git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@188834 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@188833 13f79535-47bb-0310-9956-ffa450edef68

off-by-one.

PR: 35081
Submitted by: Marc Stern <mstern csc.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@179781 13f79535-47bb-0310-9956-ffa450edef68

  Reintroduce stack frame construction with /Oy- (removal was implied by /O2).
  This makes binaries far easier to debug, during operation and for post-crash
  .dmp analysis.  Do not alter /Gs optimizations per brane.

Reviewed by: stoddard, brane

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@170253 13f79535-47bb-0310-9956-ffa450edef68

  svn:eol-style = native


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@164428 13f79535-47bb-0310-9956-ffa450edef68

setting when configured e.g. as a reverse proxy:

* modules/ssl/ssl_private.h: Remove ssl_hook_Translate.

* modules/ssl/ssl_engine_kernel.c (ssl_hook_ReadReq): Merge in
ssl_hook_Translate.  (ssl_hook_Translate): Remove.

* modules/ssl/mod_ssl.c (ssl_register_hooks): Ensure that _ReadReq
hook runs after mod_setenvif.c; don't register translate_name hook.

PR: 34452


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@161958 13f79535-47bb-0310-9956-ffa450edef68

Submitted by: Guenter Knauf <fuankg@apache.org>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@161813 13f79535-47bb-0310-9956-ffa450edef68

  Second fat-fingered typo in 24 hrs.  Balance parens, this now compiles.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@157947 13f79535-47bb-0310-9956-ffa450edef68

  Clean up emit for size truncation.  Division here ensures we fit nicely.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@157946 13f79535-47bb-0310-9956-ffa450edef68

* modules/ssl/ssl_engine_vars.c (ssl_ext_lookup): New function.
(ssl_var_register): Register optional function.

* modules/ssl/ssl_private.h (ssl_ext_lookup): Add prototype.

Submitted by: David Reid, Joe Orton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@153933 13f79535-47bb-0310-9956-ffa450edef68

internalise the ap_reg*<->PCRE wrapper:

* configure.in: Add srclib/pcre to the include path.

* include/ap_regex.h: Renamed from include/pcreposix.h.  Prefix all
constants with AP_; prefix all functions and types with ap_.  Define
AP_DECLARE to nothing if necessary.  Remove regcomp error codes.

* include/httpd.h: Include ap_regex.h not pcreposix.h.
(ap_pregcomp, ap_regexec, ap_regfree): s/regex_t/ap_regex_t/.
(ap_regexec, ap_regerror): Prototypes moved to ap_regex.h.

* server/util.c (regex_cleanup, ap_pregcomp, ap_pregsub, ap_pregfree):
Adjust for ap_ prefixed types.  (ap_regexec, ap_regerror): Removed.

* server/Makefile.in: Build util_pcre.c.

* server/util_pcre.c: Copied from srclib/pcre/pcreposix.c; remove use
of PCRE-internals to do error mapping; rename types to add AP_/ap_
prefixes as above.  Use APR includes.  (ap_regerror): Use apr_snprintf.

* srclib/pcre/Makefile.in: Don't build pcreposix.c into libpcre.la.

* modules/*: Update to use new type and constant names.

PR: 27750 (part one)
Submitted by: Andres Salomon <dilinger voxel.net>, Joe Orton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@153384 13f79535-47bb-0310-9956-ffa450edef68

SSLUsername-controlled assignment of r->user above the SSLRequire
checks so that the "username" gets logged if SSLRequire denies access.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@153280 13f79535-47bb-0310-9956-ffa450edef68

were escaped as fallout from CAN-2003-0020.

Submitted by: Eric Covener <ecovener gmail.com>
Reviewed by: Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@153105 13f79535-47bb-0310-9956-ffa450edef68

client certificate.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@151493 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@151408 13f79535-47bb-0310-9956-ffa450edef68

connection was reset.

PR: 32699


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@125166 13f79535-47bb-0310-9956-ffa450edef68

SSLCADNRequestFile and SSLCADNRequestPath.

* modules/ssl/ssl_private.h (modssl_pk_server_t): Add ca_name_path,
ca_name_file fields.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_verify): If either of
SSLCADNRequestFile or SSLCADNRequestPath are configured, load the CA
DN list sent in the CertificateRequest from those certificates.

* modules/ssl/ssl_engine_config.c (modssl_ctx_init_server): Use
pcalloc to zero-initialize the entire modssl_pk_server_t structure.
(ssl_config_server_new): Merge the ca_name_* fields.
(ssl_cmd_SSLCADNRequestPath, ssl_cmd_SSLCADNRequestFile): New
functions.

PR: 32848
Submitted by: Tim Taylor <tim.taylor dfas.mil>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@125165 13f79535-47bb-0310-9956-ffa450edef68

  It's perferable to use a debug build of ssleay32/libeay32, but offer
  a fallback if they are built as release libraries for creating
  mod_ssl in debug mode.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@124284 13f79535-47bb-0310-9956-ffa450edef68

  FINALLY Correct ap_http_method()!  It is NOT a method, it's a SCHEME!

  Bumped mmn, and ap module cookie, for this function rename.

  It's not a deprecation, as ap_http_method would be a lovely function
  name sometime in the future: to determine what the function name implies.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@123882 13f79535-47bb-0310-9956-ffa450edef68

passed-brigade-reuse "fix" which is currently unnecessary.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@111962 13f79535-47bb-0310-9956-ffa450edef68

from using ap_log_cerror from a c->pool cleanup; the debug message
triggers too often anyway so just remove it.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@111959 13f79535-47bb-0310-9956-ffa450edef68

X509_STORE_CTX_get_ex_data() and SSL_get_ex_data_X509_STORE_CTX_idx()
to use the correct ex_data index from the context in pathological
cases where SSL_get_ex_data_X509_STORE_CTX_idx() does not return 0.

PR: 32529


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@111241 13f79535-47bb-0310-9956-ffa450edef68

Upgrade header check; allow upgrades on any method; don't drop the
ap_pass_brigade return value.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@111159 13f79535-47bb-0310-9956-ffa450edef68

unnecessary check of the Connection request header.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@109499 13f79535-47bb-0310-9956-ffa450edef68

The first client I tested was sending 'upgrade'.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@109447 13f79535-47bb-0310-9956-ffa450edef68

Improve error messages.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@106573 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@106103 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105796 13f79535-47bb-0310-9956-ffa450edef68

change to mod_proxy_http):

* modules/ssl/ssl_engine_io.c (bio_filter_in_read): Return an error if
the read would block so that the SSL_read() caller checks for
SSL_ERROR_WANT_READ, rather than 0, which is treated like EOF.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105768 13f79535-47bb-0310-9956-ffa450edef68

configured SSL certificates to stdout, useful for cron-ing through a
"do I need to renew any of my certificates this week" tool:

* modules/ssl/ssl_engine_config.c (ssl_hook_ConfigTest): New function.

* modules/ssl/mod_ssl.c (ssl_register_hooks): ...register it as a
test_config hook.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105741 13f79535-47bb-0310-9956-ffa450edef68

hide all global symbols defined by mod_ssl other than the module
structure (where possible).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105740 13f79535-47bb-0310-9956-ffa450edef68

modules/mod_ssl.c: Switch to using ap_log_cerror() in place of
ap_log_error() everywhere that the conn_rec * is available.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105739 13f79535-47bb-0310-9956-ffa450edef68

defined and documented and can't be changed.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105683 13f79535-47bb-0310-9956-ffa450edef68

NULL pointer dereference in some configurations.

PR: 31848


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105663 13f79535-47bb-0310-9956-ffa450edef68

Add a check for SSL_ENABLED_OPTIONAL to the http_method and default_port hook so that they return the correct values for an upgradeable connection.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105426 13f79535-47bb-0310-9956-ffa450edef68

* modules/mappers/mod_rewrite.c, modules/ssl/ssl_engine_mutex.c: Use
AP_NEED_SET_MUTEX_PERMS to determine whether unixd_set_*_mutex_perms
calls are necessary.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105411 13f79535-47bb-0310-9956-ffa450edef68

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that a
correct cipher suite has been negotiated, else deny access.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): With OpenSSL
0.9.7, prevent session resumption during a renegotiation to force the
client to negotiate a new (and acceptable) cipher suite.

Submitted by: Hartmut Keil <Hartmut.Keil adnovum.ch>, Joe Orton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105396 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105354 13f79535-47bb-0310-9956-ffa450edef68

502 not 501 if SSL_connect() fails for a proxy connection.

PR: 31083


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105252 13f79535-47bb-0310-9956-ffa450edef68

shm is not supported, always remove the named segment first to cope
with unclean shutdowns.

PR: 21335 (continued)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@105249 13f79535-47bb-0310-9956-ffa450edef68