You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by dr...@apache.org on 2011/09/14 22:16:02 UTC
svn commit: r1170833 - in /httpd/httpd/trunk: docs/manual/mod/mod_ssl.xml
modules/ssl/ssl_engine_init.c modules/ssl/ssl_engine_kernel.c
modules/ssl/ssl_private.h modules/ssl/ssl_util_ssl.c
modules/ssl/ssl_util_ssl.h
Author: druggeri
Date: Wed Sep 14 20:16:02 2011
New Revision: 1170833
URL: http://svn.apache.org/viewvc?rev=1170833&view=rev
Log:
Modify SSLProxyMachineCertificateChainFile to use X509 instead of X509_INFO and use openssl to construct the chain
Modified:
httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c
httpd/httpd/trunk/modules/ssl/ssl_util_ssl.h
Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Wed Sep 14 20:16:02 2011
@@ -1549,6 +1549,11 @@ This referenced file is simply the conca
certificate files. Upon startup, each client certificate configured will
be examined and a chain of trust will be constructed.
</p>
+<note type="warning"><title>Security warning</title>
+<p>If this directive is enabled, all of the certificates in the file will be
+trusted as if they were also in <directive module="mod_ssl">
+SSLProxyCACertificateFile</directive>.</p>
+</note>
<example><title>Example</title>
SSLProxyMachineCertificateChainFile /usr/local/apache2/conf/ssl.crt/proxyCA.pem
</example>
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Wed Sep 14 20:16:02 2011
@@ -1115,7 +1115,9 @@ static void ssl_init_proxy_certs(server_
int n, ncerts = 0;
STACK_OF(X509_INFO) *sk;
modssl_pk_proxy_t *pkp = mctx->pkp;
- STACK_OF(X509_INFO) *chain;
+ STACK_OF(X509) *chain;
+ X509_STORE_CTX *sctx;
+ X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
SSL_CTX_set_client_cert_cb(mctx->ssl_ctx,
ssl_callback_proxy_cert);
@@ -1161,29 +1163,42 @@ static void ssl_init_proxy_certs(server_
ncerts);
pkp->certs = sk;
- if (!pkp->ca_cert_file) {
+
+ if (!pkp->ca_cert_file || !store) {
return;
}
/* Load all of the CA certs and construct a chain */
- sk = sk_X509_INFO_new_null();
+ pkp->ca_certs = (STACK_OF(X509) **) apr_pcalloc(p, ncerts * sizeof(sk));
+ sctx = X509_STORE_CTX_new();
+
+ if (!sctx) {
+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+ "SSL proxy client cert initialization failed");
+ ssl_die();
+ }
- SSL_X509_INFO_load_file(ptemp, sk, pkp->ca_cert_file);
- pkp->ca_certs = (STACK_OF(X509_INFO) **) apr_pcalloc(p, ncerts * sizeof(sk));
+ X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
for (n = 0; n < ncerts; n++) {
- int len;
+ int i;
X509_INFO *inf = sk_X509_INFO_value(pkp->certs, n);
- chain = sk_X509_INFO_new_null();
- len = SSL_X509_INFO_create_chain(inf->x509, sk, chain);
+ X509_STORE_CTX_init(sctx, store, inf->x509, NULL);
+ X509_verify_cert(sctx);
+ ERR_clear_error();
+
+ chain = X509_STORE_CTX_get1_chain(sctx);
+ sk_X509_shift(chain);
+ i=sk_X509_num(chain);
pkp->ca_certs[n] = chain;
+ X509_STORE_CTX_cleanup(sctx);
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
"client certificate %i has loaded %i "
- "intermediary signers ", n, len);
+ "intermediate CA%s", n, i, i == 1 ? "" : "s");
}
- sk_X509_INFO_free(sk);
+ X509_STORE_CTX_free(sctx);
}
static void ssl_init_proxy_ctx(server_rec *s,
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c Wed Sep 14 20:16:02 2011
@@ -1588,11 +1588,12 @@ int ssl_callback_proxy_cert(SSL *ssl, X5
server_rec *s = mySrvFromConn(c);
SSLSrvConfigRec *sc = mySrvConfig(s);
X509_NAME *ca_name, *issuer, *ca_issuer;
- X509_INFO *info, *ca_info;
+ X509_INFO *info;
+ X509 *ca_cert;
STACK_OF(X509_NAME) *ca_list;
STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs;
- STACK_OF(X509_INFO) *ca_certs;
- STACK_OF(X509_INFO) **ca_cert_chains;
+ STACK_OF(X509) *ca_certs;
+ STACK_OF(X509) **ca_cert_chains;
int i, j, k;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
@@ -1640,21 +1641,21 @@ int ssl_callback_proxy_cert(SSL *ssl, X5
return TRUE;
}
- if (ca_cert_chains) {
+ if (ca_cert_chains) {
/*
- * Failed to find direct issuer - search intermediaries
+ * Failed to find direct issuer - search intermediates
* (by issuer name), if provided.
*/
ca_certs = ca_cert_chains[j];
- for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
- ca_info = sk_X509_INFO_value(ca_certs, k);
- ca_issuer = X509_get_issuer_name(ca_info->x509);
+ for (k = 0; k < sk_X509_num(ca_certs); k++) {
+ ca_cert = sk_X509_value(ca_certs, k);
+ ca_issuer = X509_get_issuer_name(ca_cert);
if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) {
- modssl_proxy_info_log(c, info, "found acceptable cert by intermediary");
+ modssl_proxy_info_log(c, info, "found acceptable cert by intermediate CA");
modssl_set_cert_info(info, x509, pkey);
-
+
return TRUE;
}
} /* end loop through chained certs */
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Wed Sep 14 20:16:02 2011
@@ -539,7 +539,7 @@ typedef struct {
const char *cert_path;
const char *ca_cert_file;
STACK_OF(X509_INFO) *certs;
- STACK_OF(X509_INFO) **ca_certs; /* ptr to array of ptrs */
+ STACK_OF(X509) **ca_certs; /* ptr to array of ptrs */
} modssl_pk_proxy_t;
/** stuff related to authentication that can also be per-dir */
Modified: httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c Wed Sep 14 20:16:02 2011
@@ -385,46 +385,6 @@ BOOL SSL_X509_INFO_load_path(apr_pool_t
return ok;
}
-/*
- * Construct a stack of X509_INFO containing only certificates
- * that have signed the provided certificate or are an intermediary
- * signer of the certificate
-*/
-int SSL_X509_INFO_create_chain(const X509 *x509,
- STACK_OF(X509_INFO) *ca_certs,
- STACK_OF(X509_INFO) *chain)
-{
- int can_proceed = 1;
- int len = 0;
- int i;
- X509 *certificate = (X509 *)x509;
- X509_INFO *info;
- X509_NAME *cert_issuer_name, *ca_name, *ca_issuer_name;
-
- while (can_proceed) {
- can_proceed = 0;
- cert_issuer_name = X509_get_issuer_name(certificate);
-
- for (i = 0; i < sk_X509_INFO_num(ca_certs); i++) {
- info = sk_X509_INFO_value(ca_certs, i);
- ca_name = X509_get_subject_name(info->x509);
- ca_issuer_name = X509_get_issuer_name(info->x509);
-
- if (X509_NAME_cmp(cert_issuer_name, ca_name) == 0) {
- /* Check for a self-signed cert (no issuer) */
- can_proceed = X509_NAME_cmp(ca_name, ca_issuer_name) == 0
- ? 0 : 1;
- len++;
- certificate = info->x509;
- sk_X509_INFO_unshift(chain, info);
- break;
- }
- }
- }
-
- return len;
-}
-
/* _________________________________________________________________
**
** Extra Server Certificate Chain Support
Modified: httpd/httpd/trunk/modules/ssl/ssl_util_ssl.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_util_ssl.h?rev=1170833&r1=1170832&r2=1170833&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_util_ssl.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_util_ssl.h Wed Sep 14 20:16:02 2011
@@ -72,7 +72,6 @@ BOOL SSL_X509_INFO_load_file(apr_
BOOL SSL_X509_INFO_load_path(apr_pool_t *, STACK_OF(X509_INFO) *, const char *);
int SSL_CTX_use_certificate_chain(SSL_CTX *, char *, int, pem_password_cb *);
char *SSL_SESSION_id2sz(unsigned char *, int, char *, int);
-int SSL_X509_INFO_create_chain(const X509 *, STACK_OF(X509_INFO) *, STACK_OF(X509_INFO) *);
#endif /* __SSL_UTIL_SSL_H__ */
/** @} */