Merge r1526168, r1527291, r1527295, r1563420, r1588851, r1666363, r1679470

                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.30

  *) mod_ssl: Improve handling of ephemeral DH and ECDH keys by

     allowing custom parameters to be configured via SSLCertificateFile,

     and by adding standardized DH parameters for 1024/2048/3072/4096 bits.

     Unless custom parameters are configured, the standardized parameters

     are applied based on the certificate's RSA/DSA key size. [Kaspar Brand]

  *) mod_ssl: drop support for export-grade ciphers with ephemeral RSA

     keys, and unconditionally disable aNULL, eNULL and EXP ciphers

     (not overridable via SSLCipherSuite). [Kaspar Brand]

  *) mod_ssl: Add support for configuring persistent TLS session ticket

     encryption/decryption keys (useful for clustered environments).

     [Paul Querna, Kaspar Brand]

     ylavic: trunk/2.4.x not concerned, 2.2.x only.

     +1: ylavic, jkaluza, wrowe

   * mod_ssl: Improve handling of ephemeral DH and ECDH keys by

     allowing custom parameters to be configured via SSLCertificateFile,

     and by adding standardized DH parameters for 1024/2048/3072/4096 bits.

     Unless custom parameters are configured, the standardized parameters

     are applied based on the certificate's RSA/DSA key size.  Also drop

     support for export-grade ciphers with ephemeral RSA keys, and

     unconditionally disable aNULL, eNULL and EXP ciphers

     (not overridable via SSLCipherSuite).

     trunk patch: http://svn.apache.org/r1526168

                  http://svn.apache.org/r1527291

                  http://svn.apache.org/r1527295

                  http://svn.apache.org/r1563420

                  http://svn.apache.org/r1588851

                  http://svn.apache.org/r1666363

                  http://svn.apache.org/r1679470

     2.2.x patch: http://people.apache.org/~ylavic/httpd-2.2.x-mod_ssl-improved_EDH-v2.patch

     +1: ylavic, wrowe, rjung

     ylavic: tested with openssl 0.9.7a, 0.9.8o, 1.0.1m and 1.0.2a with 1024

             and 2048 bits certificates (modulus), using EDH and ECDH ciphers.

             v2 to include r1679470

   * mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context. PR 57100.

     trunk patch: http://svn.apache.org/r1653997

     2.4.x patch: merged in http://svn.apache.org/r1663258

<li><code>-</code>: remove cipher from list (can be added later again)</li>

<li><code>!</code>: kill cipher from list completely (can <strong>not</strong> be added later again)</li>

</ul>

<note>

<title><code>aNULL</code>, <code>eNULL</code> and <code>EXP</code>

ciphers are always disabled</title>

<p>Beginning with version 2.2.30, null and export-grade

ciphers are always disabled, as mod_ssl unconditionally prepends any supplied

cipher suite string with <code>!aNULL:!eNULL:!EXP:</code> at initialization.</p>

</note>

<p>A simpler way to look at all of this is to use the ``<code>openssl ciphers

-v</code>'' command which provides a nice way to successively create the

correct <em>cipher-spec</em> string. The default <em>cipher-spec</em> string

<usage>

<p>

This directive points to the PEM-encoded Certificate file for the server and

optionally also to the corresponding RSA or DSA Private Key file for it

(contained in the same file). If the contained Private Key is encrypted the

Pass Phrase dialog is forced at startup time. This directive can be used up to

three times (referencing different filenames) when both a RSA, a DSA, and an

ECC based server certificate is used in parallel.</p>

This directive points to the file with the PEM-encoded certificate,

optionally also the corresponding private key, and - beginning with

version 2.2.30 - DH parameters and/or an EC curve name

for ephemeral keys (as generated by <code>openssl dhparam</code>

and <code>openssl ecparam</code>, respectively). If the private key

is encrypted, the pass phrase dialog is forced at startup time.

</p>

<p>

This directive can be used up to three times (referencing different filenames)

when both an RSA, a DSA, and an ECC based server certificate is used in

parallel. Note that DH and ECDH parameters are only read from the first

<directive>SSLCertificateFile</directive> directive.</p>

<note>

<title>DH parameter interoperability with primes > 1024 bit</title>

<p>

Beginning with version 2.2.30, mod_ssl makes use of

standardized DH parameters with prime lengths of 2048, 3072, 4096, 6144 and

8192 bits (from <a href="http://www.ietf.org/rfc/rfc3526.txt">RFC 3526</a>),

and hands them out to clients based on the length of the certificate's RSA/DSA

key.

With Java-based clients in particular (Java 7 or earlier), this may lead

to handshake failures - see this

<a href="../ssl/ssl_faq.html#javadh">FAQ answer</a> for working around

such issues.

</p>

</note>

<example><title>Example</title>

SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt

</example>

<li><a href="#nn">Why do I get I/O errors, or the message "Netscape has 

encountered bad data from the server", when connecting via

HTTPS to an Apache+mod_ssl server with Netscape Navigator?</a></li>

<li><a href="#javadh">Why do I get handshake failures with Java-based clients when using a certificate with more than 1024 bits?</a></li>

</ul>

<section id="random"><title>Why do I get lots of random SSL protocol 

    implementation is correct, so when you encounter I/O errors with Netscape

    Navigator it is usually caused by the configured certificates.</p>

</section>

<section id="javadh"><title>Why do I get handshake failures with Java-based clients when using a certificate with more than 1024 bits?</title>

    <p>Beginning with version 2.2.30,

    <module>mod_ssl</module> will use DH parameters which include primes

    with lengths of more than 1024 bits. Java 7 and earlier limit their

    support for DH prime sizes to a maximum of 1024 bits, however.</p>

    <p>If your Java-based client aborts with exceptions such as

    <code>java.lang.RuntimeException: Could not generate DH keypair</code> and

    <code>java.security.InvalidAlgorithmParameterException: Prime size must be

    multiple of 64, and can only range from 512 to 1024 (inclusive)</code>,

    and httpd logs <code>tlsv1 alert internal error (SSL alert number 80)</code>

    (at <directive module="core">LogLevel</directive> <code>info</code>

    or higher), you can either rearrange mod_ssl's cipher list with

    <directive module="mod_ssl">SSLCipherSuite</directive>

    (possibly in conjunction with <directive module="mod_ssl">SSLHonorCipherOrder</directive>),

    or you can use the <directive module="mod_ssl">SSLCertificateFile</directive>

    directive to configure custom DH parameters with a 1024-bit prime, which

    will always have precedence over any of the built-in DH parameters.</p>

    <p>To generate custom DH parameters, use the <code>openssl dhparam</code>

    command. Alternatively, you can append the following standard 1024-bit DH

    parameters from <a href="http://www.ietf.org/rfc/rfc2409.txt">RFC 2409</a>,

    section 6.2 to the respective

    <directive module="ssl">SSLCertificateFile</directive> file:</p>

    <example><pre>-----BEGIN DH PARAMETERS-----

MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR

Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL

/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC

-----END DH PARAMETERS-----</pre></example>

</section>

</section>

<!-- /aboutssl -->

    sslconn->ssl = ssl;

    /*

     *  Configure callbacks for SSL connection

     */

    SSL_set_tmp_rsa_callback(ssl, ssl_callback_TmpRSA);

    SSL_set_tmp_dh_callback(ssl,  ssl_callback_TmpDH);

#ifndef OPENSSL_NO_EC

    SSL_set_tmp_ecdh_callback(ssl, ssl_callback_TmpECDH);

#endif

    SSL_set_verify_result(ssl, X509_V_OK);

    ssl_io_filter_init(c, ssl);