Support OpenSSL 1.1.0.

- use common code for OpenSSL pre-1.1.0 and
  1.1.0 where possible.

Partial backport of r1730422 from trunk.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x-openssl-1.1.0-compat@1755841 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 8cd8e86bbb296ce0051b47b9fbd060c8e12dd6d3..74bdf2907315fea3f2b030af8add1089a04570c5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,8 @@
 
 Changes with Apache 2.4.24
 
+  *) mod_ssl: Add support for OpenSSL 1.1.0. [Rainer Jung]
+ 
   *) mod_proxy_fcgi: Fix 2.4.23 breakage for mod_rewrite per-dir and query 
      string showing up in SCRIPT_FILENAME. PR59815
 

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index d92d519a42091ec84913d7f92beea6165fa1cbd6..f9528c75079c7ec808970158998b8a59070cfb71 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -858,11 +858,7 @@ static int use_certificate_chain(
     unsigned long err;
     int n;
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-    if ((bio = BIO_new(BIO_s_file_internal())) == NULL)
-#else
     if ((bio = BIO_new(BIO_s_file())) == NULL)
-#endif
         return -1;
     if (BIO_read_filename(bio, file) <= 0) {
         BIO_free(bio);

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 17ccb9b97982c7fb4646eb3d777f6b38023e5584..77e0ba885f8a7ab7526b81ff25980342ab0c6fd5 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -80,11 +80,7 @@ static apr_status_t upgrade_connection(request_rec *r)
     SSL_set_accept_state(ssl);
     SSL_do_handshake(ssl);
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-    if (SSL_get_state(ssl) != SSL_ST_OK) {
-#else
-    if (SSL_get_state(ssl) != TLS_ST_OK) {
-#endif
+    if (!SSL_is_init_finished(ssl)) {
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)
                       "TLS upgrade handshake failed");
         ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
@@ -460,11 +456,7 @@ int ssl_hook_Access(request_rec *r)
          * forbidden in the latter case, let ap_die() handle
          * this recursive (same) error.
          */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-        if (SSL_get_state(ssl) != SSL_ST_OK) {
-#else
-        if (SSL_get_state(ssl) != TLS_ST_OK) {
-#endif
+        if (!SSL_is_init_finished(ssl)) {
             return HTTP_FORBIDDEN;
         }
         ctx = SSL_get_SSL_CTX(ssl);
@@ -949,7 +941,6 @@ int ssl_hook_Access(request_rec *r)
         }
         else {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-            int rc;
             char peekbuf[1];
 #endif
             const char *reneg_support;
@@ -995,11 +986,7 @@ int ssl_hook_Access(request_rec *r)
             SSL_renegotiate(ssl);
             SSL_do_handshake(ssl);
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-            if (SSL_get_state(ssl) != SSL_ST_OK) {
-#else
-            if (SSL_get_state(ssl) != TLS_ST_OK) {
-#endif
+            if (!SSL_is_init_finished(ssl)) {
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02225)
                               "Re-negotiation request failed");
                 ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
@@ -1034,27 +1021,13 @@ int ssl_hook_Access(request_rec *r)
              * It is expected to work without changes with the forthcoming 1.1.0pre3.
              * See: http://marc.info/?t=145493359200002&r=1&w=2
              */
-            rc = SSL_peek(ssl, peekbuf, 0);
-            ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, APLOGNO()
-                          "Renegotiation peek result=%d, "
-                          "reneg_state=%d, "
-                          "in_init=%d, init_finished=%d, "
-                          "state=%s, sslconn->ssl=%s, peer_certs=%s",
-                          rc, sslconn->reneg_state,
-                          SSL_in_init(ssl), SSL_is_init_finished(ssl),
-                          SSL_state_string_long(ssl),
-                          sslconn->ssl != NULL ? "yes" : "no",
-                          SSL_get_peer_certificate(ssl) != NULL ? "yes" : "no");
+            SSL_peek(ssl, peekbuf, 0);
 
 #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
 
             sslconn->reneg_state = RENEG_REJECT;
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-            if (SSL_get_state(ssl) != SSL_ST_OK) {
-#else
-            if (SSL_get_state(ssl) != TLS_ST_OK) {
-#endif
+            if (!SSL_is_init_finished(ssl)) {
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
                               "Re-negotiation handshake failed");
                 ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);

diff --git a/modules/ssl/ssl_engine_ocsp.c b/modules/ssl/ssl_engine_ocsp.c
index b8fd8a57e763926f6e37a2aa23b9111cee7f9eef..603323d0bd06bb2d44fee7e58c0f881a6a66a90d 100644 (file)
--- a/modules/ssl/ssl_engine_ocsp.c
+++ b/modules/ssl/ssl_engine_ocsp.c
@@ -262,15 +262,7 @@ int modssl_verify_ocsp(X509_STORE_CTX *ctx, SSLSrvConfigRec *sc,
                       "No cert available to check with OCSP");
         return 1;
     }
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-    else if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {
-#else
-    /* No need to check cert->valid, because modssl_verify_ocsp() only
-     * is called if OpenSSL already successfully verified the certificate
-     * (parameter "ok" in ssl_callback_SSLVerify() must be true).
-     */
     else if (X509_check_issued(cert,cert) == X509_V_OK) {
-#endif
         /* don't do OCSP checking for valid self-issued certs */
         ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
                       "Skipping OCSP check for valid self-issued cert");

diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
index ebb39466b3644d0356e6744848a8d014e8862c80..c74cacf0260811c6e653b6a11615d8d09a76dc91 100644 (file)
--- a/modules/ssl/ssl_engine_vars.c
+++ b/modules/ssl/ssl_engine_vars.c
@@ -609,16 +609,8 @@ static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, char *
     for (i = 0; ssl_var_lookup_ssl_cert_dn_rec[i].name != NULL; i++) {
         if (strEQn(var, ssl_var_lookup_ssl_cert_dn_rec[i].name, varlen)
             && strlen(ssl_var_lookup_ssl_cert_dn_rec[i].name) == varlen) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-            for (j = 0; j < sk_X509_NAME_ENTRY_num((STACK_OF(X509_NAME_ENTRY) *)
-                                                   xsname->entries);
-                 j++) {
-                xsne = sk_X509_NAME_ENTRY_value((STACK_OF(X509_NAME_ENTRY) *)
-                                                xsname->entries, j);
-#else
             for (j = 0; j < X509_NAME_entry_count(xsname); j++) {
                 xsne = X509_NAME_get_entry(xsname, j);
-#endif
 
                 n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
 
@@ -920,9 +912,6 @@ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var)
 static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,
                        X509_NAME *xn, apr_pool_t *p)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-    STACK_OF(X509_NAME_ENTRY) *ents = xn->entries;
-#endif
     X509_NAME_ENTRY *xsne;
     apr_hash_t *count;
     int i, nid;
@@ -932,16 +921,9 @@ static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,
     count = apr_hash_make(p);
 
     /* For each RDN... */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-    for (i = 0; i < sk_X509_NAME_ENTRY_num(ents); i++) {
-         const char *tag;
-
-         xsne = sk_X509_NAME_ENTRY_value(ents, i);
-#else
     for (i = 0; i < X509_NAME_entry_count(xn); i++) {
          const char *tag;
          xsne = X509_NAME_get_entry(xn, i);
-#endif
 
          /* Retrieve the nid, and check whether this is one of the nids
           * which are to be extracted. */
@@ -1115,11 +1097,7 @@ apr_array_header_t *ssl_ext_list(apr_pool_t *p, conn_rec *c, int peer,
     for (j = 0; j < count; j++) {
         X509_EXTENSION *ext = X509_get_ext(xs, j);
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-        if (OBJ_cmp(ext->object, oid) == 0) {
-#else
         if (OBJ_cmp(X509_EXTENSION_get_object(ext), oid) == 0) {
-#endif
             BIO *bio = BIO_new(BIO_s_mem());
 
             /* We want to obtain a string representation of the extensions

diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
index 04a723ea6c296e63272a058e13ea41068528d371..03a2b756b24fdc3445d0728837fb233658d75a3a 100644 (file)
--- a/modules/ssl/ssl_private.h
+++ b/modules/ssl/ssl_private.h
@@ -151,6 +151,7 @@
 /* OCSP stapling */
 #if !defined(OPENSSL_NO_OCSP) && defined(SSL_CTX_set_tlsext_status_cb)
 #define HAVE_OCSP_STAPLING
+/* All exist but are no longer macros since OpenSSL 1.1.0 */
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 /* backward compatibility with OpenSSL < 1.0 */
 #ifndef sk_OPENSSL_STRING_num

diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c
index 57a753c16f66ba2ea7a6e41de09b5fc7ebcc58aa..63be9b2ced7a905922563421085db0ff49c1dd99 100644 (file)
--- a/modules/ssl/ssl_util_stapling.c
+++ b/modules/ssl/ssl_util_stapling.c
@@ -402,13 +402,9 @@ static int stapling_check_response(server_rec *s, modssl_ctx_t *mctx,
 
             if (bio) {
                 int n;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-                if ((i2a_ASN1_INTEGER(bio, cinf->cid->serialNumber) != -1) &&
-#else
                 ASN1_INTEGER *pserial;
                 OCSP_id_get0_info(NULL, NULL, NULL, &pserial, cinf->cid);
                 if ((i2a_ASN1_INTEGER(bio, pserial) != -1) &&
-#endif
                     ((n = BIO_read(bio, snum, sizeof snum - 1)) > 0))
                     snum[n] = '\0';
                 BIO_free(bio);