envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the
current working directory to be searched for DSOs. [Stefan Fritsch]
+ *) mod_ssl: Fix crash with threaded MPMs due to race condition when
+ initializing EC temporary keys. [Stefan Fritsch]
+
*) mod_proxy: Add the forcerecovery balancer parameter that determines if
recovery for balancer workers is enforced. [Ruediger Pluem]
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- * mod_ssl: Initialize EC temporary key on server startup, fixing a crash
- with threaded MPMs.
- Trunk patch: http://svn.apache.org/viewvc?rev=1294306&view=rev
- 2.4.x patch: Trunk patch works, skip docs/log-message-tags/next-number,
- add CHANGES:
- mod_ssl: Fix crash with threaded MPMs due to race condition when
- initializing EC temporary keys. [Stefan Fritsch]
- NOTE: If you get strange openssl errors during server start, you may have
- forgotten "make clean" before building.
- +1: sf, minfrin, jim
-
* core: Fix regexp substitution bug
Trunk patch: http://svn.apache.org/viewvc?rev=1307067&view=rev
2.4.x patch: Trunk patch works, add CHANGES:
MODSSL_TMP_KEYS_FREE(mc, RSA);
MODSSL_TMP_KEYS_FREE(mc, DH);
+#ifndef OPENSSL_NO_EC
+ MODSSL_TMP_KEY_FREE(mc, EC_KEY, SSL_TMP_KEY_EC_256);
+#endif
}
static int ssl_tmp_key_init_rsa(server_rec *s,
return OK;
}
+#ifndef OPENSSL_NO_EC
+static int ssl_tmp_key_init_ec(server_rec *s,
+ int bits, int idx)
+{
+ SSLModConfigRec *mc = myModConfig(s);
+ EC_KEY *ecdh = NULL;
+
+ /* XXX: Are there any FIPS constraints we should enforce? */
+
+ if (bits != 256) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02298)
+ "Init: Failed to generate temporary "
+ "%d bit EC parameters, only 256 bits supported", bits);
+ return !OK;
+ }
+
+ if ((ecdh = EC_KEY_new()) == NULL ||
+ EC_KEY_set_group(ecdh, EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) != 1)
+ {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02299)
+ "Init: Failed to generate temporary "
+ "%d bit EC parameters", bits);
+ return !OK;
+ }
+
+ mc->pTmpKeys[idx] = ecdh;
+ return OK;
+}
+
+#define MODSSL_TMP_KEY_INIT_EC(s, bits) \
+ ssl_tmp_key_init_ec(s, bits, SSL_TMP_KEY_EC_##bits)
+
+#endif
+
#define MODSSL_TMP_KEY_INIT_RSA(s, bits) \
ssl_tmp_key_init_rsa(s, bits, SSL_TMP_KEY_RSA_##bits)
return !OK;
}
+#ifndef OPENSSL_NO_EC
+ ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
+ "Init: Generating temporary EC parameters (256 bits)");
+
+ if (MODSSL_TMP_KEY_INIT_EC(s, 256)) {
+ return !OK;
+ }
+#endif
+
return OK;
}
EC_KEY *ssl_callback_TmpECDH(SSL *ssl, int export, int keylen)
{
conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
- static EC_KEY *ecdh = NULL;
- static int init = 0;
+ SSLModConfigRec *mc = myModConfigFromConn(c);
+ int idx;
/* XXX Uses 256-bit key for now. TODO: support other sizes. */
ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
"handing out temporary 256 bit ECC key");
- if (init == 0) {
- ecdh = EC_KEY_new();
- if (ecdh != NULL) {
- /* ecdh->group = EC_GROUP_new_by_nid(NID_secp160r2); */
- EC_KEY_set_group(ecdh,
- EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
- }
- init = 1;
+ switch (keylen) {
+ case 256:
+ default:
+ idx = SSL_TMP_KEY_EC_256;
}
- return ecdh;
+ return (EC_KEY *)mc->pTmpKeys[idx];
}
#endif
#define SSL_TMP_KEY_RSA_1024 (1)
#define SSL_TMP_KEY_DH_512 (2)
#define SSL_TMP_KEY_DH_1024 (3)
+#ifndef OPENSSL_NO_EC
+#define SSL_TMP_KEY_EC_256 (4)
+#define SSL_TMP_KEY_MAX (5)
+#else
#define SSL_TMP_KEY_MAX (4)
+#endif
/**
* Define the SSL options