Commit 94f5d97f authored by Jeff Trawick's avatar Jeff Trawick
Browse files

Merge r1679032, r1679192, and r1680276 from trunk: 

r1679032:

mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing
the OCSP response for a different certificate.  mod_ssl has an additional
global mutex, "ssl-stapling-refresh".

Not mentioned in CHANGES:

Stapling no longer uses a mutex when using a stapling cache
implementation which doesn't require it.  (A further, unrelated
code change to mod_ssl is required to allow the use of memcache 
as a stapling cache, and I haven't tested with distcache; thus
it isn't clear if this helps in practice yet.)

r1679192:

Fix regression in check for cached response
(Essentially) Submitted by: ylavic

r1680276:

OCSP stapling: slight simplification to some internal interfaces,
add a few comments and sanity checks

Submitted by: trawick (with assist from ylavic)
Reviewed by: jim, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1681320 13f79535-47bb-0310-9956-ffa450edef68
parent ff375103

CHANGES

+4 −0
Changes for CHANGES: 4 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -12,6 +12,10 @@ Changes with Apache 2.4.13 
     calls r:wsupgrade() can cause a child process crash. 

     [Edward Lu <Chaosed0 gmail.com>]



  *) mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing

     the OCSP response for a different certificate.  mod_ssl has an additional

     global mutex, "ssl-stapling-refresh".  [Jeff Trawick]



  *) mod_authz_dbm: Fix crashes when "dbm-file-group" is used and

     authz modules were loaded in the "wrong" order.  [Joe Orton]

STATUS

+0 −6
Changes for STATUS: 0 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -105,12 +105,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) OCSP stapling: Don't block initial handshakes while refreshing the OCSP 

     response for a different certificate plus additional minor changes

     trunk patch: r1679032 + r1679192 + r1680276

     2.4.x patch: trunk works with the usual CHANGES manipulation, or grab

     http://people.apache.org/~trawick/OCSP-stapling-1679032-1679192-1680276.txt

     +1: trawick, jim, jorton



PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

docs/manual/mod/mod_ssl.xml

+8 −4
Changes for docs/manual/mod/mod_ssl.xml: 8 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -2374,6 +2374,14 @@ stated goal of "saving roundtrips and resources" - see also 
<a href="http://www.ietf.org/rfc/rfc6961.txt">RFC 6961</a>

(TLS Multiple Certificate Status Extension).

</p>



<p>When OCSP stapling is enabled, the <code>ssl-stapling</code> mutex is used

to control access to the OCSP stapling cache in order to prevent corruption,

and the <code>sss-stapling-refresh</code> mutex is used to control refreshes

of OCSP responses.  These mutexes can be configured using the

<directive module="core">Mutex</directive> directive.

</p>



</usage>

</directivesynopsis>
@@ -2391,10 +2399,6 @@ is enabled. Configuration of a cache is mandatory for OCSP stapling. 
With the exception of <code>none</code> and <code>nonenotnull</code>,

the same storage types are supported as with

<directive module="mod_ssl">SSLSessionCache</directive>.</p>



<p>The <code>ssl-stapling</code> mutex is used to serialize access to the

OCSP stapling cache to prevent corruption.  This mutex can be configured

using the <directive module="core">Mutex</directive> directive.</p>

</usage>

</directivesynopsis>

modules/ssl/mod_ssl.c

+4 −1
Changes for modules/ssl/mod_ssl.c: 4 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -355,7 +355,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf, 
    /* Register mutex type names so they can be configured with Mutex */

    ap_mutex_register(pconf, SSL_CACHE_MUTEX_TYPE, NULL, APR_LOCK_DEFAULT, 0);

#ifdef HAVE_OCSP_STAPLING

    ap_mutex_register(pconf, SSL_STAPLING_MUTEX_TYPE, NULL, APR_LOCK_DEFAULT, 0);

    ap_mutex_register(pconf, SSL_STAPLING_CACHE_MUTEX_TYPE, NULL,

                      APR_LOCK_DEFAULT, 0);

    ap_mutex_register(pconf, SSL_STAPLING_REFRESH_MUTEX_TYPE, NULL,

                      APR_LOCK_DEFAULT, 0);

#endif



    return OK;

modules/ssl/ssl_engine_config.c

+2 −1
Changes for modules/ssl/ssl_engine_config.c: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -71,7 +71,8 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s) 
#endif

#ifdef HAVE_OCSP_STAPLING

    mc->stapling_cache         = NULL;

    mc->stapling_mutex         = NULL;

    mc->stapling_cache_mutex   = NULL;

    mc->stapling_refresh_mutex = NULL;

#endif



    apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,