vapier 15/06/01 06:08:35 Added: apache-2.4.12-alpn.patch Log: Add ALPN support via USE=alpn #471512. (Portage version: 2.2.20/cvs/Linux x86_64, signed Manifest commit with key D2E96200)
Revision Changes Path 1.1 www-servers/apache/files/apache-2.4.12-alpn.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-servers/apache/files/apache-2.4.12-alpn.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-servers/apache/files/apache-2.4.12-alpn.patch?rev=1.1&content-type=text/plain Index: apache-2.4.12-alpn.patch =================================================================== https://bugs.gentoo.org/471512 upstream apache has merged alpn into trunk: https://issues.apache.org/bugzilla/show_bug.cgi?id=52210 note: the bug is closed INVALID due to the npn discussion; go to the bottom to see alpn merged into it trunk. unfortunately, it wasn't merged into the 2.4 branch. the mod_h2 project has backported it to the 2.4 branch: https://github.com/icing/mod_h2/tree/master/sandbox/httpd/patches commit 73e4d0e9c813b58581a32a6948780fa948094cc1 --- modules/ssl/mod_ssl.c +++ modules/ssl/mod_ssl.c @@ -273,6 +273,12 @@ "OpenSSL configuration command") #endif +#ifdef HAVE_TLS_ALPN + SSL_CMD_SRV(ALPNPreference, ITERATE, + "Preference in Application-Layer Protocol Negotiation (ALPN), " + "protocols are chosen in the specified order") +#endif + /* Deprecated directives. */ AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL, "SSLLog directive is no longer supported - use ErrorLog."), @@ -423,12 +448,44 @@ return 1; } +static int modssl_register_alpn(conn_rec *c, + ssl_alpn_propose_protos advertisefn, + ssl_alpn_proto_negotiated negotiatedfn) +{ +#ifdef HAVE_TLS_ALPN + SSLConnRec *sslconn = myConnConfig(c); + + if (!sslconn) { + return DECLINED; + } + + if (!sslconn->alpn_proposefns) { + sslconn->alpn_proposefns = + apr_array_make(c->pool, 5, sizeof(ssl_alpn_propose_protos)); + sslconn->alpn_negofns = + apr_array_make(c->pool, 5, sizeof(ssl_alpn_proto_negotiated)); + } + + if (advertisefn) + APR_ARRAY_PUSH(sslconn->alpn_proposefns, ssl_alpn_propose_protos) = + advertisefn; + if (negotiatedfn) + APR_ARRAY_PUSH(sslconn->alpn_negofns, ssl_alpn_proto_negotiated) = + negotiatedfn; + + return OK; +#else + return DECLINED; +#endif +} + int ssl_init_ssl_connection(conn_rec *c, request_rec *r) { SSLSrvConfigRec *sc; SSL *ssl; SSLConnRec *sslconn = myConnConfig(c); char *vhost_md5; + int rc; modssl_ctx_t *mctx; server_rec *server; @@ -585,6 +647,7 @@ APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); + APR_REGISTER_OPTIONAL_FN(modssl_register_alpn); ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl", AUTHZ_PROVIDER_VERSION, --- modules/ssl/mod_ssl.h +++ modules/ssl/mod_ssl.h @@ -63,5 +93,46 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *)); +/** The alpn_propose_proto callback allows other modules to propose + * the name of the protocol that will be chosen during the + * Application-Layer Protocol Negotiation (ALPN) portion of the SSL handshake. + * The callback is given the connection and a list of NULL-terminated + * protocol strings as supported by the client. If this client_protos is + * non-empty, it must pick its preferred protocol from that list. Otherwise + * it should add its supported protocols in order of precedence. + * The callback should not yet modify the connection or install any filters + * as its proposal(s) may be overridden by another callback or server + * configuration. + * It should return OK or, to prevent further processing of (other modules') + * callbacks, return DONE. + */ +typedef int (*ssl_alpn_propose_protos)(conn_rec *connection, + apr_array_header_t *client_protos, + apr_array_header_t *proposed_protos); + +/** The alpn_proto_negotiated callback allows other modules to discover + * the name of the protocol that was chosen during the Application-Layer + * Protocol Negotiation (ALPN) portion of the SSL handshake. + * The callback is given the connection, a + * non-NUL-terminated string containing the protocol name, and the + * length of the string; it should do something appropriate + * (i.e. insert or remove filters) and return OK. To prevent further + * processing of (other modules') callbacks, return DONE. */ +typedef int (*ssl_alpn_proto_negotiated)(conn_rec *connection, + const char *proto_name, + apr_size_t proto_name_len); + +/* An optional function which can be used to register a pair of callbacks + * for ALPN handling. + * This optional function should be invoked from a pre_connection hook + * which runs *after* mod_ssl.c's pre_connection hook. The function returns + * OK if the callbacks are registered, or DECLINED otherwise (for example if + * mod_ssl does not support ALPN). + */ +APR_DECLARE_OPTIONAL_FN(int, modssl_register_alpn, + (conn_rec *conn, + ssl_alpn_propose_protos proposefn, + ssl_alpn_proto_negotiated negotiatedfn)); + #endif /* __MOD_SSL_H__ */ /** @} */ --- modules/ssl/ssl_engine_config.c +++ modules/ssl/ssl_engine_config.c @@ -159,6 +160,9 @@ SSL_CONF_CTX_set_flags(mctx->ssl_ctx_config, SSL_CONF_FLAG_CERTIFICATE); mctx->ssl_ctx_param = apr_array_make(p, 5, sizeof(ssl_ctx_param_t)); #endif +#ifdef HAVE_TLS_ALPN + mctx->ssl_alpn_pref = apr_array_make(p, 5, sizeof(const char *)); +#endif } static void modssl_ctx_init_proxy(SSLSrvConfigRec *sc, @@ -301,6 +307,9 @@ #ifdef HAVE_SSL_CONF_CMD cfgMergeArray(ssl_ctx_param); #endif +#ifdef HAVE_TLS_ALPN + cfgMergeArray(ssl_alpn_pref); +#endif } static void modssl_ctx_cfg_merge_proxy(apr_pool_t *p, @@ -1875,6 +1868,16 @@ } #endif +#ifdef HAVE_TLS_ALPN +const char *ssl_cmd_SSLALPNPreference(cmd_parms *cmd, void *dcfg, + const char *protocol) +{ + SSLSrvConfigRec *sc = mySrvConfig(cmd->server); + APR_ARRAY_PUSH(sc->server->ssl_alpn_pref, const char *) = protocol; + return NULL; +} +#endif + #ifdef HAVE_SRP const char *ssl_cmd_SSLSRPVerifierFile(cmd_parms *cmd, void *dcfg, --- modules/ssl/ssl_engine_init.c +++ modules/ssl/ssl_engine_init.c @@ -623,6 +646,11 @@ SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); SSL_CTX_set_info_callback(ctx, ssl_callback_Info); + +#ifdef HAVE_TLS_ALPN + SSL_CTX_set_alpn_select_cb( + ctx, ssl_callback_alpn_select, NULL); +#endif } static apr_status_t ssl_init_ctx_verify(server_rec *s, --- modules/ssl/ssl_engine_io.c +++ modules/ssl/ssl_engine_io.c @@ -28,6 +28,7 @@ core keeps dumping.'' -- Unknown */ #include "ssl_private.h" +#include "mod_ssl.h" #include "apr_date.h" /* _________________________________________________________________ @@ -297,6 +315,9 @@ apr_pool_t *pool; char buffer[AP_IOBUFSIZE]; ssl_filter_ctx_t *filter_ctx; +#ifdef HAVE_TLS_ALPN + int alpn_finished; /* 1 if ALPN has finished, 0 otherwise */ +#endif } bio_filter_in_ctx_t; /* @@ -1412,6 +1485,37 @@ APR_BRIGADE_INSERT_TAIL(bb, bucket); } +#ifdef HAVE_TLS_ALPN + /* By this point, Application-Layer Protocol Negotiation (ALPN) should be + * completed (if our version of OpenSSL supports it). If we haven't already, + * find out which protocol was decided upon and inform other modules + * by calling alpn_proto_negotiated_hook. + */ + if (!inctx->alpn_finished) { + SSLConnRec *sslconn = myConnConfig(f->c); + const unsigned char *next_proto = NULL; + unsigned next_proto_len = 0; + int n; + + if (sslconn->alpn_negofns) { + SSL_get0_alpn_selected(inctx->ssl, &next_proto, &next_proto_len); + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c, + APLOGNO(02836) "SSL negotiated protocol: '%s'", + (next_proto && next_proto_len)? + apr_pstrmemdup(f->c->pool, (const char *)next_proto, + next_proto_len) : "(null)"); + for (n = 0; n < sslconn->alpn_negofns->nelts; n++) { + ssl_alpn_proto_negotiated fn = + APR_ARRAY_IDX(sslconn->alpn_negofns, n, ssl_alpn_proto_negotiated); + + if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE) + break; + } + } + inctx->alpn_finished = 1; + } +#endif + return APR_SUCCESS; } @@ -1893,6 +1996,9 @@ inctx->block = APR_BLOCK_READ; inctx->pool = c->pool; inctx->filter_ctx = filter_ctx; +#ifdef HAVE_TLS_ALPN + inctx->alpn_finished = 0; +#endif } /* The request_rec pointer is passed in here only to ensure that the --- modules/ssl/ssl_engine_kernel.c +++ modules/ssl/ssl_engine_kernel.c @@ -29,6 +29,7 @@ time I was too famous.'' -- Unknown */ #include "ssl_private.h" +#include "mod_ssl.h" #include "util_md5.h" static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn); @@ -2137,6 +2162,153 @@ } #endif /* HAVE_TLS_SESSION_TICKETS */ +#ifdef HAVE_TLS_ALPN +static int ssl_array_index(apr_array_header_t *array, + const char *s) +{ + int i; + for (i = 0; i < array->nelts; i++) { + const char *p = APR_ARRAY_IDX(array, i, const char*); + if (!strcmp(p, s)) { + return i; + } + } + return -1; +} + +/* + * Compare two ALPN protocol proposal. Result is similar to strcmp(): + * 0 gives same precedence, >0 means proto1 is prefered. + */ +static int ssl_cmp_alpn_protos(modssl_ctx_t *ctx, + const char *proto1, + const char *proto2) +{ + /* TODO: we should have a mod_ssl configuration parameter. */ + if (ctx && ctx->ssl_alpn_pref) { + int index1 = ssl_array_index(ctx->ssl_alpn_pref, proto1); + int index2 = ssl_array_index(ctx->ssl_alpn_pref, proto2); + if (index2 > index1) { + return (index1 >= 0)? 1 : -1; + } + else if (index1 > index2) { + return (index2 >= 0)? -1 : 1; + } + } + /* both have the same index (mabye -1 or no pref configured) and we compare + * the names so that spdy3 gets precedence over spdy2. That makes + * the outcome at least deterministic. */ + return strcmp((const char *)proto1, (const char *)proto2); +} + +/* + * This callback function is executed when the TLS Application Layer + * Protocol Negotiate Extension (ALPN, RFC 7301) is triggered by the client + * hello, giving a list of desired protocol names (in descending preference) + * to the server. + * The callback has to select a protocol name or return an error if none of + * the clients preferences is supported. + * The selected protocol does not have to be on the client list, according + * to RFC 7301, so no checks are performed. + * The client protocol list is serialized as length byte followed by ascii + * characters (not null-terminated), followed by the next protocol name. + */ +int ssl_callback_alpn_select(SSL *ssl, + const unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, void *arg) +{ + conn_rec *c = (conn_rec*)SSL_get_app_data(ssl); + SSLConnRec *sslconn = myConnConfig(c); + server_rec *s = mySrvFromConn(c); + SSLSrvConfigRec *sc = mySrvConfig(s); + modssl_ctx_t *mctx = myCtxConfig(sslconn, sc); + const char *alpn_http1 = "http/1.1"; + apr_array_header_t *client_protos; + apr_array_header_t *proposed_protos; + int i; + size_t len; + + /* If the connection object is not available, + * then there's nothing for us to do. */ + if (c == NULL) { + return SSL_TLSEXT_ERR_OK; + } + + if (inlen == 0) { + // someone tries to trick us? + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02837) + "ALPN client protocol list empty"); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + + client_protos = apr_array_make(c->pool, 0, sizeof(char *)); + for (i = 0; i < inlen; /**/) { + unsigned int plen = in[i++]; + if (plen + i > inlen) { + // someone tries to trick us? + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02838) + "ALPN protocol identier too long"); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + APR_ARRAY_PUSH(client_protos, char*) = + apr_pstrndup(c->pool, (const char *)in+i, plen); + i += plen; + } + + proposed_protos = apr_array_make(c->pool, client_protos->nelts+1, + sizeof(char *)); + + if (sslconn->alpn_proposefns != NULL) { + /* Invoke our alpn_propos_proto hooks, giving other modules a chance to + * propose protocol names for selection. We might have several such + * hooks installed and if two make a proposal, we need to give + * preference to one. + */ + for (i = 0; i < sslconn->alpn_proposefns->nelts; i++) { + ssl_alpn_propose_protos fn = + APR_ARRAY_IDX(sslconn->alpn_proposefns, i, + ssl_alpn_propose_protos); + + if (fn(c, client_protos, proposed_protos) == DONE) + break; + } + } + + if (proposed_protos->nelts <= 0) { + /* Regardless of installed hooks, the http/1.1 protocol is always + * supported by us. Choose it if none other matches. */ + if (ssl_array_index(client_protos, alpn_http1) < 0) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02839) + "none of the client ALPN protocols are supported"); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + *out = (const unsigned char*)alpn_http1; + *outlen = (unsigned char)strlen(alpn_http1); + return SSL_TLSEXT_ERR_OK; + } + + /* Now select the most preferred protocol from the proposals. */ + *out = APR_ARRAY_IDX(proposed_protos, 0, const unsigned char *); + for (i = 1; i < proposed_protos->nelts; ++i) { + const char *proto = APR_ARRAY_IDX(proposed_protos, i, const char*); + /* Do we prefer it over existing candidate? */ + if (ssl_cmp_alpn_protos(mctx, (const char *)*out, proto) < 0) { + *out = (const unsigned char*)proto; + } + } + + len = strlen((const char*)*out); + if (len > 255) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02840) + "ALPN negotiated protocol name too long"); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + *outlen = (unsigned char)len; + + return SSL_TLSEXT_ERR_OK; +} +#endif + #ifdef HAVE_SRP int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg) --- modules/ssl/ssl_private.h +++ modules/ssl/ssl_private.h @@ -182,6 +182,11 @@ #include <openssl/srp.h> #endif +/* ALPN Protocol Negotiation */ +#if defined(TLSEXT_TYPE_application_layer_protocol_negotiation) +#define HAVE_TLS_ALPN +#endif + #endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */ /* mod_ssl headers */ @@ -443,6 +438,12 @@ * connection */ } reneg_state; +#ifdef HAVE_TLS_ALPN + /* Poor man's inter-module optional hooks for ALPN. */ + apr_array_header_t *alpn_proposefns; /* list of ssl_alpn_propose_protos callbacks */ + apr_array_header_t *alpn_negofns; /* list of ssl_alpn_proto_negotiated callbacks. */ +#endif + server_rec *server; } SSLConnRec; @@ -633,6 +633,10 @@ SSL_CONF_CTX *ssl_ctx_config; /* Configuration context */ apr_array_header_t *ssl_ctx_param; /* parameters to pass to SSL_CTX */ #endif + +#ifdef HAVE_TLS_ALPN + apr_array_header_t *ssl_alpn_pref; /* protocol names in order of preference */ +#endif } modssl_ctx_t; struct SSLSrvConfigRec { @@ -763,6 +763,10 @@ const char *ssl_cmd_SSLOpenSSLConfCmd(cmd_parms *cmd, void *dcfg, const char *arg1, const char *arg2); #endif +#ifdef HAVE_TLS_ALPN +const char *ssl_cmd_SSLALPNPreference(cmd_parms *cmd, void *dcfg, const char *protocol); +#endif + #ifdef HAVE_SRP const char *ssl_cmd_SSLSRPVerifierFile(cmd_parms *cmd, void *dcfg, const char *arg); const char *ssl_cmd_SSLSRPUnknownUserSeed(cmd_parms *cmd, void *dcfg, const char *arg); @@ -815,6 +815,12 @@ EVP_CIPHER_CTX *, HMAC_CTX *, int); #endif +#ifdef HAVE_TLS_ALPN +int ssl_callback_alpn_select(SSL *ssl, const unsigned char **out, + unsigned char *outlen, const unsigned char *in, + unsigned int inlen, void *arg); +#endif + /** Session Cache Support */ apr_status_t ssl_scache_init(server_rec *, apr_pool_t *); void ssl_scache_status_register(apr_pool_t *p);
