From: Graham Leggett Date: Thu, 6 Aug 2026 11:01:29 +0000 (+0000) Subject: mod_ssl: Rename URI directives to follow the pattern SSLStoreURI X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=c2e32f8d5b54679410cd426e4ab38ce5e6c2f7e4;p=thirdparty%2Fapache%2Fhttpd.git mod_ssl: Rename URI directives to follow the pattern SSLStoreURI and SSLTrustURI. Move CRL functionality from a dedicated directive into SSLTrustURI. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936908 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 37df8d1c7c..e4008ad9e3 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -1168,9 +1168,9 @@ effect.

-SSLCertificateURI +SSLStoreURI Server certificate and key store -SSLCertificateURI uri +SSLStoreURI uri server config virtual host Available in httpd 2.5.1 and later, when linked with @@ -1224,11 +1224,11 @@ at startup time.

Example # Example using a PEM-encoded file. -SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt" +SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.crt" # Example using a PKCS12 file. -SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12" +SSLStoreURI "/usr/local/apache2/conf/ssl.crt/server.p12" # Example use of a certificate and private key from a PKCS#11 token: -SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45" +SSLStoreURI "pkcs11:token=My%20Token%20Name;id=45" @@ -1238,12 +1238,12 @@ and readable only by root. The URI is not re-read during normal operation; a server restart is required for changes to take effect.

-Using SSLCertificateFile and SSLCertificateURI +<note type="warning"><title>Using SSLCertificateFile and SSLStoreURI together

-You can use both SSLCertificateFile and SSLCertificateURI together, however +You can use both SSLCertificateFile and SSLStoreURI together, however there is no overlap between the mechanisms. A certificate defined by -SSLCertificateFile will not be matched with a key from SSLCertificateURI. +SSLCertificateFile will not be matched with a key from SSLStoreURI.

@@ -1316,9 +1316,9 @@ effect.

 -SSLCACertificateURI +SSLTrustURI Server CA certificate store for Client Authentication -SSLCACertificateURI uri +SSLTrustURI uri server config virtual host AuthConfig @@ -1327,22 +1327,27 @@ OpenSSL v3 or later.

-This directive sets the all-in-one URI where you can assemble the -Certificates of Certification Authorities (CA) whose clients you deal -with. These are used for Client Authentication. This can be used alternatively -and/or additionally to SSLCACertificateFile +This directive sets URIs where you can assemble the Certificates of Certification +Authorities (CA) whose clients you deal with. These are used for Client +Authentication. This can be used alternatively and/or additionally to +SSLCACertificateFile or SSLCACertificatePath.

Example # trust certs in a PEM encoded certificate bundle -SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt" +SSLTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt" # trust all certs in a typical Linux machine -SSLCACertificateURI "pkcs11:token=System%20Trust" +SSLTrustURI "pkcs11:token=System%20Trust" # trust all certs in the Windows trust store -SSLCACertificateURI "org.openssl.winstore:" +SSLTrustURI "org.openssl.winstore:" +

+This directive will also read in Certificate Revocation Lists (CRL) of +Certification Authorities (CAs) whose clients you deal with. These are used +to revoke the client certificate on Client Authentication.

+

This URI is read at server startup, while the server is still running as root (before privilege dropping), so it may be owned by and readable only by root. The URI is not re-read during @@ -1369,12 +1374,12 @@ available.

If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the +module="mod_ssl">SSLTrustRequestURI are given, then the set of acceptable CA names sent to the client is the names of all the CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other +module="mod_ssl">SSLTrustURI directives; in other words, the names of the CAs which will actually be used to verify the client certificate.

@@ -1384,7 +1389,7 @@ the client certificate - for example, if the client certificates are signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the +module="mod_ssl">SSLTrustRequestURI can be used; the acceptable CA names are then taken from the complete set of certificates in the directory and/or file specified by this pair of directives.

@@ -1443,10 +1448,10 @@ to take effect.

 -SSLCADNRequestURI +SSLTrustRequestURI certificate store of CA Certificates for defining acceptable CA names -SSLCADNRequestURI uri +SSLTrustRequestURI uri server config virtual host @@ -1460,12 +1465,12 @@ available.

If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the +module="mod_ssl">SSLTrustRequestURI are given, then the set of acceptable CA names sent to the client is the names of all the CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other +module="mod_ssl">SSLTrustURI directives; in other words, the names of the CAs which will actually be used to verify the client certificate.

@@ -1475,18 +1480,18 @@ the client certificate - for example, if the client certificates are signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the +module="mod_ssl">SSLTrustRequestURI can be used; the acceptable CA names are then taken from the complete set of certificates in the directory and/or file specified by this pair of directives.

-

SSLCADNRequestURI must +

SSLTrustRequestURI must specify an all-in-one certificate store uri containing a set of CA certificates.

Example -SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt" +SSLTrustRequestURI "file:///usr/local/apache2/conf/ca-names.crt" @@ -1570,44 +1575,6 @@ effect.

 - -SSLCARevocationURI -Server CA certificate revocation list store for Client Authentication -SSLCARevocationURI uri -server config -virtual host - - -

-This directive sets the all-in-one file where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose clients you deal with. These are used -for Client Authentication. This can be used alternatively and/or -additionally to SSLCARevocationFile and SSLCARevocationPath.

-Example - -SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl" - - - -

A file: URI pointing at a file of PEM encoded CRLs -can be used instead of SSLCARevocationFile, and a file: -URI pointing at a directory of PEM encoded CRLs can be used -instead of SSLCARevocationPath. -

- -

This URI is read at server startup, while the server is still running -as root (before privilege dropping), so it may be owned by -and readable only by root. The URI is not re-read during -normal operation; a server restart is required for changes to take -effect.

- - - SSLCARevocationCheck Enable CRL-based revocation checking @@ -2387,9 +2354,9 @@ SSLProxyMachineCertificateChainFile "/usr/local/apache2/conf/ssl.crt/proxyCA.pem -SSLProxyMachineCertificateURI +SSLProxyStoreURI Proxy certificate and key stores -SSLProxyMachineCertificateURI uri +SSLProxyStoreURI uri server config virtual host proxy section Available in httpd 2.5.1 and later, when linked with @@ -2437,11 +2404,11 @@ at startup time.

Example # Example using a PEM-encoded file. -SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem" +SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.pem" # Example using a PKCS12 file. -SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12" +SSLProxyStoreURI "/usr/local/apache2/conf/ssl.crt/proxy.p12" # Example use of a certificate and private key from a PKCS#11 token: -SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45" +SSLProxyStoreURI "pkcs11:token=My%20Token%20Name;id=45" @@ -2469,13 +2436,13 @@ likely fail the SSL/TLS handshake (depending on the remote server configuration).

Using SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together +SSLProxyStoreURI together

You can use both SSLProxyMachineCertificateFile and -SSLProxyMachineCertificateURI together, however there is +SSLProxyStoreURI together, however there is no overlap between the mechanisms. A certificate defined by SSLProxyMachineCertificateFile will not be matched with a -key from SSLProxyMachineCertificateURI. +key from SSLProxyStoreURI.

@@ -2790,9 +2757,9 @@ SSLProxyCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-serv -SSLProxyCACertificateURI +SSLProxyTrustURI Proxy CA certificate store for Remote Server Auth -SSLProxyCACertificateURI uri +SSLProxyTrustURI uri server config virtual host proxy section Available in httpd 2.5.1 and later, when linked with @@ -2800,7 +2767,7 @@ OpenSSL v3 or later.

-This directive sets the all-in-one URI where you can assemble the +This directive sets URIs where you can assemble the Certificates of Certification Authorities (CA) whose remote servers you deal with. These are used for Remote Server Authentication. This can be used alternatively and/or additionally to @@ -2808,9 +2775,14 @@ and/or additionally to SSLProxyCACertificatePath.

Example -SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt" +SSLProxyTrustURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt" +

+This directive will also process Certificate Revocation Lists (CRL) of Certification +Authorities (CAs) whose remote servers you deal with, if they fall within scope. +These are used to revoke the remote server certificate on Remote Server Authentication. +

 @@ -2868,32 +2840,6 @@ SSLProxyCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-serve - -SSLProxyCARevocationURI -Proxy CA certificate revocation list store for Remote Server Auth -SSLProxyCARevocationURI uri -server config virtual host -proxy section -Available in httpd 2.5.1 and later, when linked with -OpenSSL v3 or later. - - -

-This directive sets the all-in-one URI where you can -assemble the Certificate Revocation Lists (CRL) of Certification -Authorities (CA) whose remote servers you deal with. These are used -for Remote Server Authentication. This can be -used alternatively and/or additionally to SSLProxyCARevocationFile and SSLProxyCARevocationPath.

-Example - -SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl" - - - - - SSLProxyCARevocationCheck Enable CRL-based revocation checking for Remote Server Auth diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c index 5d5efa2e8a..c456416e9f 100644 --- a/modules/ssl/mod_ssl.c +++ b/modules/ssl/mod_ssl.c @@ -110,7 +110,7 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_ALL(CipherSuite, TAKE12, "Colon-delimited list of permitted SSL Ciphers, optional preceded " "by protocol identifier ('XXX:...:XXX' - see manual)") - SSL_CMD_SRV(CertificateURI, TAKE1, + SSL_CMD_SRV(StoreURI, TAKE1, "SSL Server Certificate/Key uri " "('file:', 'pkcs11:' - URI of certificate or key)") SSL_CMD_SRV(CertificateFile, TAKE1, @@ -132,7 +132,7 @@ static const command_rec ssl_config_cmds[] = { "TLS ECH Key Directory" "('/path/to/dir' - directory with ECH key pairs)") #endif - SSL_CMD_SRV(CACertificateURI, TAKE1, + SSL_CMD_SRV(TrustURI, TAKE1, "SSL CA Certificate uri " "('file:', 'pkcs11:' - URI of CA certificates)") SSL_CMD_ALL(CACertificatePath, TAKE1, @@ -147,12 +147,9 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_SRV(CADNRequestFile, TAKE1, "SSL CA Distinguished Name file " "('/path/to/file' - PEM encoded to derive acceptable CA names to request)") - SSL_CMD_SRV(CADNRequestURI, TAKE1, + SSL_CMD_SRV(TrustRequestURI, TAKE1, "SSL CA Distinguished Name uri " "('file:', 'pkcs11:' - URI of certificates to derive acceptable CA names to request)") - SSL_CMD_SRV(CARevocationURI, TAKE1, - "SSL CA Certificate Revocation List (CRL) uri " - "('file:', 'pkcs11:' - URI of CRLs)") SSL_CMD_SRV(CARevocationPath, TAKE1, "SSL CA Certificate Revocation List (CRL) path " "('/path/to/dir' - contains PEM encoded files)") @@ -228,8 +225,8 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_PXY(ProxyVerifyDepth, TAKE1, "SSL Proxy: maximum certificate verification depth " "('N' - number of intermediate certificates)") - SSL_CMD_PXY(ProxyCACertificateURI, TAKE1, - "SSL Proxy: uri referring to server certificates " + SSL_CMD_PXY(ProxyTrustURI, TAKE1, + "SSL Proxy: uri referring to trusted server certificates " "('file:', 'pkcs11:' - URI of CA certificates)") SSL_CMD_PXY(ProxyCACertificateFile, TAKE1, "SSL Proxy: file containing server certificates " @@ -237,9 +234,6 @@ static const command_rec ssl_config_cmds[] = { SSL_CMD_PXY(ProxyCACertificatePath, TAKE1, "SSL Proxy: directory containing server certificates " "('/path/to/dir' - contains PEM encoded certificates)") - SSL_CMD_PXY(ProxyCARevocationURI, TAKE1, - "SSL Proxy: CA Certificate Revocation List (CRL) uri " - "('file:', 'pkcs11:' - URI of CRLs)") SSL_CMD_PXY(ProxyCARevocationPath, TAKE1, "SSL Proxy: CA Certificate Revocation List (CRL) path " "('/path/to/dir' - contains PEM encoded files)") @@ -248,7 +242,7 @@ static const command_rec ssl_config_cmds[] = { "('/path/to/file' - PEM encoded)") SSL_CMD_PXY(ProxyCARevocationCheck, RAW_ARGS, "SSL Proxy: CA Certificate Revocation List (CRL) checking mode") - SSL_CMD_PXY(ProxyMachineCertificateURI, TAKE1, + SSL_CMD_PXY(ProxyStoreURI, TAKE1, "SSL Proxy: uri referring to client certificates " "('file:', 'pkcs11:' - URI of certificate or key)") SSL_CMD_PXY(ProxyMachineCertificateFile, TAKE1, diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c index 594cfbe462..3652b7f0cf 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c @@ -132,10 +132,9 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) mctx->crl_file = NULL; mctx->crl_path = NULL; - mctx->crl_uri = NULL; mctx->crl_check_mask = UNSET; - mctx->auth.ca_cert_uri = NULL; + mctx->auth.trust_uris = apr_array_make(p, 3, sizeof(char *));; mctx->auth.ca_cert_path = NULL; mctx->auth.ca_cert_file = NULL; mctx->auth.cipher_suite = NULL; @@ -204,6 +203,7 @@ static void modssl_ctx_init_server(SSLSrvConfigRec *sc, mctx->pks = apr_pcalloc(p, sizeof(*mctx->pks)); mctx->pks->uris = apr_array_make(p, 3, sizeof(char *)); + mctx->pks->trust_request_uris = apr_array_make(p, 3, sizeof(char *)); mctx->pks->cert_files = apr_array_make(p, 3, sizeof(char *)); mctx->pks->key_files = apr_array_make(p, 3, sizeof(char *)); @@ -281,10 +281,9 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, cfgMerge(crl_file, NULL); cfgMerge(crl_path, NULL); - cfgMerge(crl_uri, NULL); cfgMergeInt(crl_check_mask); - cfgMergeString(auth.ca_cert_uri); + cfgMergeArray(auth.trust_uris); cfgMergeString(auth.ca_cert_path); cfgMergeString(auth.ca_cert_file); cfgMergeString(auth.cipher_suite); @@ -343,7 +342,7 @@ static void modssl_ctx_cfg_merge_server(apr_pool_t *p, cfgMergeArray(pks->cert_files); cfgMergeArray(pks->key_files); - cfgMergeString(pks->ca_name_uri); + cfgMergeArray(pks->trust_request_uris); cfgMergeString(pks->ca_name_path); cfgMergeString(pks->ca_name_file); @@ -1096,7 +1095,7 @@ static const char *ssl_cmd_check_dir(cmd_parms *parms, } -const char *ssl_cmd_SSLCertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLStoreURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1185,7 +1184,7 @@ const char *ssl_cmd_SSLSessionTicketKeyFile(cmd_parms *cmd, #define NO_PER_DIR_SSL_CA \ "Your SSL library does not have support for per-directory CA" -const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLTrustURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1202,7 +1201,7 @@ const char *ssl_cmd_SSLCACertificateURI(cmd_parms *cmd, } /* XXX: bring back per-dir */ - sc->server->auth.ca_cert_uri = arg; + *(const char **)apr_array_push(sc->server->auth.trust_uris) = arg; return NULL; } @@ -1251,8 +1250,8 @@ const char *ssl_cmd_SSLCACertificateFile(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg, - const char *arg) +const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *cmd, void *dcfg, + const char *arg) { SSLSrvConfigRec *sc = mySrvConfig(cmd->server); const char *err; @@ -1261,7 +1260,7 @@ const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *cmd, void *dcfg, return err; } - sc->server->pks->ca_name_uri = arg; + *(const char **)apr_array_push(sc->server->pks->trust_request_uris) = arg; return NULL; } @@ -1296,22 +1295,6 @@ const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *cmd, void *dcfg, return NULL; } -const char *ssl_cmd_SSLCARevocationURI(cmd_parms *cmd, - void *dcfg, - const char *arg) -{ - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - const char *err; - - if ((err = ssl_cmd_check_uri(cmd, arg))) { - return err; - } - - sc->server->crl_uri = arg; - - return NULL; -} - const char *ssl_cmd_SSLCARevocationPath(cmd_parms *cmd, void *dcfg, const char *arg) @@ -1857,7 +1840,7 @@ const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd, +const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *cmd, void *dcfg, const char *arg) { @@ -1868,7 +1851,7 @@ const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *cmd, return err; } - dc->proxy->auth.ca_cert_uri = arg; + *(const char **)apr_array_push(dc->proxy->auth.trust_uris) = arg; return NULL; } @@ -1905,22 +1888,6 @@ const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *cmd, return NULL; } -const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *cmd, - void *dcfg, - const char *arg) -{ - SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; - const char *err; - - if ((err = ssl_cmd_check_uri(cmd, arg))) { - return err; - } - - dc->proxy->crl_uri = arg; - - return NULL; -} - const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *cmd, void *dcfg, const char *arg) @@ -1962,9 +1929,9 @@ const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *cmd, return ssl_cmd_crlcheck_parse(cmd, arg, &dc->proxy->crl_check_mask); } -const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *cmd, - void *dcfg, - const char *arg) +const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *cmd, + void *dcfg, + const char *arg) { SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; const char *err; @@ -2529,9 +2496,15 @@ void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s) SSLSrvConfigRec *sc = mySrvConfig(s); if (sc && sc->server) { - if (sc->server->auth.ca_cert_uri) { + + int i; + + for (i = 0; (i < sc->server->auth.trust_uris->nelts) && + APR_ARRAY_IDX(sc->server->auth.trust_uris, i, const char *); + i++) { apr_file_printf(out, " %s\n", - sc->server->auth.ca_cert_uri); + APR_ARRAY_IDX(sc->server->auth.trust_uris, + i, const char *)); } if (sc->server->auth.ca_cert_path) { apr_file_printf(out, " %s\n", @@ -2800,7 +2773,7 @@ static void modssl_auth_ctx_dump(modssl_auth_ctx_t *auth, apr_pool_t *p, int pro #endif DMP_VERIFY(proxy? "SSLProxyVerify" : "SSLVerifyClient", auth->verify_mode); DMP_LONG( proxy? "SSLProxyVerify" : "SSLVerifyDepth", auth->verify_depth); - DMP_STRING(proxy? "SSLProxyCACertificateURI" : "SSLCACertificateURI", auth->ca_cert_uri); + DMP_STRARR(proxy? "SSLProxyTrustURI" : "SSLTrustURI", auth->trust_uris); DMP_STRING(proxy? "SSLProxyCACertificateFile" : "SSLCACertificateFile", auth->ca_cert_file); DMP_STRING(proxy? "SSLProxyCACertificatePath" : "SSLCACertificatePath", auth->ca_cert_path); } @@ -2820,15 +2793,14 @@ static void modssl_ctx_dump(modssl_ctx_t *ctx, apr_pool_t *p, int proxy, DMP_STRING(proxy? "SSLProxyCARevocationFile" : "SSLCARevocationFile", ctx->crl_file); DMP_STRING(proxy? "SSLProxyCARevocationPath" : "SSLCARevocationPath", ctx->crl_path); - DMP_STRING(proxy? "SSLProxyCARevocationURI" : "SSLCARevocationURI", ctx->crl_uri); DMP_CRLCHK(proxy? "SSLProxyCARevocationCheck" : "SSLCARevocationCheck", ctx->crl_check_mask); if (!proxy) { DMP_PHRASE("SSLPassPhraseDialog", ctx->pphrase_dialog_type, ctx->pphrase_dialog_path); if (ctx->pks) { - DMP_STRING("SSLCADNRequestURI", ctx->pks->ca_name_uri); + DMP_STRARR("SSLTrustRequestURI", ctx->pks->trust_request_uris); DMP_STRING("SSLCADNRequestFile", ctx->pks->ca_name_file); DMP_STRING("SSLCADNRequestPath", ctx->pks->ca_name_path); - DMP_STRARR("SSLCertificateURI", ctx->pks->uris); + DMP_STRARR("SSLStoreURI", ctx->pks->uris); DMP_STRARR("SSLCertificateFile", ctx->pks->cert_files); DMP_STRARR("SSLCertificateKeyFile", ctx->pks->key_files); } @@ -2879,7 +2851,7 @@ static void modssl_ctx_dump(modssl_ctx_t *ctx, apr_pool_t *p, int proxy, } else { /* proxy */ if (ctx->pkp) { - DMP_STRARR("SSLProxyMachineCertificateURI", ctx->pkp->uris); + DMP_STRARR("SSLProxyStoreURI", ctx->pkp->uris); DMP_STRING("SSLProxyMachineCertificateFile", ctx->pkp->cert_file); DMP_STRING("SSLProxyMachineCertificatePath", ctx->pkp->cert_path); DMP_STRING("SSLProxyMachineCertificateChainFile", ctx->pkp->ca_cert_file); diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index 9a03bc45cf..d533785868 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -339,7 +339,7 @@ static void hash_sni_policy_pk(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ct md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files); } -static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx) +static void hash_sni_policy_auth(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx) { modssl_pk_server_t *pks = ctx->pks; modssl_auth_ctx_t *a = &ctx->auth; @@ -347,13 +347,12 @@ static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx) md5_fmt_update(hash, "verify_depth:%d", a->verify_depth); md5_fmt_update(hash, "verify_mode:%d", a->verify_mode); - md5_ifstr_update(hash, "ca_name_uri:", pks->ca_name_uri); + md5_strarray_hash(ptemp, hash, "trust_request_uris:", pks->trust_request_uris); md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path); md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file); - md5_ifstr_update(hash, "ca_cert_uri:", a->ca_cert_uri); + md5_strarray_hash(ptemp, hash, "trust_uris:", a->trust_uris); md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path); md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file); - md5_ifstr_update(hash, "crl_uri:", ctx->crl_uri); md5_ifstr_update(hash, "crl_path:", ctx->crl_path); md5_ifstr_update(hash, "crl_file:", ctx->crl_file); md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask); @@ -393,7 +392,7 @@ static char *create_sni_policy_hash(apr_pool_t *p, apr_pool_t *ptemp, /* Create the vhost policy hash for comparison later. */ apr_md5_init(&hash); - hash_sni_policy_auth(&hash, sc->server); + hash_sni_policy_auth(ptemp, &hash, sc->server); if (policy == MODSSL_SNIVH_SECURE) hash_sni_policy_pk(ptemp, &hash, sc->server); apr_md5_final(digest, &hash); @@ -1307,6 +1306,26 @@ apr_status_t modssl_CTX_load_verify_store(server_rec *s, break; } + case OSSL_STORE_INFO_CRL: { + + X509_CRL *crl; + + if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) { + OSSL_STORE_close(sctx); + return APR_EGENERAL; + } + if (X509_STORE_add_crl(store, crl)) { + + ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601) + "Host %s: Certificate revocation list from URI: %s", + mctx->sc->vhost_id, + modssl_X509_NAME_to_string(ptemp, + X509_CRL_get_issuer(crl), 0)); + + } + + break; + } } } @@ -1361,20 +1380,30 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, */ if (mctx->auth.ca_cert_file || mctx->auth.ca_cert_path || - mctx->auth.ca_cert_uri) { + mctx->auth.trust_uris->nelts) { + const char *trust_uri; + + int i; apr_status_t rv; ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, "Configuring client authentication"); - if ((rv = modssl_CTX_load_verify_store(s, ptemp, - mctx->auth.ca_cert_uri, 1, mctx)) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600) - "Unable to configure verify store " - "for client authentication"); - ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); - return ssl_die(s); + for (i = 0; (i < mctx->auth.trust_uris->nelts) && + (trust_uri = APR_ARRAY_IDX(mctx->auth.trust_uris, i, + const char *)); + i++) { + + if ((rv = modssl_CTX_load_verify_store(s, ptemp, + trust_uri, 1, mctx)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10600) + "Unable to configure verify store " + "for client authentication: %s", trust_uri); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return ssl_die(s); + } + } if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, @@ -1387,18 +1416,18 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, } if (mctx->pks && (mctx->pks->ca_name_file || mctx->pks->ca_name_path || - mctx->pks->ca_name_uri)) { + mctx->pks->trust_request_uris->nelts)) { ca_list = ssl_init_FindCAList(s, ptemp, mctx->pks->ca_name_file, mctx->pks->ca_name_path, - mctx->pks->ca_name_uri, + mctx->pks->trust_request_uris, mctx); } else { ca_list = ssl_init_FindCAList(s, ptemp, mctx->auth.ca_cert_file, mctx->auth.ca_cert_path, - mctx->auth.ca_cert_uri, + mctx->auth.trust_uris, mctx); } @@ -1493,99 +1522,6 @@ int modssl_X509_STORE_load_locations(X509_STORE *store, return 1; } -/* - * OpenSSL has a X509_STORE_load_store() function, but this - * function has side effects - it loads both CRLs and trusted - * CA certificates. - * - * An end user reasonably wants to configure a URI pointing at - * CRLs and not have any surprises if the scope of the URI - * included trusted CA certificates for whatever reason. - * - * As a result we consider CRLs exclusively below. - */ - -static APR_INLINE -apr_status_t modssl_X509_STORE_load_crl(server_rec *s, - apr_pool_t *ptemp, - const char *uri, - int depth, - modssl_ctx_t *mctx) -{ -#if MODSSL_HAVE_OPENSSL_STORE - OSSL_STORE_CTX *sctx; - OSSL_STORE_INFO *info; - - apr_status_t rv = APR_SUCCESS; - - X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); - - ap_assert(store != NULL); /* safe to assume always non-NULL? */ - - if (!uri) { - return APR_SUCCESS; - } - - if ((!(sctx = OSSL_STORE_open_ex(uri, mctx->libctx, NULL, NULL, NULL, - NULL, NULL, NULL)))) { - return APR_EGENERAL; - } - - while (!OSSL_STORE_eof(sctx) && !OSSL_STORE_error(sctx)) { - - if (!(info = OSSL_STORE_load(sctx))) { - continue; - } - - switch(OSSL_STORE_INFO_get_type(info)) { - case OSSL_STORE_INFO_NAME: { - - if (depth > 0) { - rv = modssl_X509_STORE_load_crl(s, ptemp, - OSSL_STORE_INFO_get0_NAME(info), - depth - 1, mctx); - if (APR_SUCCESS != rv) { - OSSL_STORE_close(sctx); - return rv; - } - } - - break; - } - case OSSL_STORE_INFO_CRL: { - - X509_CRL *crl; - - if (!(crl = OSSL_STORE_INFO_get0_CRL(info))) { - return APR_EGENERAL; - } - if (X509_STORE_add_crl(store, crl)) { - - ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(10601) - "Host %s: Certificate revocation list from URI: %s", - mctx->sc->vhost_id, - modssl_X509_NAME_to_string(ptemp, - X509_CRL_get_issuer(crl), 0)); - - } - - break; - } - } - } - - OSSL_STORE_close(sctx); - - return rv; -#else - if (!uri) { - return APR_SUCCESS; - } - - return APR_ENOTIMPL; -#endif -} - static apr_status_t ssl_init_ctx_crl(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, @@ -1612,12 +1548,12 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, * Configure Certificate Revocation List (CRL) Details */ - if (!(mctx->crl_uri || mctx->crl_file || mctx->crl_path)) { + if (!(mctx->auth.trust_uris->nelts || mctx->crl_file || mctx->crl_path)) { if (crl_check_mode == SSL_CRLCHECK_LEAF || crl_check_mode == SSL_CRLCHECK_CHAIN) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01899) "Host %s: CRL checking has been enabled, but " - "neither %sCARevocationURI, %sCARevocationFile nor %sCARevocationPath " + "neither %sTrustURI, %sCARevocationFile nor %sCARevocationPath " "is configured", mctx->sc->vhost_id, cfgp, cfgp, cfgp); return ssl_die(s); } @@ -1627,14 +1563,6 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) "Configuring certificate revocation facility"); - if ((rv = modssl_X509_STORE_load_crl(s, ptemp, mctx->crl_uri, 1, mctx)) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, APLOGNO(10602) - "Host %s: unable to configure X.509 CRL uri " - "for certificate revocation", mctx->sc->vhost_id); - ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); - return ssl_die(s); - } - if (!modssl_X509_STORE_load_locations(store, mctx->crl_file, mctx->crl_path)) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) @@ -3632,21 +3560,32 @@ STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s, apr_pool_t *ptemp, const char *ca_file, const char *ca_path, - const char *ca_uri, + apr_array_header_t *trust_uris, modssl_ctx_t *mctx) { + const char *trust_uri; + int i; + STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();; /* * Process CA certificate store uri */ - if (ca_uri && - ssl_init_ca_cert_uri(s, ptemp, - ca_uri, ca_list, 1, mctx) != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616) - "Failed to open Certificate URI `%s'", ca_uri); - sk_X509_NAME_pop_free(ca_list, X509_NAME_free); - return NULL; + + for (i = 0; (i < trust_uris->nelts) && + (trust_uri = APR_ARRAY_IDX(trust_uris, i, + const char *)); + i++) { + + if (trust_uris->nelts && + ssl_init_ca_cert_uri(s, ptemp, + trust_uri, ca_list, 1, mctx) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10616) + "Failed to open Trust URI `%s'", trust_uri); + sk_X509_NAME_pop_free(ca_list, X509_NAME_free); + return NULL; + } + } /* diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h index 938adf01fe..16014186e8 100644 --- a/modules/ssl/ssl_private.h +++ b/modules/ssl/ssl_private.h @@ -761,7 +761,7 @@ typedef struct { /** Certificates which specify the set of CA names which should be * sent in the CertificateRequest message: */ - const char *ca_name_uri; + apr_array_header_t *trust_request_uris; const char *ca_name_path; const char *ca_name_file; @@ -788,7 +788,7 @@ typedef struct { /** stuff related to authentication that can also be per-dir */ typedef struct { /** known/trusted CAs */ - const char *ca_cert_uri; + apr_array_header_t *trust_uris; const char *ca_cert_path; const char *ca_cert_file; @@ -849,7 +849,6 @@ typedef struct { const char *cert_chain; /** certificate revocation list */ - const char *crl_uri; const char *crl_path; const char *crl_file; int crl_check_mask; @@ -990,17 +989,16 @@ const char *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLECHKeyDir(cmd_parms *cmd, void *dcfg, const char *arg); #endif const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *); -const char *ssl_cmd_SSLCertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLStoreURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCACertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLTrustURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCACertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCACertificateFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCADNRequestURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLTrustRequestURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCADNRequestPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCADNRequestFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLCARevocationURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *); @@ -1027,14 +1025,13 @@ const char *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *); const char *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyCACertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLProxyTrustURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCACertificateFile(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyCARevocationURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationPath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *, void *, const char *); -const char *ssl_cmd_SSLProxyMachineCertificateURI(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLProxyStoreURI(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificatePath(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificateFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLProxyMachineCertificateChainFile(cmd_parms *, void *, const char *); @@ -1080,7 +1077,7 @@ int ssl_proxy_section_post_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s, ap_conf_vector_t *section_config); STACK_OF(X509_NAME) - *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, const char *, modssl_ctx_t *); + *ssl_init_FindCAList(server_rec *, apr_pool_t *, const char *, const char *, apr_array_header_t *, modssl_ctx_t *); void ssl_init_Child(apr_pool_t *, server_rec *); apr_status_t ssl_init_ModuleKill(void *data);