Commit 6ee9d597 authored by Joe Orton's avatar Joe Orton
Browse files

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): 

  Disable AUTO_RETRY mode for OpenSSL 1.1.1, which fixes
  post-handshake authentication.
  (ssl_init_proxy_certs): Fix proxy client cert support with
  TLSv1.3, which is now crippled by default.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840710 13f79535-47bb-0310-9956-ffa450edef68
parent 6f7f330a

modules/ssl/ssl_engine_init.c

+14 −0
Changes for modules/ssl/ssl_engine_init.c: 14 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -786,6 +786,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, 
        SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);

#endif



#if OPENSSL_VERSION_NUMBER >= 0x1010100fL

    /* For OpenSSL >=1.1.1, disable auto-retry mode so it's possible

     * to consume handshake records without blocking for app-data.

     * https://github.com/openssl/openssl/issues/7178 */

    SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);

#endif

    

    return APR_SUCCESS;

}
@@ -1551,6 +1558,13 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, 
    X509_STORE_CTX *sctx;

    X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);



#if OPENSSL_VERSION_NUMBER >= 0x1010100fL

    /* For OpenSSL >=1.1.1, turn on client cert support which is

     * otherwise turned off by default (by design).

     * https://github.com/openssl/openssl/issues/6933 */

    SSL_CTX_set_post_handshake_auth(mctx->ssl_ctx, 1);

#endif

    

    SSL_CTX_set_client_cert_cb(mctx->ssl_ctx,

                               ssl_callback_proxy_cert);