[Pkg-apache-commits] r1254 - in /branches/lenny-apache2: NEWS changelog config-dir/mods-available/ssl.conf control patches/00list patches/080_CVE-2009-3555-rfc5746.dpatch
sf at alioth.debian.org
sf at alioth.debian.org
Sun Dec 5 10:47:03 UTC 2010
Author: sf
Date: Sun Dec 5 10:47:02 2010
New Revision: 1254
URL: http://svn.debian.org/wsvn/pkg-apache/?sc=1&rev=1254
Log:
backport support for rfc5746
bump openssl build-dep
Added:
branches/lenny-apache2/patches/080_CVE-2009-3555-rfc5746.dpatch
Modified:
branches/lenny-apache2/NEWS
branches/lenny-apache2/changelog
branches/lenny-apache2/config-dir/mods-available/ssl.conf
branches/lenny-apache2/control
branches/lenny-apache2/patches/00list
Modified: branches/lenny-apache2/NEWS
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/NEWS?rev=1254&op=diff
==============================================================================
--- branches/lenny-apache2/NEWS (original)
+++ branches/lenny-apache2/NEWS Sun Dec 5 10:47:02 2010
@@ -1,3 +1,15 @@
+apache2 (2.2.9-10+lenny9) stable-security; urgency=low
+
+ * The latest openssl upgrade added support for SSL/TLS secure renegotiation
+ (RFC 5746) to fix the protocol vulnerability CVE-2009-3555 but disallows
+ renegotiation for clients that do not yet support this extension. This
+ upgrade of apache2 adds the new SSLInsecureRenegotiation directive which
+ allows to revert to the old behaviour. If you need to support such
+ clients, uncomment the 'SSLInsecureRenegotiation on' line in
+ /etc/apache2/mods-available/ssl.conf
+
+ -- Stefan Fritsch <sf at debian.org> Mon, 15 Nov 2010 22:53:03 +0100
+
apache2 (2.2.9-3) unstable; urgency=low
* The directive "NameVirtualHost *" has been changed to "NameVirtualHost
Modified: branches/lenny-apache2/changelog
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/changelog?rev=1254&op=diff
==============================================================================
--- branches/lenny-apache2/changelog (original)
+++ branches/lenny-apache2/changelog Sun Dec 5 10:47:02 2010
@@ -1,3 +1,14 @@
+apache2 (2.2.9-10+lenny9) UNRELEASED; urgency=low
+
+ * Add the new SSLInsecureRenegotiation directive to configure if clients
+ that have not been patched to support secure renegotiation (RFC 5746)
+ are allowed to connect (CVE-2009-3555).
+ Together with the recent openssl upgrade, this closes: #587037
+ This upgrade also adds support for the SSL_SECURE_RENEG variable, to
+ allow testing if secure renegotiation is supported by the client.
+
+ -- Stefan Fritsch <sf at debian.org> Mon, 15 Nov 2010 22:46:40 +0100
+
apache2 (2.2.9-10+lenny8) stable; urgency=low
* Add missing psmisc dependency for killall used in the init script.
Modified: branches/lenny-apache2/config-dir/mods-available/ssl.conf
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/config-dir/mods-available/ssl.conf?rev=1254&op=diff
==============================================================================
--- branches/lenny-apache2/config-dir/mods-available/ssl.conf (original)
+++ branches/lenny-apache2/config-dir/mods-available/ssl.conf Sun Dec 5 10:47:02 2010
@@ -61,4 +61,8 @@
# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2
+# Allow insecure renegotiation with clients which do not yet support the
+# secure renegotiation protocol. Default: Off
+#SSLInsecureRenegotiation on
+
</IfModule>
Modified: branches/lenny-apache2/control
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/control?rev=1254&op=diff
==============================================================================
--- branches/lenny-apache2/control (original)
+++ branches/lenny-apache2/control Sun Dec 5 10:47:02 2010
@@ -3,7 +3,7 @@
Priority: optional
Maintainer: Debian Apache Maintainers <debian-apache at lists.debian.org>
Uploaders: Tollef Fog Heen <tfheen at debian.org>, Thom May <thom at debian.org>, Adam Conrad <adconrad at 0c3.net>, Peter Samuelson <peter at p12n.org>, Stefan Fritsch <sf at debian.org>
-Build-Depends: debhelper (>=6.0.7), dpatch, lsb-release, libaprutil1-dev, libapr1-dev (>= 1.2.7-6), openssl, libpcre3-dev, mawk, zlib1g-dev, libssl-dev, sharutils
+Build-Depends: debhelper (>=6.0.7), dpatch, lsb-release, libaprutil1-dev, libapr1-dev (>= 1.2.7-6), openssl, libpcre3-dev, mawk, zlib1g-dev, libssl-dev (>=0.9.8g-15+lenny10), sharutils
Standards-Version: 3.8.0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-apache/trunk/apache2
Vcs-svn: svn://svn.debian.org/pkg-apache/trunk/apache2
Modified: branches/lenny-apache2/patches/00list
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/patches/00list?rev=1254&op=diff
==============================================================================
--- branches/lenny-apache2/patches/00list (original)
+++ branches/lenny-apache2/patches/00list Sun Dec 5 10:47:02 2010
@@ -38,6 +38,7 @@
077_CVE-2010-0408.dpatch
078_CVE-2010-0434.dpatch
079_avoid_brigade_destroy.dpatch
+080_CVE-2009-3555-rfc5746.dpatch
099_config_guess_sub_update
200_cp_suexec.dpatch
201_build_suexec-custom.dpatch
Added: branches/lenny-apache2/patches/080_CVE-2009-3555-rfc5746.dpatch
URL: http://svn.debian.org/wsvn/pkg-apache/branches/lenny-apache2/patches/080_CVE-2009-3555-rfc5746.dpatch?rev=1254&op=file
==============================================================================
--- branches/lenny-apache2/patches/080_CVE-2009-3555-rfc5746.dpatch (added)
+++ branches/lenny-apache2/patches/080_CVE-2009-3555-rfc5746.dpatch Sun Dec 5 10:47:02 2010
@@ -1,0 +1,178 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+# Description: Add support for SSLInsecureRenegotiation directive
+# Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=917044
+
+ at DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/mod_ssl.c lenny-apache2/modules/ssl/mod_ssl.c
+--- lenny-apache2~/modules/ssl/mod_ssl.c 2010-11-15 22:45:54.000000000 +0100
++++ lenny-apache2/modules/ssl/mod_ssl.c 2010-11-15 23:14:11.411204883 +0100
+@@ -143,6 +143,8 @@
+ "(`[+-][SSLv2|SSLv3|TLSv1] ...' - see manual)")
+ SSL_CMD_SRV(HonorCipherOrder, FLAG,
+ "Use the server's cipher ordering preference")
++ SSL_CMD_SRV(InsecureRenegotiation, FLAG,
++ "Enable support for insecure renegotiation")
+ SSL_CMD_ALL(UserName, TAKE1,
+ "Set user name to SSL variable value")
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/ssl_engine_config.c lenny-apache2/modules/ssl/ssl_engine_config.c
+--- lenny-apache2~/modules/ssl/ssl_engine_config.c 2010-11-15 22:45:54.000000000 +0100
++++ lenny-apache2/modules/ssl/ssl_engine_config.c 2010-11-15 23:14:11.411204883 +0100
+@@ -169,6 +169,7 @@
+ sc->vhost_id_len = 0; /* set during module init */
+ sc->session_cache_timeout = UNSET;
+ sc->cipher_server_pref = UNSET;
++ sc->insecure_reneg = UNSET;
+
+ modssl_ctx_init_proxy(sc, p);
+
+@@ -257,6 +258,7 @@
+ cfgMergeBool(proxy_enabled);
+ cfgMergeInt(session_cache_timeout);
+ cfgMergeBool(cipher_server_pref);
++ cfgMergeBool(insecure_reneg);
+
+ modssl_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
+
+@@ -674,6 +676,19 @@
+ #endif
+ }
+
++const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag)
++{
++#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
++ SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
++ sc->insecure_reneg = flag?TRUE:FALSE;
++ return NULL;
++#else
++ return "The SSLInsecureRenegotiation directive is not available "
++ "with this SSL library";
++#endif
++}
++
++
+ static const char *ssl_cmd_check_dir(cmd_parms *parms,
+ const char **dir)
+ {
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/ssl_engine_init.c lenny-apache2/modules/ssl/ssl_engine_init.c
+--- lenny-apache2~/modules/ssl/ssl_engine_init.c 2010-11-15 23:14:11.306955553 +0100
++++ lenny-apache2/modules/ssl/ssl_engine_init.c 2010-11-15 23:14:11.411204883 +0100
+@@ -364,6 +364,7 @@
+ MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
+ char *cp;
+ int protocol = mctx->protocol;
++ SSLSrvConfigRec *sc = mySrvConfig(s);
+
+ /*
+ * Create the new per-server SSL context
+@@ -414,11 +415,14 @@
+ }
+
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
+- {
+- SSLSrvConfigRec *sc = mySrvConfig(s);
+- if (sc->cipher_server_pref == TRUE) {
+- SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+- }
++ if (sc->cipher_server_pref == TRUE) {
++ SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
++ }
++#endif
++
++#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
++ if (sc->insecure_reneg == TRUE) {
++ SSL_CTX_set_options(ctx, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
+ }
+ #endif
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/ssl_engine_kernel.c lenny-apache2/modules/ssl/ssl_engine_kernel.c
+--- lenny-apache2~/modules/ssl/ssl_engine_kernel.c 2010-11-15 23:14:11.310953934 +0100
++++ lenny-apache2/modules/ssl/ssl_engine_kernel.c 2010-11-15 23:14:11.411204883 +0100
+@@ -612,10 +612,18 @@
+ else {
+ request_rec *id = r->main ? r->main : r;
+
+- /* do a full renegotiation */
++ /* Perform a full renegotiation. */
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,
+- "Performing full renegotiation: "
+- "complete handshake protocol");
++ "Performing full renegotiation: complete handshake "
++ "protocol (%s support secure renegotiation)",
++#if defined(SSL_get_secure_renegotiation_support)
++ SSL_get_secure_renegotiation_support(ssl) ?
++ "client does" : "client does not"
++#else
++ "server does not"
++#endif
++ );
++
+
+ SSL_set_session_id_context(ssl,
+ (unsigned char *)&id,
+@@ -631,6 +639,7 @@
+ if (SSL_get_state(ssl) != SSL_ST_OK) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+ "Re-negotiation request failed");
++ ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, r->server);
+
+ r->connection->aborted = 1;
+ return HTTP_FORBIDDEN;
+@@ -917,6 +926,7 @@
+ "SSL_VERSION_INTERFACE",
+ "SSL_VERSION_LIBRARY",
+ "SSL_PROTOCOL",
++ "SSL_SECURE_RENEG",
+ "SSL_COMPRESS_METHOD",
+ "SSL_CIPHER",
+ "SSL_CIPHER_EXPORT",
+@@ -1061,6 +1071,12 @@
+ }
+ }
+
++
++#ifdef SSL_get_secure_renegotiation_support
++ apr_table_setn(r->notes, "ssl-secure-reneg",
++ SSL_get_secure_renegotiation_support(ssl) ? "1" : "0");
++#endif
++
+ return DECLINED;
+ }
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/ssl_engine_vars.c lenny-apache2/modules/ssl/ssl_engine_vars.c
+--- lenny-apache2~/modules/ssl/ssl_engine_vars.c 2010-11-15 22:45:54.000000000 +0100
++++ lenny-apache2/modules/ssl/ssl_engine_vars.c 2010-11-15 23:18:12.226747522 +0100
+@@ -320,6 +320,14 @@
+ else if (ssl != NULL && strcEQ(var, "COMPRESS_METHOD")) {
+ result = ssl_var_lookup_ssl_compress_meth(ssl);
+ }
++ else if (ssl != NULL && strcEQ(var, "SECURE_RENEG")) {
++ int flag = 0;
++#ifdef SSL_get_secure_renegotiation_support
++ flag = SSL_get_secure_renegotiation_support(ssl);
++#endif
++ result = apr_pstrdup(p, flag ? "true" : "false");
++ }
++
+ return result;
+ }
+
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' lenny-apache2~/modules/ssl/ssl_private.h lenny-apache2/modules/ssl/ssl_private.h
+--- lenny-apache2~/modules/ssl/ssl_private.h 2010-11-15 23:14:11.310953934 +0100
++++ lenny-apache2/modules/ssl/ssl_private.h 2010-11-15 23:14:11.411204883 +0100
+@@ -460,6 +460,7 @@
+ int vhost_id_len;
+ int session_cache_timeout;
+ BOOL cipher_server_pref;
++ BOOL insecure_reneg;
+ modssl_ctx_t *server;
+ modssl_ctx_t *proxy;
+ };
+@@ -526,6 +527,7 @@
+ const char *ssl_cmd_SSLRequireSSL(cmd_parms *, void *);
+ const char *ssl_cmd_SSLRequire(cmd_parms *, void *, const char *);
+ const char *ssl_cmd_SSLUserName(cmd_parms *, void *, const char *);
++const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag);
+
+ const char *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
+ const char *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *);
More information about the Pkg-apache-commits
mailing list