Commit 9edfa9cc authored by Kaspar Brand's avatar Kaspar Brand
Browse files

mod_ssl: Add new directive SSLCompression to disable 

TLS-level compression.

PR 53219.

Backport of r1345319 and r1348656 from trunk.

Submitted by: Bjoern Jacke <bjoern j3e de>, sf
Reviewed by: rjung, kbrand
Backported by: covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1395231 13f79535-47bb-0310-9956-ffa450edef68
parent e949e666

CHANGES

+2 −1
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.24





 *) mod_ssl: Add new directive SSLCompression to disable TLS-level

    compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]



Changes with Apache 2.2.23

docs/manual/mod/mod_ssl.xml

+16 −0
Original line number Diff line number Diff line
@@ -1901,4 +1901,20 @@ supported for a given SSL connection.</p> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLCompression</name>

<description>Disallow compression on the SSL level</description>

<syntax>SSLCompression on|off</syntax>

<default>SSLCompression on</default>

<contextlist><context>server config</context>

<context>virtual host</context></contextlist>

<compatibility>Available in httpd 2.2.24 and later, if using OpenSSL 0.9.8 or later;

virtual host scope available if using OpenSSL 1.0.0 or later</compatibility>



<usage>

<p>This directive allows to disable compression on the SSL level.</p>

</usage>

</directivesynopsis>





</modulesynopsis>

modules/ssl/mod_ssl.c

+3 −0
Original line number Diff line number Diff line
@@ -156,6 +156,9 @@ static const command_rec ssl_config_cmds[] = { 
                "('[+-][" SSL_PROTOCOLS "] ...' - see manual)")

    SSL_CMD_SRV(HonorCipherOrder, FLAG,

                "Use the server's cipher ordering preference")

    SSL_CMD_SRV(Compression, FLAG,

                "Enable SSL level compression"

                "(`on', `off')")

    SSL_CMD_SRV(InsecureRenegotiation, FLAG,

                "Enable support for insecure renegotiation")

    SSL_CMD_ALL(UserName, TAKE1,

modules/ssl/ssl_engine_config.c

+23 −0
Original line number Diff line number Diff line
@@ -180,6 +180,9 @@ static SSLSrvConfigRec *ssl_config_server_new(apr_pool_t *p) 
#ifdef HAVE_FIPS

    sc->fips                   = UNSET;

#endif

#ifndef OPENSSL_NO_COMP

    sc->compression            = UNSET;

#endif



    modssl_ctx_init_proxy(sc, p);
@@ -278,6 +281,9 @@ void *ssl_config_server_merge(apr_pool_t *p, void *basev, void *addv) 
#ifdef HAVE_FIPS

    cfgMergeBool(fips);

#endif

#ifndef OPENSSL_NO_COMP

    cfgMergeBool(compression);

#endif



    modssl_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
@@ -711,6 +717,23 @@ static const char *ssl_cmd_check_file(cmd_parms *parms, 


}



const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag)

{

#if !defined(OPENSSL_NO_COMP)

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);

#ifndef SSL_OP_NO_COMPRESSION

    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);

    if (err)

        return "This version of openssl does not support configuring "

               "compression within <VirtualHost> sections.";

#endif

    sc->compression = flag ? TRUE : FALSE;

    return NULL;

#else

    return "Setting Compression mode unsupported; not implemented by the SSL library";

#endif

}



const char *ssl_cmd_SSLHonorCipherOrder(cmd_parms *cmd, void *dcfg, int flag)

{

#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE

modules/ssl/ssl_engine_init.c

+12 −0
Original line number Diff line number Diff line
@@ -533,6 +533,18 @@ static void ssl_init_ctx_protocol(server_rec *s, 
    }

#endif





#ifndef OPENSSL_NO_COMP

    if (sc->compression == FALSE) {

#ifdef SSL_OP_NO_COMPRESSION

        /* OpenSSL >= 1.0 only */

        SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);

#elif OPENSSL_VERSION_NUMBER >= 0x00908000L

        sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());

#endif

    }

#endif



#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION

    if (sc->insecure_reneg == TRUE) {

        SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);