Commits · 50aebdaf7188d17ebedfd4147c5e5e58f7b38c14 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

30 Mar, 2002 6 commits

implement proxy client certificate callback · 50aebdaf

Doug MacEachern authored Mar 30, 2002

(uses SSLProxyMachineCertificate{File,Cert} when downstream server
requires a client certificate)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94329 13f79535-47bb-0310-9956-ffa450edef68

50aebdaf

input filter should not return failure when ssl runtime wants to read more · 9815373b
Doug MacEachern authored Mar 30, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94328 13f79535-47bb-0310-9956-ffa450edef68
```
9815373b

ssl_io_input_read needs to return something other than APR_SUCCESS · d1c282b6

Doug MacEachern authored Mar 30, 2002

when bucket read from socket was successful,
but there was an error within the ssl runtime.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94327 13f79535-47bb-0310-9956-ffa450edef68

d1c282b6

load SSLProxyMachineCertificate{File,Path} · e4c98eb5

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94324 13f79535-47bb-0310-9956-ffa450edef68

e4c98eb5

enable/cleanup SSL_X509_INFO_load_{file,path} functions for use in · d818b898

Doug MacEachern authored Mar 30, 2002

proxy context


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94323 13f79535-47bb-0310-9956-ffa450edef68

d818b898

Fix the version string. We want to end up with "mod_ssl/2.0.xx", not · a7043344

Cliff Woolley authored Mar 30, 2002

"mod_ssl/Apache/2.0.xx".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94320 13f79535-47bb-0310-9956-ffa450edef68

a7043344

29 Mar, 2002 34 commits

Cloudy today. · a5480f9d

Joshua Slive authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94317 13f79535-47bb-0310-9956-ffa450edef68

a5480f9d

Removed email address on request - as obviscation was slammed down on the list... · eecbb192

Dirk-Willem van Gulik authored Mar 29, 2002

Removed email address on request - as obviscation was slammed down on the list - and Google is your friend in any case


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94315 13f79535-47bb-0310-9956-ffa450edef68

eecbb192

add SSLProxyEngine directive. this was not required in the 1.x based · 69e18950

Doug MacEachern authored Mar 29, 2002

mod_ssl because the SSL_CTX was created and configured for *every*
request. unlike in 2.0 where we configure the proxy SSL_CTX at
startup time, which is much better for performance. but we don't want
to configure a proxy context for every vhost if it isn't going to be
used, for the same reasons we don't create a server context for every
vhost unless SSLEngine is on.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94314 13f79535-47bb-0310-9956-ffa450edef68

69e18950

check the return value of ap_proxy_ssl_enable · 10bda6ff

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94313 13f79535-47bb-0310-9956-ffa450edef68

10bda6ff

Syncing makes no sense now · 87e69bb3

Jim Jagielski authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94309 13f79535-47bb-0310-9956-ffa450edef68

87e69bb3

· d41edaec

Paul J. Reder authored Mar 29, 2002

PR:
Obtained from:
Submitted by:	Paul J. Reder
Reviewed by:

Remove the MPM_SYNC_CHILD_TABLE macro since there is no longer a scoreboard
file that needs to be synched.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94308 13f79535-47bb-0310-9956-ffa450edef68

d41edaec

The old, legacy (and unused) code in which the scoreboard was totally · 0c8afb14

Jim Jagielski authored Mar 29, 2002

and completely contained in a file (SCOREBOARD_FILE) has been
removed. This does not affect scoreboards which are *mapped* to
files using named-shared-memory at all. This implies that scoreboards
must be based, at some level, on native shared memory (mmap, shm_open,
shmget, whatever), but the code has assumed that for quite awhile
now. Having the scoreboard be *based* on a file makes no sense today.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94306 13f79535-47bb-0310-9956-ffa450edef68

0c8afb14

BUCKET FREELISTS · d6e02ee3

Cliff Woolley authored Mar 29, 2002

Add an allocator-passing mechanism throughout the bucket brigades API.

From Apache's standpoint, the apr_bucket_alloc_t* used throughout a given
connection is stored in the conn_rec by the create_connection hook. That
means it's the MPM's job to optimize recycling of apr_bucket_alloc_t's --
the MPM must ensure that no two threads can ever use the same one at the
same time, for instance.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94304 13f79535-47bb-0310-9956-ffa450edef68

d6e02ee3

import ssl_proxy_enable in the post config phase, otherwise LoadModule · 7cfb2f35

Doug MacEachern authored Mar 29, 2002

order may leave us without the function.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94303 13f79535-47bb-0310-9956-ffa450edef68

7cfb2f35

remove ssl_engine_ext.c · e783d880

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94302 13f79535-47bb-0310-9956-ffa450edef68

e783d880

removing old proxy extension code · a733daf7

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94301 13f79535-47bb-0310-9956-ffa450edef68

a733daf7

hook into mod_ssl for https support · c8f573be

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94300 13f79535-47bb-0310-9956-ffa450edef68

c8f573be

need to flush output buffer before reading in proxy mode · 3ec6b50c

Doug MacEachern authored Mar 29, 2002

need to call ssl_hook_process_connection in the output filter in proxy
mode, since proxy hits the output filter before the input filter

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94299 13f79535-47bb-0310-9956-ffa450edef68

3ec6b50c

in proxy mode we need to SSL_connect rather than SSL_accept in · 89847f9a

Doug MacEachern authored Mar 29, 2002

ssl_hook_process_connection.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94298 13f79535-47bb-0310-9956-ffa450edef68

89847f9a

These two variables were left uninitialized accidentally. · 762a59d4

Cliff Woolley authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94297 13f79535-47bb-0310-9956-ffa450edef68

762a59d4

Document the variable expansion enhancements for mod_include · 9685c80e

Brian Pane authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94295 13f79535-47bb-0310-9956-ffa450edef68

9685c80e

Allow variable expansion within in the "var" arg to <!--#echo · b32fe1e4

Brian Pane authored Mar 29, 2002

and <!--#set, so that people can do things like this:
  <!--#echo var="${foo}_${bar}" -->


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94294 13f79535-47bb-0310-9956-ffa450edef68

b32fe1e4

add optional function (ssl_proxy_enable) to turn on ssl proxy · 27fc4b3c

Doug MacEachern authored Mar 29, 2002

choose SSL_CTX based on SSLConnRec.is_proxy


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94293 13f79535-47bb-0310-9956-ffa450edef68

27fc4b3c

init proxy context · 641dedc0

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94292 13f79535-47bb-0310-9956-ffa450edef68

641dedc0

Replaced my fix for the is_only_below() bug with Cliff's faster · 968e7cef

Brian Pane authored Mar 29, 2002

and simpler version.
Submitted by:	Cliff Woolley


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94291 13f79535-47bb-0310-9956-ffa450edef68

968e7cef

s/id/mode/ in ssl_cmd_SSLProxyVerify · bdbb46fe

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94290 13f79535-47bb-0310-9956-ffa450edef68

bdbb46fe

use ssl_cmd_verify_parse for SSLProxyVerify directive handler · 308cc611
Doug MacEachern authored Mar 29, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94289 13f79535-47bb-0310-9956-ffa450edef68
```
308cc611

cleanup the proxy context · 489b79b3

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94288 13f79535-47bb-0310-9956-ffa450edef68

489b79b3

s/ctx/dcfg/g in ssl directive handlers · 581a133a

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94287 13f79535-47bb-0310-9956-ffa450edef68

581a133a

enable proxy directives · c8cfc6f9

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94286 13f79535-47bb-0310-9956-ffa450edef68

c8cfc6f9

change existing ssl_init_ctx() to ssl_init_ctx_protocol() · 72733a16

Doug MacEachern authored Mar 29, 2002

new ssl_init_ctx() inits the lot: protocol, session_cache, callbacks,
verify, cipher suite, crl, cert_chain

new ssl_init_server_ctx function inits everything for sc->server

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94285 13f79535-47bb-0310-9956-ffa450edef68

72733a16

Fixes for three problems in mod_include: · b3476178

Brian Pane authored Mar 29, 2002

  * The ctx->tag_length computation in find_end_sequence() was a bit
    broken in cases where there was a "false alarm" match on a partial
    "-->"
  * The ap_ssi_get_tag_and_value() function needs to avoid walking off
    the end of the string.  After debugging this some more, I ended up
    using Cliff's original patch.
  * Infinite loop in is_only_below()


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94284 13f79535-47bb-0310-9956-ffa450edef68

b3476178

proxy will have a different verify callback · c85866ce

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94283 13f79535-47bb-0310-9956-ffa450edef68

c85866ce

proxy needs to use client ssl method · 7f3d430b

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94282 13f79535-47bb-0310-9956-ffa450edef68

7f3d430b

setup sc->proxy->sc · 0c428711

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94281 13f79535-47bb-0310-9956-ffa450edef68

0c428711

add ssl_config_server_new function to fold some duplication in server · 761375c6

Doug MacEachern authored Mar 29, 2002

create/merge and to make sure merge config is fully inititialized


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94280 13f79535-47bb-0310-9956-ffa450edef68

761375c6

inititialize and merge proxy config · d0a70383

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94279 13f79535-47bb-0310-9956-ffa450edef68

d0a70383

no point in merging things which are not set until after merge happens. · d348e627

Doug MacEachern authored Mar 29, 2002

make a note of those which are set during module init.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94278 13f79535-47bb-0310-9956-ffa450edef68

d348e627

'ctx' traditionally refers to an SSL_CTX. change modssl_ctx_t · 29db7053

Doug MacEachern authored Mar 29, 2002

instances to 'mctx'


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94277 13f79535-47bb-0310-9956-ffa450edef68

29db7053