Commits · 0d5382bfe1e1176f993f425b7ea529b3a34f6168 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

16 May, 2002 3 commits

tweak an error message for readability · 0d5382bf

Jeff Trawick authored May 16, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95135 13f79535-47bb-0310-9956-ffa450edef68

0d5382bf

Remove SSLLog and SSLLogLevel directives in favor of having mod_ssl use the · 07a800f0

Justin Erenkrantz authored May 16, 2002

standard ErrorLog directives.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95129 13f79535-47bb-0310-9956-ffa450edef68

07a800f0

Change mod_ssl from using ssl_log() to ap_log_error(). · 02c6d0a3

Justin Erenkrantz authored May 16, 2002

The issue is that ssl_log doesn't handle apr_status_t result codes.  This
leads to a number of places (esp. with mutexes) where the error codes get
lost.  Rather than extending ssl_log further, since mod_ssl is part of
our core, migrate to ap_log_error.  This means that mod_ssl no longer
does its own logging.

Most uses of SSL_ADD_ERRNO are now mapped correctly to apr_status_t values
(mainly because the APIs that used to return errnos are now APRized and
have apr_status_t codes available).

SSL_LOG_TRACE and SSL_LOG_DEBUG were mapped to the APLOG_DEBUG values.
mod_ssl prints out a LOT of debugging information, so mod_ssl with LogLevel
Debug may not be a good idea - perhaps mod_ssl should be less chatty.

Numerous printf type collisions were also resolved.

(The ssl logging code itself will be removed in a subsequent commit.)

This has been discussed on dev@httpd, but the fact that there isn't
much to review besides the mindless changes, I'm going to commit now
and rely on CTR if I screwed up anything on the translation.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95127 13f79535-47bb-0310-9956-ffa450edef68

02c6d0a3

15 May, 2002 1 commit

Stop using SSL_ADD_SSLERR option in ssl_log() and replace with new · 8419b0df

Justin Erenkrantz authored May 15, 2002

ssl_log_ssl_error() function that wraps ap_log_error instead.

This begins the migration from ssl_log() -> ap_log_error(). Divorcing
ourselves from the SSL_ADD_SSLERR option is required to make the next
pass easier.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95122 13f79535-47bb-0310-9956-ffa450edef68

8419b0df

13 May, 2002 2 commits

Correct typo in last commit. · 536145b3

Justin Erenkrantz authored May 13, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95059 13f79535-47bb-0310-9956-ffa450edef68

536145b3

Apply same patch (nee hack) to mod_ssl as was done to mod_rewrite to · dcb1456e

Justin Erenkrantz authored May 13, 2002

get cross-process mutex permissions working.

This is waiting for a proper APR interface, but this does not mean that
we should remain broken in the meantime.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95057 13f79535-47bb-0310-9956-ffa450edef68

dcb1456e

10 May, 2002 1 commit

· de81e7f3

William A. Rowe Jr authored May 10, 2002

Afraid these are likely generated, just something to watch out for
in the future. Address PR 8963

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95024 13f79535-47bb-0310-9956-ffa450edef68

de81e7f3

09 May, 2002 1 commit

Fix a mod_ssl build problem on OS/390. · e41ba3cb

Jeff Trawick authored May 09, 2002

This is admittedly rather ugly code to come up with a unique 4-byte
identifier for the thread. Since our threads are pthreads and a pthread
maps 1:1 to a TCB, the address of the TCB is sufficient. Yes, every
TCB sees a different piece of real storage mapped to the first page,
so the code does make sense.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@95016 13f79535-47bb-0310-9956-ffa450edef68

e41ba3cb

01 May, 2002 1 commit

· b4334540

Paul J. Reder authored May 01, 2002

Fix a case where an invalid pass phrase is entered and an
error message is given, but the prompt is not shown again.
This left the user in an ambiguous state.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94896 13f79535-47bb-0310-9956-ffa450edef68

b4334540

30 Apr, 2002 4 commits

Revert optimization from circa 2.0.34 that caused very long vhost id's · daf4ed35

Cliff Woolley authored Apr 30, 2002

to be unusable with mod_ssl.

PR: 8572


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94881 13f79535-47bb-0310-9956-ffa450edef68

daf4ed35

note a desirable goal · ef23e1dd

Cliff Woolley authored Apr 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94877 13f79535-47bb-0310-9956-ffa450edef68

ef23e1dd

SHMCB should not have been using apr_rmm -- it was doing so incorrectly, · 04d94c3c

Cliff Woolley authored Apr 30, 2002

for one thing.  But it just plain doesn't need it.  Rip it out to avoid
segfaulting.

Submitted by:  Aaron Bannert


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94876 13f79535-47bb-0310-9956-ffa450edef68

04d94c3c

- Sync with modssl 2.8.8-1.3.24 · f1ff0d63

Cliff Woolley authored Apr 30, 2002

- Also a minor change to add more useful error
  logging for shmcb startup failures


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94875 13f79535-47bb-0310-9956-ffa450edef68

f1ff0d63

18 Apr, 2002 1 commit

Fix so that we can compile with OpenSSL 0.9.8-dev. · 09412ef6

Justin Erenkrantz authored Apr 18, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94696 13f79535-47bb-0310-9956-ffa450edef68

09412ef6

13 Apr, 2002 1 commit

Adapt to the rename of apr_explode_localtime to apr_time_exp_lt in APR. · a670e29b

Sander Striker authored Apr 13, 2002

Submitted by: Thom May <thom@planetarytramp.net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94631 13f79535-47bb-0310-9956-ffa450edef68

a670e29b

12 Apr, 2002 1 commit

Touch these files so that their datestamps are newer than the corresponding · 3cdcd9e2

Cliff Woolley authored Apr 12, 2002

.y and .l files.  These must be kept newer than those at all times to avoid
introducing a dependency on flex and yacc.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94623 13f79535-47bb-0310-9956-ffa450edef68

3cdcd9e2

09 Apr, 2002 1 commit

Convert mod_ssl to the new apr_global_mutex.h API and remove all · a0bff387

Aaron Bannert authored Apr 09, 2002

uses of apr_lock.h [deprecated]. Tested that I could serve simple
SSL (v3) pages.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94583 13f79535-47bb-0310-9956-ffa450edef68

a0bff387

08 Apr, 2002 1 commit

another todo · 89098659

Doug MacEachern authored Apr 08, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94547 13f79535-47bb-0310-9956-ffa450edef68

89098659

07 Apr, 2002 3 commits

PR: 7802 · cc85fefa

Doug MacEachern authored Apr 07, 2002

Obtained from:
Submitted by:
Reviewed by:
fix compilation problem in ssl_engine_kernel.c
if SSL_LIBRARY_VERSION >= 0x00907000


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94527 13f79535-47bb-0310-9956-ffa450edef68

cc85fefa

PR: · 824dbd9b

Doug MacEachern authored Apr 07, 2002

Obtained from:
Submitted by:
Reviewed by:
ssl_io_input_read now returns APR_EOF if ssl_io_hook_read returns 0
bytes for a reason other than SSL_ERROR_WANT_READ.  this should
prevent a possible endless loop.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94519 13f79535-47bb-0310-9956-ffa450edef68

824dbd9b

fix ProxyPass when frontend is https and backend is http · 181920ee

Doug MacEachern authored Apr 07, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94515 13f79535-47bb-0310-9956-ffa450edef68

181920ee

05 Apr, 2002 2 commits

Get the HTTP-on-HTTPS hint to come through again. We're in AP_MODE_GETLINE · a4a00bcc

Cliff Woolley authored Apr 05, 2002

at this point, so the \r\n\r\n just confuses the http input filter.

One concern: this patch is only correct as long as we only ever call this
function while in AP_MODE_GETLINE. Ideally we would account for the mode
and return the newlines if not in GETLINE mode, but at the moment it doesn't
seem to matter.

Reviewed by: Doug MacEachern

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94453 13f79535-47bb-0310-9956-ffa450edef68

a4a00bcc

PR: · f07cf357

Doug MacEachern authored Apr 05, 2002

Obtained from:
Submitted by:
Reviewed by:
avoid the error_log message: [error] mod_ssl: Certificate Verification: Error ...
if SSLProxyVerify is not configured or set to "none".
the verify callback does not happen in the server context when
SSLVerify is not configured or set to "none".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94444 13f79535-47bb-0310-9956-ffa450edef68

f07cf357

02 Apr, 2002 7 commits

fix SSL_X509_INFO_load_path so SSLProxyMachineCertificatePath works · 7aaaeff3

Doug MacEachern authored Apr 02, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94406 13f79535-47bb-0310-9956-ffa450edef68

7aaaeff3

copy-n-pasto: need to use SSL_X509_INFO_load_*path* on pkp->cert_path · ebe3d101
Doug MacEachern authored Apr 02, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94405 13f79535-47bb-0310-9956-ffa450edef68
```
ebe3d101
copy-n-pasto: ssl_cmd_SSLProxyMachineCertificatePath needs to set cert_path · 0152a958
Doug MacEachern authored Apr 02, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94404 13f79535-47bb-0310-9956-ffa450edef68
```
0152a958

fix copy-n-pasto: ssl_cmd_SSLProxyCACertificatePath needs to use · e6b6ca34

Doug MacEachern authored Apr 02, 2002

ssl_cmd_check_dir rather than ssl_cmd_check_file


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94403 13f79535-47bb-0310-9956-ffa450edef68

e6b6ca34

another todo · 672b1ced

Doug MacEachern authored Apr 02, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94400 13f79535-47bb-0310-9956-ffa450edef68

672b1ced

PR: · 92accdb3

Doug MacEachern authored Apr 02, 2002

Obtained from:
Submitted by:
Reviewed by:    Ryan Bloom
ap_remove_output_filter no longer works for connection filters.
change logic in the case of "HTTP spoken on HTTPS port" to disable the
ssl filters rather than attempt to remove the filters.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94393 13f79535-47bb-0310-9956-ffa450edef68

92accdb3

various updates · e0a228be

Doug MacEachern authored Apr 02, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94392 13f79535-47bb-0310-9956-ffa450edef68

e0a228be

30 Mar, 2002 10 commits

add/use EVP_PKEY_reference_inc and X509_reference_inc compat macros · be078833

Doug MacEachern authored Mar 30, 2002

to get these changes working with sslc


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94341 13f79535-47bb-0310-9956-ffa450edef68

be078833

add sslc compat for sk_X509_INFO_free · 7790a55d

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94340 13f79535-47bb-0310-9956-ffa450edef68

7790a55d

add SSLProxyCARevocation{File,Path} directives to support CRLs in the proxy · 495d5f41
Doug MacEachern authored Mar 30, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94338 13f79535-47bb-0310-9956-ffa450edef68
```
495d5f41

pass sc to myCtxConfig macro · 7e3f4fe9

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94337 13f79535-47bb-0310-9956-ffa450edef68

7e3f4fe9

make it possible for proxy to use CRL callback · a9bda397

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94336 13f79535-47bb-0310-9956-ffa450edef68

a9bda397

enable the verify callback for proxy · c8312a43

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94334 13f79535-47bb-0310-9956-ffa450edef68

c8312a43

change sc->server references to myCtxConfig, so proxy can use the · 9c0f1eae

Doug MacEachern authored Mar 30, 2002

verify callback.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94332 13f79535-47bb-0310-9956-ffa450edef68

9c0f1eae

add myCtxConfig macro · fff2032a

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94331 13f79535-47bb-0310-9956-ffa450edef68

fff2032a

implement proxy client certificate callback · af6f2c49

Doug MacEachern authored Mar 30, 2002

(uses SSLProxyMachineCertificate{File,Cert} when downstream server
requires a client certificate)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94329 13f79535-47bb-0310-9956-ffa450edef68

af6f2c49

input filter should not return failure when ssl runtime wants to read more · 79cd12cf
Doug MacEachern authored Mar 30, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94328 13f79535-47bb-0310-9956-ffa450edef68
```
79cd12cf