Skip to content
GitLab
  1. 14 Dec, 2009 2 commits
  3. 12 Dec, 2009 1 commit
  5. 07 Dec, 2009 1 commit
  7. 03 Dec, 2009 2 commits
  9. 30 Nov, 2009 1 commit
  11. 29 Nov, 2009 2 commits
  13. 21 Nov, 2009 1 commit
  15. 20 Nov, 2009 1 commit
  17. 19 Nov, 2009 4 commits
  19. 18 Nov, 2009 4 commits
  21. 17 Nov, 2009 1 commit
  23. 16 Nov, 2009 1 commit
  25. 08 Nov, 2009 1 commit
  27. 07 Nov, 2009 1 commit
    • Joe Orton's avatar
      Merge r833582, r833593 from trunk: · 0c75010d
      Joe Orton authored 
      SECURITY: Partial fix for CVE-2009-3555:

Reject client-initiated renegotiations; this is sufficient to prevent
the attack for any configuration which does not require renegotiation
due to per-directory/per-location access control configuration.

Configuration with per-directory/per-location access control
requirements (such as "SSLVerifyClient require") are still vulnerable
to CVE-2009-3555 with this patch applied (if using OpenSSL <= 0.9.8k).

* modules/ssl/ssl_private.h (SSLConnRec): Add reneg_state field.
  (ssl_callback_Info): Renamed from ssl_callback_LogTracingState.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks): Install
  the (renamed) info callback unconditionally.

* modules/ssl/ssl_engine_io.c (ssl_filter_ctx_t): Add config pointer
  to SSLConnRec.
  (bio_filter_out_write, bio_filter_in_read): Fail with
  APR_ECONNABORTED if the reneg state is set to RENEG_ABORT.

* modules/ssl/ssl_engine_kernel.c (log_tracing_state): Factored out
  of ssl_callback_LogTracingState.
  (ssl_callback_Info): New function.

Submitted by: jorton, rpluem
Reviewed by: jorton, rpluem, dirkx


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@833622 13f79535-47bb-0310-9956-ffa450edef68
      0c75010d
  29. 05 Nov, 2009 2 commits
  31. 04 Nov, 2009 1 commit
  33. 02 Nov, 2009 3 commits
  35. 01 Nov, 2009 2 commits
  37. 29 Oct, 2009 1 commit
  39. 27 Oct, 2009 5 commits
  41. 26 Oct, 2009 2 commits
  43. 25 Oct, 2009 1 commit