Commit 668aaab3 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1781575, r1781577, r1781580, r1781687, r1783305 from trunk: 

Add Configuration for trusted OCSP responder certificates
Fix for PR 46037


Add back the file I removed in r1781575.


Add missing documentation for r1781575
Fix for PR 46037


Remove unused variable

Fix OpenSSL 1.1.0 breakage in r1781575; BIO_s_file_internal() is gone.



Submitted by: jfclere, druggeri, wrowe
Reviewed by: jfclere, jim, ylavic
Merge r1788430 from trunk:

mod_ssl: follow up to r1781575
Fix SSLOCSPNoVerify merging, and while at it capitalize Verify as suggested
by wrowe.


Submitted by: ylavic
Reviewed by: jfclere, jim, ylavic


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1789970 13f79535-47bb-0310-9956-ffa450edef68
parent 5dda6dd3

STATUS

+0 −12
Original line number Diff line number Diff line
@@ -118,18 +118,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_ssl: backport fix for PR 46037

     trunk patch: http://svn.apache.org/r1781575

                  http://svn.apache.org/r1781577

                  http://svn.apache.org/r1781580

                  http://svn.apache.org/r1781687

                  http://svn.apache.org/r1783305

     2.4.x patch: http://people.apache.org/~jfclere/patches/patch.46037.txt

     +1: jfclere, jim

     wrowe asks: Can we capitalize Verify in SSLOCSPNoverify to keep

                 with conventions?

     ylavic: +1 with http://svn.apache.org/r1788430, fixing the merge of

             SSLOCSPNoverify and capitalizing as suggested above.



PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

docs/manual/mod/mod_ssl.xml

+31 −0
Original line number Diff line number Diff line
@@ -2414,6 +2414,37 @@ Responder), this option should be turned <code>off</code>.</p> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLOCSPNoverify</name>

<description>skip the OCSP responder certificates verification</description>

<syntax>SSLOCSPNoverify <em>On/Off</em></syntax>

<default>SSLOCSPNoverify Off</default>

<contextlist><context>server config</context>

<context>virtual host</context></contextlist>

<compatibility>Available in httpd 2.5 and later, if using OpenSSL 0.9.7 or later</compatibility>

<usage>

<p>Skip the OCSP responder certificates verification, mostly useful when

testing an OCSP server.</p>

</usage>

</directivesynopsis>





<directivesynopsis>

<name>SSLOCSPResponderCertificateFile</name>

<description>Set of trusted PEM encoded OCSP responder certificates</description>

<syntax>SSLOCSPResponderCertificateFile <em>file</em></syntax>

<contextlist><context>server config</context>

<context>virtual host</context></contextlist>

<compatibility>Available in httpd 2.5 and later, if using OpenSSL 0.9.7 or later</compatibility>

<usage>

<p>This supplies a list of trusted OCSP responder certificates to be used

during OCSP responder certificate validation. The supplied certificates are

implicitly trusted without any further validation. This is typically used

where the OCSP responder certificate is self signed or omitted from the OCSP

response.</p>

</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLOCSPProxyURL</name>

<description>Proxy URL to use for OCSP requests</description>

modules/ssl/mod_ssl.c

+8 −0
Original line number Diff line number Diff line
@@ -254,6 +254,14 @@ static const command_rec ssl_config_cmds[] = { 
    SSL_CMD_SRV(OCSPProxyURL, TAKE1,

                "Proxy URL to use for OCSP requests")



/* Define OCSP Responder Certificate Verification Directive */

    SSL_CMD_SRV(OCSPNoVerify, FLAG,

                "Do not verify OCSP Responder certificate ('on', 'off')")

/* Define OCSP Responder File Configuration Directive */

    SSL_CMD_SRV(OCSPResponderCertificateFile, TAKE1,

               "Trusted OCSP responder certificates"

               "(`/path/to/file' - PEM encoded certificates)")



#ifdef HAVE_OCSP_STAPLING

    /*

     * OCSP Stapling options

modules/ssl/ssl_engine_config.c

+38 −0
Original line number Diff line number Diff line
@@ -146,6 +146,13 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) 
    mctx->ocsp_use_request_nonce = UNSET;

    mctx->proxy_uri              = NULL;



/* Set OCSP Responder Certificate Verification variable */

    mctx->ocsp_noverify       = UNSET;

/* Set OCSP Responder File variables */

    mctx->ocsp_verify_flags   = 0;

    mctx->ocsp_certs_file     = NULL;

    mctx->ocsp_certs          = NULL;



#ifdef HAVE_OCSP_STAPLING

    mctx->stapling_enabled           = UNSET;

    mctx->stapling_resptime_skew     = UNSET;
@@ -298,6 +305,12 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, 
    cfgMergeInt(ocsp_responder_timeout);

    cfgMergeBool(ocsp_use_request_nonce);

    cfgMerge(proxy_uri, NULL);



/* Set OCSP Responder Certificate Verification directive */

    cfgMergeBool(ocsp_noverify);  

/* Set OCSP Responder File directive for importing */

    cfgMerge(ocsp_certs_file, NULL);



#ifdef HAVE_OCSP_STAPLING

    cfgMergeBool(stapling_enabled);

    cfgMergeInt(stapling_resptime_skew);
@@ -1710,6 +1723,16 @@ const char *ssl_cmd_SSLOCSPProxyURL(cmd_parms *cmd, void *dcfg, 
    return NULL;

}



/* Set OCSP responder certificate verification directive */

const char *ssl_cmd_SSLOCSPNoVerify(cmd_parms *cmd, void *dcfg, int flag)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);



    sc->server->ocsp_noverify = flag ? TRUE : FALSE;



    return NULL;

}



const char *ssl_cmd_SSLProxyCheckPeerExpire(cmd_parms *cmd, void *dcfg, int flag)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
@@ -1961,6 +1984,21 @@ const char *ssl_cmd_SSLSRPUnknownUserSeed(cmd_parms *cmd, void *dcfg, 


#endif /* HAVE_SRP */



/* OCSP Responder File Function to read in value */

const char *ssl_cmd_SSLOCSPResponderCertificateFile(cmd_parms *cmd, void *dcfg, 

					   const char *arg)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);

    const char *err;



    if ((err = ssl_cmd_check_file(cmd, &arg))) {

        return err;

    }



    sc->server->ocsp_certs_file = arg;

    return NULL;

}



void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s)

{

    apr_file_t *out = NULL;

modules/ssl/ssl_engine_init.c

+12 −0
Original line number Diff line number Diff line
@@ -1709,6 +1709,12 @@ apr_status_t ssl_init_ConfigureServer(server_rec *s, 
            != APR_SUCCESS) {

            return rv;

        }



	/* Initialize OCSP Responder certificate if OCSP enabled */

	#ifndef OPENSSL_NO_OCSP

        	ssl_init_ocsp_certificates(s, sc->server);

	#endif



    }



    if (sc->proxy_enabled) {
@@ -1997,6 +2003,12 @@ apr_status_t ssl_init_ModuleKill(void *data) 
        ssl_init_ctx_cleanup_proxy(sc->proxy);



        ssl_init_ctx_cleanup(sc->server);



	/* Not Sure but possibly clear X509 trusted cert file */

	#ifndef OPENSSL_NO_OCSP

		sk_X509_pop_free(sc->server->ocsp_certs, X509_free);

	#endif



    }



#if OPENSSL_VERSION_NUMBER >= 0x10100000L