Solve SSL-C breakage introduced in mod_ssl.h rev 1.129 and
ssl_engine_kernel.c rev 1.88. SSL* is not const under SSL-C.
I've confirmed Jeff's comment that the original patch doesn't harm
earlier OpenSSL versions which declared no arguments at all.
I suspect now that we could fold
#define MODSSL_BIO_CB_ARG_TYPE const char
#define MODSSL_CRYPTO_CB_ARG_TYPE const char
#define MODSSL_INFO_CB_ARG_TYPE const SSL*
into a single MODSSL_CB_ARG_CONST define, but this works for now.
Reapply the fix *intended* by rev 1.79 in a safer manner. Prior to
all assignments and the final SSL_free(), free ssl_conn->client_cert
to avoid leaks of this refcounted X509*. Prereleasing refcounted
objects is unsafe programming; fix applied to both branches.
EVP_PKEY_free() is refcounted on OpenSSL, but NOT under RSA SSL-C.
Eliminate a number of test failures by conditionally reverting rev 1.79
pubkey handling in ssl_engine_kernel.c, except under OpenSSL.
Also revert a rev 1.79 bogisity for all toolkits; it's entirely bogus
to release a refcount after setting aside the results in a persistant
structure, in this case sslconn->client_cert from SSL_get_peer_certificate()
mustn't be freed while sslconn is still in play. The proper patch (not
written yet) is to invoke the X509_free(sslconn->client_cert) when we
cleanup the sslconn structure.
A cosmetic change to 1.79 - a real X509 *cert is in play, don't use
that same variable to retrieve/release the quick lookup and discard
of the peercert.
Jeff Trawick [Fri, 4 Apr 2003 03:57:10 +0000 (03:57 +0000)]
Fix a compile failure with recent OpenSSL and picky compilers
(e.g., OpenSSL 0.9.7a and xlc_r on AIX).
The OpenSSL info callback field changed recently from a generic
function pointer to a specific one, and ssl_callback_LogTracingState
wasn't quite right.
Introduce a number of SSLC hints to mod_ssl, including the following
type overrides;
MODSSL_CLIENT_CERT_CB_ARG_TYPE
MODSSL_PCHAR_CAST (for a host of non-void/const sslc values)
modssl_read_bio_cb_fn (for several callbacks with same prototypes)
Declare callback functions appropriately.
And protect us from indetermineant toolkits with
#error "Unrecognized SSL Toolkit!"
Jim Jagielski [Mon, 31 Mar 2003 14:38:51 +0000 (14:38 +0000)]
Match what we do with the ssl_scache_dbm
chown junk, which we know is safe and works, and more directly
handles the issue with chown (agreed that a macro is needed
eventually)
André Malo [Sat, 29 Mar 2003 04:39:08 +0000 (04:39 +0000)]
Fix mod_ssl.dsp and abs.dsp to use also the openssl-0.9.7-defines for
NO_MD5, NO_IDEA and NO_MDC2 (won't compile otherwise with 0.9.7+ and
restricted crypto algorithms)
Jim Jagielski [Sat, 29 Mar 2003 02:18:43 +0000 (02:18 +0000)]
Because SSL's child init is run *after* we change uid/gid. So we need to ensure that file-based
locks have the correct perms so that the child process
can access them
Fix a serious bug where the 'next' generation of the server would open
a brand new mutex. This patch creates a single mutex in the first config
phase that survives for the life of the server (server->process->pool).
Now one server generation to the next will respect the same mutex between
one another, while the previous generation is still mopping up.
Allow any mutex to accept a 'filename' ... and always root it to the
server root unless we are using posixsem, which can't handle big paths.
This reorganization should make the code much more readable because
all of the common code is at the beginning and end of the function,
simplifing the long conditional test case block.
This patch allows SSLMutex default:logs/ssl_mutex syntax. It also
removes the mod_ssl historical '.pid' suffixes - that isn't how Apache2
specifies files.
Fix PR 17864, and also fixes a SEGV problem when SHMHT was used.
The porting of the code from mod_ssl 1.3.x was still incomplete, and depended
upon a complete implentation of apr_shm (hence pieces of code was #if 0'ed out).
After discussions at length on dev@apr/httpd, it is determined that
the older .dbg format symbols are not worth the interference with
generating complete .pdb symbolic debugging databases.
This patch further eliminates pdbtype:sept flags that interfere with
deciphering local symbols and type information.
Jim Jagielski [Sun, 23 Feb 2003 17:12:43 +0000 (17:12 +0000)]
Right now SSLMutex is bogus. It just uses APR_LOCK_DEFAULT no
matter what. We now allow for the full range of APR mutex
locking mechanims to be used, while maintaining backwards
compatibility.
PR: 8122
Obtained from:
Submitted by:
Reviewed by: William Rowe
After consultations on the APR list, it was decided that /map files are
fairly redundant when you retain rich .pdb debugging symbol files. We
have rarely used them, and generally .dbg and .pdb files prove much more
useful for the cases we have.
While eliminating /map files, we are also shrinking the size of the .dbg
files by stripping 'private' symbol information. Really this means less
rich diagnostics from Dr. Watson on NT or Win9x when they query the .dbg
symbols in creating a DrWatson log file. But it's more than compensated
for on newer OS'es where Dr. Watson will query the .pdb symbols, on all
Win32 flavors when WinDbg is used with the .pdb symbols, and the fact that
the distribution of binary symbols will use less bandwidth when less
information is duplicated from the .pdb format into the .dbg files.
foo.dbgmark turned out to be the same 8.3 name as foo.dbg itself, which
was badness. Twist this puppy to .dbr, the only name I could invent that
doesn't look like any database file extension I recall.
*) Introduce debugging symbols for Win32 release builds, both .pdb
and .dbg files (older debuggers and Dr. Watson-type utilities
on WinNT or Win9x don't support the newer .pdb flavor.)
[Allen Edwards, William Rowe]
Catch up with the changes to apr/build/win32ver.awk and name all loadable
httpd modules as .so, internally. Credit to Mladen Turk for identifing
the issue.
After introducing tests in the cmds, we lose the absolute authority
of the CRYPTO_malloc_init() which must happen the moment we load the
module and prior to *any* ssl library fn invocation.
Moved the CRYPTO_malloc_init() into the ssl_register_hooks() function,
the absolute first call made into any loaded module.
After some productive feedback and no negative feedback, introduce
SSLEngine upgrade so that we can begin and continue to support these
facilities. This makes it simpler to keep this effort (while we have
no known clients that support Connection: upgrade at this time), and
begin refactoring more of SSL into smaller and tighter (and then optional)
components.
After some productive feedback and no negative feedback, introduce
SSLEngine upgrade so that we can begin and continue to support these
facilities. This makes it simpler to keep this effort (while we have
no known clients that support Connection: upgrade at this time), and
begin refactoring more of SSL into smaller and tighter (and then optional)
components.
Submitted by: Ryan Bloom
Reviewed by: William Rowe, Joe Orton
Rule one of winsock and other one-offs (even unix EINTR) ... blocking
isn't necessarily blocking. Should not have changed this in the prior
commit, and adding the same retry to the -1/EAGAIN|EINTR case.
errno? EINTR? what planet was this code on :-? Normalize the
ssl_io_filter_connect code to follow the filter read and write.
Notice that it's buck ugly, but we will extract an rc first from
the input BIO if it was written, and then try the output bio if
it was APR_SUCCESS, during _connect processing.
Merge the last of the 'filtering' functions into ssl_engine_io.c, merge
ssl_abort into what was ssl_hook_CloseConnection, clean out a bunch of
now-static or private headers from mod_ssl.h, and final fix a very small
but potent segfault if ->pssl is destroyed within our read loop.
Actually, the APR_ECONNABORTED (EOS-only brigade) is the direction we
are contemplating for the next release, not the prior behavior
(which was APR_SUCCESS for c->aborted.)
With a last little bit of help from Justin, this should cause the
appropriate amount of tumolt and turmoil if our client has 'gone away'
on us, sparing us of further processing (and potential 'renegotiations'
with a non-existant client.)
Appears we forgot to check the possibility of errors coming from the
write brigade passed down from the content generator through the body
and protocol filters.
Rename the many flavors of filter_ctx (pRec, fctx etc) to filter_ctx,
wbio to bio_out, BIO new and free to create and destroy (to match OpenSSL),
refactor the bio write code to stash errors in outctx->rc,
fix the blocking read at EOF if we have some data to return,
and preempt the nonblock read on GETLINE if we have the newline already.
I don't see how *len > wanted, but leave the check there.
Stick a comment in there as a 'Waldo was here' so that if I ever see this
again, I realize that I've actually thought about it and didn't think >
was necessary.
Suggestions by Justin, implemention by Will. Rename away all bogisity,
especially eliminating all of 'our' capitalized identifiers that were
easily confused with library symbols; go with APR_STATUS_IS_EOF() just
in case there is a platform result; fix a bogus *len = 0; reassignment
and fold the two flavors of input context tracking into one.
Jeff Trawick [Fri, 25 Oct 2002 21:44:28 +0000 (21:44 +0000)]
mod_ssl uses free() inappropriately in several places, to free
memory which has been previously allocated inside OpenSSL.
Such memory should be freed with OPENSSL_free(), not with free().
Jim Jagielski [Tue, 22 Oct 2002 23:18:14 +0000 (23:18 +0000)]
2 silly bugs. First of all, make the code match the error log
(and allow 8192 to be valid). Secondly, this missplaced else
made the size part (8192) non-optional for shm:
PR:
Obtained from:
Submitted by:
Reviewed by:
Ryan Bloom [Fri, 11 Oct 2002 15:29:22 +0000 (15:29 +0000)]
Fix a compile of compiler warnings. I don't know how these slipped past.
Also, uncomment a line of code that the last commit should have uncommented.
Randall found this line and the fix, but I forgot to uncomment this line
along with the fix.
Ryan Bloom [Mon, 30 Sep 2002 23:43:18 +0000 (23:43 +0000)]
Call out the success cases when we don't get APR_SUCCESS back from the
network write. All other status codes result in c->aborted being set,
which allows the logs to note that the connection was aborted. Previous
to this patch, if the network cable was unplugged on the client, the server
would get APR_ETIMEUP, but we wouldn't note that the connection was
aborted.
Add a filter_init function to the filters so that a filter can execute
arbitrary code before the handlers are invoked.
This resolves an issue with incorrect 304s on If-Modified-Since mod_include
requests since ap_meets_conditions() is not aware that this is a dynamic
request and it is not possible to satisfy 304 for these requests (unless
xbithack full is on, of course). When mod_include runs as a filter, it is
too late to set any flag since the handler is responsible for calling
ap_meets_conditions(), which it should do before generating any data.
If a module doesn't need to run such arbitrary code, it can just pass NULL
as the argument and all is well.
These emits occur mainline, outside of the pphrase_callback, so we never
opened readtty or writetty. But they are absolute failures, nothing the
user could do to deal with them. They are logged in the ssl vhost's error
log.
In this case, I forgot my SSLCertificateKeyFile, so the server never
tried the callback. writetty wasn't initialized, so we segfaulted.
This segfault is due to misconfig, not to the dialog with the user.
This is the easiest fix (easier to read, too), but we shouldn't need
to worry too much that the release is tagged. If we retag, fine, then
grab it, but it only addresses a config problem.
Doug MacEachern [Tue, 11 Jun 2002 03:45:54 +0000 (03:45 +0000)]
in case there is actually a cert chain in the cache, we should be
using the value of SSL_get_peer_certificate(ssl) to verify as it will
have been removed from the chain before it was put in the cache.
Doug MacEachern [Tue, 11 Jun 2002 03:19:27 +0000 (03:19 +0000)]
PR:
Obtained from:
Submitted by:
Reviewed by:
allow POST method over SSL when per-directory client cert
authentication is used with 'SSLOptions +OptRenegotiate' enabled
and a client cert was found in the ssl session cache.
Doug MacEachern [Tue, 11 Jun 2002 03:12:33 +0000 (03:12 +0000)]
PR:
Obtained from:
Submitted by:
Reviewed by:
'SSLOptions +OptRengotiate' will use client cert in from the ssl
session cache when there is no cert chain in the cache. prior to
the fix this situation would result in a FORBIDDEN response and
error message "Cannot find peer certificate chain"
Cliff Woolley [Thu, 6 Jun 2002 18:27:42 +0000 (18:27 +0000)]
Update Geoff's email address. PS: Geoff still volunteers to answer any
questions about shmcb:
"Feel free to buzz me on shmcb matters to as/when you like - my time
may be limited right now but I will certainly reply as best I can to
anything that comes up."
The only remaining question ... are nested or strictly unnested locks
expected by OpenSSL? Right now I've left it as _DEFAULT for the platform
preference. Very simple code really - the server_rec was superfluous.
Cliff Woolley [Thu, 30 May 2002 22:39:08 +0000 (22:39 +0000)]
This definitely gets the award for least useful error message of the month.
Not only should it just say "can't do that on win32," which is after all
the bottom line, it was spitting out openssl error messages which were
totally useless. Eg:
[30/May/2002 17:31:17 05760] [error] Init: PassPhraseDialog BuiltIn not
supported in server private key from file
F:/Apache/Apache2/conf/ssl/secure.key (OpenSSL library error follows)
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D084069:asn1
encoding routines:d2i_ASN1_SET:bad tag
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D09D082:asn1
encoding routines:d2i_RSAPrivateKey:parsing
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D09B00D:asn1
encoding routines:d2i_PrivateKey:ASN1 lib
Which is essentially saying "OpenSSL couldn't read your private key because
it was encrypted, and we can't get the passphrase the way you asked us to
on this platform."
Brought to my attention by the inquiry of: Chris Hsiang <chsiang@ivivos.com>
projects / thirdparty / apache / httpd.git / log
