]> git.ipfire.org Git - thirdparty/apache/httpd.git/commit
mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility
authorJoe Orton <jorton@apache.org>
Thu, 23 Oct 2025 11:51:28 +0000 (11:51 +0000)
committerJoe Orton <jorton@apache.org>
Thu, 23 Oct 2025 11:51:28 +0000 (11:51 +0000)
commit21491b21577c68858b3cc02c21e3db88f0a30bb1
tree27bfd913c8bea093930d86c98a37679b5b12ad46
parente54735bf82e02278dc70eb80d931a748a81e8ce8
mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility
level required for VirtualHost matching.

For "secure" and "authonly" modes, a hash of the policy-relevant vhost
configuration is created and stored in the post_config hooks, reducing
the runtime code complexity (and overhead).

* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New
  function, replacing ssl_server_compatible et al.

* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New
  function.

* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash,
  hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash):
  New functions.
  (ssl_init_Module): Invoke create_sni_policy_hash to store the hash
  for every SSLSrvConfigRec.

* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field.
  (SSLSrvConfigRec): Add sni_policy_hash field.

PR: 69743
GitHub: closes #561

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1929308 13f79535-47bb-0310-9956-ffa450edef68
docs/manual/mod/mod_ssl.xml
modules/ssl/mod_ssl.c
modules/ssl/ssl_engine_config.c
modules/ssl/ssl_engine_init.c
modules/ssl/ssl_engine_kernel.c
modules/ssl/ssl_private.h