git.net

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: svn commit: r1837435 - in /httpd/httpd/trunk/modules/ssl: mod_ssl.c ssl_engine_init.c


Yann and Rüdiger, looking at this, I am thinking about how to improve mod_md's init of openssl. Basically, if mod_ssl + mod_md is loaded, mod_md does not have to do anything, it seems.

However, there is a slim chance that someone has another ssl module (or none?) and what should mod_md do then? I can copy the crypto parts of the pre_config and cleanup code, but given the ever increasing version number checks...is there a better way?

-Stefan



> Am 04.08.2018 um 19:17 schrieb ylavic@xxxxxxxxxx:
> 
> Author: ylavic
> Date: Sat Aug  4 17:17:03 2018
> New Revision: 1837435
> 
> URL: http://svn.apache.org/viewvc?rev=1837435&view=rev
> Log:
> mod_ssl: OpenSSL now initializes fully through APR, use that.
> 
> Follow up to r1833368 and r1833452.
> 
> Modified:
>    httpd/httpd/trunk/modules/ssl/mod_ssl.c
>    httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
> 
> Modified: httpd/httpd/trunk/modules/ssl/mod_ssl.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/mod_ssl.c?rev=1837435&r1=1837434&r2=1837435&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/mod_ssl.c (original)
> +++ httpd/httpd/trunk/modules/ssl/mod_ssl.c Sat Aug  4 17:17:03 2018
> @@ -342,6 +342,7 @@ static int modssl_is_prelinked(void)
>     return 0;
> }
> 
> +#if !USE_APR_CRYPTO_LIB_INIT
> static apr_status_t ssl_cleanup_pre_config(void *data)
> {
>     /*
> @@ -397,47 +398,31 @@ static apr_status_t ssl_cleanup_pre_conf
>      */
>     return APR_SUCCESS;
> }
> +#endif /* !USE_APR_CRYPTO_LIB_INIT */
> 
> static int ssl_hook_pre_config(apr_pool_t *pconf,
>                                apr_pool_t *plog,
>                                apr_pool_t *ptemp)
> {
> -#if USE_APR_CRYPTO_LIB_INIT
> -    apr_status_t rv;
> -#endif
> -
> #if HAVE_VALGRIND
>     ssl_running_on_valgrind = RUNNING_ON_VALGRIND;
> #endif
>     modssl_running_statically = modssl_is_prelinked();
> 
> -    /* Some OpenSSL internals are allocated per-thread, make sure they
> -     * are associated to the/our same thread-id until cleaned up.
> -     */
> -#if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API
> -    ssl_util_thread_id_setup(pconf);
> -#endif
> -
> #if USE_APR_CRYPTO_LIB_INIT
> -    /* When mod_ssl is builtin, no need to unload openssl on restart */
> -    rv = apr_crypto_lib_init("openssl", NULL, NULL,
> -                             modssl_running_statically ? ap_pglobal : pconf);
> -    if (rv == APR_SUCCESS || rv == APR_EREINIT) {
> -        /* apr_crypto inits libcrypto only, so in any case init libssl here,
> -         * each time if openssl is unloaded with pconf, but only once if
> -         * mod_ssl is builtin.
> +    {
> +        /* When mod_ssl is builtin, no need to unload openssl on restart,
> +         * so use pglobal.
>          */
> -        if (!modssl_running_statically
> -                || !ap_retained_data_get("ssl_hook_pre_config")) {
> -            if (modssl_running_statically) {
> -                ap_retained_data_create("ssl_hook_pre_config", 1);
> -            }
> -            SSL_load_error_strings();
> -            SSL_library_init();
> +        apr_pool_t *p = modssl_running_statically ? ap_pglobal : pconf;
> +        apr_status_t rv = apr_crypto_lib_init("openssl", NULL, NULL, p);
> +        if (rv != APR_SUCCESS && rv != APR_EREINIT) {
> +            ap_log_perror(APLOG_MARK, APLOG_ERR, rv, pconf, APLOGNO()
> +                          "mod_ssl: can't initialize OpenSSL library");
> +            return !OK;
>         }
>     }
> -    else
> -#endif
> +#else /* USE_APR_CRYPTO_LIB_INIT */
>     {
>         /* We must register the library in full, to ensure our configuration
>          * code can successfully test the SSL environment.
> @@ -456,6 +441,7 @@ static int ssl_hook_pre_config(apr_pool_
> #endif
>         OpenSSL_add_all_algorithms();
>         OPENSSL_load_builtin_modules();
> +
>         SSL_load_error_strings();
>         SSL_library_init();
> 
> @@ -466,6 +452,16 @@ static int ssl_hook_pre_config(apr_pool_
>                                                apr_pool_cleanup_null);
>     }
> 
> +#if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API
> +    /* Some OpenSSL internals are allocated per-thread, make sure they
> +     * are associated to the/our same thread-id until cleaned up. Then
> +     * initialize all the thread locking stuff needed by the lib.
> +     */
> +    ssl_util_thread_id_setup(pconf);
> +    ssl_util_thread_setup(pconf);
> +#endif
> +#endif /* USE_APR_CRYPTO_LIB_INIT */
> +
>     if (OBJ_txt2nid("id-on-dnsSRV") == NID_undef) {
>         (void)OBJ_create("1.3.6.1.5.5.7.8.7", "id-on-dnsSRV",
>                          "SRVName otherName form");
> 
> Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_init.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_init.c?rev=1837435&r1=1837434&r2=1837435&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/modules/ssl/ssl_engine_init.c (original)
> +++ httpd/httpd/trunk/modules/ssl/ssl_engine_init.c Sat Aug  4 17:17:03 2018
> @@ -294,10 +294,6 @@ apr_status_t ssl_init_Module(apr_pool_t
> #endif
>     }
> 
> -#if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API
> -    ssl_util_thread_setup(p);
> -#endif
> -
>     /*
>      * SSL external crypto device ("engine") support
>      */
> 
>