Attachment #486254 for bug #625450

View | Details | Raw Unified | Return to bug 625450
Collapse All | Expand All




#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
    ENGINE_cleanup();
#endif
#if OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined(OPENSSL_NO_COMP)
    SSL_COMP_free_compression_methods();
#endif

    /* Usually needed per thread, but this parent process is single-threaded */
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
#if OPENSSL_VERSION_NUMBER >= 0x1000000fL
    ERR_remove_thread_state(NULL);
#else

    /* Some OpenSSL internals are allocated per-thread, make sure they
     * are associated to the/our same thread-id until cleaned up.
     */
#if APR_HAS_THREADS && OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
    ssl_util_thread_id_setup(pconf);
#endif

    /* We must register the library in full, to ensure our configuration
     * code can successfully test the SSL environment.
     */
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
    CRYPTO_malloc_init();
#else
    OPENSSL_malloc_init();




#define KEYTYPES "RSA or DSA"
#endif

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
/* OpenSSL Pre-1.1.0 compatibility */
/* Taken from OpenSSL 1.1.0 snapshot 20160410 */
static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)

#endif
    }

#if APR_HAS_THREADS && ( OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) )
    ssl_util_thread_setup(p);
#endif


    modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */

    init_dh_params();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
    init_bio_methods();
#endif


     * or configure NIST P-256 (required to enable ECDHE for earlier versions)
     * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList
     */
#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
    else {
#if defined(SSL_CTX_set_ecdh_auto)
        SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);


    }

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
    free_bio_methods();
#endif
    free_dh_params();




{
    BIO_set_shutdown(bio, 1);
    BIO_set_init(bio, 1);
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
    /* No setter method for OpenSSL 1.1.0 available,
     * but I can't find any functional use of the
     * "num" field there either.

    return -1;
}

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
        
static BIO_METHOD bio_filter_out_method = {
    BIO_TYPE_MEM,


    filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
    filter_ctx->pbioRead = BIO_new(&bio_filter_in_method);
#else
    filter_ctx->pbioRead = BIO_new(bio_filter_in_method);

    filter_ctx->pOutputFilter   = ap_add_output_filter(ssl_io_filter,
                                                       filter_ctx, r, c);

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
    filter_ctx->pbioWrite       = BIO_new(&bio_filter_out_method);
#else
    filter_ctx->pbioWrite       = BIO_new(bio_filter_out_method);

Lines 1733-1739 static void modssl_proxy_info_log(conn_r Link Here

(-)httpd-2.4.26/modules/ssl/ssl_engine_kernel.c.orig (-1 / +1 lines)
1733	* so we need to increment here to prevent them from	1733	* so we need to increment here to prevent them from
1734	* being freed.	1734	* being freed.
1735	*/	1735	*/
1736	#if OPENSSL_VERSION_NUMBER < 0x10100000L	1736	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
1737	#define modssl_set_cert_info(info, cert, pkey) \	1737	#define modssl_set_cert_info(info, cert, pkey) \
1738	*cert = info->x509; \	1738	*cert = info->x509; \
1739	CRYPTO_add(&(*cert)->references, +1, CRYPTO_LOCK_X509); \	1739	CRYPTO_add(&(*cert)->references, +1, CRYPTO_LOCK_X509); \

Lines 529-535 static char *ssl_var_lookup_ssl_cert(apr Link Here

(-)httpd-2.4.26/modules/ssl/ssl_engine_vars.c.orig (-1 / +1 lines)
529	resdup = FALSE;	529	resdup = FALSE;
530	}	530	}
531	else if (strcEQ(var, "A_SIG")) {	531	else if (strcEQ(var, "A_SIG")) {
532	#if OPENSSL_VERSION_NUMBER < 0x10100000L	532	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
533	nid = OBJ_obj2nid((ASN1_OBJECT *)(xs->cert_info->signature->algorithm));	533	nid = OBJ_obj2nid((ASN1_OBJECT *)(xs->cert_info->signature->algorithm));
534	#else	534	#else
535	const ASN1_OBJECT *paobj;	535	const ASN1_OBJECT *paobj;

Lines 123-128 Link Here

(-)httpd-2.4.26/modules/ssl/ssl_private.h.orig (-4 / +14 lines)
123	#define MODSSL_SSL_METHOD_CONST	123	#define MODSSL_SSL_METHOD_CONST
124	#endif	124	#endif
125		125
		126	#if defined(LIBRESSL_VERSION_NUMBER)
		127	/* Missing from LibreSSL */
		128	#define SSL_CTRL_SET_MIN_PROTO_VERSION 123
		129	#define SSL_CTRL_SET_MAX_PROTO_VERSION 124
		130	#define SSL_CTX_set_min_proto_version(ctx, version) \
		131	SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
		132	#define SSL_CTX_set_max_proto_version(ctx, version) \
		133	SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
		134	#endif
		135
126	#if defined(OPENSSL_FIPS)	136	#if defined(OPENSSL_FIPS)
127	#define HAVE_FIPS	137	#define HAVE_FIPS
128	#endif	138	#endif
Lines 136-142 Link Here
136	#endif	146	#endif
137		147
138	/* session id constness */	148	/* session id constness */
139	#if OPENSSL_VERSION_NUMBER < 0x10100000L	149	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
140	#define IDCONST	150	#define IDCONST
141	#else	151	#else
142	#define IDCONST const	152	#define IDCONST const
Lines 199-205 Link Here
199		209
200	#endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */	210	#endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */
201		211
202	#if OPENSSL_VERSION_NUMBER < 0x10100000L	212	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
203	#define BN_get_rfc2409_prime_768 get_rfc2409_prime_768	213	#define BN_get_rfc2409_prime_768 get_rfc2409_prime_768
204	#define BN_get_rfc2409_prime_1024 get_rfc2409_prime_1024	214	#define BN_get_rfc2409_prime_1024 get_rfc2409_prime_1024
205	#define BN_get_rfc3526_prime_1536 get_rfc3526_prime_1536	215	#define BN_get_rfc3526_prime_1536 get_rfc3526_prime_1536
Lines 219-225 void init_bio_methods(void); Link Here
219	void free_bio_methods(void);	229	void free_bio_methods(void);
220	#endif	230	#endif
221		231
222	#if OPENSSL_VERSION_NUMBER < 0x10002000L	232	#if OPENSSL_VERSION_NUMBER < 0x10002000L \|\| defined(LIBRESSL_VERSION_NUMBER)
223	#define X509_STORE_CTX_get0_store(x) (x->ctx)	233	#define X509_STORE_CTX_get0_store(x) (x->ctx)
224	#endif	234	#endif
225		235
Lines 934-940 char *ssl_util_readfilter(server_ Link Here
934	const char * const *);	944	const char * const *);
935	BOOL ssl_util_path_check(ssl_pathcheck_t, const char , apr_pool_t );	945	BOOL ssl_util_path_check(ssl_pathcheck_t, const char , apr_pool_t );
936	#if APR_HAS_THREADS	946	#if APR_HAS_THREADS
937	#if OPENSSL_VERSION_NUMBER < 0x10100000L	947	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
938	void ssl_util_thread_setup(apr_pool_t *);	948	void ssl_util_thread_setup(apr_pool_t *);
939	#endif	949	#endif
940	void ssl_util_thread_id_setup(apr_pool_t *);	950	void ssl_util_thread_id_setup(apr_pool_t *);

Lines 247-253 void ssl_asn1_table_unset(apr_hash_t *ta Link Here

(-)httpd-2.4.26/modules/ssl/ssl_util.c.orig (-1 / +1 lines)
247	}	247	}
248		248
249	#if APR_HAS_THREADS	249	#if APR_HAS_THREADS
250	#if OPENSSL_VERSION_NUMBER < 0x10100000L	250	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
251	/*	251	/*
252	* To ensure thread-safetyness in OpenSSL - work in progress	252	* To ensure thread-safetyness in OpenSSL - work in progress
253	*/	253	*/

Lines 41-47 Link Here

(-)httpd-2.4.26/modules/ssl/ssl_util_ssl.h.orig (-1 / +1 lines)
41	#define MODSSL_LIBRARY_VERSION OPENSSL_VERSION_NUMBER	41	#define MODSSL_LIBRARY_VERSION OPENSSL_VERSION_NUMBER
42	#define MODSSL_LIBRARY_NAME "OpenSSL"	42	#define MODSSL_LIBRARY_NAME "OpenSSL"
43	#define MODSSL_LIBRARY_TEXT OPENSSL_VERSION_TEXT	43	#define MODSSL_LIBRARY_TEXT OPENSSL_VERSION_TEXT
44	#if OPENSSL_VERSION_NUMBER < 0x10100000L	44	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
45	#define MODSSL_LIBRARY_DYNTEXT SSLeay_version(SSLEAY_VERSION)	45	#define MODSSL_LIBRARY_DYNTEXT SSLeay_version(SSLEAY_VERSION)
46	#else	46	#else
47	#define MODSSL_LIBRARY_DYNTEXT OpenSSL_version(OPENSSL_VERSION)	47	#define MODSSL_LIBRARY_DYNTEXT OpenSSL_version(OPENSSL_VERSION)

Lines 197-202 typedef STACK_OF(X509) X509_STACK_TYPE; Link Here

(-)httpd-2.4.26/support/ab.c.orig (+8 lines)
197	#if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name)	197	#if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name)
198	#define HAVE_TLSEXT	198	#define HAVE_TLSEXT
199	#endif	199	#endif
		200	#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2060000f
		201	# define SSL_CTRL_SET_MIN_PROTO_VERSION 123
		202	# define SSL_CTRL_SET_MAX_PROTO_VERSION 124
		203	#define SSL_CTX_set_min_proto_version(ctx, version) \
		204	SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
		205	#define SSL_CTX_set_max_proto_version(ctx, version) \
		206	SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
		207	#endif
200	#endif	208	#endif
201		209
202	#include <math.h>	210	#include <math.h>

Return to bug 625450

Lines 337-348 static apr_status_t ssl_cleanup_pre_conf Link Here

(-)httpd-2.4.26/modules/ssl/mod_ssl.c.orig (-4 / +4 lines)
337	#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES	337	#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
338	ENGINE_cleanup();	338	ENGINE_cleanup();
339	#endif	339	#endif
340	#if OPENSSL_VERSION_NUMBER >= 0x1000200fL	340	#if OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined(OPENSSL_NO_COMP)
341	SSL_COMP_free_compression_methods();	341	SSL_COMP_free_compression_methods();
342	#endif	342	#endif
343		343
344	/* Usually needed per thread, but this parent process is single-threaded */	344	/* Usually needed per thread, but this parent process is single-threaded */
345	#if OPENSSL_VERSION_NUMBER < 0x10100000L	345	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
346	#if OPENSSL_VERSION_NUMBER >= 0x1000000fL	346	#if OPENSSL_VERSION_NUMBER >= 0x1000000fL
347	ERR_remove_thread_state(NULL);	347	ERR_remove_thread_state(NULL);
348	#else	348	#else
Lines 383-396 static int ssl_hook_pre_config(apr_pool_ Link Here
383	/* Some OpenSSL internals are allocated per-thread, make sure they	383	/* Some OpenSSL internals are allocated per-thread, make sure they
384	* are associated to the/our same thread-id until cleaned up.	384	* are associated to the/our same thread-id until cleaned up.
385	*/	385	*/
386	#if APR_HAS_THREADS && OPENSSL_VERSION_NUMBER < 0x10100000L	386	#if APR_HAS_THREADS && OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
387	ssl_util_thread_id_setup(pconf);	387	ssl_util_thread_id_setup(pconf);
388	#endif	388	#endif
389		389
390	/* We must register the library in full, to ensure our configuration	390	/* We must register the library in full, to ensure our configuration
391	* code can successfully test the SSL environment.	391	* code can successfully test the SSL environment.
392	*/	392	*/
393	#if OPENSSL_VERSION_NUMBER < 0x10100000L	393	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
394	CRYPTO_malloc_init();	394	CRYPTO_malloc_init();
395	#else	395	#else
396	OPENSSL_malloc_init();	396	OPENSSL_malloc_init();

Lines 164-170 static int bio_filter_create(BIO *bio) Link Here

(-)httpd-2.4.26/modules/ssl/ssl_engine_io.c.orig (-4 / +4 lines)
164	{	164	{
165	BIO_set_shutdown(bio, 1);	165	BIO_set_shutdown(bio, 1);
166	BIO_set_init(bio, 1);	166	BIO_set_init(bio, 1);
167	#if OPENSSL_VERSION_NUMBER < 0x10100000L	167	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
168	/* No setter method for OpenSSL 1.1.0 available,	168	/* No setter method for OpenSSL 1.1.0 available,
169	* but I can't find any functional use of the	169	* but I can't find any functional use of the
170	* "num" field there either.	170	* "num" field there either.
Lines 549-555 static long bio_filter_in_ctrl(BIO *bio, Link Here
549	return -1;	549	return -1;
550	}	550	}
551		551
552	#if OPENSSL_VERSION_NUMBER < 0x10100000L	552	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
553		553
554	static BIO_METHOD bio_filter_out_method = {	554	static BIO_METHOD bio_filter_out_method = {
555	BIO_TYPE_MEM,	555	BIO_TYPE_MEM,
Lines 2024-2030 static void ssl_io_input_add_filter(ssl_ Link Here
2024		2024
2025	filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);	2025	filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);
2026		2026
2027	#if OPENSSL_VERSION_NUMBER < 0x10100000L	2027	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
2028	filter_ctx->pbioRead = BIO_new(&bio_filter_in_method);	2028	filter_ctx->pbioRead = BIO_new(&bio_filter_in_method);
2029	#else	2029	#else
2030	filter_ctx->pbioRead = BIO_new(bio_filter_in_method);	2030	filter_ctx->pbioRead = BIO_new(bio_filter_in_method);
Lines 2059-2065 void ssl_io_filter_init(conn_rec *c, req Link Here
2059	filter_ctx->pOutputFilter = ap_add_output_filter(ssl_io_filter,	2059	filter_ctx->pOutputFilter = ap_add_output_filter(ssl_io_filter,
2060	filter_ctx, r, c);	2060	filter_ctx, r, c);
2061		2061
2062	#if OPENSSL_VERSION_NUMBER < 0x10100000L	2062	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
2063	filter_ctx->pbioWrite = BIO_new(&bio_filter_out_method);	2063	filter_ctx->pbioWrite = BIO_new(&bio_filter_out_method);
2064	#else	2064	#else
2065	filter_ctx->pbioWrite = BIO_new(bio_filter_out_method);	2065	filter_ctx->pbioWrite = BIO_new(bio_filter_out_method);

Lines 47-53 APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, Link Here

(-)httpd-2.4.26/modules/ssl/ssl_engine_init.c.orig (-5 / +5 lines)
47	#define KEYTYPES "RSA or DSA"	47	#define KEYTYPES "RSA or DSA"
48	#endif	48	#endif
49		49
50	#if OPENSSL_VERSION_NUMBER < 0x10100000L	50	#if OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER)
51	/* OpenSSL Pre-1.1.0 compatibility */	51	/* OpenSSL Pre-1.1.0 compatibility */
52	/* Taken from OpenSSL 1.1.0 snapshot 20160410 */	52	/* Taken from OpenSSL 1.1.0 snapshot 20160410 */
53	static int DH_set0_pqg(DH dh, BIGNUM p, BIGNUM q, BIGNUM g)	53	static int DH_set0_pqg(DH dh, BIGNUM p, BIGNUM q, BIGNUM g)
Lines 257-263 apr_status_t ssl_init_Module(apr_pool_t Link Here
257	#endif	257	#endif
258	}	258	}
259		259
260	#if APR_HAS_THREADS && OPENSSL_VERSION_NUMBER < 0x10100000L	260	#if APR_HAS_THREADS && ( OPENSSL_VERSION_NUMBER < 0x10100000L \|\| defined(LIBRESSL_VERSION_NUMBER) )
261	ssl_util_thread_setup(p);	261	ssl_util_thread_setup(p);
262	#endif	262	#endif
263		263
Lines 380-386 apr_status_t ssl_init_Module(apr_pool_t Link Here
380	modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */	380	modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
381		381
382	init_dh_params();	382	init_dh_params();
383	#if OPENSSL_VERSION_NUMBER >= 0x10100000L	383	#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
384	init_bio_methods();	384	init_bio_methods();
385	#endif	385	#endif
386		386
Lines 1301-1307 static apr_status_t ssl_init_server_cert Link Here
1301	* or configure NIST P-256 (required to enable ECDHE for earlier versions)	1301	* or configure NIST P-256 (required to enable ECDHE for earlier versions)
1302	* ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList	1302	* ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList
1303	*/	1303	*/
1304	#if (OPENSSL_VERSION_NUMBER < 0x10100000L)	1304	#if (OPENSSL_VERSION_NUMBER < 0x10100000L) \|\| defined(LIBRESSL_VERSION_NUMBER)
1305	else {	1305	else {
1306	#if defined(SSL_CTX_set_ecdh_auto)	1306	#if defined(SSL_CTX_set_ecdh_auto)
1307	SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);	1307	SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);
Lines 2011-2017 apr_status_t ssl_init_ModuleKill(void *d Link Here
2011		2011
2012	}	2012	}
2013		2013
2014	#if OPENSSL_VERSION_NUMBER >= 0x10100000L	2014	#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
2015	free_bio_methods();	2015	free_bio_methods();
2016	#endif	2016	#endif
2017	free_dh_params();	2017	free_dh_params();