Commit 6a5cd65a authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1684171 from trunk: 

mod_ssl: when SSLVerify is disabled (NONE), don't force a renegotiation if
the SSLVerifyDepth applied with the default/handshaken vhost differs from
the one applicable with the finally selected vhost.

Submitted by: ylavic
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1733476 13f79535-47bb-0310-9956-ffa450edef68
parent d763210c

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -78,6 +78,10 @@ Changes with Apache 2.4.19 
  *) prefork: Initialize the POD when running in ONE_PROCESS (or -X) mode to

     avoid a crash.  [Jan Kaluza, Yann Ylavic]



  *) mod_ssl: When SSLVerify is disabled (NONE), don't force a renegotiation if

     the SSLVerifyDepth applied with the default/handshaken vhost differs from

     the one applicable with the finally selected vhost.  [Yann Ylavic]



  *) mod_ssl: Add SSLOCSPProxyURL to add the possibility to do all queries

     to OCSP responders through a HTTP proxy. [Ruediger Pluem]

STATUS

+0 −6
Original line number Diff line number Diff line
@@ -112,12 +112,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_ssl: When SSLVerify is disabled (NONE), don't force a renegotiation if

     the SSLVerifyDepth applied with the default/handshaken vhost differs from

     the one applicable with the finally selected vhost.

     trunk patch: http://svn.apache.org/r1684171

     2.4.x patch: http://home.apache.org/~ylavic/patches/httpd-2.4.x-SSLVerify_NONE_no_reneg_Depth.patch

     +1: ylavic, icing, jim





PATCHES PROPOSED TO BACKPORT FROM TRUNK:

modules/ssl/ssl_engine_kernel.c

+30 −26
Original line number Diff line number Diff line
@@ -668,31 +668,6 @@ int ssl_hook_Access(request_rec *r) 
        }

    }



    /*

     * override of SSLVerifyDepth

     *

     * The depth checks are handled by us manually inside the verify callback

     * function and not by OpenSSL internally (and our function is aware of

     * both the per-server and per-directory contexts). So we cannot ask

     * OpenSSL about the currently verify depth. Instead we remember it in our

     * SSLConnRec attached to the SSL* of OpenSSL.  We've to force the

     * renegotiation if the reconfigured/new verify depth is less than the

     * currently active/remembered verify depth (because this means more

     * restriction on the certificate chain).

     */

    n = (sslconn->verify_depth != UNSET) ?

        sslconn->verify_depth :

        (mySrvConfig(handshakeserver))->server->auth.verify_depth;

    /* determine the new depth */

    sslconn->verify_depth = (dc->nVerifyDepth != UNSET) ?

                            dc->nVerifyDepth : sc->server->auth.verify_depth;

    if (sslconn->verify_depth < n) {

        renegotiate = TRUE;

        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02254)

                     "Reduced client verification depth will force "

                     "renegotiation");

    }



    /*

     * override of SSLVerifyClient

     *
@@ -769,6 +744,35 @@ int ssl_hook_Access(request_rec *r) 
                              "%srenegotiation",

                              renegotiate_quick ? "quick " : "");

            }

            else if (verify != SSL_VERIFY_NONE) {

                /*

                 * override of SSLVerifyDepth

                 *

                 * The depth checks are handled by us manually inside the

                 * verify callback function and not by OpenSSL internally

                 * (and our function is aware of both the per-server and

                 * per-directory contexts). So we cannot ask OpenSSL about

                 * the currently verify depth. Instead we remember it in our

                 * SSLConnRec attached to the SSL* of OpenSSL.  We've to force

                 * the renegotiation if the reconfigured/new verify depth is

                 * less than the currently active/remembered verify depth

                 * (because this means more restriction on the certificate

                 * chain).

                 */

                n = (sslconn->verify_depth != UNSET)

                    ? sslconn->verify_depth

                    : hssc->server->auth.verify_depth;

                /* determine the new depth */

                sslconn->verify_depth = (dc->nVerifyDepth != UNSET)

                                        ? dc->nVerifyDepth

                                        : sc->server->auth.verify_depth;

                if (sslconn->verify_depth < n) {

                    renegotiate = TRUE;

                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02254)

                                  "Reduced client verification depth will "

                                  "force renegotiation");

                }

            }

        }

        /* If we're handling a request for a vhost other than the default one,

         * then we need to make sure that client authentication is properly