;
+ return -1;
}
#if MODSSL_USE_OPENSSL_PRE_1_1_API
bio_filter_in_read,
bio_filter_in_puts, /* puts is never called */
bio_filter_in_gets, /* gets is never called */
- bio_filter_in_ctrl, /* ctrl is called for EOF check */
+ bio_filter_in_ctrl, /* ctrl is never called */
bio_filter_create,
bio_filter_destroy,
NULL
** _________________________________________________________________
*/
-#if MODSSL_USE_OPENSSL_PRE_1_1_API
/*
* Hand out standard DH parameters, based on the authentication strength
*/
return modssl_get_dh_params(keylen);
}
-#endif
/*
* This OpenSSL callback function is called when OpenSSL
unsigned char *keyname,
unsigned char *iv,
EVP_CIPHER_CTX *cipher_ctx,
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- HMAC_CTX *hmac_ctx,
-#else
- EVP_MAC_CTX *mac_ctx,
-#endif
+ HMAC_CTX *hctx,
int mode)
{
conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
}
EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
ticket_key->aes_key, iv);
-
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
- tlsext_tick_md(), NULL);
-#else
- EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-#endif
+ HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
"TLS session ticket key for %s successfully set, "
EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
ticket_key->aes_key, iv);
-
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
- tlsext_tick_md(), NULL);
-#else
- EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-#endif
+ HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
"TLS session ticket key for %s successfully set, "
return APR_EGENERAL;
}
-static APR_INLINE
-unsigned long modssl_ERR_peek_error_data(const char **data, int *flags)
-{
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- return ERR_peek_error_line_data(NULL, NULL, data, flags);
-#else
- return ERR_peek_error_data(data, flags);
-#endif
-}
-
/*
* Prints the SSL library error information.
*/
const char *data;
int flags;
- while ((e = modssl_ERR_peek_error_data(&data, &flags))) {
+ while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) {
const char *annotation;
char err[256];
/* must be defined before including ssl.h */
#define OPENSSL_NO_SSL_INTERN
#endif
-#if OPENSSL_VERSION_NUMBER >= 0x30000000
-#include <openssl/core_names.h>
-#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/x509.h>
SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
#define SSL_CTX_set_max_proto_version(ctx, version) \
SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
-#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
+#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
/* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
* include most changes from OpenSSL >= 1.1 (new functions, macros,
* deprecations, ...), so we have to work around this...
*/
-#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
+#define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
#else /* defined(LIBRESSL_VERSION_NUMBER) */
#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
#endif
typedef struct {
const char *file_path;
unsigned char key_name[16];
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
unsigned char hmac_secret[16];
-#else
- OSSL_PARAM mac_params[3];
-#endif
unsigned char aes_key[16];
} modssl_ticket_key_t;
#endif
int ssl_callback_ClientHello(SSL *, int *, void *);
#endif
#ifdef HAVE_TLS_SESSION_TICKETS
-int ssl_callback_SessionTicket(SSL *ssl,
- unsigned char *keyname,
- unsigned char *iv,
- EVP_CIPHER_CTX *cipher_ctx,
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- HMAC_CTX *hmac_ctx,
-#else
- EVP_MAC_CTX *mac_ctx,
-#endif
- int mode);
+int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
+ EVP_CIPHER_CTX *, HMAC_CTX *, int);
#endif
#ifdef HAVE_TLS_ALPN
#endif
-#if MODSSL_USE_OPENSSL_PRE_1_1_API
/* Retrieve DH parameters for given key length. Return value should
* be treated as unmutable, since it is stored in process-global
* memory. */
DH *modssl_get_dh_params(unsigned keylen);
-#endif
/* Returns non-zero if the request was made over SSL/TLS. If sslconn
* is non-NULL and the request is using SSL/TLS, sets *sslconn to the
projects / thirdparty / apache / httpd.git / commitdiff
