Blame SOURCES/httpd-2.4.6-r1332643+.patch

28b219
# ./pullrev.sh 1332643 1345599 1487772
28b219
28b219
https://bugzilla.redhat.com//show_bug.cgi?id=809599
28b219
28b219
http://svn.apache.org/viewvc?view=revision&revision=1332643
28b219
http://svn.apache.org/viewvc?view=revision&revision=1345599
28b219
http://svn.apache.org/viewvc?view=revision&revision=1487772
28b219
28b219
--- httpd-2.4.6/modules/ssl/mod_ssl.c.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/mod_ssl.c
28b219
@@ -413,6 +413,37 @@ int ssl_engine_disable(conn_rec *c)
28b219
     return 1;
28b219
 }
28b219
 
28b219
+static int modssl_register_npn(conn_rec *c, 
28b219
+                               ssl_npn_advertise_protos advertisefn,
28b219
+                               ssl_npn_proto_negotiated negotiatedfn)
28b219
+{
28b219
+#ifdef HAVE_TLS_NPN
28b219
+    SSLConnRec *sslconn = myConnConfig(c);
28b219
+
28b219
+    if (!sslconn) {
28b219
+        return DECLINED;
28b219
+    }
28b219
+
28b219
+    if (!sslconn->npn_advertfns) {
28b219
+        sslconn->npn_advertfns = 
28b219
+            apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos));
28b219
+        sslconn->npn_negofns = 
28b219
+            apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated));
28b219
+    }
28b219
+
28b219
+    if (advertisefn)
28b219
+        APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) =
28b219
+            advertisefn;
28b219
+    if (negotiatedfn)
28b219
+        APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) =
28b219
+            negotiatedfn;
28b219
+
28b219
+    return OK;
28b219
+#else
28b219
+    return DECLINED;
28b219
+#endif
28b219
+}
28b219
+
28b219
 int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
28b219
 {
28b219
     SSLSrvConfigRec *sc;
28b219
@@ -584,6 +615,7 @@ static void ssl_register_hooks(apr_pool_
28b219
 
28b219
     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
28b219
     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
28b219
+    APR_REGISTER_OPTIONAL_FN(modssl_register_npn);
28b219
 
28b219
     ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl",
28b219
                               AUTHZ_PROVIDER_VERSION,
28b219
--- httpd-2.4.6/modules/ssl/mod_ssl.h.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/mod_ssl.h
28b219
@@ -63,5 +63,40 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_e
28b219
 
28b219
 APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
28b219
 
28b219
+/** The npn_advertise_protos callback allows another modules to add
28b219
+ * entries to the list of protocol names advertised by the server
28b219
+ * during the Next Protocol Negotiation (NPN) portion of the SSL
28b219
+ * handshake.  The callback is given the connection and an APR array;
28b219
+ * it should push one or more char*'s pointing to NUL-terminated
28b219
+ * strings (such as "http/1.1" or "spdy/2") onto the array and return
28b219
+ * OK.  To prevent further processing of (other modules') callbacks,
28b219
+ * return DONE. */
28b219
+typedef int (*ssl_npn_advertise_protos)(conn_rec *connection, 
28b219
+                                        apr_array_header_t *protos);
28b219
+
28b219
+/** The npn_proto_negotiated callback allows other modules to discover
28b219
+ * the name of the protocol that was chosen during the Next Protocol
28b219
+ * Negotiation (NPN) portion of the SSL handshake.  Note that this may
28b219
+ * be the empty string (in which case modules should probably assume
28b219
+ * HTTP), or it may be a protocol that was never even advertised by
28b219
+ * the server.  The callback is given the connection, a
28b219
+ * non-NUL-terminated string containing the protocol name, and the
28b219
+ * length of the string; it should do something appropriate
28b219
+ * (i.e. insert or remove filters) and return OK.  To prevent further
28b219
+ * processing of (other modules') callbacks, return DONE. */
28b219
+typedef int (*ssl_npn_proto_negotiated)(conn_rec *connection, 
28b219
+                                        const char *proto_name,
28b219
+                                        apr_size_t proto_name_len);
28b219
+
28b219
+/* An optional function which can be used to register a pair of
28b219
+ * callbacks for NPN handling.  This optional function should be
28b219
+ * invoked from a pre_connection hook which runs *after* mod_ssl.c's
28b219
+ * pre_connection hook.  The function returns OK if the callbacks are
28b219
+ * register, or DECLINED otherwise (for example if mod_ssl does not
28b219
+l * support NPN).  */
28b219
+APR_DECLARE_OPTIONAL_FN(int, modssl_register_npn, (conn_rec *conn, 
28b219
+                                                   ssl_npn_advertise_protos advertisefn,
28b219
+                                                   ssl_npn_proto_negotiated negotiatedfn));
28b219
+
28b219
 #endif /* __MOD_SSL_H__ */
28b219
 /** @} */
28b219
--- httpd-2.4.6/modules/ssl/ssl_engine_init.c.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/ssl_engine_init.c
28b219
@@ -725,6 +725,11 @@ static void ssl_init_ctx_callbacks(serve
28b219
 #endif
28b219
 
28b219
     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
28b219
+
28b219
+#ifdef HAVE_TLS_NPN
28b219
+    SSL_CTX_set_next_protos_advertised_cb(
28b219
+        ctx, ssl_callback_AdvertiseNextProtos, NULL);
28b219
+#endif
28b219
 }
28b219
 
28b219
 static void ssl_init_ctx_verify(server_rec *s,
28b219
--- httpd-2.4.6/modules/ssl/ssl_engine_io.c.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/ssl_engine_io.c
28b219
@@ -297,6 +297,7 @@ typedef struct {
28b219
     apr_pool_t *pool;
28b219
     char buffer[AP_IOBUFSIZE];
28b219
     ssl_filter_ctx_t *filter_ctx;
28b219
+    int npn_finished;  /* 1 if NPN has finished, 0 otherwise */
28b219
 } bio_filter_in_ctx_t;
28b219
 
28b219
 /*
28b219
@@ -1400,6 +1401,37 @@ static apr_status_t ssl_io_filter_input(
28b219
         APR_BRIGADE_INSERT_TAIL(bb, bucket);
28b219
     }
28b219
 
28b219
+#ifdef HAVE_TLS_NPN
28b219
+    /* By this point, Next Protocol Negotiation (NPN) should be completed (if
28b219
+     * our version of OpenSSL supports it).  If we haven't already, find out
28b219
+     * which protocol was decided upon and inform other modules by calling
28b219
+     * npn_proto_negotiated_hook. */
28b219
+    if (!inctx->npn_finished) {
28b219
+        SSLConnRec *sslconn = myConnConfig(f->c);
28b219
+        const unsigned char *next_proto = NULL;
28b219
+        unsigned next_proto_len = 0;
28b219
+        int n;
28b219
+
28b219
+        if (sslconn->npn_negofns) {
28b219
+            SSL_get0_next_proto_negotiated(
28b219
+                inctx->ssl, &next_proto, &next_proto_len);
28b219
+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
28b219
+                          APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
28b219
+                          next_proto_len, (const char*)next_proto);
28b219
+            
28b219
+            for (n = 0; n < sslconn->npn_negofns->nelts; n++) {
28b219
+                ssl_npn_proto_negotiated fn = 
28b219
+                    APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated);
28b219
+                
28b219
+                if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE)
28b219
+                    break;
28b219
+            }
28b219
+        }
28b219
+            
28b219
+        inctx->npn_finished = 1;
28b219
+    }
28b219
+#endif
28b219
+
28b219
     return APR_SUCCESS;
28b219
 }
28b219
 
28b219
@@ -1881,6 +1913,7 @@ static void ssl_io_input_add_filter(ssl_
28b219
     inctx->block = APR_BLOCK_READ;
28b219
     inctx->pool = c->pool;
28b219
     inctx->filter_ctx = filter_ctx;
28b219
+    inctx->npn_finished = 0;
28b219
 }
28b219
 
28b219
 /* The request_rec pointer is passed in here only to ensure that the
28b219
--- httpd-2.4.6/modules/ssl/ssl_engine_kernel.c.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/ssl_engine_kernel.c
28b219
@@ -2161,6 +2161,97 @@ int ssl_callback_SessionTicket(SSL *ssl,
28b219
 }
28b219
 #endif /* HAVE_TLS_SESSION_TICKETS */
28b219
 
28b219
+#ifdef HAVE_TLS_NPN
28b219
+/*
28b219
+ * This callback function is executed when SSL needs to decide what protocols
28b219
+ * to advertise during Next Protocol Negotiation (NPN).  It must produce a
28b219
+ * string in wire format -- a sequence of length-prefixed strings -- indicating
28b219
+ * the advertised protocols.  Refer to SSL_CTX_set_next_protos_advertised_cb
28b219
+ * in OpenSSL for reference.
28b219
+ */
28b219
+int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
28b219
+                                     unsigned int *size_out, void *arg)
28b219
+{
28b219
+    conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
28b219
+    SSLConnRec *sslconn = myConnConfig(c);
28b219
+    apr_array_header_t *protos;
28b219
+    int num_protos;
28b219
+    unsigned int size;
28b219
+    int i;
28b219
+    unsigned char *data;
28b219
+    unsigned char *start;
28b219
+
28b219
+    *data_out = NULL;
28b219
+    *size_out = 0;
28b219
+
28b219
+    /* If the connection object is not available, or there are no NPN
28b219
+     * hooks registered, then there's nothing for us to do. */
28b219
+    if (c == NULL || sslconn->npn_advertfns == NULL) {
0943f8
+        return SSL_TLSEXT_ERR_NOACK;
28b219
+    }
28b219
+
28b219
+    /* Invoke our npn_advertise_protos hook, giving other modules a chance to
28b219
+     * add alternate protocol names to advertise. */
28b219
+    protos = apr_array_make(c->pool, 0, sizeof(char *));
28b219
+    for (i = 0; i < sslconn->npn_advertfns->nelts; i++) {
28b219
+        ssl_npn_advertise_protos fn = 
28b219
+            APR_ARRAY_IDX(sslconn->npn_advertfns, i, ssl_npn_advertise_protos);
28b219
+        
28b219
+        if (fn(c, protos) == DONE)
28b219
+            break;
28b219
+    }
28b219
+    num_protos = protos->nelts;
28b219
+
28b219
+    /* We now have a list of null-terminated strings; we need to concatenate
28b219
+     * them together into a single string, where each protocol name is prefixed
28b219
+     * by its length.  First, calculate how long that string will be. */
28b219
+    size = 0;
28b219
+    for (i = 0; i < num_protos; ++i) {
28b219
+        const char *string = APR_ARRAY_IDX(protos, i, const char*);
28b219
+        unsigned int length = strlen(string);
28b219
+        /* If the protocol name is too long (the length must fit in one byte),
28b219
+         * then log an error and skip it. */
28b219
+        if (length > 255) {
28b219
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02307)
28b219
+                          "SSL NPN protocol name too long (length=%u): %s",
28b219
+                          length, string);
28b219
+            continue;
28b219
+        }
28b219
+        /* Leave room for the length prefix (one byte) plus the protocol name
28b219
+         * itself. */
28b219
+        size += 1 + length;
28b219
+    }
28b219
+
28b219
+    /* If there is nothing to advertise (either because no modules added
28b219
+     * anything to the protos array, or because all strings added to the array
28b219
+     * were skipped), then we're done. */
28b219
+    if (size == 0) {
0943f8
+        return SSL_TLSEXT_ERR_NOACK;
28b219
+    }
28b219
+
28b219
+    /* Now we can build the string.  Copy each protocol name string into the
28b219
+     * larger string, prefixed by its length. */
28b219
+    data = apr_palloc(c->pool, size * sizeof(unsigned char));
28b219
+    start = data;
28b219
+    for (i = 0; i < num_protos; ++i) {
28b219
+        const char *string = APR_ARRAY_IDX(protos, i, const char*);
28b219
+        apr_size_t length = strlen(string);
28b219
+        if (length > 255)
28b219
+            continue;
28b219
+        *start = (unsigned char)length;
28b219
+        ++start;
28b219
+        memcpy(start, string, length * sizeof(unsigned char));
28b219
+        start += length;
28b219
+    }
28b219
+
28b219
+    /* Success. */
28b219
+    *data_out = data;
28b219
+    *size_out = size;
28b219
+    return SSL_TLSEXT_ERR_OK;
28b219
+}
28b219
+
28b219
+#endif /* HAVE_TLS_NPN */
28b219
+
28b219
 #ifndef OPENSSL_NO_SRP
28b219
 
28b219
 int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg)
28b219
--- httpd-2.4.6/modules/ssl/ssl_private.h.r1332643+
28b219
+++ httpd-2.4.6/modules/ssl/ssl_private.h
28b219
@@ -98,6 +98,8 @@
28b219
 #include <openssl/x509_vfy.h>
28b219
 #include <openssl/ocsp.h>
28b219
 
28b219
+#include "mod_ssl.h"
28b219
+
28b219
 /* Avoid tripping over an engine build installed globally and detected
28b219
  * when the user points at an explicit non-engine flavor of OpenSSL
28b219
  */
28b219
@@ -139,6 +141,11 @@
28b219
 #define HAVE_FIPS
28b219
 #endif
28b219
 
28b219
+#if OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_NEXTPROTONEG) \
28b219
+    && !defined(OPENSSL_NO_TLSEXT)
28b219
+#define HAVE_TLS_NPN
28b219
+#endif
28b219
+
28b219
 #if (OPENSSL_VERSION_NUMBER >= 0x10000000)
28b219
 #define MODSSL_SSL_CIPHER_CONST const
28b219
 #define MODSSL_SSL_METHOD_CONST const
28b219
@@ -487,6 +494,12 @@ typedef struct {
28b219
                      * connection */
28b219
     } reneg_state;
28b219
 
28b219
+#ifdef HAVE_TLS_NPN
28b219
+    /* Poor man's inter-module optional hooks for NPN. */
28b219
+    apr_array_header_t *npn_advertfns; /* list of ssl_npn_advertise_protos callbacks */
28b219
+    apr_array_header_t *npn_negofns; /* list of ssl_npn_proto_negotiated callbacks. */
28b219
+#endif
28b219
+
28b219
     server_rec *server;
28b219
 } SSLConnRec;
28b219
 
28b219
@@ -842,6 +855,7 @@ int          ssl_callback_ServerNameIndi
28b219
 int         ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
28b219
                                        EVP_CIPHER_CTX *, HMAC_CTX *, int);
28b219
 #endif
28b219
+int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data, unsigned int *len, void *arg);
28b219
 
28b219
 /**  Session Cache Support  */
28b219
 void         ssl_scache_init(server_rec *, apr_pool_t *);