Attachment #30476 for bug #53899

View | Details | Raw Unified | Return to bug 53899
Collapse All | Expand All

Lines 138-143 Link Here

(-)httpd-2.4.4/modules/ssl/mod_ssl.c (+2 lines)
138	"('[+-][" SSL_PROTOCOLS "] ...' - see manual)")	138	"('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
139	SSL_CMD_SRV(HonorCipherOrder, FLAG,	139	SSL_CMD_SRV(HonorCipherOrder, FLAG,
140	"Use the server's cipher ordering preference")	140	"Use the server's cipher ordering preference")
		141	SSL_CMD_SRV(EnableEmptyFragments, FLAG,
		142	"Enable countermeasure against SSL3.0/TLS1.0 protocol vulnerability")
141	SSL_CMD_SRV(Compression, FLAG,	143	SSL_CMD_SRV(Compression, FLAG,
142	"Enable SSL level compression"	144	"Enable SSL level compression"
143	"(`on', `off')")	145	"(`on', `off')")




    sc->vhost_id_len           = 0;     /* set during module init */
    sc->session_cache_timeout  = UNSET;
    sc->cipher_server_pref     = UNSET;
    sc->enable_empty_fragments = UNSET;
    sc->insecure_reneg         = UNSET;
    sc->proxy_ssl_check_peer_expire = SSL_ENABLED_UNSET;
    sc->proxy_ssl_check_peer_cn     = SSL_ENABLED_UNSET;

    cfgMergeBool(proxy_enabled);
    cfgMergeInt(session_cache_timeout);
    cfgMergeBool(cipher_server_pref);
    cfgMergeBool(enable_empty_fragments);
    cfgMergeBool(insecure_reneg);
    cfgMerge(proxy_ssl_check_peer_expire, SSL_ENABLED_UNSET);
    cfgMerge(proxy_ssl_check_peer_cn, SSL_ENABLED_UNSET);

#endif
}

const char *ssl_cmd_SSLEnableEmptyFragments(cmd_parms *cmd,
                                            void *dcfg, int flag)
{
#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
    sc->enable_empty_fragments = flag?TRUE:FALSE;
    return NULL;
#else
    return "SSLEnableEmptyFragments unsupported; "
        "not implemented by the SSL library";
#endif
}

const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag)
{
#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION




    char *cp;
    int protocol = mctx->protocol;
    SSLSrvConfigRec *sc = mySrvConfig(s);
    long ssl_initial_options; 

    /*
     *  Create the new per-server SSL context


    mctx->ssl_ctx = ctx;

    /* We can not rely on SSL_CTX_clear_options being available, 
       so we unset from SSL_OP_ALL before we call SSL_CTX_set_options */
    /* Use a generic variable in case we ever wish to unmask other options */
    ssl_initial_options = SSL_OP_ALL;
#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
    /* We check TRUE and FALSE as the default is UNSET, in which case
       no manipulation of the default SSL_OP_ALL bits is done */
    if (sc->enable_empty_fragments == TRUE) {
        /* we must UNSET the "DONT_INSERT" bit to enable empty fragments */
        ssl_initial_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
    }
    else if (sc->enable_empty_fragments == FALSE) {
        /* we SET the "DONT_INSERT" bit to disable empty fragments */
        /* This is redundant, as this bit is SET in SSL_OP_ALL
           however it could be removed in the future */
        ssl_initial_options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
    }
#endif
    SSL_CTX_set_options(ctx, ssl_initial_options);

    /* always disable SSLv2, as per RFC 6176 */
    SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);

Lines 682-687 Link Here

(-)httpd-2.4.4/modules/ssl/ssl_private.h (+2 lines)
682	int vhost_id_len;	682	int vhost_id_len;
683	int session_cache_timeout;	683	int session_cache_timeout;
684	BOOL cipher_server_pref;	684	BOOL cipher_server_pref;
		685	BOOL enable_empty_fragments;
685	BOOL insecure_reneg;	686	BOOL insecure_reneg;
686	modssl_ctx_t *server;	687	modssl_ctx_t *server;
687	modssl_ctx_t *proxy;	688	modssl_ctx_t *proxy;
Lines 750-755 Link Here
750	const char ssl_cmd_SSLCARevocationFile(cmd_parms , void , const char );	751	const char ssl_cmd_SSLCARevocationFile(cmd_parms , void , const char );
751	const char ssl_cmd_SSLCARevocationCheck(cmd_parms , void , const char );	752	const char ssl_cmd_SSLCARevocationCheck(cmd_parms , void , const char );
752	const char ssl_cmd_SSLHonorCipherOrder(cmd_parms cmd, void *dcfg, int flag);	753	const char ssl_cmd_SSLHonorCipherOrder(cmd_parms cmd, void *dcfg, int flag);
		754	const char ssl_cmd_SSLEnableEmptyFragments(cmd_parms cmd, void *dcfg, int flag);
753	const char ssl_cmd_SSLCompression(cmd_parms , void *, int flag);	755	const char ssl_cmd_SSLCompression(cmd_parms , void *, int flag);
754	const char ssl_cmd_SSLVerifyClient(cmd_parms , void , const char );	756	const char ssl_cmd_SSLVerifyClient(cmd_parms , void , const char );
755	const char ssl_cmd_SSLVerifyDepth(cmd_parms , void , const char );	757	const char ssl_cmd_SSLVerifyDepth(cmd_parms , void , const char );

Return to bug 53899

Lines 204-209 Link Here

(-)httpd-2.4.4/modules/ssl/ssl_engine_config.c (+15 lines)
204	sc->vhost_id_len = 0; /* set during module init */	204	sc->vhost_id_len = 0; /* set during module init */
205	sc->session_cache_timeout = UNSET;	205	sc->session_cache_timeout = UNSET;
206	sc->cipher_server_pref = UNSET;	206	sc->cipher_server_pref = UNSET;
		207	sc->enable_empty_fragments = UNSET;
207	sc->insecure_reneg = UNSET;	208	sc->insecure_reneg = UNSET;
208	sc->proxy_ssl_check_peer_expire = SSL_ENABLED_UNSET;	209	sc->proxy_ssl_check_peer_expire = SSL_ENABLED_UNSET;
209	sc->proxy_ssl_check_peer_cn = SSL_ENABLED_UNSET;	210	sc->proxy_ssl_check_peer_cn = SSL_ENABLED_UNSET;
Lines 333-338 Link Here
333	cfgMergeBool(proxy_enabled);	334	cfgMergeBool(proxy_enabled);
334	cfgMergeInt(session_cache_timeout);	335	cfgMergeInt(session_cache_timeout);
335	cfgMergeBool(cipher_server_pref);	336	cfgMergeBool(cipher_server_pref);
		337	cfgMergeBool(enable_empty_fragments);
336	cfgMergeBool(insecure_reneg);	338	cfgMergeBool(insecure_reneg);
337	cfgMerge(proxy_ssl_check_peer_expire, SSL_ENABLED_UNSET);	339	cfgMerge(proxy_ssl_check_peer_expire, SSL_ENABLED_UNSET);
338	cfgMerge(proxy_ssl_check_peer_cn, SSL_ENABLED_UNSET);	340	cfgMerge(proxy_ssl_check_peer_cn, SSL_ENABLED_UNSET);
Lines 708-713 Link Here
708	#endif	710	#endif
709	}	711	}
710		712
		713	const char ssl_cmd_SSLEnableEmptyFragments(cmd_parms cmd,
		714	void *dcfg, int flag)
		715	{
		716	#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
		717	SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
		718	sc->enable_empty_fragments = flag?TRUE:FALSE;
		719	return NULL;
		720	#else
		721	return "SSLEnableEmptyFragments unsupported; "
		722	"not implemented by the SSL library";
		723	#endif
		724	}
		725
711	const char ssl_cmd_SSLInsecureRenegotiation(cmd_parms cmd, void *dcfg, int flag)	726	const char ssl_cmd_SSLInsecureRenegotiation(cmd_parms cmd, void *dcfg, int flag)
712	{	727	{
713	#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION	728	#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION

Lines 571-576 Link Here

(-)httpd-2.4.4/modules/ssl/ssl_engine_init.c (-1 / +20 lines)
571	char *cp;	571	char *cp;
572	int protocol = mctx->protocol;	572	int protocol = mctx->protocol;
573	SSLSrvConfigRec *sc = mySrvConfig(s);	573	SSLSrvConfigRec *sc = mySrvConfig(s);
		574	long ssl_initial_options;
574		575
575	/*	576	/*
576	* Create the new per-server SSL context	577	* Create the new per-server SSL context
Lines 625-631 Link Here
625		626
626	mctx->ssl_ctx = ctx;	627	mctx->ssl_ctx = ctx;
627		628
628	SSL_CTX_set_options(ctx, SSL_OP_ALL);	629	/* We can not rely on SSL_CTX_clear_options being available,
		630	so we unset from SSL_OP_ALL before we call SSL_CTX_set_options */
		631	/* Use a generic variable in case we ever wish to unmask other options */
		632	ssl_initial_options = SSL_OP_ALL;
		633	#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
		634	/* We check TRUE and FALSE as the default is UNSET, in which case
		635	no manipulation of the default SSL_OP_ALL bits is done */
		636	if (sc->enable_empty_fragments == TRUE) {
		637	/* we must UNSET the "DONT_INSERT" bit to enable empty fragments */
		638	ssl_initial_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
		639	}
		640	else if (sc->enable_empty_fragments == FALSE) {
		641	/* we SET the "DONT_INSERT" bit to disable empty fragments */
		642	/* This is redundant, as this bit is SET in SSL_OP_ALL
		643	however it could be removed in the future */
		644	ssl_initial_options \|= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
		645	}
		646	#endif
		647	SSL_CTX_set_options(ctx, ssl_initial_options);
629		648
630	/* always disable SSLv2, as per RFC 6176 */	649	/* always disable SSLv2, as per RFC 6176 */
631	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);	650	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);