You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rj...@apache.org on 2016/04/23 15:17:53 UTC
svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Author: rjung
Date: Sat Apr 23 13:17:52 2016
New Revision: 1740653
URL: http://svn.apache.org/viewvc?rev=1740653&view=rev
Log:
Support for OpenSSL 1.1.0:
- X509_STORE_CTX is now opaque.
Modified:
httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
httpd/httpd/trunk/modules/ssl/ssl_engine_ocsp.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
httpd/httpd/trunk/modules/ssl/ssl_util_stapling.c
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=1740653&r1=1740652&r2=1740653&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c Sat Apr 23 13:17:52 2016
@@ -432,7 +432,7 @@ int ssl_hook_Access(request_rec *r)
X509 *cert;
X509 *peercert;
X509_STORE *cert_store = NULL;
- X509_STORE_CTX cert_store_ctx;
+ X509_STORE_CTX *cert_store_ctx;
STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;
const SSL_CIPHER *cipher = NULL;
int depth, verify_old, verify, n, is_slave = 0;
@@ -913,25 +913,27 @@ int ssl_hook_Access(request_rec *r)
cert = sk_X509_value(cert_stack, 0);
}
- X509_STORE_CTX_init(&cert_store_ctx, cert_store, cert, cert_stack);
+ cert_store_ctx = X509_STORE_CTX_new();
+ X509_STORE_CTX_init(cert_store_ctx, cert_store, cert, cert_stack);
depth = SSL_get_verify_depth(ssl);
if (depth >= 0) {
- X509_STORE_CTX_set_depth(&cert_store_ctx, depth);
+ X509_STORE_CTX_set_depth(cert_store_ctx, depth);
}
- X509_STORE_CTX_set_ex_data(&cert_store_ctx,
+ X509_STORE_CTX_set_ex_data(cert_store_ctx,
SSL_get_ex_data_X509_STORE_CTX_idx(),
(char *)ssl);
- if (!X509_verify_cert(&cert_store_ctx)) {
+ if (!X509_verify_cert(cert_store_ctx)) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02224)
"Re-negotiation verification step failed");
ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
}
- SSL_set_verify_result(ssl, cert_store_ctx.error);
- X509_STORE_CTX_cleanup(&cert_store_ctx);
+ SSL_set_verify_result(ssl, X509_STORE_CTX_get_error(cert_store_ctx));
+ X509_STORE_CTX_cleanup(cert_store_ctx);
+ X509_STORE_CTX_free(cert_store_ctx);
if (cert_stack != SSL_get_peer_cert_chain(ssl)) {
/* we created this ourselves, so free it */
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_ocsp.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_ocsp.c?rev=1740653&r1=1740652&r2=1740653&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_ocsp.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_ocsp.c Sat Apr 23 13:17:52 2016
@@ -109,7 +109,7 @@ static OCSP_REQUEST *create_request(X509
{
OCSP_REQUEST *req = OCSP_REQUEST_new();
- *certid = OCSP_cert_to_id(NULL, cert, ctx->current_issuer);
+ *certid = OCSP_cert_to_id(NULL, cert, X509_STORE_CTX_get0_current_issuer(ctx));
if (!*certid || !OCSP_request_add0_id(req, *certid)) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01921)
"could not retrieve certificate id");
@@ -184,7 +184,7 @@ static int verify_ocsp_status(X509 *cert
if (rc == V_OCSP_CERTSTATUS_GOOD) {
/* TODO: allow flags configuration. */
- if (OCSP_basic_verify(basicResponse, NULL, ctx->ctx, 0) != 1) {
+ if (OCSP_basic_verify(basicResponse, NULL, X509_STORE_CTX_get0_store(ctx), 0) != 1) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)
"failed to verify the OCSP response");
ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1740653&r1=1740652&r2=1740653&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Sat Apr 23 13:17:52 2016
@@ -219,6 +219,16 @@ void init_bio_methods(void);
void free_bio_methods(void);
#endif
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#define X509_STORE_CTX_get0_store(x) (x->ctx)
+#endif
+
+#if OPENSSL_VERSION_NUMBER < 0x10000000L
+#ifndef X509_STORE_CTX_get0_current_issuer
+#define X509_STORE_CTX_get0_current_issuer(x) (x->current_issuer)
+#endif
+#endif
+
/* mod_ssl headers */
#include "ssl_util_ssl.h"
Modified: httpd/httpd/trunk/modules/ssl/ssl_util_stapling.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_util_stapling.c?rev=1740653&r1=1740652&r2=1740653&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_util_stapling.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_util_stapling.c Sat Apr 23 13:17:52 2016
@@ -79,7 +79,7 @@ static X509 *stapling_get_issuer(modssl_
X509 *issuer = NULL;
int i;
X509_STORE *st = SSL_CTX_get_cert_store(mctx->ssl_ctx);
- X509_STORE_CTX inctx;
+ X509_STORE_CTX *inctx;
STACK_OF(X509) *extra_certs = NULL;
#ifdef OPENSSL_NO_SSL_INTERN
@@ -100,13 +100,14 @@ static X509 *stapling_get_issuer(modssl_
}
}
- if (!X509_STORE_CTX_init(&inctx, st, NULL, NULL))
+ inctx = X509_STORE_CTX_new();
+ if (!X509_STORE_CTX_init(inctx, st, NULL, NULL))
return 0;
- if (X509_STORE_CTX_get1_issuer(&issuer, &inctx, x) <= 0)
+ if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0)
issuer = NULL;
- X509_STORE_CTX_cleanup(&inctx);
+ X509_STORE_CTX_cleanup(inctx);
+ X509_STORE_CTX_free(inctx);
return issuer;
-
}
int ssl_stapling_init_cert(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp,
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Yann Ylavic <yl...@gmail.com>.
On Fri, Apr 29, 2016 at 11:29 AM, Rainer Jung <ra...@kippdata.de> wrote:
> Am 29.04.2016 um 10:26 schrieb Yann Ylavic:
>>
>> On Fri, Apr 29, 2016 at 10:16 AM, Yann Ylavic <yl...@gmail.com>
>> wrote:
>>>
>>> Hi Rainer,
>>>
>>> On Fri, Apr 29, 2016 at 10:13 AM, Rainer Jung <ra...@kippdata.de>
>>> wrote:
>>>>
>>>> The function X509_STORE_CTX_get0_current_issuer() has first shown up in
>>>> OpenSSL 1.0.0, but is not available in 0.9.8.
>>>
>>>
>>> I don't see it in 1.0.1s, but it is in 1.0.2g, maybe introduced in 1.0.2?
>>
>>
>> It seems to
>> (https://github.com/openssl/openssl/commit/75f535315aadb36a4c591c0b6710e4962a7aa841).
>
>
> That's the change why we need for
>
> +#if OPENSSL_VERSION_NUMBER < 0x10002000L
> +#define X509_STORE_CTX_get0_store(x) (x->ctx)
> +#endif
>
> But you were asking for
>
> +#if OPENSSL_VERSION_NUMBER < 0x10000000L
> +#ifndef X509_STORE_CTX_get0_current_issuer
> +#define X509_STORE_CTX_get0_current_issuer(x) (x->current_issuer)
> +#endif
>
> And X509_STORE_CTX_get0_current_issuer() is a function since 1.0.0 (no
> letter) and was introduced as a macro somewhere in the middle of 0.9.8.
> Therefore the nested check above.
Oh, right, sorry for the confusion.
Thanks Rainer.
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Rainer Jung <ra...@kippdata.de>.
Am 29.04.2016 um 10:26 schrieb Yann Ylavic:
> On Fri, Apr 29, 2016 at 10:16 AM, Yann Ylavic <yl...@gmail.com> wrote:
>> Hi Rainer,
>>
>> On Fri, Apr 29, 2016 at 10:13 AM, Rainer Jung <ra...@kippdata.de> wrote:
>>> The function X509_STORE_CTX_get0_current_issuer() has first shown up in
>>> OpenSSL 1.0.0, but is not available in 0.9.8.
>>
>> I don't see it in 1.0.1s, but it is in 1.0.2g, maybe introduced in 1.0.2?
>
> It seems to (https://github.com/openssl/openssl/commit/75f535315aadb36a4c591c0b6710e4962a7aa841).
That's the change why we need for
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#define X509_STORE_CTX_get0_store(x) (x->ctx)
+#endif
But you were asking for
+#if OPENSSL_VERSION_NUMBER < 0x10000000L
+#ifndef X509_STORE_CTX_get0_current_issuer
+#define X509_STORE_CTX_get0_current_issuer(x) (x->current_issuer)
+#endif
And X509_STORE_CTX_get0_current_issuer() is a function since 1.0.0 (no
letter) and was introduced as a macro somewhere in the middle of 0.9.8.
Therefore the nested check above.
It is in include/openssl/symhacks.h for 0.9.8 and was added to 1.0.0 with
https://github.com/openssl/openssl/commit/4a7f7171f5dbaa4cbab2d3768a2c93e96a9dcdb5
I didn't check whether the macro in 0.9.8 actually works if it is
defined, but I hope so ...
Regards,
Rainer
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Yann Ylavic <yl...@gmail.com>.
On Fri, Apr 29, 2016 at 10:16 AM, Yann Ylavic <yl...@gmail.com> wrote:
> Hi Rainer,
>
> On Fri, Apr 29, 2016 at 10:13 AM, Rainer Jung <ra...@kippdata.de> wrote:
>> The function X509_STORE_CTX_get0_current_issuer() has first shown up in
>> OpenSSL 1.0.0, but is not available in 0.9.8.
>
> I don't see it in 1.0.1s, but it is in 1.0.2g, maybe introduced in 1.0.2?
It seems to (https://github.com/openssl/openssl/commit/75f535315aadb36a4c591c0b6710e4962a7aa841).
>
> Regards,
> Yann.
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Yann Ylavic <yl...@gmail.com>.
Hi Rainer,
On Fri, Apr 29, 2016 at 10:13 AM, Rainer Jung <ra...@kippdata.de> wrote:
> The function X509_STORE_CTX_get0_current_issuer() has first shown up in
> OpenSSL 1.0.0, but is not available in 0.9.8.
I don't see it in 1.0.1s, but it is in 1.0.2g, maybe introduced in 1.0.2?
Regards,
Yann.
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Rainer Jung <ra...@kippdata.de>.
Hi Yann,
Am 29.04.2016 um 09:59 schrieb Yann Ylavic:
> On Sat, Apr 23, 2016 at 3:17 PM, <rj...@apache.org> wrote:
>> Author: rjung
>> Date: Sat Apr 23 13:17:52 2016
>> New Revision: 1740653
>>
>> URL: http://svn.apache.org/viewvc?rev=1740653&view=rev
>> Log:
>> Support for OpenSSL 1.1.0:
>> - X509_STORE_CTX is now opaque.
>>
>> Modified:
> []
>> httpd/httpd/trunk/modules/ssl/ssl_private.h
> []
>>
>> Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
>> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1740653&r1=1740652&r2=1740653&view=diff
>> ==============================================================================
>> --- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
>> +++ httpd/httpd/trunk/modules/ssl/ssl_private.h Sat Apr 23 13:17:52 2016
>> @@ -219,6 +219,16 @@ void init_bio_methods(void);
>> void free_bio_methods(void);
>> #endif
>>
>> +#if OPENSSL_VERSION_NUMBER < 0x10002000L
>> +#define X509_STORE_CTX_get0_store(x) (x->ctx)
>> +#endif
>> +
>> +#if OPENSSL_VERSION_NUMBER < 0x10000000L
>
> 0x10100000L ?
Thanks for carefully checking. In this case actually 0x10000000L was
meant. The function X509_STORE_CTX_get0_current_issuer() has first shown
up in OpenSSL 1.0.0, but is not available in 0.9.8.
>> +#ifndef X509_STORE_CTX_get0_current_issuer
>> +#define X509_STORE_CTX_get0_current_issuer(x) (x->current_issuer)
>> +#endif
>> +#endif
>> +
Regards,
Rainer
Re: svn commit: r1740653 - in /httpd/httpd/trunk/modules/ssl:
ssl_engine_kernel.c ssl_engine_ocsp.c ssl_private.h ssl_util_stapling.c
Posted by Yann Ylavic <yl...@gmail.com>.
On Sat, Apr 23, 2016 at 3:17 PM, <rj...@apache.org> wrote:
> Author: rjung
> Date: Sat Apr 23 13:17:52 2016
> New Revision: 1740653
>
> URL: http://svn.apache.org/viewvc?rev=1740653&view=rev
> Log:
> Support for OpenSSL 1.1.0:
> - X509_STORE_CTX is now opaque.
>
> Modified:
[]
> httpd/httpd/trunk/modules/ssl/ssl_private.h
[]
>
> Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1740653&r1=1740652&r2=1740653&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
> +++ httpd/httpd/trunk/modules/ssl/ssl_private.h Sat Apr 23 13:17:52 2016
> @@ -219,6 +219,16 @@ void init_bio_methods(void);
> void free_bio_methods(void);
> #endif
>
> +#if OPENSSL_VERSION_NUMBER < 0x10002000L
> +#define X509_STORE_CTX_get0_store(x) (x->ctx)
> +#endif
> +
> +#if OPENSSL_VERSION_NUMBER < 0x10000000L
0x10100000L ?
> +#ifndef X509_STORE_CTX_get0_current_issuer
> +#define X509_STORE_CTX_get0_current_issuer(x) (x->current_issuer)
> +#endif
> +#endif
> +
Regards,
Yann.