You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sf...@apache.org on 2012/02/27 21:01:40 UTC
svn commit: r1294306 - in /httpd/httpd/trunk:
docs/log-message-tags/next-number modules/ssl/ssl_engine_init.c
modules/ssl/ssl_engine_kernel.c modules/ssl/ssl_private.h
Author: sf
Date: Mon Feb 27 20:01:40 2012
New Revision: 1294306
URL: http://svn.apache.org/viewvc?rev=1294306&view=rev
Log:
Initialize EC temporary key on server startup, as for DH and
RSA. This fixes a race condition that could lead to a crash with threaded
MPMs.
Modified:
httpd/httpd/trunk/docs/log-message-tags/next-number
httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
Modified: httpd/httpd/trunk/docs/log-message-tags/next-number
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/log-message-tags/next-number?rev=1294306&r1=1294305&r2=1294306&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/log-message-tags/next-number (original)
+++ httpd/httpd/trunk/docs/log-message-tags/next-number Mon Feb 27 20:01:40 2012
@@ -1 +1 @@
-2298
+2300
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1294306&r1=1294305&r2=1294306&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Mon Feb 27 20:01:40 2012
@@ -77,6 +77,9 @@ static void ssl_tmp_keys_free(server_rec
MODSSL_TMP_KEYS_FREE(mc, RSA);
MODSSL_TMP_KEYS_FREE(mc, DH);
+#ifndef OPENSSL_NO_EC
+ MODSSL_TMP_KEY_FREE(mc, EC_KEY, SSL_TMP_KEY_EC_256);
+#endif
}
static int ssl_tmp_key_init_rsa(server_rec *s,
@@ -157,6 +160,40 @@ static int ssl_tmp_key_init_dh(server_re
return OK;
}
+#ifndef OPENSSL_NO_EC
+static int ssl_tmp_key_init_ec(server_rec *s,
+ int bits, int idx)
+{
+ SSLModConfigRec *mc = myModConfig(s);
+ EC_KEY *ecdh = NULL;
+
+ /* XXX: Are there any FIPS constraints we should enforce? */
+
+ if (bits != 256) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02298)
+ "Init: Failed to generate temporary "
+ "%d bit EC parameters, only 256 bits supported", bits);
+ return !OK;
+ }
+
+ if ((ecdh = EC_KEY_new()) == NULL ||
+ EC_KEY_set_group(ecdh, EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) != 1)
+ {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02299)
+ "Init: Failed to generate temporary "
+ "%d bit EC parameters", bits);
+ return !OK;
+ }
+
+ mc->pTmpKeys[idx] = ecdh;
+ return OK;
+}
+
+#define MODSSL_TMP_KEY_INIT_EC(s, bits) \
+ ssl_tmp_key_init_ec(s, bits, SSL_TMP_KEY_EC_##bits)
+
+#endif
+
#define MODSSL_TMP_KEY_INIT_RSA(s, bits) \
ssl_tmp_key_init_rsa(s, bits, SSL_TMP_KEY_RSA_##bits)
@@ -181,6 +218,15 @@ static int ssl_tmp_keys_init(server_rec
return !OK;
}
+#ifndef OPENSSL_NO_EC
+ ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
+ "Init: Generating temporary EC parameters (256 bits)");
+
+ if (MODSSL_TMP_KEY_INIT_EC(s, 256)) {
+ return !OK;
+ }
+#endif
+
return OK;
}
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=1294306&r1=1294305&r2=1294306&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c Mon Feb 27 20:01:40 2012
@@ -1386,24 +1386,20 @@ DH *ssl_callback_TmpDH(SSL *ssl, int exp
EC_KEY *ssl_callback_TmpECDH(SSL *ssl, int export, int keylen)
{
conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
- static EC_KEY *ecdh = NULL;
- static int init = 0;
+ SSLModConfigRec *mc = myModConfigFromConn(c);
+ int idx;
/* XXX Uses 256-bit key for now. TODO: support other sizes. */
ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
"handing out temporary 256 bit ECC key");
- if (init == 0) {
- ecdh = EC_KEY_new();
- if (ecdh != NULL) {
- /* ecdh->group = EC_GROUP_new_by_nid(NID_secp160r2); */
- EC_KEY_set_group(ecdh,
- EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
- }
- init = 1;
+ switch (keylen) {
+ case 256:
+ default:
+ idx = SSL_TMP_KEY_EC_256;
}
- return ecdh;
+ return (EC_KEY *)mc->pTmpKeys[idx];
}
#endif
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1294306&r1=1294305&r2=1294306&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Mon Feb 27 20:01:40 2012
@@ -298,7 +298,12 @@ typedef int ssl_algo_t;
#define SSL_TMP_KEY_RSA_1024 (1)
#define SSL_TMP_KEY_DH_512 (2)
#define SSL_TMP_KEY_DH_1024 (3)
+#ifndef OPENSSL_NO_EC
+#define SSL_TMP_KEY_EC_256 (4)
+#define SSL_TMP_KEY_MAX (5)
+#else
#define SSL_TMP_KEY_MAX (4)
+#endif
/**
* Define the SSL options