Blame SOURCES/httpd-2.4.35-r1825120.patch

e71654
diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
e71654
index 19cb611..79d5219 100644
e71654
--- a/modules/ssl/ssl_engine_init.c
e71654
+++ b/modules/ssl/ssl_engine_init.c
e71654
@@ -2070,70 +2070,18 @@ int ssl_proxy_section_post_config(apr_pool_t *p, apr_pool_t *plog,
e71654
     return OK;
e71654
 }
e71654
 
e71654
-static int ssl_init_FindCAList_X509NameCmp(const X509_NAME * const *a,
e71654
-                                           const X509_NAME * const *b)
e71654
-{
e71654
-    return(X509_NAME_cmp(*a, *b));
e71654
-}
e71654
-
e71654
-static void ssl_init_PushCAList(STACK_OF(X509_NAME) *ca_list,
e71654
-                                server_rec *s, apr_pool_t *ptemp,
e71654
-                                const char *file)
e71654
-{
e71654
-    int n;
e71654
-    STACK_OF(X509_NAME) *sk;
e71654
-
e71654
-    sk = (STACK_OF(X509_NAME) *)
e71654
-             SSL_load_client_CA_file(file);
e71654
-
e71654
-    if (!sk) {
e71654
-        return;
e71654
-    }
e71654
-
e71654
-    for (n = 0; n < sk_X509_NAME_num(sk); n++) {
e71654
-        X509_NAME *name = sk_X509_NAME_value(sk, n);
e71654
-
e71654
-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02209)
e71654
-                     "CA certificate: %s",
e71654
-                     modssl_X509_NAME_to_string(ptemp, name, 0));
e71654
-
e71654
-        /*
e71654
-         * note that SSL_load_client_CA_file() checks for duplicates,
e71654
-         * but since we call it multiple times when reading a directory
e71654
-         * we must also check for duplicates ourselves.
e71654
-         */
e71654
-
e71654
-        if (sk_X509_NAME_find(ca_list, name) < 0) {
e71654
-            /* this will be freed when ca_list is */
e71654
-            sk_X509_NAME_push(ca_list, name);
e71654
-        }
e71654
-        else {
e71654
-            /* need to free this ourselves, else it will leak */
e71654
-            X509_NAME_free(name);
e71654
-        }
e71654
-    }
e71654
-
e71654
-    sk_X509_NAME_free(sk);
e71654
-}
e71654
-
e71654
 STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s,
e71654
                                          apr_pool_t *ptemp,
e71654
                                          const char *ca_file,
e71654
                                          const char *ca_path)
e71654
 {
e71654
-    STACK_OF(X509_NAME) *ca_list;
e71654
-
e71654
-    /*
e71654
-     * Start with a empty stack/list where new
e71654
-     * entries get added in sorted order.
e71654
-     */
e71654
-    ca_list = sk_X509_NAME_new(ssl_init_FindCAList_X509NameCmp);
e71654
+    STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();;
e71654
 
e71654
     /*
e71654
      * Process CA certificate bundle file
e71654
      */
e71654
     if (ca_file) {
e71654
-        ssl_init_PushCAList(ca_list, s, ptemp, ca_file);
e71654
+        SSL_add_file_cert_subjects_to_stack(ca_list, ca_file);
e71654
         /*
e71654
          * If ca_list is still empty after trying to load ca_file
e71654
          * then the file failed to load, and users should hear about that.
e71654
@@ -2168,17 +2116,12 @@ STACK_OF(X509_NAME) *ssl_init_FindCAList(server_rec *s,
e71654
                 continue; /* don't try to load directories */
e71654
             }
e71654
             file = apr_pstrcat(ptemp, ca_path, "/", direntry.name, NULL);
e71654
-            ssl_init_PushCAList(ca_list, s, ptemp, file);
e71654
+            SSL_add_file_cert_subjects_to_stack(ca_list, file);
e71654
         }
e71654
 
e71654
         apr_dir_close(dir);
e71654
     }
e71654
 
e71654
-    /*
e71654
-     * Cleanup
e71654
-     */
e71654
-    (void) sk_X509_NAME_set_cmp_func(ca_list, NULL);
e71654
-
e71654
     return ca_list;
e71654
 }
e71654