You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sf...@apache.org on 2012/06/01 21:36:37 UTC
svn commit: r1345319 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_ssl.xml modules/ssl/mod_ssl.c
modules/ssl/ssl_engine_config.c modules/ssl/ssl_engine_init.c
modules/ssl/ssl_private.h
Author: sf
Date: Fri Jun 1 19:36:37 2012
New Revision: 1345319
URL: http://svn.apache.org/viewvc?rev=1345319&view=rev
Log:
Add new directive SSLCompression to disable SSL-level compression.
PR: 53219
Submitted by: Björn Jacke <bjoern j3e de>, Stefan Fritsch
Modified:
httpd/httpd/trunk/CHANGES
httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
httpd/httpd/trunk/modules/ssl/mod_ssl.c
httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
httpd/httpd/trunk/modules/ssl/ssl_private.h
Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Fri Jun 1 19:36:37 2012
@@ -1,6 +1,9 @@
-*- coding: utf-8 -*-
Changes with Apache 2.5.0
+ *) mod_ssl: Add new directive SSLCompression to disable TLS-level
+ compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]
+
*) core: Make ap_regcomp() return AP_REG_ESPACE if out of memory. Make
ap_pregcomp() abort if out of memory. This raises the minimum PCRE
requirement to version 6.0. PR 53284. [Stefan Fritsch]
Modified: httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_ssl.xml Fri Jun 1 19:36:37 2012
@@ -2382,4 +2382,20 @@ be protected with file permissions simil
</usage>
</directivesynopsis>
+<directivesynopsis>
+<name>SSLCompression</name>
+<description>Disallow compression on the SSL level</description>
+<syntax>SSLCompression on|off</syntax>
+<default>SSLCompression on</default>
+<contextlist><context>server config</context>
+<context>virtual host</context></contextlist>
+<compatibility>Available in httpd 2.5.0 and later, if using OpenSSL 0.9.8 or later;
+virtual host scope available if using OpenSSL 1.0.0 or later</compatibility>
+
+<usage>
+<p>This directive allows to disable compression on the SSL level.</p>
+</usage>
+</directivesynopsis>
+
+
</modulesynopsis>
Modified: httpd/httpd/trunk/modules/ssl/mod_ssl.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/mod_ssl.c?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/mod_ssl.c (original)
+++ httpd/httpd/trunk/modules/ssl/mod_ssl.c Fri Jun 1 19:36:37 2012
@@ -138,6 +138,9 @@ static const command_rec ssl_config_cmds
"('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
SSL_CMD_SRV(HonorCipherOrder, FLAG,
"Use the server's cipher ordering preference")
+ SSL_CMD_SRV(Compression, FLAG,
+ "Enable SSL level compression"
+ "(`on', `off')")
SSL_CMD_SRV(InsecureRenegotiation, FLAG,
"Enable support for insecure renegotiation")
SSL_CMD_ALL(UserName, TAKE1,
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_config.c?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_config.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Fri Jun 1 19:36:37 2012
@@ -207,6 +207,7 @@ static SSLSrvConfigRec *ssl_config_serve
#ifdef HAVE_FIPS
sc->fips = UNSET;
#endif
+ sc->compression = UNSET;
modssl_ctx_init_proxy(sc, p);
@@ -328,6 +329,7 @@ void *ssl_config_server_merge(apr_pool_t
#ifdef HAVE_FIPS
cfgMergeBool(fips);
#endif
+ cfgMergeBool(compression);
modssl_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
@@ -663,6 +665,23 @@ static const char *ssl_cmd_check_file(cm
}
+const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag)
+{
+#if defined(SSL_OP_NO_COMPRESSION) || OPENSSL_VERSION_NUMBER >= 0x00908000L
+ SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+#ifndef SSL_OP_NO_COMPRESSION
+ const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
+ if (err)
+ return "This version of openssl does not support configuring "
+ "compression within <VirtualHost> sections.";
+#endif
+ sc->compression = flag ? TRUE : FALSE;
+ return NULL;
+#else
+ return "Setting Compression mode unsupported; not implemented by the SSL library";
+#endif
+}
+
const char *ssl_cmd_SSLHonorCipherOrder(cmd_parms *cmd, void *dcfg, int flag)
{
#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Fri Jun 1 19:36:37 2012
@@ -622,6 +622,20 @@ static void ssl_init_ctx_protocol(server
}
#endif
+#ifdef SSL_OP_NO_COMPRESSION
+ /* OpenSSL >= 1.0 only */
+ if (sc->compression == FALSE) {
+ SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
+ }
+#elif OPENSSL_VERSION_NUMBER >= 0x00908000L
+ /* workaround for OpenSSL 0.9.8 */
+ if (sc->compression == FALSE) {
+ STACK_OF(SSL_COMP)* comp_methods;
+ comp_methods = SSL_COMP_get_compression_methods();
+ sk_SSL_COMP_zero(comp_methods);
+ }
+#endif
+
#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
if (sc->insecure_reneg == TRUE) {
SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
Modified: httpd/httpd/trunk/modules/ssl/ssl_private.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_private.h?rev=1345319&r1=1345318&r2=1345319&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_private.h (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_private.h Fri Jun 1 19:36:37 2012
@@ -678,6 +678,7 @@ struct SSLSrvConfigRec {
#ifdef HAVE_FIPS
BOOL fips;
#endif
+ BOOL compression;
};
/**
@@ -732,6 +733,7 @@ const char *ssl_cmd_SSLCARevocationPath
const char *ssl_cmd_SSLCARevocationFile(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLCARevocationCheck(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLHonorCipherOrder(cmd_parms *cmd, void *dcfg, int flag);
+const char *ssl_cmd_SSLCompression(cmd_parms *, void *, int flag);
const char *ssl_cmd_SSLVerifyClient(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLVerifyDepth(cmd_parms *, void *, const char *);
const char *ssl_cmd_SSLSessionCache(cmd_parms *, void *, const char *);
Re: svn commit: r1345319 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_ssl.xml modules/ssl/mod_ssl.c modules/ssl/ssl_engine_config.c modules/ssl/ssl_engine_init.c modules/ssl/ssl_private.h
Posted by Stefan Fritsch <sf...@sfritsch.de>.
On Sunday 10 June 2012, Kaspar Brand wrote:
> On 01.06.2012 21:36, sf@apache.org wrote:
> > Author: sf
> > Date: Fri Jun 1 19:36:37 2012
> > New Revision: 1345319
> >
> > URL: http://svn.apache.org/viewvc?rev=1345319&view=rev
> > Log:
> > Add new directive SSLCompression to disable SSL-level
> > compression.
> >
> > PR: 53219
> > Submitted by: Björn Jacke <bjoern j3e de>, Stefan Fritsch
>
> [...]
>
> > Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
> > URL:
> > http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_e
> > ngine_config.c?rev=1345319&r1=1345318&r2=1345319&view=diff
> > ================================================================
> > ============== ---
> > httpd/httpd/trunk/modules/ssl/ssl_engine_config.c (original) +++
> > httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Fri Jun 1
> > 19:36:37 2012
>
> [...]
> I suggest changing/shortening this to something like:
>
> #ifndef OPENSSL_NO_COMP
> if (sc->compression == FALSE) {
> #ifdef SSL_OP_NO_COMPRESSION
> /* OpenSSL >= 1.0 only */
> SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
> #elif OPENSSL_VERSION_NUMBER >= 0x00908000L
> /* workaround for OpenSSL 0.9.8 */
> sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
> #endif
> }
> #endif
Done with some more clean ups in r1348656.
Re: svn commit: r1345319 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_ssl.xml
modules/ssl/mod_ssl.c modules/ssl/ssl_engine_config.c modules/ssl/ssl_engine_init.c
modules/ssl/ssl_private.h
Posted by Kaspar Brand <ht...@velox.ch>.
On 01.06.2012 21:36, sf@apache.org wrote:
> Author: sf
> Date: Fri Jun 1 19:36:37 2012
> New Revision: 1345319
>
> URL: http://svn.apache.org/viewvc?rev=1345319&view=rev
> Log:
> Add new directive SSLCompression to disable SSL-level compression.
>
> PR: 53219
> Submitted by: Björn Jacke <bjoern j3e de>, Stefan Fritsch
[...]
> Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_config.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_config.c?rev=1345319&r1=1345318&r2=1345319&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/ssl_engine_config.c (original)
> +++ httpd/httpd/trunk/modules/ssl/ssl_engine_config.c Fri Jun 1 19:36:37 2012
[...]
> @@ -663,6 +665,23 @@ static const char *ssl_cmd_check_file(cm
>
> }
>
> +const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag)
> +{
> +#if defined(SSL_OP_NO_COMPRESSION) || OPENSSL_VERSION_NUMBER >= 0x00908000L
> + SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
> +#ifndef SSL_OP_NO_COMPRESSION
> + const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
> + if (err)
> + return "This version of openssl does not support configuring "
> + "compression within <VirtualHost> sections.";
> +#endif
> + sc->compression = flag ? TRUE : FALSE;
> + return NULL;
> +#else
> + return "Setting Compression mode unsupported; not implemented by the SSL library";
> +#endif
> +}
I think you should also check for !defined(OPENSSL_NO_COMP) - in this
case the directive is simply not applicable.
> Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1345319&r1=1345318&r2=1345319&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
> +++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Fri Jun 1 19:36:37 2012
> @@ -622,6 +622,20 @@ static void ssl_init_ctx_protocol(server
> }
> #endif
>
> +#ifdef SSL_OP_NO_COMPRESSION
> + /* OpenSSL >= 1.0 only */
> + if (sc->compression == FALSE) {
> + SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
> + }
> +#elif OPENSSL_VERSION_NUMBER >= 0x00908000L
> + /* workaround for OpenSSL 0.9.8 */
> + if (sc->compression == FALSE) {
> + STACK_OF(SSL_COMP)* comp_methods;
> + comp_methods = SSL_COMP_get_compression_methods();
> + sk_SSL_COMP_zero(comp_methods);
> + }
> +#endif
> +
> #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
> if (sc->insecure_reneg == TRUE) {
> SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
>
I suggest changing/shortening this to something like:
#ifndef OPENSSL_NO_COMP
if (sc->compression == FALSE) {
#ifdef SSL_OP_NO_COMPRESSION
/* OpenSSL >= 1.0 only */
SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
#elif OPENSSL_VERSION_NUMBER >= 0x00908000L
/* workaround for OpenSSL 0.9.8 */
sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
#endif
}
#endif
Kaspar