You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rp...@apache.org on 2011/08/26 15:07:49 UTC
svn commit: r1162103 - /httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
Author: rpluem
Date: Fri Aug 26 13:07:49 2011
New Revision: 1162103
URL: http://svn.apache.org/viewvc?rev=1162103&view=rev
Log:
* Don't SEGFAULT if SSLProxyMachineCertificateChainFile is not set. Just skip the additional lookups in this case.
Modified:
httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=1162103&r1=1162102&r2=1162103&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c Fri Aug 26 13:07:49 2011
@@ -1803,6 +1803,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X5
STACK_OF(X509_NAME) *ca_list;
STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs;
STACK_OF(X509_INFO) *ca_certs;
+ STACK_OF(X509_INFO) **ca_cert_chains;
int i, j, k;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
@@ -1833,6 +1834,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X5
return TRUE;
}
+ ca_cert_chains = sc->proxy->pkp->ca_certs;
for (i = 0; i < sk_X509_NAME_num(ca_list); i++) {
ca_name = sk_X509_NAME_value(ca_list, i);
@@ -1849,20 +1851,25 @@ int ssl_callback_proxy_cert(SSL *ssl, X5
return TRUE;
}
- /* Failed to find direct issuer - search intermediaries (by issuer name) */
- ca_certs = sc->proxy->pkp->ca_certs[j];
- for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
- ca_info = sk_X509_INFO_value(ca_certs, k);
- ca_issuer = X509_get_issuer_name(ca_info->x509);
-
- if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) {
- modssl_proxy_info_log(s, info, "found acceptable cert by intermediary");
-
- modssl_set_cert_info(info, x509, pkey);
-
- return TRUE;
- }
- } /* end loop through chained certs */
+ if (ca_cert_chains) {
+ /*
+ * Failed to find direct issuer - search intermediaries
+ * (by issuer name), if provided.
+ */
+ ca_certs = ca_cert_chains[j];
+ for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
+ ca_info = sk_X509_INFO_value(ca_certs, k);
+ ca_issuer = X509_get_issuer_name(ca_info->x509);
+
+ if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) {
+ modssl_proxy_info_log(s, info, "found acceptable cert by intermediary");
+
+ modssl_set_cert_info(info, x509, pkey);
+
+ return TRUE;
+ }
+ } /* end loop through chained certs */
+ }
} /* end loop through available certs */
}