Commits · 92accdb35a8d96c4d267622d254bf7e00a2e6740 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

Apr 02, 2002

PR: · 92accdb3

Doug MacEachern authored Apr 02, 2002

Obtained from:
Submitted by:
Reviewed by:    Ryan Bloom
ap_remove_output_filter no longer works for connection filters.
change logic in the case of "HTTP spoken on HTTPS port" to disable the
ssl filters rather than attempt to remove the filters.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94393 13f79535-47bb-0310-9956-ffa450edef68

92accdb3

various updates · e0a228be

Doug MacEachern authored Apr 02, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94392 13f79535-47bb-0310-9956-ffa450edef68

e0a228be

Mar 30, 2002

add/use EVP_PKEY_reference_inc and X509_reference_inc compat macros · be078833

Doug MacEachern authored Mar 30, 2002

to get these changes working with sslc


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94341 13f79535-47bb-0310-9956-ffa450edef68

be078833

add sslc compat for sk_X509_INFO_free · 7790a55d

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94340 13f79535-47bb-0310-9956-ffa450edef68

7790a55d

add SSLProxyCARevocation{File,Path} directives to support CRLs in the proxy · 495d5f41
Doug MacEachern authored Mar 30, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94338 13f79535-47bb-0310-9956-ffa450edef68
```
495d5f41

pass sc to myCtxConfig macro · 7e3f4fe9

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94337 13f79535-47bb-0310-9956-ffa450edef68

7e3f4fe9

make it possible for proxy to use CRL callback · a9bda397

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94336 13f79535-47bb-0310-9956-ffa450edef68

a9bda397

enable the verify callback for proxy · c8312a43

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94334 13f79535-47bb-0310-9956-ffa450edef68

c8312a43

change sc->server references to myCtxConfig, so proxy can use the · 9c0f1eae

Doug MacEachern authored Mar 30, 2002

verify callback.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94332 13f79535-47bb-0310-9956-ffa450edef68

9c0f1eae

add myCtxConfig macro · fff2032a

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94331 13f79535-47bb-0310-9956-ffa450edef68

fff2032a

implement proxy client certificate callback · af6f2c49

Doug MacEachern authored Mar 30, 2002

(uses SSLProxyMachineCertificate{File,Cert} when downstream server
requires a client certificate)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94329 13f79535-47bb-0310-9956-ffa450edef68

af6f2c49

input filter should not return failure when ssl runtime wants to read more · 79cd12cf
Doug MacEachern authored Mar 30, 2002
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94328 13f79535-47bb-0310-9956-ffa450edef68
```
79cd12cf

ssl_io_input_read needs to return something other than APR_SUCCESS · 1b0e0c77

Doug MacEachern authored Mar 30, 2002

when bucket read from socket was successful,
but there was an error within the ssl runtime.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94327 13f79535-47bb-0310-9956-ffa450edef68

1b0e0c77

load SSLProxyMachineCertificate{File,Path} · 9d470beb

Doug MacEachern authored Mar 30, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94324 13f79535-47bb-0310-9956-ffa450edef68

9d470beb

enable/cleanup SSL_X509_INFO_load_{file,path} functions for use in · 7d2ddf20

Doug MacEachern authored Mar 30, 2002

proxy context


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94323 13f79535-47bb-0310-9956-ffa450edef68

7d2ddf20

Fix the version string. We want to end up with "mod_ssl/2.0.xx", not · a7c4e365

Cliff Woolley authored Mar 30, 2002

"mod_ssl/Apache/2.0.xx".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94320 13f79535-47bb-0310-9956-ffa450edef68

a7c4e365

Mar 29, 2002

add SSLProxyEngine directive. this was not required in the 1.x based · 03a77177

Doug MacEachern authored Mar 29, 2002

mod_ssl because the SSL_CTX was created and configured for *every*
request. unlike in 2.0 where we configure the proxy SSL_CTX at
startup time, which is much better for performance. but we don't want
to configure a proxy context for every vhost if it isn't going to be
used, for the same reasons we don't create a server context for every
vhost unless SSLEngine is on.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94314 13f79535-47bb-0310-9956-ffa450edef68

03a77177

BUCKET FREELISTS · 6e9eab8b

Cliff Woolley authored Mar 29, 2002

Add an allocator-passing mechanism throughout the bucket brigades API.

From Apache's standpoint, the apr_bucket_alloc_t* used throughout a given
connection is stored in the conn_rec by the create_connection hook. That
means it's the MPM's job to optimize recycling of apr_bucket_alloc_t's --
the MPM must ensure that no two threads can ever use the same one at the
same time, for instance.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94304 13f79535-47bb-0310-9956-ffa450edef68

6e9eab8b

remove ssl_engine_ext.c · 8baeb249

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94302 13f79535-47bb-0310-9956-ffa450edef68

8baeb249

removing old proxy extension code · db5a70f6

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94301 13f79535-47bb-0310-9956-ffa450edef68

db5a70f6

need to flush output buffer before reading in proxy mode · 0c954617

Doug MacEachern authored Mar 29, 2002

need to call ssl_hook_process_connection in the output filter in proxy
mode, since proxy hits the output filter before the input filter

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94299 13f79535-47bb-0310-9956-ffa450edef68

0c954617

in proxy mode we need to SSL_connect rather than SSL_accept in · 03c4691c

Doug MacEachern authored Mar 29, 2002

ssl_hook_process_connection.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94298 13f79535-47bb-0310-9956-ffa450edef68

03c4691c

These two variables were left uninitialized accidentally. · c9013c1e

Cliff Woolley authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94297 13f79535-47bb-0310-9956-ffa450edef68

c9013c1e

add optional function (ssl_proxy_enable) to turn on ssl proxy · cf720bbb

Doug MacEachern authored Mar 29, 2002

choose SSL_CTX based on SSLConnRec.is_proxy


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94293 13f79535-47bb-0310-9956-ffa450edef68

cf720bbb

init proxy context · a169e0a8

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94292 13f79535-47bb-0310-9956-ffa450edef68

a169e0a8

s/id/mode/ in ssl_cmd_SSLProxyVerify · 623c0f41

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94290 13f79535-47bb-0310-9956-ffa450edef68

623c0f41

use ssl_cmd_verify_parse for SSLProxyVerify directive handler · b4254e2e

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94289 13f79535-47bb-0310-9956-ffa450edef68

b4254e2e

cleanup the proxy context · 695e8b39

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94288 13f79535-47bb-0310-9956-ffa450edef68

695e8b39

s/ctx/dcfg/g in ssl directive handlers · df4a1739

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94287 13f79535-47bb-0310-9956-ffa450edef68

df4a1739

enable proxy directives · 9b4db043

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94286 13f79535-47bb-0310-9956-ffa450edef68

9b4db043

change existing ssl_init_ctx() to ssl_init_ctx_protocol() · 14c88786

Doug MacEachern authored Mar 29, 2002

new ssl_init_ctx() inits the lot: protocol, session_cache, callbacks,
verify, cipher suite, crl, cert_chain

new ssl_init_server_ctx function inits everything for sc->server

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94285 13f79535-47bb-0310-9956-ffa450edef68

14c88786

proxy will have a different verify callback · f8c45bef

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94283 13f79535-47bb-0310-9956-ffa450edef68

f8c45bef

proxy needs to use client ssl method · c0f1b6af

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94282 13f79535-47bb-0310-9956-ffa450edef68

c0f1b6af

setup sc->proxy->sc · 3773b3f7

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94281 13f79535-47bb-0310-9956-ffa450edef68

3773b3f7

add ssl_config_server_new function to fold some duplication in server · d89cb0ba

Doug MacEachern authored Mar 29, 2002

create/merge and to make sure merge config is fully inititialized


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94280 13f79535-47bb-0310-9956-ffa450edef68

d89cb0ba

inititialize and merge proxy config · e92b4452

Doug MacEachern authored Mar 29, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94279 13f79535-47bb-0310-9956-ffa450edef68

e92b4452

no point in merging things which are not set until after merge happens. · 0a67e0db

Doug MacEachern authored Mar 29, 2002

make a note of those which are set during module init.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94278 13f79535-47bb-0310-9956-ffa450edef68

0a67e0db

'ctx' traditionally refers to an SSL_CTX. change modssl_ctx_t · fd421139

Doug MacEachern authored Mar 29, 2002

instances to 'mctx'


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94277 13f79535-47bb-0310-9956-ffa450edef68

fd421139

Mar 28, 2002

ctx->sc is set during init · c0a165b4

Doug MacEachern authored Mar 28, 2002


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94275 13f79535-47bb-0310-9956-ffa450edef68

c0a165b4

switch from SSLSrvConfigRec* to modssl_ctx_t* in the ssl_init_ctx* · bf56d059

Doug MacEachern authored Mar 28, 2002

functions


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94274 13f79535-47bb-0310-9956-ffa450edef68

bf56d059