merge of 1708107,1709587,1709602,1709995,1710231,1710419,1710572,1710583 from... (9f13ceb2) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

include/ap_mmn.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -456,6 +456,7 @@
		* ap_select_protocol(), ap_switch_protocol(),
		* ap_get_protocol(). Add HTTP_MISDIRECTED_REQUEST.
		* Added ap_parse_token_list_strict() to httpd.h
		* 20120211.52 (2.4.17-dev) Add master conn_rec* member in conn_rec.
		*/

		#define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
		@@ -463,7 +464,7 @@
		#ifndef MODULE_MAGIC_NUMBER_MAJOR
		#define MODULE_MAGIC_NUMBER_MAJOR 20120211
		#endif
		#define MODULE_MAGIC_NUMBER_MINOR 51 /* 0...n */
		#define MODULE_MAGIC_NUMBER_MINOR 52 /* 0...n */

		/**
		* Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_protocol.h

+38 −1

Original line number	Diff line number	Diff line
		@@ -783,6 +783,26 @@ AP_DECLARE_HOOK(int,protocol_switch,(conn_rec c, request_rec r,
		*/
		AP_DECLARE_HOOK(const char ,protocol_get,(const conn_rec c))

		/**
		* Get the protocols that the connection and optional request may
		* upgrade to - besides the protocol currently active on the connection. These
		* values may be used to announce to a client what choices it has.
		*
		* If report_all == 0, only protocols more preferable than the one currently
		* being used, are reported. Otherwise, all available protocols beside the
		* current one are being reported.
		*
		* @param c The current connection
		* @param r The current request or NULL
		* @param s The server/virtual host selected or NULL
		* @param report_all include also protocols less preferred than the current one
		* @param pupgrades on return, possible protocols to upgrade to in descending order
		* of preference. Maybe NULL if none are available.
		*/
		AP_DECLARE(apr_status_t) ap_get_protocol_upgrades(conn_rec c, request_rec r,
		server_rec *s, int report_all,
		const apr_array_header_t **pupgrades);

		/**
		* Select a protocol for the given connection and optional request. Will return
		* the protocol identifier selected which may be the protocol already in place
		@@ -833,6 +853,23 @@ AP_DECLARE(apr_status_t) ap_switch_protocol(conn_rec c, request_rec r,
		*/
		AP_DECLARE(const char ) ap_get_protocol(conn_rec c);

		/**
		* Check if the given protocol is an allowed choice on the given
		* combination of connection, request and server.
		*
		* When server is NULL, it is taken from request_rec, unless
		* request_rec is NULL. Then it is taken from the connection base
		* server.
		*
		* @param c The current connection
		* @param r The current request or NULL
		* @param s The server/virtual host selected or NULL
		* @param protocol the protocol to switch to
		* @return != 0 iff protocol is allowed
		*/
		AP_DECLARE(int) ap_is_allowed_protocol(conn_rec c, request_rec r,
		server_rec s, const char protocol);

		/** @see ap_bucket_type_error */
		typedef struct ap_bucket_error ap_bucket_error;

include/httpd.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -1167,6 +1167,9 @@ struct conn_rec {
		#if APR_HAS_THREADS
		apr_thread_t *current_thread;
		#endif

		/** The "real" master connection. NULL if I am the master. */
		conn_rec *master;
		};

		/**

modules/ssl/mod_ssl.c

+28 −2

Original line number	Diff line number	Diff line
		@@ -377,6 +377,7 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
		static SSLConnRec ssl_init_connection_ctx(conn_rec c)
		{
		SSLConnRec *sslconn = myConnConfig(c);
		SSLSrvConfigRec *sc;

		if (sslconn) {
		return sslconn;
		@@ -386,6 +387,8 @@ static SSLConnRec ssl_init_connection_ctx(conn_rec c)

		sslconn->server = c->base_server;
		sslconn->verify_depth = UNSET;
		sc = mySrvConfig(c->base_server);
		sslconn->cipher_suite = sc->server->auth.cipher_suite;

		myConnConfigSet(c, sslconn);

		@@ -525,6 +528,7 @@ static apr_port_t ssl_hook_default_port(const request_rec *r)

		static int ssl_hook_pre_connection(conn_rec c, void csd)
		{

		SSLSrvConfigRec *sc;
		SSLConnRec *sslconn = myConnConfig(c);

		@@ -537,7 +541,7 @@ static int ssl_hook_pre_connection(conn_rec c, void csd)
		/*
		* Immediately stop processing if SSL is disabled for this connection
		*/
		if (!(sc && (sc->enabled == SSL_ENABLED_TRUE \|\|
		if (c->master \|\| !(sc && (sc->enabled == SSL_ENABLED_TRUE \|\|
		(sslconn && sslconn->is_proxy))))
		{
		return DECLINED;
		@@ -566,6 +570,26 @@ static int ssl_hook_pre_connection(conn_rec c, void csd)
		return ssl_init_ssl_connection(c, NULL);
		}

		static int ssl_hook_process_connection(conn_rec* c)
		{
		SSLConnRec *sslconn = myConnConfig(c);

		if (sslconn && !sslconn->disabled) {
		/* On an active SSL connection, let the input filters initialize
		* themselves which triggers the handshake, which again triggers
		* all kinds of useful things such as SNI and ALPN.
		*/
		apr_bucket_brigade* temp;

		temp = apr_brigade_create(c->pool, c->bucket_alloc);
		ap_get_brigade(c->input_filters, temp,
		AP_MODE_INIT, APR_BLOCK_READ, 0);
		apr_brigade_destroy(temp);
		}

		return DECLINED;
		}

		/*
		* the module registration phase
		*/
		@@ -579,6 +603,8 @@ static void ssl_register_hooks(apr_pool_t *p)
		ssl_io_filter_register(p);

		ap_hook_pre_connection(ssl_hook_pre_connection,NULL,NULL, APR_HOOK_MIDDLE);
		ap_hook_process_connection(ssl_hook_process_connection,
		NULL, NULL, APR_HOOK_MIDDLE);
		ap_hook_test_config (ssl_hook_ConfigTest, NULL,NULL, APR_HOOK_MIDDLE);
		ap_hook_post_config (ssl_init_Module, NULL,NULL, APR_HOOK_MIDDLE);
		ap_hook_http_scheme (ssl_hook_http_scheme, NULL,NULL, APR_HOOK_MIDDLE);

modules/ssl/ssl_engine_io.c

+0 −41

Original line number	Diff line number	Diff line
		@@ -298,9 +298,6 @@ typedef struct {
		apr_pool_t *pool;
		char buffer[AP_IOBUFSIZE];
		ssl_filter_ctx_t *filter_ctx;
		#ifdef HAVE_TLS_ALPN
		int alpn_finished; /* 1 if ALPN has finished, 0 otherwise */
		#endif
		} bio_filter_in_ctx_t;

		/*
		@@ -1418,41 +1415,6 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f,
		APR_BRIGADE_INSERT_TAIL(bb, bucket);
		}

		#ifdef HAVE_TLS_ALPN
		/* By this point, Application-Layer Protocol Negotiation (ALPN) should be
		* completed (if our version of OpenSSL supports it). If we haven't already,
		* find out which protocol was decided upon and inform other modules
		* by calling alpn_proto_negotiated_hook.
		*/
		if (!inctx->alpn_finished) {
		SSLConnRec *sslconn = myConnConfig(f->c);
		const unsigned char *next_proto = NULL;
		unsigned next_proto_len = 0;
		const char *protocol;

		SSL_get0_alpn_selected(inctx->ssl, &next_proto, &next_proto_len);
		if (next_proto && next_proto_len) {
		protocol = apr_pstrmemdup(f->c->pool, (const char *)next_proto,
		next_proto_len);
		ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
		APLOGNO(02836) "ALPN selected protocol: '%s'",
		protocol);

		if (strcmp(protocol, ap_get_protocol(f->c))) {
		status = ap_switch_protocol(f->c, NULL, sslconn->server,
		protocol);
		if (status != APR_SUCCESS) {
		ap_log_cerror(APLOG_MARK, APLOG_ERR, status, f->c,
		APLOGNO(02908) "protocol switch to '%s' failed",
		protocol);
		return status;
		}
		}
		}
		inctx->alpn_finished = 1;
		}
		#endif

		return APR_SUCCESS;
		}

		@@ -1934,9 +1896,6 @@ static void ssl_io_input_add_filter(ssl_filter_ctx_t filter_ctx, conn_rec c,
		inctx->block = APR_BLOCK_READ;
		inctx->pool = c->pool;
		inctx->filter_ctx = filter_ctx;
		#ifdef HAVE_TLS_ALPN
		inctx->alpn_finished = 0;
		#endif
		}

		/* The request_rec pointer is passed in here only to ensure that the