You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by mi...@apache.org on 2021/12/10 12:59:14 UTC
svn commit: r1895758 - /httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch
Author: minfrin
Date: Fri Dec 10 12:59:14 2021
New Revision: 1895758
URL: http://svn.apache.org/viewvc?rev=1895758&view=rev
Log:
Add backport proposal.
Added:
httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch
Added: httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch
URL: http://svn.apache.org/viewvc/httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch?rev=1895758&view=auto
==============================================================================
--- httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch (added)
+++ httpd/httpd/patches/2.4.x/mod_ssl-openssl3-fix.patch Fri Dec 10 12:59:14 2021
@@ -0,0 +1,55 @@
+Index: changes-entries/mod_ssl-openssl3-fix
+===================================================================
+--- changes-entries/mod_ssl-openssl3-fix (nonexistent)
++++ changes-entries/mod_ssl-openssl3-fix (working copy)
+@@ -0,0 +1,3 @@
++
++ *) mod_ssl: Fix build failure due to ERR_GET_FUNC removal in OpenSSL v3.
++ [Joe Orton, Stefan Eissing]
+Index: modules/ssl/ssl_engine_init.c
+===================================================================
+--- modules/ssl/ssl_engine_init.c (revision 1895754)
++++ modules/ssl/ssl_engine_init.c (working copy)
+@@ -1267,6 +1267,22 @@
+ return 0;
+ }
+
++/* SSL_CTX_use_PrivateKey_file() can fail either because the private
++ * key was encrypted, or due to a mismatch between an already-loaded
++ * cert and the key - a common misconfiguration - from calling
++ * X509_check_private_key(). This macro is passed the last error code
++ * off the OpenSSL stack and evaluates to true only for the first
++ * case. With OpenSSL < 3 the second case is identifiable by the
++ * function code, but function codes are not used from 3.0. */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
++#else
++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB(ec) != ERR_LIB_X509 \
++ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
++ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
++ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
++#endif
++
+ static apr_status_t ssl_init_server_certs(server_rec *s,
+ apr_pool_t *p,
+ apr_pool_t *ptemp,
+@@ -1372,8 +1388,7 @@
+ }
+ else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+ SSL_FILETYPE_PEM) < 1)
+- && (ERR_GET_FUNC(ERR_peek_last_error())
+- != X509_F_X509_CHECK_PRIVATE_KEY)) {
++ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
+ ssl_asn1_t *asn1;
+ const unsigned char *ptr;
+
+Index: .
+===================================================================
+--- . (revision 1895754)
++++ . (working copy)
+
+Property changes on: .
+___________________________________________________________________
+Modified: svn:mergeinfo
+## -0,0 +0,1 ##
+ Merged /httpd/httpd/trunk:r1891138,1894716