API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 22nd, 2018
61
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.48 KB | None | 0 0
raw download clone embed print report
  1. diff -Naur httpd-2.2.22-orig/modules/ssl/mod_ssl.c httpd-2.2.22/modules/ssl/mod_ssl.c
  2. --- httpd-2.2.22-orig/modules/ssl/mod_ssl.c 2012-06-21 22:10:22.538184960 +0200
  3. +++ httpd-2.2.22/modules/ssl/mod_ssl.c 2012-06-21 22:12:27.894721826 +0200
  4. @@ -220,6 +220,18 @@
  5. AP_END_CMD
  6. };
  7.  
  8. +/* Implement 'ssl_run_npn_advertise_protos_hook'. */
  9. +APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
  10. + ssl, AP, int, npn_advertise_protos_hook,
  11. + (conn_rec *connection, apr_array_header_t *protos),
  12. + (connection, protos), OK, DECLINED);
  13. +
  14. +/* Implement 'ssl_run_npn_proto_negotiated_hook'. */
  15. +APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
  16. + ssl, AP, int, npn_proto_negotiated_hook,
  17. + (conn_rec *connection, const char *proto_name, apr_size_t proto_name_len),
  18. + (connection, proto_name, proto_name_len), OK, DECLINED);
  19. +
  20. /*
  21. * the various processing hooks
  22. */
  23. diff -Naur httpd-2.2.22-orig/modules/ssl/mod_ssl.h httpd-2.2.22/modules/ssl/mod_ssl.h
  24. --- httpd-2.2.22-orig/modules/ssl/mod_ssl.h 2012-06-21 22:10:22.538184960 +0200
  25. +++ httpd-2.2.22/modules/ssl/mod_ssl.h 2012-06-21 22:13:30.569379528 +0200
  26. @@ -64,5 +64,26 @@
  27.  
  28. APR_DECLARE_OPTIONAL_FN(apr_array_header_t *, ssl_extlist_by_oid, (request_rec *r, const char *oidstr));
  29.  
  30. +/** The npn_advertise_protos optional hook allows other modules to add entries
  31. + * to the list of protocol names advertised by the server during the Next
  32. + * Protocol Negotiation (NPN) portion of the SSL handshake. The hook callee is
  33. + * given the connection and an APR array; it should push one or more char*'s
  34. + * pointing to null-terminated strings (such as "http/1.1" or "spdy/2") onto
  35. + * the array and return OK, or do nothing and return DECLINED. */
  36. +APR_DECLARE_EXTERNAL_HOOK(ssl, AP, int, npn_advertise_protos_hook,
  37. + (conn_rec *connection, apr_array_header_t *protos));
  38. +
  39. +/** The npn_proto_negotiated optional hook allows other modules to discover the
  40. + * name of the protocol that was chosen during the Next Protocol Negotiation
  41. + * (NPN) portion of the SSL handshake. Note that this may be the empty string
  42. + * (in which case modules should probably assume HTTP), or it may be a protocol
  43. + * that was never even advertised by the server. The hook callee is given the
  44. + * connection, a non-null-terminated string containing the protocol name, and
  45. + * the length of the string; it should do something appropriate (i.e. insert or
  46. + * remove filters) and return OK, or do nothing and return DECLINED. */
  47. +APR_DECLARE_EXTERNAL_HOOK(ssl, AP, int, npn_proto_negotiated_hook,
  48. + (conn_rec *connection, const char *proto_name,
  49. + apr_size_t proto_name_len));
  50. +
  51. #endif /* __MOD_SSL_H__ */
  52. /** @} */
  53. diff -Naur httpd-2.2.22-orig/modules/ssl/ssl_engine_init.c httpd-2.2.22/modules/ssl/ssl_engine_init.c
  54. --- httpd-2.2.22-orig/modules/ssl/ssl_engine_init.c 2012-06-21 22:10:22.538184960 +0200
  55. +++ httpd-2.2.22/modules/ssl/ssl_engine_init.c 2012-06-21 22:15:09.974884418 +0200
  56. @@ -559,6 +559,11 @@
  57. SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH);
  58.  
  59. SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
  60. +
  61. +#if OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
  62. + SSL_CTX_set_next_protos_advertised_cb(
  63. + ctx, ssl_callback_AdvertiseNextProtos, NULL);
  64. +#endif
  65. }
  66.  
  67. static void ssl_init_ctx_verify(server_rec *s,
  68. diff -Naur httpd-2.2.22-orig/modules/ssl/ssl_engine_io.c httpd-2.2.22/modules/ssl/ssl_engine_io.c
  69. --- httpd-2.2.22-orig/modules/ssl/ssl_engine_io.c 2012-06-21 22:10:22.537184970 +0200
  70. +++ httpd-2.2.22/modules/ssl/ssl_engine_io.c 2012-06-21 22:18:27.251901885 +0200
  71. @@ -28,6 +28,7 @@
  72. core keeps dumping.''
  73. -- Unknown */
  74. #include "ssl_private.h"
  75. +#include "mod_ssl.h"
  76. #include "apr_date.h"
  77.  
  78. /* _________________________________________________________________
  79. @@ -338,6 +339,7 @@
  80. apr_pool_t *pool;
  81. char buffer[AP_IOBUFSIZE];
  82. ssl_filter_ctx_t *filter_ctx;
  83. + int npn_finished; /* 1 if NPN has finished, 0 otherwise */
  84. } bio_filter_in_ctx_t;
  85.  
  86. /*
  87. @@ -1409,6 +1411,26 @@
  88. APR_BRIGADE_INSERT_TAIL(bb, bucket);
  89. }
  90.  
  91. + /* By this point, Next Protocol Negotiation (NPN) should be completed (if
  92. + * our version of OpenSSL supports it). If we haven't already, find out
  93. + * which protocol was decided upon and inform other modules by calling
  94. + * npn_proto_negotiated_hook. */
  95. + if (!inctx->npn_finished) {
  96. +#if OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
  97. + const unsigned char *next_proto = NULL;
  98. + unsigned next_proto_len = 0;
  99. + SSL_get0_next_proto_negotiated(
  100. + inctx->ssl, &next_proto, &next_proto_len);
  101. + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
  102. + "SSL NPN negotiated protocol: '%s'",
  103. + apr_pstrmemdup(f->c->pool, (const char*)next_proto,
  104. + next_proto_len));
  105. + ssl_run_npn_proto_negotiated_hook(
  106. + f->c, (const char*)next_proto, next_proto_len);
  107. +#endif
  108. + inctx->npn_finished = 1;
  109. + }
  110. +
  111. return APR_SUCCESS;
  112. }
  113.  
  114. @@ -1753,6 +1775,7 @@
  115. inctx->block = APR_BLOCK_READ;
  116. inctx->pool = c->pool;
  117. inctx->filter_ctx = filter_ctx;
  118. + inctx->npn_finished = 0;
  119. }
  120.  
  121. void ssl_io_filter_init(conn_rec *c, SSL *ssl)
  122. diff -Naur httpd-2.2.22-orig/modules/ssl/ssl_engine_kernel.c httpd-2.2.22/modules/ssl/ssl_engine_kernel.c
  123. --- httpd-2.2.22-orig/modules/ssl/ssl_engine_kernel.c 2012-06-21 22:10:22.537184970 +0200
  124. +++ httpd-2.2.22/modules/ssl/ssl_engine_kernel.c 2012-06-21 22:21:44.340920268 +0200
  125. @@ -29,6 +29,7 @@
  126. time I was too famous.''
  127. -- Unknown */
  128. #include "ssl_private.h"
  129. +#include "mod_ssl.h"
  130.  
  131. static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn);
  132. #ifndef OPENSSL_NO_TLSEXT
  133. @@ -2103,4 +2104,84 @@
  134.  
  135. return 0;
  136. }
  137. +
  138. +/*
  139. + * This callback function is executed when SSL needs to decide what protocols
  140. + * to advertise during Next Protocol Negotiation (NPN). It must produce a
  141. + * string in wire format -- a sequence of length-prefixed strings -- indicating
  142. + * the advertised protocols. Refer to SSL_CTX_set_next_protos_advertised_cb
  143. + * in OpenSSL for reference.
  144. + */
  145. +int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
  146. + unsigned int *size_out, void *arg)
  147. +{
  148. + conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
  149. + apr_array_header_t *protos;
  150. + int num_protos;
  151. + unsigned int size;
  152. + int i;
  153. + unsigned char *data;
  154. + unsigned char *start;
  155. +
  156. + *data_out = NULL;
  157. + *size_out = 0;
  158. +
  159. + /* If the connection object is not available, then there's nothing for us
  160. + * to do. */
  161. + if (c == NULL) {
  162. + return SSL_TLSEXT_ERR_OK;
  163. + }
  164. +
  165. + /* Invoke our npn_advertise_protos hook, giving other modules a chance to
  166. + * add alternate protocol names to advertise. */
  167. + protos = apr_array_make(c->pool, 0, sizeof(char*));
  168. + ssl_run_npn_advertise_protos_hook(c, protos);
  169. + num_protos = protos->nelts;
  170. +
  171. + /* We now have a list of null-terminated strings; we need to concatenate
  172. + * them together into a single string, where each protocol name is prefixed
  173. + * by its length. First, calculate how long that string will be. */
  174. + size = 0;
  175. + for (i = 0; i < num_protos; ++i) {
  176. + const char *string = APR_ARRAY_IDX(protos, i, const char*);
  177. + unsigned int length = strlen(string);
  178. + /* If the protocol name is too long (the length must fit in one byte),
  179. + * then log an error and skip it. */
  180. + if (length > 255) {
  181. + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c,
  182. + "SSL NPN protocol name too long (length=%u): %s",
  183. + length, string);
  184. + continue;
  185. + }
  186. + /* Leave room for the length prefix (one byte) plus the protocol name
  187. + * itself. */
  188. + size += 1 + length;
  189. + }
  190. +
  191. + /* If there is nothing to advertise (either because no modules added
  192. + * anything to the protos array, or because all strings added to the array
  193. + * were skipped), then we're done. */
  194. + if (size == 0) {
  195. + return SSL_TLSEXT_ERR_OK;
  196. + }
  197. +
  198. + /* Now we can build the string. Copy each protocol name string into the
  199. + * larger string, prefixed by its length. */
  200. + data = apr_palloc(c->pool, size * sizeof(unsigned char));
  201. + start = data;
  202. + for (i = 0; i < num_protos; ++i) {
  203. + const char *string = APR_ARRAY_IDX(protos, i, const char*);
  204. + apr_size_t length = strlen(string);
  205. + *start = (unsigned char)length;
  206. + ++start;
  207. + memcpy(start, string, length * sizeof(unsigned char));
  208. + start += length;
  209. + }
  210. +
  211. + /* Success. */
  212. + *data_out = data;
  213. + *size_out = size;
  214. + return SSL_TLSEXT_ERR_OK;
  215. +}
  216. +
  217. #endif
  218. diff -Naur httpd-2.2.22-orig/modules/ssl/ssl_private.h httpd-2.2.22/modules/ssl/ssl_private.h
  219. --- httpd-2.2.22-orig/modules/ssl/ssl_private.h 2012-06-21 22:10:22.538184960 +0200
  220. +++ httpd-2.2.22/modules/ssl/ssl_private.h 2012-06-21 22:11:31.016579969 +0200
  221. @@ -604,6 +604,8 @@
  222. int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *);
  223. #endif
  224.  
  225. +int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data, unsigned int *len, void *arg);
  226. +
  227. /** Session Cache Support */
  228. void ssl_scache_init(server_rec *, apr_pool_t *);
  229. void ssl_scache_status_register(apr_pool_t *p);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!