Commit 9bb67392 authored by Cliff Woolley's avatar Cliff Woolley
Browse files

Forward port of changes in mod_ssl for Apache 1.3 up through mod_ssl 

version 2.8.7-1.3.23.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93564 13f79535-47bb-0310-9956-ffa450edef68
parent 41a2e097

mod_ssl.h

+5 −0
Changes for mod_ssl.h: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -513,6 +513,7 @@ typedef struct { 
    char           *szMutexFile;

    apr_lock_t     *pMutex;

    apr_array_header_t   *aRandSeed;

    int             nScoreboardSize; /* used for builtin random seed */

    ssl_ds_table   *tTmpKeys;

    void           *pTmpKeys[SSL_TKPIDX_MAX];

    ssl_ds_table   *tPublicCert;
@@ -675,7 +676,11 @@ int ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX *, server_rec *); 
int          ssl_callback_NewSessionCacheEntry(SSL *, SSL_SESSION *);

SSL_SESSION *ssl_callback_GetSessionCacheEntry(SSL *, unsigned char *, int, int *);

void         ssl_callback_DelSessionCacheEntry(SSL_CTX *, SSL_SESSION *);

#if SSL_LIBRARY_VERSION >= 0x00907000

void         ssl_callback_LogTracingState(const SSL *, int, int);

#else

void         ssl_callback_LogTracingState(SSL *, int, int);

#endif



/*  Session Cache Support  */

void         ssl_scache_init(server_rec *, apr_pool_t *);

ssl_engine_dh.c

+2 −2
Changes for ssl_engine_dh.c: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -225,10 +225,10 @@ $dhinfo = "\n\/\*\n$dhinfo\*\/\n\n"; 


#   generate C source from DH params

my $dhsource = '';

open(FP, "openssl dh -noout -C -in dh512.pem | indent | expand -8 |") || die;

open(FP, "openssl dh -noout -C -in dh512.pem | indent | expand |") || die;

$dhsource .= $_ while (<FP>);

close(FP);

open(FP, "openssl dh -noout -C -in dh1024.pem | indent | expand -8 |") || die;

open(FP, "openssl dh -noout -C -in dh1024.pem | indent | expand |") || die;

$dhsource .= $_ while (<FP>);

close(FP);

$dhsource =~ s|(DH\s+\*get_dh)|static $1|sg;

ssl_engine_init.c

+6 −1
Changes for ssl_engine_init.c: 6 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -221,7 +221,11 @@ int ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, 


    /*

     * Seed the Pseudo Random Number Generator (PRNG)

     *

     * Note: scoreboard size must be fetched at init time because

     * ap_calc_scoreboard_size() is not threadsafe

     */

    mc->nScoreboardSize = ap_calc_scoreboard_size();

    ssl_rand_seed(s, p, SSL_RSCTX_STARTUP, "Init: ");



    /*
@@ -713,7 +717,8 @@ void ssl_init_ConfigureServer(server_rec *s, apr_pool_t *p, SSLSrvConfigRec *sc) 
            }

            if (SSL_X509_getCN(p, sc->pPublicCert[i], &cp)) {

                if (apr_is_fnmatch(cp) &&

                    !apr_fnmatch(cp, s->server_hostname, FNM_PERIOD|FNM_CASE_BLIND)) {

                    apr_fnmatch(cp, s->server_hostname,

                                FNM_PERIOD|FNM_CASE_BLIND) == FNM_NOMATCH) {

                    ssl_log(s, SSL_LOG_WARN,

                        "Init: (%s) %s server certificate wildcard CommonName (CN) `%s' "

                        "does NOT match server name!?", cpVHostID,

ssl_engine_kernel.c

+5 −1
Changes for ssl_engine_kernel.c: 5 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -1587,7 +1587,11 @@ void ssl_callback_DelSessionCacheEntry( 
 * SSL handshake and does SSL record layer stuff. We use it to

 * trace OpenSSL's processing in out SSL logfile.

 */

#if SSL_LIBRARY_VERSION >= 0x00907000

void ssl_callback_LogTracingState(const SSL *ssl, int where, int rc)

#else

void ssl_callback_LogTracingState(SSL *ssl, int where, int rc)

#endif

{

    conn_rec *c;

    server_rec *s;
@@ -1597,7 +1601,7 @@ void ssl_callback_LogTracingState(SSL *ssl, int where, int rc) 
    /*

     * find corresponding server

     */

    if ((c = (conn_rec *)SSL_get_app_data(ssl)) == NULL)

    if ((c = (conn_rec *)SSL_get_app_data((SSL *)ssl)) == NULL)

        return;

    s = c->base_server;

    if ((sc = mySrvConfig(s)) == NULL)

ssl_engine_rand.c

+12 −8
Changes for ssl_engine_rand.c: 12 added lines, 8 removed lines.
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ int ssl_rand_seed(server_rec *s, apr_pool_t *p, ssl_rsctx_t nCtx, char *prefix) 
    int nReq, nDone;

    apr_file_t *fp;

    int i, n, l;

    int m;



    mc = myModConfig(s);

    nReq  = 0;
@@ -154,18 +155,21 @@ int ssl_rand_seed(server_rec *s, apr_pool_t *p, ssl_rsctx_t nCtx, char *prefix) 
                RAND_seed(stackdata+n, 128);

                nDone += 128;



#if XXX_SBENTROPY_SOLVED

                /*

                 * XXX: This is entirely borked, sizeof(scoreboard) < 1024

                 * seed in data extracted from the current scoreboard

                 *

                 * seed in an 1KB extract of the current scoreboard

                 * XXX: this assumes that the entire scoreboard is

                 * allocated in one big block of memory that begins at

                 * the location pointed to by ap_scoreboard_image->global

                 */

                if (ap_scoreboard_image != NULL) {

                    n = ssl_rand_choosenum(0,ap_calc_scoreboard_size()-1024-1);

                    RAND_seed(((unsigned char *)ap_scoreboard_image)+n, 1024);

                    nDone += 1024;

                if (ap_scoreboard_image != NULL && mc->nScoreboardSize > 16)

                {

                    m = ((mc->nScoreboardSize / 2) - 1);

                    n = ssl_rand_choosenum(0, m);

                    RAND_seed(

                        ((unsigned char *)ap_scoreboard_image->global)+n, m);

                    nDone += m;

                }

#endif

            }

        }

    }