Commit 9ca4188e authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1726881, r1727111 from trunk: 

* Introduce SSLOCSPProxyURL in order to do OCSP requests via a HTTP proxy.
  Documentation to follow.


* Change entry and documentation for SSLOCSPProxyURL
Submitted by: rpluem
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1733066 13f79535-47bb-0310-9956-ffa450edef68
parent 71542eb8

CHANGES

+3 −0
Original line number Diff line number Diff line
@@ -2,6 +2,9 @@ 


Changes with Apache 2.4.19



  *) mod_ssl: Add SSLOCSPProxyURL to add the possibility to do all queries

     to OCSP responders through a HTTP proxy. [Ruediger Pluem]



  *) mod_cache_socache: Fix a possible cached entity body corruption when it

     is received from an origin server in multiple batches and forwarded by

     mod_proxy.  [Yann Ylavic]

docs/manual/mod/mod_ssl.xml

+14 −0
Original line number Diff line number Diff line
@@ -2349,6 +2349,20 @@ Responder), this option should be turned <code>off</code>.</p> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLOCSPProxyURL</name>

<description>Proxy URL to use for OCSP requests</description>

<syntax>SSLOCSPProxyURL <em>url</em></syntax>

<contextlist><context>server config</context>

<context>virtual host</context></contextlist>

<compatibility>Available in httpd 2.5 and later</compatibility>



<usage>

<p>This option allows to set the URL of a HTTP proxy that should be used for

all queries to OCSP responders.</p>

</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLInsecureRenegotiation</name>

<description>Option to enable support for insecure renegotiation</description>

modules/ssl/mod_ssl.c

+2 −0
Original line number Diff line number Diff line
@@ -243,6 +243,8 @@ static const command_rec ssl_config_cmds[] = { 
                "OCSP responder query timeout")

    SSL_CMD_SRV(OCSPUseRequestNonce, FLAG,

                "Whether OCSP queries use a nonce or not ('on', 'off')")

    SSL_CMD_SRV(OCSPProxyURL, TAKE1,

                "Proxy URL to use for OCSP requests")



#ifdef HAVE_OCSP_STAPLING

    /*

modules/ssl/ssl_engine_config.c

+14 −0
Original line number Diff line number Diff line
@@ -136,6 +136,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) 
    mctx->ocsp_resp_maxage    = UNSET;

    mctx->ocsp_responder_timeout = UNSET;

    mctx->ocsp_use_request_nonce = UNSET;

    mctx->proxy_uri              = NULL;



#ifdef HAVE_OCSP_STAPLING

    mctx->stapling_enabled           = UNSET;
@@ -285,6 +286,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, 
    cfgMergeInt(ocsp_resp_maxage);

    cfgMergeInt(ocsp_responder_timeout);

    cfgMergeBool(ocsp_use_request_nonce);

    cfgMerge(proxy_uri, NULL);

#ifdef HAVE_OCSP_STAPLING

    cfgMergeBool(stapling_enabled);

    cfgMergeInt(stapling_resptime_skew);
@@ -1670,6 +1672,18 @@ const char *ssl_cmd_SSLOCSPUseRequestNonce(cmd_parms *cmd, void *dcfg, int flag) 
    return NULL;

}



const char *ssl_cmd_SSLOCSPProxyURL(cmd_parms *cmd, void *dcfg,

                                    const char *arg)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);

    sc->server->proxy_uri = apr_palloc(cmd->pool, sizeof(apr_uri_t));

    if (apr_uri_parse(cmd->pool, arg, sc->server->proxy_uri) != APR_SUCCESS) {

        return apr_psprintf(cmd->pool,

                            "SSLOCSPProxyURL: Cannot parse URL %s", arg);

    }

    return NULL;

}



const char *ssl_cmd_SSLProxyCheckPeerExpire(cmd_parms *cmd, void *dcfg, int flag)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);

modules/ssl/ssl_private.h

+2 −0
Original line number Diff line number Diff line
@@ -638,6 +638,7 @@ typedef struct { 
    long ocsp_resp_maxage;

    apr_interval_time_t ocsp_responder_timeout;

    BOOL ocsp_use_request_nonce;

    apr_uri_t *proxy_uri;



#ifdef HAVE_SSL_CONF_CMD

    SSL_CONF_CTX *ssl_ctx_config; /* Configuration context */
@@ -764,6 +765,7 @@ const char *ssl_cmd_SSLOCSPResponseMaxAge(cmd_parms *cmd, void *dcfg, const char 
const char *ssl_cmd_SSLOCSPResponderTimeout(cmd_parms *cmd, void *dcfg, const char *arg);

const char *ssl_cmd_SSLOCSPUseRequestNonce(cmd_parms *cmd, void *dcfg, int flag);

const char *ssl_cmd_SSLOCSPEnable(cmd_parms *cmd, void *dcfg, int flag);

const char *ssl_cmd_SSLOCSPProxyURL(cmd_parms *cmd, void *dcfg, const char *arg);



#ifdef HAVE_SSL_CONF_CMD

const char *ssl_cmd_SSLOpenSSLConfCmd(cmd_parms *cmd, void *dcfg, const char *arg1, const char *arg2);