You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ic...@apache.org on 2016/02/08 17:50:07 UTC
svn commit: r1729208 - in /httpd/httpd/trunk/modules: proxy/proxy_util.c
ssl/ssl_engine_io.c
Author: icing
Date: Mon Feb 8 16:50:07 2016
New Revision: 1729208
URL: http://svn.apache.org/viewvc?rev=1729208&view=rev
Log:
let proxy handler forward ALPN protocol strings for ssl proxy connections
Modified:
httpd/httpd/trunk/modules/proxy/proxy_util.c
httpd/httpd/trunk/modules/ssl/ssl_engine_io.c
Modified: httpd/httpd/trunk/modules/proxy/proxy_util.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?rev=1729208&r1=1729207&r2=1729208&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/proxy/proxy_util.c (original)
+++ httpd/httpd/trunk/modules/proxy/proxy_util.c Mon Feb 8 16:50:07 2016
@@ -2717,6 +2717,8 @@ PROXY_DECLARE(int) ap_proxy_connect_back
if (conn->sock) {
if (!(connected = ap_proxy_is_socket_connected(conn->sock))) {
+ /* FIXME: this loses conn->ssl_hostname and it will not be
+ * restablished before the SSL connection is made -> no SNI! */
socket_cleanup(conn);
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00951)
"%s: backend socket is disconnected.",
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_io.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?rev=1729208&r1=1729207&r2=1729208&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_io.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_io.c Mon Feb 8 16:50:07 2016
@@ -1146,12 +1146,48 @@ static apr_status_t ssl_io_filter_handsh
#endif
const char *hostname_note = apr_table_get(c->notes,
"proxy-request-hostname");
+ const char *alpn_note;
BOOL proxy_ssl_check_peer_ok = TRUE;
int post_handshake_rc = OK;
sc = mySrvConfig(server);
#ifdef HAVE_TLSEXT
+#ifdef HAVE_TLS_ALPN
+ alpn_note = apr_table_get(c->notes, "proxy-request-alpn-protos");
+ if (alpn_note) {
+ char *protos, *s, *p, *last;
+ apr_size_t len;
+
+ s = protos = apr_pcalloc(c->pool, strlen(alpn_note)+1);
+ p = apr_pstrdup(c->pool, alpn_note);
+ while ((p = apr_strtok(p, ", ", &last))) {
+ len = last - p - (*last? 1 : 0);
+ if (len > 255) {
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO()
+ "ALPN proxy protocol identifier too long: %s",
+ p);
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, server);
+ return APR_EGENERAL;
+ }
+ *s++ = (unsigned char)len;
+ while (len--) {
+ *s++ = *p++;
+ }
+ p = last;
+ }
+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, c,
+ "setting alpn protos from '%s', protolen=%d",
+ alpn_note, (int)(s - protos));
+ if (protos != s && SSL_set_alpn_protos(filter_ctx->pssl,
+ (unsigned char *)protos,
+ s - protos)) {
+ ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO()
+ "error setting alpn protos from '%s'", alpn_note);
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_WARNING, server);
+ }
+ }
+#endif /* defined HAVE_TLS_ALPN */
/*
* Enable SNI for backend requests. Make sure we don't do it for
* pure SSLv3 connections, and also prevent IP addresses
@@ -1176,7 +1212,7 @@ static apr_status_t ssl_io_filter_handsh
ssl_log_ssl_error(SSLLOG_MARK, APLOG_WARNING, server);
}
}
-#endif
+#endif /* defined HAVE_TLSEXT */
if ((n = SSL_connect(filter_ctx->pssl)) <= 0) {
ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO(02003)
Re: svn commit: r1729208 - in /httpd/httpd/trunk/modules: proxy/proxy_util.c ssl/ssl_engine_io.c
Posted by Stefan Eissing <st...@greenbytes.de>.
> Am 10.02.2016 um 20:09 schrieb Ruediger Pluem <rp...@apache.org>:
>
>
>
> On 02/08/2016 05:50 PM, icing@apache.org wrote:
>> [...]#ifdef HAVE_TLSEXT
>> +#ifdef HAVE_TLS_ALPN
>> + alpn_note = apr_table_get(c->notes, "proxy-request-alpn-protos");
>> + if (alpn_note) {
>> + char *protos, *s, *p, *last;
>> + apr_size_t len;
>> +
>> + s = protos = apr_pcalloc(c->pool, strlen(alpn_note)+1);
>> + p = apr_pstrdup(c->pool, alpn_note);
>> + while ((p = apr_strtok(p, ", ", &last))) {
>> + len = last - p - (*last? 1 : 0);
>> + if (len > 255) {
>> + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO()
>> + "ALPN proxy protocol identifier too long: %s",
>> + p);
>> + ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, server);
>> + return APR_EGENERAL;
>> + }
>> + *s++ = (unsigned char)len;
>> + while (len--) {
>> + *s++ = *p++;
>> + }
>> + p = last;
>
> Why not p = NULL as it should be for subsequent calls of apr_strtok?
Matter of taste. If code is more readable to everyone using NULL, that is fine with me.
Changed in r1729782.
Stefan
Re: svn commit: r1729208 - in /httpd/httpd/trunk/modules:
proxy/proxy_util.c ssl/ssl_engine_io.c
Posted by Ruediger Pluem <rp...@apache.org>.
On 02/08/2016 05:50 PM, icing@apache.org wrote:
> Author: icing
> Date: Mon Feb 8 16:50:07 2016
> New Revision: 1729208
>
> URL: http://svn.apache.org/viewvc?rev=1729208&view=rev
> Log:
> let proxy handler forward ALPN protocol strings for ssl proxy connections
>
> Modified:
> httpd/httpd/trunk/modules/proxy/proxy_util.c
> httpd/httpd/trunk/modules/ssl/ssl_engine_io.c
>
> Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_io.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?rev=1729208&r1=1729207&r2=1729208&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/ssl_engine_io.c (original)
> +++ httpd/httpd/trunk/modules/ssl/ssl_engine_io.c Mon Feb 8 16:50:07 2016
> @@ -1146,12 +1146,48 @@ static apr_status_t ssl_io_filter_handsh
> #endif
> const char *hostname_note = apr_table_get(c->notes,
> "proxy-request-hostname");
> + const char *alpn_note;
> BOOL proxy_ssl_check_peer_ok = TRUE;
> int post_handshake_rc = OK;
>
> sc = mySrvConfig(server);
>
> #ifdef HAVE_TLSEXT
> +#ifdef HAVE_TLS_ALPN
> + alpn_note = apr_table_get(c->notes, "proxy-request-alpn-protos");
> + if (alpn_note) {
> + char *protos, *s, *p, *last;
> + apr_size_t len;
> +
> + s = protos = apr_pcalloc(c->pool, strlen(alpn_note)+1);
> + p = apr_pstrdup(c->pool, alpn_note);
> + while ((p = apr_strtok(p, ", ", &last))) {
> + len = last - p - (*last? 1 : 0);
> + if (len > 255) {
> + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO()
> + "ALPN proxy protocol identifier too long: %s",
> + p);
> + ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, server);
> + return APR_EGENERAL;
> + }
> + *s++ = (unsigned char)len;
> + while (len--) {
> + *s++ = *p++;
> + }
> + p = last;
Why not p = NULL as it should be for subsequent calls of apr_strtok?
> + }
> + ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, c,
> + "setting alpn protos from '%s', protolen=%d",
> + alpn_note, (int)(s - protos));
> + if (protos != s && SSL_set_alpn_protos(filter_ctx->pssl,
> + (unsigned char *)protos,
> + s - protos)) {
> + ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c, APLOGNO()
> + "error setting alpn protos from '%s'", alpn_note);
> + ssl_log_ssl_error(SSLLOG_MARK, APLOG_WARNING, server);
> + }
> + }
> +#endif /* defined HAVE_TLS_ALPN */
> /*
> * Enable SNI for backend requests. Make sure we don't do it for
> * pure SSLv3 connections, and also prevent IP addresses
Regards
Rüdiger