Commit 9dda72f0 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1708107, r1709587, r1709602, r1709995, r1710231, r1710419, r1710572,... 

Merge r1708107, r1709587, r1709602, r1709995, r1710231, r1710419, r1710572, r1710583, r1715023 from trunk:

mod_ssl: performing protocol switch directly after ALPN selection, mod_http2: connection hook inits network filters to force TLS handshake, reads input only if H2Direct explicitly enabled, changes H2Direct default to off even for cleartext connections

new ap_is_allowed_protocol() for testing configured protocols, added H2Upgrade on/off directive, changed H2Direct default back to on when h2c is in Protocols

moved ssl handshake trigger from mod_http2 to new process_connection hook in mod_ssl

mod_ssl: check request-server for TLS settings compatible to handshake server, allow request if equal, renegotiation checks: remember last used cipher_suite for optimizations, deny any regnegotiation in presence of master connection

announce protocol choices on first request

fixing compilation issue for older platform

disabling protocol upgrades on slave connections

first request on master connection only reports more preferred protocols in Upgrade header

mod_ssl: follow up to r1709602.
Fix "HTTP spoken on HTTPS port" broken by the SSL handshake trigger moved to
process_connection hook (r1709602) along with H2Direct speculative read.

Submitted by: icing, ylavic
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1715255 13f79535-47bb-0310-9956-ffa450edef68
parents 7452a4fc 6ccb1c2a

STATUS

+0 −21
Original line number Diff line number Diff line
@@ -111,27 +111,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) core/mod_ssl: 

     - master conn_rec* addition to conn_rec

     - minor mmn bump

     - improved ALPN and Upgrade handling

     - allowing requests for servers whose TLS configuration is compatible

       to the SNI server ones

     - disabling TLS renegotiation for slave connections

     changes are necessary for update modules/http2

     trunk patch: http://svn.apache.org/r1708107

                  http://svn.apache.org/r1709587

                  http://svn.apache.org/r1709602

                  http://svn.apache.org/r1709995

                  http://svn.apache.org/r1710231

                  http://svn.apache.org/r1710419

                  http://svn.apache.org/r1710572

                  http://svn.apache.org/r1710583

                  http://svn.apache.org/r1715023

                  + manual addition of "conn_rec *master;"

     branch mergeable to 2.4.x: ^/httpd/httpd/branches/2.4.17-protocols-changes

     +1: icing, ylavic, jim







PATCHES PROPOSED TO BACKPORT FROM TRUNK:

include/ap_mmn.h

+2 −1
Original line number Diff line number Diff line
@@ -456,6 +456,7 @@ 
 *                          ap_select_protocol(), ap_switch_protocol(),

 *                          ap_get_protocol(). Add HTTP_MISDIRECTED_REQUEST.

 *                          Added ap_parse_token_list_strict() to httpd.h

 * 20120211.52 (2.4.17-dev) Add master conn_rec* member in conn_rec.

 */



#define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
@@ -463,7 +464,7 @@ 
#ifndef MODULE_MAGIC_NUMBER_MAJOR

#define MODULE_MAGIC_NUMBER_MAJOR 20120211

#endif

#define MODULE_MAGIC_NUMBER_MINOR 51                   /* 0...n */

#define MODULE_MAGIC_NUMBER_MINOR 52                   /* 0...n */



/**

 * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_protocol.h

+38 −1
Original line number Diff line number Diff line
@@ -783,6 +783,26 @@ AP_DECLARE_HOOK(int,protocol_switch,(conn_rec *c, request_rec *r, 
 */

AP_DECLARE_HOOK(const char *,protocol_get,(const conn_rec *c))



/**

 * Get the protocols that the connection and optional request may

 * upgrade to - besides the protocol currently active on the connection. These

 * values may be used to announce to a client what choices it has.

 *

 * If report_all == 0, only protocols more preferable than the one currently

 * being used, are reported. Otherwise, all available protocols beside the

 * current one are being reported.

 *

 * @param c The current connection

 * @param r The current request or NULL

 * @param s The server/virtual host selected or NULL

 * @param report_all include also protocols less preferred than the current one

 * @param pupgrades on return, possible protocols to upgrade to in descending order 

 *                 of preference. Maybe NULL if none are available.    

 */

AP_DECLARE(apr_status_t) ap_get_protocol_upgrades(conn_rec *c, request_rec *r, 

                                                  server_rec *s, int report_all, 

                                                  const apr_array_header_t **pupgrades);

                                                  

/**

 * Select a protocol for the given connection and optional request. Will return

 * the protocol identifier selected which may be the protocol already in place
@@ -833,6 +853,23 @@ AP_DECLARE(apr_status_t) ap_switch_protocol(conn_rec *c, request_rec *r, 
 */

AP_DECLARE(const char *) ap_get_protocol(conn_rec *c);



/**

 * Check if the given protocol is an allowed choice on the given

 * combination of connection, request and server. 

 *

 * When server is NULL, it is taken from request_rec, unless

 * request_rec is NULL. Then it is taken from the connection base

 * server.

 *

 * @param c The current connection

 * @param r The current request or NULL

 * @param s The server/virtual host selected or NULL

 * @param protocol the protocol to switch to

 * @return != 0 iff protocol is allowed

 */

AP_DECLARE(int) ap_is_allowed_protocol(conn_rec *c, request_rec *r,

                                       server_rec *s, const char *protocol);



/** @see ap_bucket_type_error */

typedef struct ap_bucket_error ap_bucket_error;

include/httpd.h

+3 −0
Original line number Diff line number Diff line
@@ -1167,6 +1167,9 @@ struct conn_rec { 
#if APR_HAS_THREADS

    apr_thread_t *current_thread;

#endif



    /** The "real" master connection. NULL if I am the master. */

    conn_rec *master;

};



/**

modules/ssl/mod_ssl.c

+28 −2
Original line number Diff line number Diff line
@@ -377,6 +377,7 @@ static int ssl_hook_pre_config(apr_pool_t *pconf, 
static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)

{

    SSLConnRec *sslconn = myConnConfig(c);

    SSLSrvConfigRec *sc;



    if (sslconn) {

        return sslconn;
@@ -386,6 +387,8 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c) 


    sslconn->server = c->base_server;

    sslconn->verify_depth = UNSET;

    sc = mySrvConfig(c->base_server);

    sslconn->cipher_suite = sc->server->auth.cipher_suite;



    myConnConfigSet(c, sslconn);
@@ -525,6 +528,7 @@ static apr_port_t ssl_hook_default_port(const request_rec *r) 


static int ssl_hook_pre_connection(conn_rec *c, void *csd)

{



    SSLSrvConfigRec *sc;

    SSLConnRec *sslconn = myConnConfig(c);
@@ -537,7 +541,7 @@ static int ssl_hook_pre_connection(conn_rec *c, void *csd) 
    /*

     * Immediately stop processing if SSL is disabled for this connection

     */

    if (!(sc && (sc->enabled == SSL_ENABLED_TRUE ||

    if (c->master || !(sc && (sc->enabled == SSL_ENABLED_TRUE ||

                              (sslconn && sslconn->is_proxy))))

    {

        return DECLINED;
@@ -566,6 +570,26 @@ static int ssl_hook_pre_connection(conn_rec *c, void *csd) 
    return ssl_init_ssl_connection(c, NULL);

}



static int ssl_hook_process_connection(conn_rec* c)

{

    SSLConnRec *sslconn = myConnConfig(c);



    if (sslconn && !sslconn->disabled) {

        /* On an active SSL connection, let the input filters initialize

         * themselves which triggers the handshake, which again triggers

         * all kinds of useful things such as SNI and ALPN.

         */

        apr_bucket_brigade* temp;



        temp = apr_brigade_create(c->pool, c->bucket_alloc);

        ap_get_brigade(c->input_filters, temp,

                       AP_MODE_INIT, APR_BLOCK_READ, 0);

        apr_brigade_destroy(temp);

    }

    

    return DECLINED;

}



/*

 *  the module registration phase

 */
@@ -579,6 +603,8 @@ static void ssl_register_hooks(apr_pool_t *p) 
    ssl_io_filter_register(p);



    ap_hook_pre_connection(ssl_hook_pre_connection,NULL,NULL, APR_HOOK_MIDDLE);

    ap_hook_process_connection(ssl_hook_process_connection, 

                                                   NULL, NULL, APR_HOOK_MIDDLE);

    ap_hook_test_config   (ssl_hook_ConfigTest,    NULL,NULL, APR_HOOK_MIDDLE);

    ap_hook_post_config   (ssl_init_Module,        NULL,NULL, APR_HOOK_MIDDLE);

    ap_hook_http_scheme   (ssl_hook_http_scheme,   NULL,NULL, APR_HOOK_MIDDLE);