Changeset 1348 for trunk/server

Timestamp:

Nov 8, 2009, 11:02:18 AM (14 years ago)

Author:

mitchb

Message:

Prompt for certs once, not five bajillion times (fix SSL session caching)

Clients that support both the SNI extension and the TLS Session Tickets
extension have problems that, among other things, result in many of our
cert-protected sites requesting the user's certs an inordinate number
of times.  This will supposedly be fixed in later versions of openssl,
but in the meantime, this applies the patch proposed here:

  http://mail-archives.apache.org/mod_mbox/httpd-dev/200911.mbox/ajax/%3c4AF58A80.5080101@velox.ch%3e

with the following modifications:
  o Remove the documentation chunk of the patch (it applies to the source
    XML file which isn't part of the distribution tarball)
  o Expand the macro SSL_CTX_set_tlsext_ticket_keys in two places to work
    around the typo in our version of openssl corrected by this upstream
    commit:
      http://marc.info/?l=openssl-cvs&m=124638969912935&w=2

Location:

trunk/server

Files:

• common/patches/httpd-2.2.x-mod_ssl-sessioncaching.patch (added)
• fedora/specs/httpd.spec.patch (modified) (5 diffs)

trunk/server/fedora/specs/httpd.spec.patch

@@ -1 @@
---- httpd.spec.orig     2009-08-25 07:12:16.000000000 -0400
-+++ httpd.spec  2009-08-25 07:15:12.000000000 -0400
+--- httpd.spec.orig     2009-11-08 08:58:40.000000000 -0500
++++ httpd.spec  2009-11-08 09:00:43.000000000 -0500
 @@ -7,7 +7,7 @@
  Summary: Apache HTTP Server
@@ -10 +10 @@
  Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.gz
  Source1: index.html
-@@ -55,6 +55,11 @@
+@@ -55,6 +55,12 @@
  Conflicts: pcre < 4.0
  Requires: httpd-tools = %{version}-%{release}, apr-util-ldap
@@ -18 +18 @@
 +Patch1003: httpd-2.2.x-mod_status-security.patch
 +Patch1004: httpd-2.2.x-304.patch
++Patch1005: httpd-2.2.x-mod_ssl-sessioncaching.patch
 +
  %description
  The Apache HTTP Server is a powerful, efficient, and extensible
  web server.
-@@ -101,6 +106,7 @@
+@@ -101,6 +107,7 @@
  BuildRequires: openssl-devel, distcache-devel
  Requires(post): openssl >= 0.9.7f-4, /bin/cat
@@ -30 +31 @@
  
  %description -n mod_ssl
-@@ -128,6 +134,10 @@
+@@ -128,6 +135,11 @@
  # Patch in vendor/release string
  sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
@@ -37 +38 @@
 +%patch1003 -p1 -b .permitstatus
 +%patch1004 -p1 -b .scripts-304
++%patch1005 -p1 -b .ssl-sessioncache
 +
  # Safety check: prevent build if defined MMN does not equal upstream MMN.
  vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
  if test "x${vmmn}" != "x%{mmn}"; then
-@@ -176,10 +186,12 @@
+@@ -176,10 +188,12 @@
          --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
         --enable-suexec --with-suexec \