git.schokokeks.org
Repositories
Help
Report an Issue
keks-overlay.git
Code
Commits
Branches
Tags
Suche
Strukturansicht:
7ef9447
Branches
Tags
master
keks-overlay.git
www-servers
apache
files
apache-2.2.14-staticdhparameters.diff
dh parameters
Hanno Böck
commited
7ef9447
at 2012-05-04 11:05:06
apache-2.2.14-staticdhparameters.diff
Blame
History
Raw
diff -ru httpd-2.2.14.orig/modules/ssl/mod_ssl.c httpd-2.2.14.new/modules/ssl/mod_ssl.c --- httpd-2.2.14.orig/modules/ssl/mod_ssl.c 2009-05-19 13:44:59.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/mod_ssl.c 2010-07-06 11:56:50.897588899 +0200 @@ -108,6 +108,9 @@ SSL_CMD_SRV(CertificateKeyFile, TAKE1, "SSL Server Private Key file " "(`/path/to/file' - PEM or DER encoded)") + SSL_CMD_SRV(DHParametersFile, TAKE1, + "SSL Server Diffie-Hellman parameters file " + "(`/path/to/file' - PEM or DER encoded)") SSL_CMD_SRV(CertificateChainFile, TAKE1, "SSL Server CA Certificate Chain file " "(`/path/to/file' - PEM encoded)") diff -ru httpd-2.2.14.orig/modules/ssl/ssl_engine_config.c httpd-2.2.14.new/modules/ssl/ssl_engine_config.c --- httpd-2.2.14.orig/modules/ssl/ssl_engine_config.c 2009-05-19 13:44:59.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_engine_config.c 2010-07-06 11:56:50.897588899 +0200 @@ -72,6 +72,7 @@ mc->tVHostKeys = apr_hash_make(pool); mc->tPrivateKey = apr_hash_make(pool); mc->tPublicCert = apr_hash_make(pool); + mc->tDHParams = apr_hash_make(pool); #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) mc->szCryptoDevice = NULL; #endif @@ -156,6 +157,9 @@ mctx->pks = apr_pcalloc(p, sizeof(*mctx->pks)); /* mctx->pks->... certs/keys are set during module init */ + + mctx->pks->dhparams_file = NULL; + mctx->pks->dhparams = NULL; } static SSLSrvConfigRec *ssl_config_server_new(apr_pool_t *p) @@ -246,6 +250,7 @@ cfgMergeString(pks->ca_name_path); cfgMergeString(pks->ca_name_file); + cfgMergeString(pks->dhparams_file); } /* @@ -762,6 +767,22 @@ return NULL; } +const char *ssl_cmd_SSLDHParametersFile(cmd_parms *cmd, + void *dcfg, + const char *arg) +{ + SSLSrvConfigRec *sc = mySrvConfig(cmd->server); + const char *err; + + if ((err = ssl_cmd_check_file(cmd, &arg))) { + return err; + } + + sc->server->pks->dhparams_file = arg; + + return NULL; +} + const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *cmd, void *dcfg, const char *arg) diff -ru httpd-2.2.14.orig/modules/ssl/ssl_engine_init.c httpd-2.2.14.new/modules/ssl/ssl_engine_init.c --- httpd-2.2.14.orig/modules/ssl/ssl_engine_init.c 2009-08-16 17:53:12.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_engine_init.c 2010-07-06 11:56:50.897588899 +0200 @@ -723,6 +723,42 @@ } } +static int ssl_server_import_dhparams(server_rec *s, + modssl_ctx_t *mctx, + const char *id) +{ + SSLModConfigRec *mc = myModConfig(s); + ssl_asn1_t *asn1; + MODSSL_D2I_DHparams_CONST unsigned char *ptr; + DH *dhparams = NULL; + + if (!(asn1 = ssl_asn1_table_get(mc->tDHParams, id))) { + return FALSE; + } + + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, + "Configuring server Diffie-Hellman parameters"); + + ptr = asn1->cpData; + if (!(dhparams = d2i_DHparams(NULL, &ptr, asn1->nData))) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, + "Unable to import server Diffie-Hellman parameters"); + ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s); + ssl_die(); + } + + if (SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams) <= 0) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, + "Unable to configure server Diffie-Hellman parameters"); + ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s); + ssl_die(); + } + + mctx->pks->dhparams = dhparams; + + return TRUE; +} + static int ssl_server_import_cert(server_rec *s, modssl_ctx_t *mctx, const char *id, @@ -882,16 +918,18 @@ apr_pool_t *ptemp, modssl_ctx_t *mctx) { - const char *rsa_id, *dsa_id; + const char *rsa_id, *dsa_id, *dh_id; const char *vhost_id = mctx->sc->vhost_id; int i; int have_rsa, have_dsa; rsa_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_RSA); dsa_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_DSA); + dh_id = apr_pstrcat(ptemp, vhost_id, ":", "DH", NULL); have_rsa = ssl_server_import_cert(s, mctx, rsa_id, SSL_AIDX_RSA); have_dsa = ssl_server_import_cert(s, mctx, dsa_id, SSL_AIDX_DSA); + (void)ssl_server_import_dhparams(s, mctx, dh_id); if (!(have_rsa || have_dsa)) { ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, @@ -1265,6 +1303,7 @@ MODSSL_CFG_ITEM_FREE(EVP_PKEY_free, mctx->pks->keys[i]); } + MODSSL_CFG_ITEM_FREE(DH_free, mctx->pks->dhparams); } apr_status_t ssl_init_ModuleKill(void *data) diff -ru httpd-2.2.14.orig/modules/ssl/ssl_engine_pphrase.c httpd-2.2.14.new/modules/ssl/ssl_engine_pphrase.c --- httpd-2.2.14.orig/modules/ssl/ssl_engine_pphrase.c 2009-09-16 22:06:05.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_engine_pphrase.c 2010-07-06 11:56:50.897588899 +0200 @@ -144,6 +144,7 @@ unsigned char *ucp; long int length; X509 *pX509Cert; + DH *pDHParams; BOOL bReadable; apr_array_header_t *aPassPhrase; int nPassPhrase; @@ -192,8 +193,10 @@ pServ->defn_name, pServ->defn_line_number); ssl_die(); } + algoCert = SSL_ALGO_UNKNOWN; algoKey = SSL_ALGO_UNKNOWN; + for (i = 0, j = 0; i < SSL_AIDX_MAX && sc->server->pks->cert_files[i] != NULL; i++) { apr_cpystrn(szPath, sc->server->pks->cert_files[i], sizeof(szPath)); @@ -517,6 +520,45 @@ */ EVP_PKEY_free(pPrivateKey); } + + /* + * Read in Diffie-Hellman parameters file if such a file is + * specified. + */ + if (sc->server->pks->dhparams_file) { + apr_cpystrn(szPath, sc->server->pks->dhparams_file, sizeof(szPath)); + if ((rv = exists_and_readable(szPath, p, NULL)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, + "Init: Can't open server Diffie-Hellman parameters file %s", + szPath); + ssl_die(); + } + if ((pDHParams = SSL_read_DHparams(szPath, NULL, NULL)) == NULL) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, + "Init: Unable to read server Diffie-Hellman parameters from file %s", szPath); + ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s); + ssl_die(); + } + + /* + * Insert the DH params into global module configuration + * to let it survive the processing between the 1st Apache + * API init round (where we operate here) and the 2nd + * Apache init round (where it will be actually used to + * configure mod_ssl's per-server configuration + * structures). + */ + cp = asn1_table_vhost_key(mc, p, cpVHostID, "DH"); + length = i2d_DHparams(pDHParams, NULL); + ucp = ssl_asn1_table_set(mc->tDHParams, cp, length); + (void)i2d_DHparams(pDHParams, &ucp); /* 2nd arg increments */ + + /* + * Free the DH structure + */ + DH_free(pDHParams); + } + } /* diff -ru httpd-2.2.14.orig/modules/ssl/ssl_private.h httpd-2.2.14.new/modules/ssl/ssl_private.h --- httpd-2.2.14.orig/modules/ssl/ssl_private.h 2009-05-19 13:44:59.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_private.h 2010-07-06 11:56:50.897588899 +0200 @@ -378,6 +378,7 @@ void *pTmpKeys[SSL_TMP_KEY_MAX]; apr_hash_t *tPublicCert; apr_hash_t *tPrivateKey; + apr_hash_t *tDHParams; #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) const char *szCryptoDevice; #endif @@ -394,8 +395,10 @@ */ const char *cert_files[SSL_AIDX_MAX]; const char *key_files[SSL_AIDX_MAX]; + const char *dhparams_file; X509 *certs[SSL_AIDX_MAX]; EVP_PKEY *keys[SSL_AIDX_MAX]; + DH *dhparams; /** Certificates which specify the set of CA names which should be * sent in the CertificateRequest message: */ @@ -510,6 +513,7 @@ const char *ssl_cmd_SSLRandomSeed(cmd_parms *, void *, const char *, const char *, const char *); const char *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *); +const char *ssl_cmd_SSLDHParametersFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *); const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *); diff -ru httpd-2.2.14.orig/modules/ssl/ssl_toolkit_compat.h httpd-2.2.14.new/modules/ssl/ssl_toolkit_compat.h --- httpd-2.2.14.orig/modules/ssl/ssl_toolkit_compat.h 2009-05-19 13:44:59.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_toolkit_compat.h 2010-07-06 11:56:50.897588899 +0200 @@ -100,9 +100,11 @@ #if (OPENSSL_VERSION_NUMBER >= 0x00908000) # define MODSSL_D2I_PrivateKey_CONST const # define MODSSL_D2I_X509_CONST const +# define MODSSL_D2I_DHparams_CONST const #else # define MODSSL_D2I_PrivateKey_CONST # define MODSSL_D2I_X509_CONST +# define MODSSL_D2I_DHparams_CONST #endif #if (OPENSSL_VERSION_NUMBER >= 0x00909000) @@ -117,8 +119,10 @@ #if (OPENSSL_VERSION_NUMBER < 0x00904000) #define modssl_PEM_read_bio_X509(b, x, cb, arg) PEM_read_bio_X509(b, x, cb) +#define modssl_PEM_read_bio_DHparams(b, x, cb, arg) PEM_read_bio_DHparams(b, x, cb) #else #define modssl_PEM_read_bio_X509(b, x, cb, arg) PEM_read_bio_X509(b, x, cb, arg) +#define modssl_PEM_read_bio_DHparams(b, x, cb, arg) PEM_read_bio_DHparams(b, x, cb, arg) #endif #define modssl_PEM_X509_INFO_read_bio PEM_X509_INFO_read_bio diff -ru httpd-2.2.14.orig/modules/ssl/ssl_util_ssl.c httpd-2.2.14.new/modules/ssl/ssl_util_ssl.c --- httpd-2.2.14.orig/modules/ssl/ssl_util_ssl.c 2009-08-06 09:28:47.000000000 +0200 +++ httpd-2.2.14.new/modules/ssl/ssl_util_ssl.c 2010-07-06 11:56:50.897588899 +0200 @@ -115,6 +115,47 @@ return rc; } +DH *SSL_read_DHparams(char* filename, DH **DHparams, modssl_read_bio_cb_fn *cb) +{ + DH *rc; + BIO *bioS; + BIO *bioF; + + /* 1. try PEM (= DER+Base64+headers) */ + if ((bioS=BIO_new_file(filename, "r")) == NULL) + return NULL; + rc = modssl_PEM_read_bio_DHparams (bioS, DHparams, cb, NULL); + BIO_free(bioS); + + if (rc == NULL) { + /* 2. try DER+Base64 */ + if ((bioS=BIO_new_file(filename, "r")) == NULL) + return NULL; + + if ((bioF = BIO_new(BIO_f_base64())) == NULL) { + BIO_free(bioS); + return NULL; + } + bioS = BIO_push(bioF, bioS); + rc = d2i_DHparams_bio(bioS, NULL); + BIO_free_all(bioS); + + if (rc == NULL) { + /* 3. try plain DER */ + if ((bioS=BIO_new_file(filename, "r")) == NULL) + return NULL; + rc = d2i_DHparams_bio(bioS, NULL); + BIO_free(bioS); + } + } + if (rc != NULL && DHparams != NULL) { + if (*DHparams != NULL) + DH_free(*DHparams); + *DHparams = rc; + } + return rc; +} + #if SSL_LIBRARY_VERSION <= 0x00904100 static EVP_PKEY *d2i_PrivateKey_bio(BIO *bio, EVP_PKEY **key) {
