Commits · 6e3067d5710c8e13df0c14b22f6274d7051e1da1 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

29 Nov, 2001 6 commits

fix for last change that removed ssl_util_getmodconfig(): · 6e3067d5

Doug MacEachern authored Nov 29, 2001

go back to using s->process->pool userdata, but just to store the
global module config during startup so we only create _one_ SSLModConfigRec.
(didn't realize this function was called in both ssl_init_Module and
ssl_config_server_create)
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92235 13f79535-47bb-0310-9956-ffa450edef68

6e3067d5

ssl_util_getmodconfig() and ssl_util_getmodconfig_ssl() show up high · 77a962b3

Doug MacEachern authored Nov 29, 2001

in the gprof profile.  there's no need for the "global" SSLModConfigRec
to live in the s->process->pool userdata table.  we now just point the
SSLSrvConfigRec in each server_rec.module_config to the SSLModConfigRec
so we can access it directly which is much faster.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92234 13f79535-47bb-0310-9956-ffa450edef68

77a962b3

SSL_rand() does a mutex lock/unlock with threaded MPMs, so collapse · c0b005cc

Doug MacEachern authored Nov 29, 2001

two calls that seed pid and time into one.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92233 13f79535-47bb-0310-9956-ffa450edef68

c0b005cc

move srand() call from ssl_rand_choosenum() to ssl_init_Child() · 0a22c4bf

Doug MacEachern authored Nov 29, 2001

this was being called twice per-connection with 'SSLRandom connect builtin'
configured (which is in the default config)

this also gets rid of two time() syscalls per-connection

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92232 13f79535-47bb-0310-9956-ffa450edef68

0a22c4bf

call getpid() once at child init and save in the SSLModConfigRec · 3a2fa0ff

Doug MacEachern authored Nov 29, 2001

to avoid getpid() calls at request time
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92231 13f79535-47bb-0310-9956-ffa450edef68

3a2fa0ff

Fix awkward grammar in some of mod_ssl's error messages. · f8056ae2

Aaron Bannert authored Nov 29, 2001

Submitted by: Ryan Morgan <rmorgan@covalent.net>
Reviewed by: Aaron Bannert

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92229 13f79535-47bb-0310-9956-ffa450edef68

f8056ae2

28 Nov, 2001 6 commits

calculate VHostID length at startup rather than request time. · 088d07d2

Doug MacEachern authored Nov 28, 2001

change ap_md5() call in ssl_hook_pre_connection() to ap_md5_binary()
that uses the precalculated sc->nVHostID_length to avoid a strlen() call.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92216 13f79535-47bb-0310-9956-ffa450edef68

088d07d2

avoid calling ssl_util_vhostid() (and apr_sprintf underneath) at · ac2aa4aa

Doug MacEachern authored Nov 28, 2001

request time by calling it at startup time and saving the value in the
SSLSrvConfigRec.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92215 13f79535-47bb-0310-9956-ffa450edef68

ac2aa4aa

replace strlen(cpVHostMD5) with MD5_DIGESTSIZE*2 in ssl_hook_pre_connection() · a0fcfd71

Doug MacEachern authored Nov 28, 2001

since we know the string returned by ap_md5() will always be that length
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92213 13f79535-47bb-0310-9956-ffa450edef68

a0fcfd71

remove unused ssl::handshake::timeout references · ac52b515

Doug MacEachern authored Nov 28, 2001

(core handles all timeouts)
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92211 13f79535-47bb-0310-9956-ffa450edef68

ac52b515

remove setting of ap::{http::method,default::port} r->notes. · 06d5018c

Doug MacEachern authored Nov 28, 2001

these notes are unused, they handled by hooks.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92210 13f79535-47bb-0310-9956-ffa450edef68

06d5018c

moving chunk of logic that deals with writing ssl data from · cef28c4d

Doug MacEachern authored Nov 28, 2001

ssl_io_filter_Output() to a new ssl_filter_write() function.
this will make it easier to optimize how we deal with file buckets
than cannot be mmaped.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92209 13f79535-47bb-0310-9956-ffa450edef68

cef28c4d

27 Nov, 2001 1 commit

implement a custom BIO which allows us to hook SSL_write directly into · 1654c5dd

Doug MacEachern authored Nov 27, 2001

an apr_bucket_brigade and use transient buckets with the SSL
malloc-ed buffer, rather than copying into a mem BIO.

also allows us to pass the brigade as data is being written
rather than buffering up the entire response in the mem BIO.

PR:
Obtained from:
Submitted by:
Reviewed by:	Justin Erenkrantz, Ryan Bloom


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92206 13f79535-47bb-0310-9956-ffa450edef68

1654c5dd

24 Nov, 2001 1 commit

don't bother setting the ssl info callback unless SSLLogLevel >= info · fd233547

Doug MacEachern authored Nov 24, 2001

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92151 13f79535-47bb-0310-9956-ffa450edef68

fd233547

23 Nov, 2001 1 commit

Modify post_config hook so that it can return a error, · 81cca93a

Ian Holsman authored Nov 23, 2001

causing the server not to start.
previous method was to call exit(1) which would not fail
gracefully

PR:
Obtained from:
Submitted by:
Reviewed by:	(Idea only Jeff Trawick)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92144 13f79535-47bb-0310-9956-ffa450edef68

81cca93a

22 Nov, 2001 7 commits

dont va_start() in ssl_log() unless we are actually going to log something · f648ad3b
Doug MacEachern authored Nov 22, 2001
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92123 13f79535-47bb-0310-9956-ffa450edef68
```
f648ad3b

avoid a couple of calls to ssl_util_vhostid() and apr_psprintf() · 58b1b5e7

Doug MacEachern authored Nov 22, 2001

unless loglevel >= SSL_LOG_INFO
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92122 13f79535-47bb-0310-9956-ffa450edef68

58b1b5e7

optimize lookup of ssl-{unclean,accurate}-shutdown flags: · ca285b54

Doug MacEachern authored Nov 22, 2001

- only look through the table once, rather than 2 apr_table_gets()
- case-sensitive and use strcmp() as little as possible
- only lookup once per-connection, as the flags will not change across
  keepalive requests
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92121 13f79535-47bb-0310-9956-ffa450edef68

ca285b54

return from ssl_callback_LogTracingState if sc->nLogLevel < SSL_LOG_INFO · 0b5976c0

Doug MacEachern authored Nov 22, 2001

else there are 5 (expensive!) calls made to ssl_var_lookup on every request
for info that will never be logged
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92119 13f79535-47bb-0310-9956-ffa450edef68

0b5976c0

remove AP_CTX_* macros which are no longer used · 87affd68

Doug MacEachern authored Nov 22, 2001


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92114 13f79535-47bb-0310-9956-ffa450edef68

87affd68

get rid of 'apctx' table that used to live in SSL_get_app_data2(ssl) · 8277f0b9

Doug MacEachern authored Nov 22, 2001

change app_data2 to be the request_rec itself.
if something needs per-request context in the future,
it can use r->request_config

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92113 13f79535-47bb-0310-9956-ffa450edef68

8277f0b9

move c->notes.ssl::verify::depth to SSLConnRec.verify_depth · b2a99e3b

Doug MacEachern authored Nov 22, 2001

note: may actually be removed unless somebody can figure out why it is in
there to begin with
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92111 13f79535-47bb-0310-9956-ffa450edef68

b2a99e3b

21 Nov, 2001 5 commits

get rid of SSL_get_app_data2_idx() which had a race condition when · 44b639d4

Doug MacEachern authored Nov 21, 2001

writing to app_data2_idx, and another inside OpenSSL when calling
SSL_get_ex_new_index().
add SSL_init_app_data2_idx() to provide the same functionality but in
a safe place: called during ssl_init_Module
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92110 13f79535-47bb-0310-9956-ffa450edef68

44b639d4

move c->notes.ssl::verify::{info,error} to SSLConnRec.verify_{info,error} · 15ae2d0c

Doug MacEachern authored Nov 21, 2001

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92109 13f79535-47bb-0310-9956-ffa450edef68

15ae2d0c

move c->notes.ssl::flag::{unclean,accurate}-shutdown to SSLConnRec.shutdown_type · eb7bc72b

Doug MacEachern authored Nov 21, 2001

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92100 13f79535-47bb-0310-9956-ffa450edef68

eb7bc72b

move c->notes.ssl::client::dn to SSLConnRec.client_dn · a75b92ff

Doug MacEachern authored Nov 21, 2001

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92094 13f79535-47bb-0310-9956-ffa450edef68

a75b92ff

start moving c->notes usage to a new SSLConnRec structure hanging off of · ed882f1b

Doug MacEachern authored Nov 21, 2001

c->conn_config
PR:
Obtained from:
Submitted by:
Reviewed by: rbb, madhu


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92093 13f79535-47bb-0310-9956-ffa450edef68

ed882f1b

20 Nov, 2001 2 commits

Gets us compiling again on FreeBSD. Adds conditional compilation around · f59ac367

Aaron Bannert authored Nov 20, 2001

thread mutex routines for when we don't have APR_HAS_THREADS.

Submitted by:	Justin Erenkrantz
Reviewed by:	Aaron Bannert


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92061 13f79535-47bb-0310-9956-ffa450edef68

f59ac367

No good reason to have this in <> instead of "". Having it in <> might · 63f7c8b6

Aaron Bannert authored Nov 20, 2001

interact badly with makefile dependency generators, too.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92059 13f79535-47bb-0310-9956-ffa450edef68

63f7c8b6

19 Nov, 2001 1 commit

add input filter AP_MODE_INIT support to handshake before reading · 5f0b410b

Doug MacEachern authored Nov 19, 2001

request data from the client.
PR:
Obtained from:
Submitted by:	dougm
Reviewed by:	wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@92043 13f79535-47bb-0310-9956-ffa450edef68

5f0b410b

16 Nov, 2001 1 commit

Conversion from old apr_lock_t to new apr_thread_mutex_t · fc6abc4a

Aaron Bannert authored Nov 16, 2001

(only converting INTRAPROCESS locks at this time).

I don't see how this used to work, which also means I'm not entirely
sure if it works now. It really didn't look like it was allocating
the correct size before. It compiles and SSL still works in my limited
tests, but I'd appreciate a second opinion.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91979 13f79535-47bb-0310-9956-ffa450edef68

fc6abc4a

15 Nov, 2001 3 commits

Fix the SSL filter logic. The SSL filter is not a network filter, because · 6539d1c4

Ryan Bloom authored Nov 15, 2001

it does not actually do the reading and writing to the network. By
moving that filter to in between CONNECTION and NETWORK filters, we ensure
that SSL is always called before the core.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91969 13f79535-47bb-0310-9956-ffa450edef68

6539d1c4

Style updates before I convert to the new lock type. · abb6860e

Aaron Bannert authored Nov 15, 2001


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91966 13f79535-47bb-0310-9956-ffa450edef68

abb6860e

Ignore *.slo files. · 476ba2b9

Aaron Bannert authored Nov 15, 2001


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91961 13f79535-47bb-0310-9956-ffa450edef68

476ba2b9

14 Nov, 2001 1 commit

Turns out this is causing problems on my linux box (libtool 1.3.5), so · ee0ef629

Aaron Bannert authored Nov 14, 2001

I'm going to remove it until I or someone else can come up with a better
way to check for and link against libssl and libcrypto for mod_ssl.so.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91950 13f79535-47bb-0310-9956-ffa450edef68

ee0ef629

12 Nov, 2001 1 commit

fix segv triggered by recent ap_lingering_close change · acc18647

Doug MacEachern authored Nov 12, 2001

need to set SSLFilterRec.pssl = NULL when ssl_hook_CloseConnection is called
otherwise, ap_lingering_close -> ap_flush_conn will call ssl_io_filter_Output
which thinks it can still use the SSLFilterRec.pssl
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91886 13f79535-47bb-0310-9956-ffa450edef68

acc18647

07 Nov, 2001 3 commits

Gets mod_ssl building/loading as a DSO on some platforms (like HPUX). · 14fd76cd

Aaron Bannert authored Nov 07, 2001

Submitted by:	Madhu Mathihalli <madhusudan_mathihalli@hp.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91791 13f79535-47bb-0310-9956-ffa450edef68

14fd76cd

Don't close the dbm until after we have copied the datum retrieved by the fetch · 348d06cf

Bill Stoddard authored Nov 07, 2001

into a local buffer.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91781 13f79535-47bb-0310-9956-ffa450edef68

348d06cf

Check the return code properly. · 330cae3d

Bill Stoddard authored Nov 07, 2001


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91774 13f79535-47bb-0310-9956-ffa450edef68

330cae3d

20 Oct, 2001 1 commit

· f164fcd2

William A. Rowe Jr authored Oct 20, 2001

  Fix a nasty GP fault... stop testing buckets after they are passed!!!


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@91610 13f79535-47bb-0310-9956-ffa450edef68

f164fcd2