Commit c4522ff3 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1750854, r1750855, r1750947, r1750955, r1750960 from trunk: 

ab: add SNI support when available.

ab: follow up to r1750854: put the -I at the right place for apr_getopt().

ab: follow up to r1750854.
Use SNI when available by default, and invert -I logic to now disable it.

ab: follow up to r1750854: some comments and better naming.

ab: follow up to r1750854: still better naming, and a C89 fix.
Submitted by: ylavic
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1757674 13f79535-47bb-0310-9956-ffa450edef68
parent 38daa344

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ 


Changes with Apache 2.4.24



  *) ab: Set the Server Name Indication (SNI) extension on outgoing TLS

     connections (unless -I is specified), according to the Host header (if

     any) or the requested URL's hostname otherwise.  [Yann Ylavic]



  *) mod_proxy_fcgi: avoid loops when ProxyErrorOverride is enabled

     and the error documents are proxied. PR 55415. [Luca Toscano]

STATUS

+0 −12
Original line number Diff line number Diff line
@@ -117,18 +117,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) ab: Set the Server Name Indication (SNI) extension on outgoing TLS

     connections (unless -I is specified), according to the Host header (if

     any) or the requested URL's hostname otherwise.

     trunk patch: http://svn.apache.org/r1750854

                  http://svn.apache.org/r1750855

                  http://svn.apache.org/r1750947

                  http://svn.apache.org/r1750955

                  http://svn.apache.org/r1750960

     2.4.x patch: http://home.apache.org/~ylavic/patches/httpd-2.4.x-ab_sni.patch

                  (needed to adapt CHANGES entry since r1750854)

     +1: ylavic, covener, jim



  *) mod_reqtimeout: Fix body timeout disabling for CONNECT requests to avoid

     triggering mod_proxy_connect's AH01018 once the tunnel is established.

     trunk patch: http://svn.apache.org/r1754391

support/ab.c

+55 −3
Original line number Diff line number Diff line
@@ -194,6 +194,9 @@ typedef STACK_OF(X509) X509_STACK_TYPE; 
#ifdef SSL_OP_NO_TLSv1_2

#define HAVE_TLSV1_X

#endif

#if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name)

#define HAVE_TLSEXT

#endif

#endif



#include <math.h>
@@ -310,7 +313,7 @@ int isproxy = 0; 
apr_interval_time_t aprtimeout = apr_time_from_sec(30); /* timeout value */



/* overrides for ab-generated common headers */

int opt_host = 0;       /* was an optional "Host:" header specified? */

const char *opt_host;   /* which optional "Host:" header specified, if any */

int opt_useragent = 0;  /* was an optional "User-Agent:" header specified? */

int opt_accept = 0;     /* was an optional "Accept:" header specified? */

 /*
@@ -343,6 +346,10 @@ SSL_CTX *ssl_ctx; 
char *ssl_cipher = NULL;

char *ssl_info = NULL;

BIO *bio_out,*bio_err;

#ifdef HAVE_TLSEXT

int tls_use_sni = 1;         /* used by default, -I disables it */

const char *tls_sni = NULL; /* 'opt_host' if any, 'hostname' otherwise */

#endif

#endif



apr_time_t start, lasttime, stoptime;
@@ -864,6 +871,11 @@ static void output_results(int sig) 
    if (is_ssl && ssl_info) {

        printf("SSL/TLS Protocol:       %s\n", ssl_info);

    }

#ifdef HAVE_TLSEXT

    if (is_ssl && tls_sni) {

        printf("TLS Server Name:        %s\n", tls_sni);

    }

#endif

#endif

    printf("\n");

    printf("Document Path:          %s\n", path);
@@ -1332,6 +1344,11 @@ static void start_connect(struct connection * c) 
            BIO_set_callback(bio, ssl_print_cb);

            BIO_set_callback_arg(bio, (void *)bio_err);

        }

#ifdef HAVE_TLSEXT

        if (tls_sni) {

            SSL_set_tlsext_host_name(c->ssl, tls_sni);

        }

#endif

    } else {

        c->ssl = NULL;

    }
@@ -1710,6 +1727,18 @@ static void test(void) 
        /* Header overridden, no need to add, as it is already in hdrs */

    }



#ifdef HAVE_TLSEXT

    if (is_ssl && tls_use_sni) {

        apr_ipsubnet_t *ip;

        if (((tls_sni = opt_host) || (tls_sni = hostname)) &&

            (!*tls_sni || apr_ipsubnet_create(&ip, tls_sni, NULL,

                                               cntxt) == APR_SUCCESS)) {

            /* IP not allowed in TLS SNI extension */

            tls_sni = NULL;

        }

    }

#endif



    if (!opt_useragent) {

        /* User-Agent: header not overridden, add default value to hdrs */

        hdrs = apr_pstrcat(cntxt, hdrs, "User-Agent: ApacheBench/", AP_AB_BASEREVISION, "\r\n", NULL);
@@ -2009,6 +2038,9 @@ static void usage(const char *progname) 
#define TLS1_X_HELP_MSG ""

#endif



#ifdef HAVE_TLSEXT

    fprintf(stderr, "    -I              Disable TLS Server Name Indication (SNI) extension\n");

#endif

    fprintf(stderr, "    -Z ciphersuite  Specify SSL/TLS cipher suite (See openssl ciphers)\n");

    fprintf(stderr, "    -f protocol     Specify SSL/TLS protocol\n");

    fprintf(stderr, "                    (" SSL2_HELP_MSG SSL3_HELP_MSG "TLS1" TLS1_X_HELP_MSG " or ALL)\n");
@@ -2172,7 +2204,7 @@ int main(int argc, const char * const argv[]) 
    myhost = NULL; /* 0.0.0.0 or :: */



    apr_getopt_init(&opt, cntxt, argc, argv);

    while ((status = apr_getopt(opt, "n:c:t:s:b:T:p:u:v:lrkVhwix:y:z:C:H:P:A:g:X:de:SqB:m:"

    while ((status = apr_getopt(opt, "n:c:t:s:b:T:p:u:v:lrkVhwiIx:y:z:C:H:P:A:g:X:de:SqB:m:"

#ifdef USE_SSL

            "Z:f:"

#endif
@@ -2291,7 +2323,16 @@ int main(int argc, const char * const argv[]) 
                 * allow override of some of the common headers that ab adds

                 */

                if (strncasecmp(opt_arg, "Host:", 5) == 0) {

                    opt_host = 1;

                    char *host;

                    apr_size_t len;

                    opt_arg += 5;

                    while (apr_isspace(*opt_arg))

                        opt_arg++;

                    len = strlen(opt_arg);

                    host = strdup(opt_arg);

                    while (len && apr_isspace(host[len-1]))

                        host[--len] = '\0';

                    opt_host = host;

                } else if (strncasecmp(opt_arg, "Accept:", 7) == 0) {

                    opt_accept = 1;

                } else if (strncasecmp(opt_arg, "User-Agent:", 11) == 0) {
@@ -2355,10 +2396,16 @@ int main(int argc, const char * const argv[]) 
#ifndef OPENSSL_NO_SSL2

                } else if (strncasecmp(opt_arg, "SSL2", 4) == 0) {

                    meth = SSLv2_client_method();

#ifdef HAVE_TLSEXT

                    tls_use_sni = 0;

#endif

#endif

#ifndef OPENSSL_NO_SSL3

                } else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {

                    meth = SSLv3_client_method();

#ifdef HAVE_TLSEXT

                    tls_use_sni = 0;

#endif

#endif

#ifdef HAVE_TLSV1_X

                } else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {
@@ -2370,6 +2417,11 @@ int main(int argc, const char * const argv[]) 
                    meth = TLSv1_client_method();

                }

                break;

#ifdef HAVE_TLSEXT

            case 'I':

                tls_use_sni = 0;

                break;

#endif

#endif

        }

    }