]> Raphaƫl G. Git Repositories - ihttpd/blob - SOURCES/httpd-2.4.4-r1332643+.patch
Remove tmpfiles
[ihttpd] / SOURCES / httpd-2.4.4-r1332643+.patch
1 # ./pullrev.sh 1332643 1345599
2
3 https://bugzilla.redhat.com//show_bug.cgi?id=809599
4
5 http://svn.apache.org/viewvc?view=revision&revision=1332643
6
7 http://svn.apache.org/viewvc?view=revision&revision=1345599
8
9 --- httpd-2.4.4/modules/ssl/mod_ssl.c.r1332643+
10 +++ httpd-2.4.4/modules/ssl/mod_ssl.c
11 @@ -272,6 +272,18 @@ static const command_rec ssl_config_cmds
12 AP_END_CMD
13 };
14
15 +/* Implement 'modssl_run_npn_advertise_protos_hook'. */
16 +APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
17 + modssl, AP, int, npn_advertise_protos_hook,
18 + (conn_rec *connection, apr_array_header_t *protos),
19 + (connection, protos), OK, DECLINED);
20 +
21 +/* Implement 'modssl_run_npn_proto_negotiated_hook'. */
22 +APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
23 + modssl, AP, int, npn_proto_negotiated_hook,
24 + (conn_rec *connection, const char *proto_name, apr_size_t proto_name_len),
25 + (connection, proto_name, proto_name_len), OK, DECLINED);
26 +
27 /*
28 * the various processing hooks
29 */
30 --- httpd-2.4.4/modules/ssl/mod_ssl.h.r1332643+
31 +++ httpd-2.4.4/modules/ssl/mod_ssl.h
32 @@ -63,5 +63,26 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_e
33
34 APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
35
36 +/** The npn_advertise_protos optional hook allows other modules to add entries
37 + * to the list of protocol names advertised by the server during the Next
38 + * Protocol Negotiation (NPN) portion of the SSL handshake. The hook callee is
39 + * given the connection and an APR array; it should push one or more char*'s
40 + * pointing to null-terminated strings (such as "http/1.1" or "spdy/2") onto
41 + * the array and return OK, or do nothing and return DECLINED. */
42 +APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_advertise_protos_hook,
43 + (conn_rec *connection, apr_array_header_t *protos));
44 +
45 +/** The npn_proto_negotiated optional hook allows other modules to discover the
46 + * name of the protocol that was chosen during the Next Protocol Negotiation
47 + * (NPN) portion of the SSL handshake. Note that this may be the empty string
48 + * (in which case modules should probably assume HTTP), or it may be a protocol
49 + * that was never even advertised by the server. The hook callee is given the
50 + * connection, a non-null-terminated string containing the protocol name, and
51 + * the length of the string; it should do something appropriate (i.e. insert or
52 + * remove filters) and return OK, or do nothing and return DECLINED. */
53 +APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_proto_negotiated_hook,
54 + (conn_rec *connection, const char *proto_name,
55 + apr_size_t proto_name_len));
56 +
57 #endif /* __MOD_SSL_H__ */
58 /** @} */
59 --- httpd-2.4.4/modules/ssl/ssl_engine_init.c.r1332643+
60 +++ httpd-2.4.4/modules/ssl/ssl_engine_init.c
61 @@ -725,6 +725,11 @@ static void ssl_init_ctx_callbacks(serve
62 #endif
63
64 SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
65 +
66 +#ifdef HAVE_TLS_NPN
67 + SSL_CTX_set_next_protos_advertised_cb(
68 + ctx, ssl_callback_AdvertiseNextProtos, NULL);
69 +#endif
70 }
71
72 static void ssl_init_ctx_verify(server_rec *s,
73 --- httpd-2.4.4/modules/ssl/ssl_engine_io.c.r1332643+
74 +++ httpd-2.4.4/modules/ssl/ssl_engine_io.c
75 @@ -28,6 +28,7 @@
76 core keeps dumping.''
77 -- Unknown */
78 #include "ssl_private.h"
79 +#include "mod_ssl.h"
80 #include "apr_date.h"
81
82 /* _________________________________________________________________
83 @@ -297,6 +298,7 @@ typedef struct {
84 apr_pool_t *pool;
85 char buffer[AP_IOBUFSIZE];
86 ssl_filter_ctx_t *filter_ctx;
87 + int npn_finished; /* 1 if NPN has finished, 0 otherwise */
88 } bio_filter_in_ctx_t;
89
90 /*
91 @@ -1385,6 +1387,26 @@ static apr_status_t ssl_io_filter_input(
92 APR_BRIGADE_INSERT_TAIL(bb, bucket);
93 }
94
95 +#ifdef HAVE_TLS_NPN
96 + /* By this point, Next Protocol Negotiation (NPN) should be completed (if
97 + * our version of OpenSSL supports it). If we haven't already, find out
98 + * which protocol was decided upon and inform other modules by calling
99 + * npn_proto_negotiated_hook. */
100 + if (!inctx->npn_finished) {
101 + const unsigned char *next_proto = NULL;
102 + unsigned next_proto_len = 0;
103 +
104 + SSL_get0_next_proto_negotiated(
105 + inctx->ssl, &next_proto, &next_proto_len);
106 + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
107 + APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
108 + next_proto_len, (const char*)next_proto);
109 + modssl_run_npn_proto_negotiated_hook(
110 + f->c, (const char*)next_proto, next_proto_len);
111 + inctx->npn_finished = 1;
112 + }
113 +#endif
114 +
115 return APR_SUCCESS;
116 }
117
118 @@ -1866,6 +1888,7 @@ static void ssl_io_input_add_filter(ssl_
119 inctx->block = APR_BLOCK_READ;
120 inctx->pool = c->pool;
121 inctx->filter_ctx = filter_ctx;
122 + inctx->npn_finished = 0;
123 }
124
125 /* The request_rec pointer is passed in here only to ensure that the
126 --- httpd-2.4.4/modules/ssl/ssl_engine_kernel.c.r1332643+
127 +++ httpd-2.4.4/modules/ssl/ssl_engine_kernel.c
128 @@ -29,6 +29,7 @@
129 time I was too famous.''
130 -- Unknown */
131 #include "ssl_private.h"
132 +#include "mod_ssl.h"
133 #include "util_md5.h"
134
135 static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn);
136 @@ -2161,6 +2162,90 @@ int ssl_callback_SessionTicket(SSL *ssl,
137 }
138 #endif /* HAVE_TLS_SESSION_TICKETS */
139
140 +#ifdef HAVE_TLS_NPN
141 +/*
142 + * This callback function is executed when SSL needs to decide what protocols
143 + * to advertise during Next Protocol Negotiation (NPN). It must produce a
144 + * string in wire format -- a sequence of length-prefixed strings -- indicating
145 + * the advertised protocols. Refer to SSL_CTX_set_next_protos_advertised_cb
146 + * in OpenSSL for reference.
147 + */
148 +int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
149 + unsigned int *size_out, void *arg)
150 +{
151 + conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
152 + apr_array_header_t *protos;
153 + int num_protos;
154 + unsigned int size;
155 + int i;
156 + unsigned char *data;
157 + unsigned char *start;
158 +
159 + *data_out = NULL;
160 + *size_out = 0;
161 +
162 + /* If the connection object is not available, then there's nothing for us
163 + * to do. */
164 + if (c == NULL) {
165 + return SSL_TLSEXT_ERR_OK;
166 + }
167 +
168 + /* Invoke our npn_advertise_protos hook, giving other modules a chance to
169 + * add alternate protocol names to advertise. */
170 + protos = apr_array_make(c->pool, 0, sizeof(char*));
171 + modssl_run_npn_advertise_protos_hook(c, protos);
172 + num_protos = protos->nelts;
173 +
174 + /* We now have a list of null-terminated strings; we need to concatenate
175 + * them together into a single string, where each protocol name is prefixed
176 + * by its length. First, calculate how long that string will be. */
177 + size = 0;
178 + for (i = 0; i < num_protos; ++i) {
179 + const char *string = APR_ARRAY_IDX(protos, i, const char*);
180 + unsigned int length = strlen(string);
181 + /* If the protocol name is too long (the length must fit in one byte),
182 + * then log an error and skip it. */
183 + if (length > 255) {
184 + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02307)
185 + "SSL NPN protocol name too long (length=%u): %s",
186 + length, string);
187 + continue;
188 + }
189 + /* Leave room for the length prefix (one byte) plus the protocol name
190 + * itself. */
191 + size += 1 + length;
192 + }
193 +
194 + /* If there is nothing to advertise (either because no modules added
195 + * anything to the protos array, or because all strings added to the array
196 + * were skipped), then we're done. */
197 + if (size == 0) {
198 + return SSL_TLSEXT_ERR_OK;
199 + }
200 +
201 + /* Now we can build the string. Copy each protocol name string into the
202 + * larger string, prefixed by its length. */
203 + data = apr_palloc(c->pool, size * sizeof(unsigned char));
204 + start = data;
205 + for (i = 0; i < num_protos; ++i) {
206 + const char *string = APR_ARRAY_IDX(protos, i, const char*);
207 + apr_size_t length = strlen(string);
208 + if (length > 255)
209 + continue;
210 + *start = (unsigned char)length;
211 + ++start;
212 + memcpy(start, string, length * sizeof(unsigned char));
213 + start += length;
214 + }
215 +
216 + /* Success. */
217 + *data_out = data;
218 + *size_out = size;
219 + return SSL_TLSEXT_ERR_OK;
220 +}
221 +
222 +#endif /* HAVE_TLS_NPN */
223 +
224 #ifndef OPENSSL_NO_SRP
225
226 int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg)
227 --- httpd-2.4.4/modules/ssl/ssl_private.h.r1332643+
228 +++ httpd-2.4.4/modules/ssl/ssl_private.h
229 @@ -139,6 +139,11 @@
230 #define HAVE_FIPS
231 #endif
232
233 +#if OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_NEXTPROTONEG) \
234 + && !defined(OPENSSL_NO_TLSEXT)
235 +#define HAVE_TLS_NPN
236 +#endif
237 +
238 #if (OPENSSL_VERSION_NUMBER >= 0x10000000)
239 #define MODSSL_SSL_CIPHER_CONST const
240 #define MODSSL_SSL_METHOD_CONST const
241 @@ -840,6 +845,7 @@ int ssl_callback_ServerNameIndi
242 int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
243 EVP_CIPHER_CTX *, HMAC_CTX *, int);
244 #endif
245 +int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data, unsigned int *len, void *arg);
246
247 /** Session Cache Support */
248 void ssl_scache_init(server_rec *, apr_pool_t *);