Commit 41235a9b authored by Graham Leggett's avatar Graham Leggett
Browse files

mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck directive 

to opt-in previous behaviour (2.2) with CRLs verification when checking
certificate(s) with no corresponding CRL.

Submitted by: ylavic
Reviewed by: icing, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1748338 13f79535-47bb-0310-9956-ffa450edef68
parent 42d65173

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ 


Changes with Apache 2.4.21



  *) mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck directive

     to opt-in previous behaviour (2.2) with CRLs verification when checking

     certificate(s) with no corresponding CRL.  [Yann Ylavic]



  *) mpm_event, mpm_worker: Fix computation of MinSpareThreads' lower bound

     according the number of listeners buckets.  [Yann Ylavic]

STATUS

+0 −12
Original line number Diff line number Diff line
@@ -114,18 +114,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck directive

     to opt-in previous behaviour (2.2) with CRLs verification when checking

     certificate(s) with no corresponding CRL.

     trunk patch: http://svn.apache.org/r1734561

                  http://svn.apache.org/r1734807

                  http://svn.apache.org/r1735159

                  http://svn.apache.org/r1735337

                  http://svn.apache.org/r1737265

     2.4.x patch: trunk works (modulo CHANGES) or

                  http://home.apache.org/~ylavic/patches/httpd-2.4.x-no_crl_for_cert_ok-v2.patch

     +1: ylavic, icing, minfrin





PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

docs/manual/mod/mod_ssl.xml

+30 −15
Original line number Diff line number Diff line
@@ -1210,10 +1210,12 @@ SSLCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl" 
<directivesynopsis>

<name>SSLCARevocationCheck</name>

<description>Enable CRL-based revocation checking</description>

<syntax>SSLCARevocationCheck chain|leaf|none</syntax>

<syntax>SSLCARevocationCheck chain|leaf|none <em>flag</em>s</syntax>

<default>SSLCARevocationCheck none</default>

<contextlist><context>server config</context>

<context>virtual host</context></contextlist>

<compatibility>Optional <em>flag</em>s available in httpd 2.5-dev or

later</compatibility>



<usage>

<p>
@@ -1224,25 +1226,38 @@ configured. When set to <code>chain</code> (recommended setting), 
CRL checks are applied to all certificates in the chain, while setting it to

<code>leaf</code> limits the checks to the end-entity cert.

</p>

<note>

<title>When set to <code>chain</code> or <code>leaf</code>,

CRLs <em>must</em> be available for successful validation</title>

<p>The available <em>flag</em>s are:</p>

<ul>

<li><code>no_crl_for_cert_ok</code>

    <p>

    Prior to version 2.3.15, CRL checking in mod_ssl also succeeded when

no CRL(s) were found in any of the locations configured with

<directive module="mod_ssl">SSLCARevocationFile</directive>

    no CRL(s) for the checked certificate(s) were found in any of the locations

    configured with <directive module="mod_ssl">SSLCARevocationFile</directive>

    or <directive module="mod_ssl">SSLCARevocationPath</directive>.

With the introduction of this directive, the behavior has been changed:

when checking is enabled, CRLs <em>must</em> be present for the validation

to succeed - otherwise it will fail with an

    </p>

    <p>

    With the introduction of <directive>SSLCARevocationFile</directive>,

    the behavior has been changed: by default with <code>chain</code> or

    <code>leaf</code>, CRLs <strong>must</strong> be present for the

    validation to succeed - otherwise it will fail with an

    <code>"unable to get certificate CRL"</code> error.

    </p>

</note>

    <p>

    The <em>flag</em> <code>no_crl_for_cert_ok</code> allows to restore

    previous behaviour.

    </p>

</li>

</ul>

<example><title>Example</title>

<highlight language="config">

SSLCARevocationCheck chain

</highlight>

</example>

<example><title>Compatibility with versions 2.2</title>

<highlight language="config">

SSLCARevocationCheck chain no_crl_for_cert_ok

</highlight>

</example>

</usage>

</directivesynopsis>

modules/ssl/mod_ssl.c

+2 −2
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ static const command_rec ssl_config_cmds[] = { 
    SSL_CMD_SRV(CARevocationFile, TAKE1,

                "SSL CA Certificate Revocation List (CRL) file "

                "('/path/to/file' - PEM encoded)")

    SSL_CMD_SRV(CARevocationCheck, TAKE1,

    SSL_CMD_SRV(CARevocationCheck, RAW_ARGS,

                "SSL CA Certificate Revocation List (CRL) checking mode")

    SSL_CMD_ALL(VerifyClient, TAKE1,

                "SSL Client verify type "
@@ -197,7 +197,7 @@ static const command_rec ssl_config_cmds[] = { 
    SSL_CMD_SRV(ProxyCARevocationFile, TAKE1,

                "SSL Proxy: CA Certificate Revocation List (CRL) file "

                "('/path/to/file' - PEM encoded)")

    SSL_CMD_SRV(ProxyCARevocationCheck, TAKE1,

    SSL_CMD_SRV(ProxyCARevocationCheck, RAW_ARGS,

                "SSL Proxy: CA Certificate Revocation List (CRL) checking mode")

    SSL_CMD_SRV(ProxyMachineCertificateFile, TAKE1,

               "SSL Proxy: file containing client certificates "

modules/ssl/ssl_engine_config.c

+27 −12
Original line number Diff line number Diff line
@@ -121,7 +121,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) 


    mctx->crl_path            = NULL;

    mctx->crl_file            = NULL;

    mctx->crl_check_mode      = SSL_CRLCHECK_UNSET;

    mctx->crl_check_mask      = UNSET;



    mctx->auth.ca_cert_path   = NULL;

    mctx->auth.ca_cert_file   = NULL;
@@ -271,7 +271,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, 


    cfgMerge(crl_path, NULL);

    cfgMerge(crl_file, NULL);

    cfgMerge(crl_check_mode, SSL_CRLCHECK_UNSET);

    cfgMergeInt(crl_check_mask);



    cfgMergeString(auth.ca_cert_path);

    cfgMergeString(auth.ca_cert_file);
@@ -1000,23 +1000,38 @@ const char *ssl_cmd_SSLCARevocationFile(cmd_parms *cmd, 


static const char *ssl_cmd_crlcheck_parse(cmd_parms *parms,

                                          const char *arg,

                                          ssl_crlcheck_t *mode)

                                          int *mask)

{

    if (strcEQ(arg, "none")) {

        *mode = SSL_CRLCHECK_NONE;

    const char *w;



    w = ap_getword_conf(parms->temp_pool, &arg);

    if (strcEQ(w, "none")) {

        *mask = SSL_CRLCHECK_NONE;

    }

    else if (strcEQ(arg, "leaf")) {

        *mode = SSL_CRLCHECK_LEAF;

    else if (strcEQ(w, "leaf")) {

        *mask = SSL_CRLCHECK_LEAF;

    }

    else if (strcEQ(arg, "chain")) {

        *mode = SSL_CRLCHECK_CHAIN;

    else if (strcEQ(w, "chain")) {

        *mask = SSL_CRLCHECK_CHAIN;

    }

    else {

        return apr_pstrcat(parms->temp_pool, parms->cmd->name,

                           ": Invalid argument '", arg, "'",

                           ": Invalid argument '", w, "'",

                           NULL);

    }



    while (*arg) {

        w = ap_getword_conf(parms->temp_pool, &arg);

        if (strcEQ(w, "no_crl_for_cert_ok")) {

            *mask |= SSL_CRLCHECK_NO_CRL_FOR_CERT_OK;

        }

        else {

            return apr_pstrcat(parms->temp_pool, parms->cmd->name,

                               ": Invalid argument '", w, "'",

                               NULL);

        }

    }



    return NULL;

}
@@ -1026,7 +1041,7 @@ const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *cmd, 
{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);



    return ssl_cmd_crlcheck_parse(cmd, arg, &sc->server->crl_check_mode);

    return ssl_cmd_crlcheck_parse(cmd, arg, &sc->server->crl_check_mask);

}



static const char *ssl_cmd_verify_parse(cmd_parms *parms,
@@ -1540,7 +1555,7 @@ const char *ssl_cmd_SSLProxyCARevocationCheck(cmd_parms *cmd, 
{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);



    return ssl_cmd_crlcheck_parse(cmd, arg, &sc->proxy->crl_check_mode);

    return ssl_cmd_crlcheck_parse(cmd, arg, &sc->proxy->crl_check_mask);

}



const char *ssl_cmd_SSLProxyMachineCertificateFile(cmd_parms *cmd,