Commit cbd264e7 authored by Rainer Jung's avatar Rainer Jung
Browse files

Support OpenSSL 1.1.0. 

- use common code for OpenSSL pre-1.1.0 and
  1.1.0 where possible.

Partial backport of r1730422 from trunk.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x-openssl-1.1.0-compat@1755841 13f79535-47bb-0310-9956-ffa450edef68
parent 9dad1dd7

CHANGES

+2 −0
Original line number Diff line number Diff line
@@ -2,6 +2,8 @@ 


Changes with Apache 2.4.24



  *) mod_ssl: Add support for OpenSSL 1.1.0. [Rainer Jung]

 

  *) mod_proxy_fcgi: Fix 2.4.23 breakage for mod_rewrite per-dir and query 

     string showing up in SCRIPT_FILENAME. PR59815

modules/ssl/ssl_engine_init.c

+0 −4
Original line number Diff line number Diff line
@@ -858,11 +858,7 @@ static int use_certificate_chain( 
    unsigned long err;

    int n;



#if OPENSSL_VERSION_NUMBER < 0x10100000L

    if ((bio = BIO_new(BIO_s_file_internal())) == NULL)

#else

    if ((bio = BIO_new(BIO_s_file())) == NULL)

#endif

        return -1;

    if (BIO_read_filename(bio, file) <= 0) {

        BIO_free(bio);

modules/ssl/ssl_engine_kernel.c

+5 −32
Original line number Diff line number Diff line
@@ -80,11 +80,7 @@ static apr_status_t upgrade_connection(request_rec *r) 
    SSL_set_accept_state(ssl);

    SSL_do_handshake(ssl);



#if OPENSSL_VERSION_NUMBER < 0x10100000L

    if (SSL_get_state(ssl) != SSL_ST_OK) {

#else

    if (SSL_get_state(ssl) != TLS_ST_OK) {

#endif

    if (!SSL_is_init_finished(ssl)) {

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)

                      "TLS upgrade handshake failed");

        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
@@ -460,11 +456,7 @@ int ssl_hook_Access(request_rec *r) 
         * forbidden in the latter case, let ap_die() handle

         * this recursive (same) error.

         */

#if OPENSSL_VERSION_NUMBER < 0x10100000L

        if (SSL_get_state(ssl) != SSL_ST_OK) {

#else

        if (SSL_get_state(ssl) != TLS_ST_OK) {

#endif

        if (!SSL_is_init_finished(ssl)) {

            return HTTP_FORBIDDEN;

        }

        ctx = SSL_get_SSL_CTX(ssl);
@@ -949,7 +941,6 @@ int ssl_hook_Access(request_rec *r) 
        }

        else {

#if OPENSSL_VERSION_NUMBER >= 0x10100000L

            int rc;

            char peekbuf[1];

#endif

            const char *reneg_support;
@@ -995,11 +986,7 @@ int ssl_hook_Access(request_rec *r) 
            SSL_renegotiate(ssl);

            SSL_do_handshake(ssl);



#if OPENSSL_VERSION_NUMBER < 0x10100000L

            if (SSL_get_state(ssl) != SSL_ST_OK) {

#else

            if (SSL_get_state(ssl) != TLS_ST_OK) {

#endif

            if (!SSL_is_init_finished(ssl)) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02225)

                              "Re-negotiation request failed");

                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
@@ -1034,27 +1021,13 @@ int ssl_hook_Access(request_rec *r) 
             * It is expected to work without changes with the forthcoming 1.1.0pre3.

             * See: http://marc.info/?t=145493359200002&r=1&w=2

             */

            rc = SSL_peek(ssl, peekbuf, 0);

            ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, APLOGNO()

                          "Renegotiation peek result=%d, "

                          "reneg_state=%d, "

                          "in_init=%d, init_finished=%d, "

                          "state=%s, sslconn->ssl=%s, peer_certs=%s",

                          rc, sslconn->reneg_state,

                          SSL_in_init(ssl), SSL_is_init_finished(ssl),

                          SSL_state_string_long(ssl),

                          sslconn->ssl != NULL ? "yes" : "no",

                          SSL_get_peer_certificate(ssl) != NULL ? "yes" : "no");

            SSL_peek(ssl, peekbuf, 0);



#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */



            sslconn->reneg_state = RENEG_REJECT;



#if OPENSSL_VERSION_NUMBER < 0x10100000L

            if (SSL_get_state(ssl) != SSL_ST_OK) {

#else

            if (SSL_get_state(ssl) != TLS_ST_OK) {

#endif

            if (!SSL_is_init_finished(ssl)) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)

                              "Re-negotiation handshake failed");

                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);

modules/ssl/ssl_engine_ocsp.c

+0 −8
Original line number Diff line number Diff line
@@ -262,15 +262,7 @@ int modssl_verify_ocsp(X509_STORE_CTX *ctx, SSLSrvConfigRec *sc, 
                      "No cert available to check with OCSP");

        return 1;

    }

#if OPENSSL_VERSION_NUMBER < 0x10100000L

    else if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {

#else

    /* No need to check cert->valid, because modssl_verify_ocsp() only

     * is called if OpenSSL already successfully verified the certificate

     * (parameter "ok" in ssl_callback_SSLVerify() must be true).

     */

    else if (X509_check_issued(cert,cert) == X509_V_OK) {

#endif

        /* don't do OCSP checking for valid self-issued certs */

        ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,

                      "Skipping OCSP check for valid self-issued cert");

modules/ssl/ssl_engine_vars.c

+0 −22
Original line number Diff line number Diff line
@@ -609,16 +609,8 @@ static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, char * 
    for (i = 0; ssl_var_lookup_ssl_cert_dn_rec[i].name != NULL; i++) {

        if (strEQn(var, ssl_var_lookup_ssl_cert_dn_rec[i].name, varlen)

            && strlen(ssl_var_lookup_ssl_cert_dn_rec[i].name) == varlen) {

#if OPENSSL_VERSION_NUMBER < 0x10100000L

            for (j = 0; j < sk_X509_NAME_ENTRY_num((STACK_OF(X509_NAME_ENTRY) *)

                                                   xsname->entries);

                 j++) {

                xsne = sk_X509_NAME_ENTRY_value((STACK_OF(X509_NAME_ENTRY) *)

                                                xsname->entries, j);

#else

            for (j = 0; j < X509_NAME_entry_count(xsname); j++) {

                xsne = X509_NAME_get_entry(xsname, j);

#endif



                n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
@@ -920,9 +912,6 @@ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var) 
static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,

                       X509_NAME *xn, apr_pool_t *p)

{

#if OPENSSL_VERSION_NUMBER < 0x10100000L

    STACK_OF(X509_NAME_ENTRY) *ents = xn->entries;

#endif

    X509_NAME_ENTRY *xsne;

    apr_hash_t *count;

    int i, nid;
@@ -932,16 +921,9 @@ static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx, 
    count = apr_hash_make(p);



    /* For each RDN... */

#if OPENSSL_VERSION_NUMBER < 0x10100000L

    for (i = 0; i < sk_X509_NAME_ENTRY_num(ents); i++) {

         const char *tag;



         xsne = sk_X509_NAME_ENTRY_value(ents, i);

#else

    for (i = 0; i < X509_NAME_entry_count(xn); i++) {

         const char *tag;

         xsne = X509_NAME_get_entry(xn, i);

#endif



         /* Retrieve the nid, and check whether this is one of the nids

          * which are to be extracted. */
@@ -1115,11 +1097,7 @@ apr_array_header_t *ssl_ext_list(apr_pool_t *p, conn_rec *c, int peer, 
    for (j = 0; j < count; j++) {

        X509_EXTENSION *ext = X509_get_ext(xs, j);



#if OPENSSL_VERSION_NUMBER < 0x10100000L

        if (OBJ_cmp(ext->object, oid) == 0) {

#else

        if (OBJ_cmp(X509_EXTENSION_get_object(ext), oid) == 0) {

#endif

            BIO *bio = BIO_new(BIO_s_mem());



            /* We want to obtain a string representation of the extensions