ALPN support, based on mod_spdy/mod_h2 patch set

Omitted from r1620926 in error. Add API to support TLS channel bindings with mod_ssl. * modules/ssl/mod_ssl.h: Define ssl_get_tls_cb. * modules/ssl/ssl_engine_vars.c (ssl_get_tls_cb): New function. Submitted by: Simo Sorce <simo redhat.com>

mod_ssl: Add hooks to allow other modules to perform processing at several stages of initialization and connection handling. See mod_ssl_openssl.h. This is enough to allow implementation of Certificate Transparency outside of mod_ssl.

remove stray character in comment

mod_ssl: Redesign NPN (Next Protocol Negotiation) API to avoid use of hooks API and inter-module hard linkage: * modules/ssl/mod_ssl.h: Remove NPN hooks, add "modssl_register_npn" optional function and callback function type declarations for ssl_npn_advertise_protos, ssl_npn_proto_negotiated. * modules/ssl/mod_ssl.c: Drop hooks. (modssl_register_npn): New optional function implementation. (ssl_register_hooks): Register it. * modules/ssl/ssl_private.h (SSLConnRec): Add npn_advertfns, npn_negofns array fields. * modules/ssl/ssl_engine_kernel.c (ssl_callback_AdvertiseNextProtos): Replace use of hook API with array iteration. * modules/ssl/ssl_engine_io.c (ssl_io_filter_input): Likewise. Reviewed by: Matthew Steele <mdsteele google.com>

Removed trailing semicolons from header also.

Add support for TLS Next Protocol Negotiation: * modules/ssl/mod_ssl.c, modules/ssl/mod_ssl.h: Add and implement new hooks for next protocol advertisement/discovery. * modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks): Enable NPN advertisement callback in handshake. * modules/ssl/ssl_engine_io.c (ssl_io_filter_input): Invoke next-protocol discovery hook. * modules/ssl/ssl_engine_kernel.c (ssl_callback_AdvertiseNextProtos): New callback. * modules/ssl/ssl_private.h: Add prototype. Submitted by: Matthew Steele <mdsteele google.com> with slight tweaks by jorton

Cleanup effort in prep for GA push: Trim trailing whitespace... no func change

update license header text

Update the copyright year in all .c, .h and .xml files

- remove ssl_ext_lookup and replace it with ssl_ext_list - change ssl_expr_eval_oid to use ssl_ext_list This change provides for a singfle function that provides an array of all values from a certificate that match a given extension and removes the duplictaed code that was present. Reviewed by: Joe Orton

Doxygen fixup / cleanup submited by: Neale Ranns neale ranns.org reviewed by: Ian Holsman

* modules/ssl/ssl_expr_eval.c (ssl_expr_eval_oid): Remove unused variable. * modules/ssl/ssl_private.h, modules/ssl/mod_ssl.h (ssl_extlist_by_oid): Move prototype to ssl_private.h.

Allow extraction of the values of SSL certificate extensions into environment variables, so that their value can be used by any module that is aware of environment variables, as in: SetEnvIf OID("2.16.840.1.113730.1.13") "(.*) Generated (Certificate)" ca=$1 sets ca=TinyCA if the cert was issued by TinyCA. Similarly, SetenvIf OID("2.16.840.1.113730.1.13") "(.*)" NetscapeComment=$1 will set $NetscapeComment to the whole string. It is technically allowed to have multiple instances of an extension field, all with the same oid. In this case, the environment variable will be set to the list of all fields, separated by commas. The [PATCH] uses a cross-module call from mod_setenvif to mod_ssl (the latter may also be missing: in this case the variable will never be set). It calls a common function in the ssl module that is also used for the SSLRequire directive's test.

* modules/ssl/mod_ssl.h: Add ssl_ext_lookup optional hook declaration. * modules/ssl/ssl_engine_vars.c (ssl_ext_lookup): New function. (ssl_var_register): Register optional function. * modules/ssl/ssl_private.h (ssl_ext_lookup): Add prototype. Submitted by: David Reid, Joe Orton

Update copyright year to 2005 and standardize on current copyright owner line.

* modules/ssl/mod_ssl.h: Declare ssl_is_https optional function. * modules/ssl/ssl_engine_vars (ssl_is_https): New function. (ssl_var_register): Register it.

Move mod_ssl-internal interfaces into ssl_private.h; allow mod_ssl.h to be included even when mod_ssl is not enabled. * Makefile.in (install-include): Only install mod_ssl.h. * modules/ssl/ssl_private.h: New file. * modules/ssl/mod_ssl.h: Move everything apart from than the optional hook definitions into ssl_private.h. * modules/ssl/*.c: Include ssl_private.h not mod_ssl.h * modules/ssl/config.m4: Always add the mod_ssl directory to the include path so other modules can find mod_ssl.h. * modules/proxy/mod_proxy.c: Include mod_ssl.h to pick up the optional hook definitions rather than copy'n'pasting them.

fix name of The Apache Software Foundation

fix copyright dates according to the first check in

apply Apache License, Version 2.0

* modules/ssl/ssl_scache_dc.c: Add the Apache Software License. * modules/ssl/mod_ssl.h: Undo accidental comment change in previous commit.

Add support to mod_ssl for a distributed session cache using distcache. * LAYOUT: Update for removal of scache_shmht and addition of scache_dc. * modules/ssl/config.m4: Check for libdistcache; build ssl_scache_dc.lo. * modules/ssl/mod_ssl.dsp: Build ssl_scache_dc (with luck). * modules/ssl/mod_ssl.h: Add SSL_SCMODE_DC and scache_dc_* prototypes. * modules/ssl/ssl_engine_config.c (ssl_cmd_SSLSessionCache): Allow use of dc: argument. * modules/ssl/ssl_scache_dc.c: New file. * modules/ssl/ssl_scache.c (ssl_scache_init, ssl_scache_kill, ssl_scache_store, ssl_scache_retrieve, ssl_scache_remove, ssl_ext_status_hook): Hook into scache_dc. Submitted by: Geoff Thorpe <geoff@geoffthorpe.net>

update license to 2004.

* modules/ssl/mod_ssl.h: Remove prototypes for shmht.

Extend mod_status output to include SSL session cache status information: * modules/ssl/mod_ssl.c (ssl_hook_pre_config): Call ssl_scache_status_register. * modules/ssl/ssl_scache.c (ssl_scache_status): Removed function. (ssl_ext_status_hook): Renamed from ssl_ext_ms_display: switch to 2.1's mod_status "status_hook" API. (ssl_scache_status_register): Register optional hook. * modules/ssl/ssl_scache_dbm.c (ssl_scache_dbm_status): Adjust to use new API. * modules/ssl/ssl_scache_shmcb.c (ssl_scache_shmcb_status): Adjust to use new API.

Remove shmht session cache in favour of shmcb; shmht has had data corruption bugs since being apr_rmm'ified. * config.m4, mod_ssl.dsp: Don't build ssl_util_table and ssl_scache_shmht. * ssl_util_table.h, ssl_util_table.c, ssl_scache_shmht.c: Removed files. * mod_ssl.h (SSLModConfigRec): Use a void * pointer for storing the scache-specific data. * ssl_engine_config.c (ssl_cmd_SSLSessionCache): Treat shmht: as shmcb:. * ssl_scache.c: Remove shmht hooks throughout. * ssl_scache_shmcb.c: Remove casts to use the table_t * pointer as a void *.

Make mod_ssl consistent with itself when you have a halfass install of openssl-engine (ie, you're missing the headers). ssl_cmd_SSLCryptoDevice() is thrown away by the preprocessor if you're missing the header, so the call to it should have the same condition applied. otherwise, mod_ssl will fail to link.

not valid to modify string pointed to by szCryptoDevice... it points to a static string or something parsed from the config

Needed on EBCDIC systems

Unix: Handle permissions settings for flock-based mutexes in unixd_set_global|proc_mutex_perms(). Allow the functions to be called for any type of mutex. This resolves a fatal problem with mod_rewrite on systems where APR uses flock-based mutex. It simplifies mod_ssl as well, which had special logic to perform the chown(). It fixed an init error with mod_ssl on systems where flock is used when the user had no SSLMutex directive. The Unix MPMs continue to call unixd_set_global|proc_mutex_perms() only for SysV sems. There is no permission problem with flock-based accept mutexes since the child init logic for the MPMs is done prior to switching identity. PR: 20312

Roll away the SSL_EXPERIMENTAL_ENGINE test in favor of testing for the ENGINE_init() function in config.m4, and rely on HAVE_ENGINE_INIT instead. Reviewed by: Ben Laurie (concept)

Why wouldn't this be a mod_ssl header?

Further breakage from r.1.131: MODSSL_INFO_CB_ARG_TYPE also includes the *.

Fix compile breakage introduced in r1.131. MODSSL_INFO_CB_ARG_TYPE already includes 'SSL' in its type. Don't duplicate.

Solve SSL-C breakage introduced in mod_ssl.h rev 1.129 and ssl_engine_kernel.c rev 1.88. SSL* is not const under SSL-C. I've confirmed Jeff's comment that the original patch doesn't harm earlier OpenSSL versions which declared no arguments at all. I suspect now that we could fold #define MODSSL_BIO_CB_ARG_TYPE const char #define MODSSL_CRYPTO_CB_ARG_TYPE const char #define MODSSL_INFO_CB_ARG_TYPE const SSL* into a single MODSSL_CB_ARG_CONST define, but this works for now.

get function prototypes for strcasecmp() and strncasecmp()

Fix a compile failure with recent OpenSSL and picky compilers (e.g., OpenSSL 0.9.7a and xlc_r on AIX). The OpenSSL info callback field changed recently from a generic function pointer to a specific one, and ssl_callback_LogTracingState wasn't quite right. old: ssl.h: void (*info_callback)(); new: ssl.h: void (*info_callback)(const SSL *ssl,int type,int val);

Introduce a number of SSLC hints to mod_ssl, including the following type overrides; MODSSL_CLIENT_CERT_CB_ARG_TYPE MODSSL_PCHAR_CAST (for a host of non-void/const sslc values) modssl_read_bio_cb_fn (for several callbacks with same prototypes) Declare callback functions appropriately. And protect us from indetermineant toolkits with #error "Unrecognized SSL Toolkit!"

Because SSL's child init is run *after* we change uid/gid. So we need to ensure that file-based locks have the correct perms so that the child process can access them

OpenSSL should be included as "openssl/ssl.h" and not "ssl.h" (and rely on the INCLUDE path to be defined properly) PR: 11310 Submitted by: Geoff Thrope <geoff@geoffthrope.net> Reviewed by: Madhusudan Mathihalli

Right now SSLMutex is bogus. It just uses APR_LOCK_DEFAULT no matter what. We now allow for the full range of APR mutex locking mechanims to be used, while maintaining backwards compatibility. PR: 8122 Obtained from: Submitted by: Reviewed by: William Rowe

finished that boring job: update license to 2003. Happy New Year! ;-))

After some productive feedback and no negative feedback, introduce SSLEngine upgrade so that we can begin and continue to support these facilities. This makes it simpler to keep this effort (while we have no known clients that support Connection: upgrade at this time), and begin refactoring more of SSL into smaller and tighter (and then optional) components. Submitted by: Ryan Bloom Reviewed by: William Rowe, Joe Orton

Merge the last of the 'filtering' functions into ssl_engine_io.c, merge ssl_abort into what was ssl_hook_CloseConnection, clean out a bunch of now-static or private headers from mod_ssl.h, and final fix a very small but potent segfault if ->pssl is destroyed within our read loop.

This stuff shouldn't have been committed. This is the SSL upgrade stuff, and it was included in a commit that shouldn't have touched these files.

Fix a compile of compiler warnings. I don't know how these slipped past. Also, uncomment a line of code that the last commit should have uncommented. Randall found this line and the fix, but I forgot to uncomment this line along with the fix.

Remove all special mod_ssl URIs. This also fixes the bug where redirecting (.*) will allow an SSL protected page to be viewed without SSL.

The only remaining question ... are nested or strictly unnested locks expected by OpenSSL? Right now I've left it as _DEFAULT for the platform preference. Very simple code really - the server_rec was superfluous.

Remove SSLLog and SSLLogLevel directives in favor of having mod_ssl use the standard ErrorLog directives.

Stop using SSL_ADD_SSLERR option in ssl_log() and replace with new ssl_log_ssl_error() function that wraps ap_log_error instead. This begins the migration from ssl_log() -> ap_log_error(). Divorcing ourselves from the SSL_ADD_SSLERR option is required to make the next pass easier.

Convert mod_ssl to the new apr_global_mutex.h API and remove all uses of apr_lock.h [deprecated]. Tested that I could serve simple SSL (v3) pages.

PR: 7802 Obtained from: Submitted by: Reviewed by: fix compilation problem in ssl_engine_kernel.c if SSL_LIBRARY_VERSION >= 0x00907000

fix ProxyPass when frontend is https and backend is http

add SSLProxyCARevocation{File,Path} directives to support CRLs in the proxy

pass sc to myCtxConfig macro

make it possible for proxy to use CRL callback

add myCtxConfig macro

implement proxy client certificate callback (uses SSLProxyMachineCertificate{File,Cert} when downstream server requires a client certificate)

Fix the version string. We want to end up with "mod_ssl/2.0.xx", not "mod_ssl/Apache/2.0.xx".

add SSLProxyEngine directive. this was not required in the 1.x based mod_ssl because the SSL_CTX was created and configured for *every* request. unlike in 2.0 where we configure the proxy SSL_CTX at startup time, which is much better for performance. but we don't want to configure a proxy context for every vhost if it isn't going to be used, for the same reasons we don't create a server context for every vhost unless SSLEngine is on.

add optional function (ssl_proxy_enable) to turn on ssl proxy choose SSL_CTX based on SSLConnRec.is_proxy

use ssl_cmd_verify_parse for SSLProxyVerify directive handler

enable proxy directives

moving cfgMerge macros to ssl_engine_config.c, they are not used anywhere else

remove unused cfgMerge{Table,Ctx} macros

moving protocol location

breakup SSLSrvConfigRec in preparation for proxy support: + modssl_pk_server_t - certs/keys for the server + modssl_pk_proxy_t - certs/keys for the proxy + modssl_auth_ctx_t - stuff related to authentication that can also be per-dir, used by both server and proxy + modssl_ctx_t - context that can be used by both server and proxy + SSLSrvConfigRec - now contains original stuff specific to the server config and modssl_ctx_t *server, *proxy

ripping out some proxy stuff that isn't currently in use and is going to change anyhow.

already added configure check for SSL_set_cert_store

de-hungarian-ize server config member names which are going to stay

reorder a bit of the server config structure, moving items that are going to stay there to the top.

there is a heaping pile of: ssl_log(s, flags, "Init: (%s) ...", sc->szVHostID) add SSL_INIT flag to cut down some noise and end up with: ssl_log(s, flags, "...")

"new" is a c++ keyword; s/new/mrg/g in config merge functions

bringing back MOD_SSL_VERSION macro, define it to AP_SERVER_BASEVERSION

move prototype for modssl_session_get_time to ssl_util_ssl.h

sslc 1.x does not have an x509v3.h

moving OpenSSL+sslc compat foo to ssl_toolkit_compat.h

3rd arg of BIO callbacks in 'const char' in OpenSSL and 'char' in sslc, make both happy.

add modssl_session_get_time() function to give mod_ssl what it needs from SSL_SESSION_get_time() if using OpenSSL or sslc.

another step towards compatiblity with rsa sslc: define the STACK_OF macro if not already defined.

configure already checks OpenSSL version so dont bother here

per-dir SSLCACertificate{File,Path} cannot use SSL_CTX_set_cert_store as the 1.x based module does, since the function is not thread-safe. a patch has been submitted to OpenSSL to support SSL_set_cert_store which is thread safe. this feature is enabled by default in the current 1.x based module, we only enable it if the SSL_set_cert_store function is available.

constificationization of some char * config items

the mod_ssl provided with Apache >= 2.0 no longer has an independent version number

Clear up a const warning, and recognize some arrays by changing the variable names to the plural [rather than aszFoo, which I hope continues to be cleaned up as folks have time.]

PR: Obtained from: Submitted by: Madhusudan Mathihalli <madhusudan_mathihalli@hp.com> Reviewed by: dougm implement SSLSessionCache shmht and shmcb based on apr_rmm and apr_shm

Update our copyright for this year.

add ssl_asn1_keystr() util function that returns string representation (RSA or DSA) of the key index.

add ssl_asn1_table_keyfmt() function for clarity

use ptemp in ssl_init_FindCAList() rather than creating a subpool.

remove obsolete ssl_ds_{table,array} api

for the sake of readablity, change: SSL_TKPIDX_{DH,RSA}{512,1024} to: SSL_TMP_KEY_{DH,RSA}_{512,1024}

split ssl_init_TmpKeysHandle function to init/free functions, and make them static to ssl_engine_init.c

it is not required that temporary keys survive restarts, since they are generated and destroyed on every restart. so get rid of SSLModConfigRec.tTmpKeys table and mess that was managing it.

remove version checks for using EGD

we require OpenSSL 0.9.6+

making ssl_init_SSLLibrary() static

add SSL_VERIFY_PEER_STRICT shortcut for often used flags

remove unused ap_server_ctx member from SSLSrvConfigRec

s/const void/const char/g in ssl_asn1_table api pointed out by gstein

Consensus is that we should not use the scoreboard as a source of entropy. Reviewed by: OtherBill, Justin, Madhu

reuse vhost keys for asn1 tables where keys are allocated out of s->process->pool to prevent "leaking" each time we format a vhost key.

switch SSLModConfigRec.tPublicCert to ssl_asn1_table api to prevent leakage on restarts.

switch SSLModConfigRec.tPrivateKey to ssl_asn1_table api to prevent leakage on restarts.

add ssl_asn1_table_get() wrapper and change ssl_init_TmpKeysHandle() to use it.

mod_ssl was "leaking" on restart since mc->tTmpKeys table entries were allocated using apr_palloc out of s->process->pool and pushed into an apr_array_header_t. solve the problem by moving from apr_array_header_t's to an apr_hash_t. also add ssl_asn1_table_{set,unset} wrappers to use malloc/free so we do not "leak" from s->process->pool.

Introduce the PassPhraseDialog 'pipe' mechanism. This is the directive handling commit only, the mechanics patch will follow. PassPhraseDialog "|/path/to/pipe" will use the bidirectional pipe to have a 'conversation', along the lines of the tty dialog with PassPhraseDialog 'builtin'. This is entirely different than the 'exec' method, which simply runs once for each passphrase, and doesn't allow for failure/retries, and certainly doesn't offer any sensible 'dialog'.

changing mod_ssl to do a full startup/teardown on each restart rather than hack to only read passphrase on 1st round startup. this change: - fixes current segv on restarts (SHARED_MODULE is not defined) - allows LoadModule ssl_module to be added to httpd.conf on restart (was core dumping previously) - allows certs/keys to be changed on restart provided key is not encrypted or SSLPassPhraseDialog is exec. if key is encrypted and SSLPassPhraseDialog is builtin, existing private keys will be reused on restart (which happens currently for any type of key/dialog). note: mod_ssl currently leaks on restart; leaks more with this change. fixes to come.

Grrrrr..... We should really use the correct line endings on all platforms.

Forward port of changes in mod_ssl for Apache 1.3 up through mod_ssl version 2.8.7-1.3.23.

move OpenSSL specific SSL_{get,set}_state macros to the #ifdef'd group of macros for OpenSSL in mod_ssl.h

rewrite of mod_ssl input filter for better performance and less memory usage PR: Obtained from: Submitted by: Reviewed by: Justin Erenkrantz

The mutex must be pool-managed, not ssl managed. We are encountering segfaults on Win32 when the cleanup of the mutex occurs after the pool was destroyed.

mod_ssl adjustments to help with using toolkits other than OpenSSL: Use SSL functions/macros instead of directly dereferencing SSL structures wherever possible. Add type-casts for the cases where functions return a generic pointer. Add $SSL/include to configure search path. PR: Obtained from: Submitted by: Madhusudan Mathihalli <madhusudan_mathihalli@hp.com> Reviewed by: dougm

get SSLPassPhraseDialog exec: working by passing the proper arguments to apr_proc_create() PR: Obtained from: Submitted by: Reviewed by:

the client cert X509_NAME_oneline() is only used if SSLFakeBasicAuth is happening. so avoid calling that unless needed and just stash a pointer to the client cert for the boolean checks that the client provided a cert. PR: Obtained from: Submitted by: Reviewed by:

get rid of ssl_log_applies() function. it does more than we need and what should be done with a macro. it was only used once anyhow. PR: Obtained from: Submitted by: Reviewed by:

fix for last change that removed ssl_util_getmodconfig(): go back to using s->process->pool userdata, but just to store the global module config during startup so we only create _one_ SSLModConfigRec. (didn't realize this function was called in both ssl_init_Module and ssl_config_server_create) PR: Obtained from: Submitted by: Reviewed by:

ssl_util_getmodconfig() and ssl_util_getmodconfig_ssl() show up high in the gprof profile. there's no need for the "global" SSLModConfigRec to live in the s->process->pool userdata table. we now just point the SSLSrvConfigRec in each server_rec.module_config to the SSLModConfigRec so we can access it directly which is much faster. PR: Obtained from: Submitted by: Reviewed by:

call getpid() once at child init and save in the SSLModConfigRec to avoid getpid() calls at request time PR: Obtained from: Submitted by: Reviewed by:

calculate VHostID length at startup rather than request time. change ap_md5() call in ssl_hook_pre_connection() to ap_md5_binary() that uses the precalculated sc->nVHostID_length to avoid a strlen() call. PR: Obtained from: Submitted by: Reviewed by:

avoid calling ssl_util_vhostid() (and apr_sprintf underneath) at request time by calling it at startup time and saving the value in the SSLSrvConfigRec. PR: Obtained from: Submitted by: Reviewed by:

Modify post_config hook so that it can return a error, causing the server not to start. previous method was to call exit(1) which would not fail gracefully PR: Obtained from: Submitted by: Reviewed by: (Idea only Jeff Trawick)

avoid a couple of calls to ssl_util_vhostid() and apr_psprintf() unless loglevel >= SSL_LOG_INFO PR: Obtained from: Submitted by: Reviewed by:

optimize lookup of ssl-{unclean,accurate}-shutdown flags: - only look through the table once, rather than 2 apr_table_gets() - case-sensitive and use strcmp() as little as possible - only lookup once per-connection, as the flags will not change across keepalive requests PR: Obtained from: Submitted by: Reviewed by:

remove AP_CTX_* macros which are no longer used

move c->notes.ssl::verify::depth to SSLConnRec.verify_depth note: may actually be removed unless somebody can figure out why it is in there to begin with PR: Obtained from: Submitted by: Reviewed by:

move c->notes.ssl::verify::{info,error} to SSLConnRec.verify_{info,error} PR: Obtained from: Submitted by: Reviewed by:

move c->notes.ssl::flag::{unclean,accurate}-shutdown to SSLConnRec.shutdown_type PR: Obtained from: Submitted by: Reviewed by:

move c->notes.ssl::client::dn to SSLConnRec.client_dn PR: Obtained from: Submitted by: Reviewed by:

start moving c->notes usage to a new SSLConnRec structure hanging off of c->conn_config PR: Obtained from: Submitted by: Reviewed by: rbb, madhu

This is the mod_ssl input filtering rewrite. Lots of stuff here. I also changed some of the style issues within the filtering code to conform to the rest of the server. Various incarnations of this patch have been posted to dev@httpd without feedback. Now that it passes all of the httpd-test cases (with the exception of module/negotiation test which fails without mod_ssl anyway), it is time to check it in. Please review and test. We are under C-T-R rules, so I'm going to take advantage of that and commit it now. I have tested this about as much as I can and it seems to work from everything I can give to it. Considering that mod_ssl was broken before this commit, this is an improvement.

I don't seriously expect this solves the segfault ... but it does make the code more legible, and protects particularly ugly unset values.

Implement CRYPTO_set_locking_callback() for mod_ssl PR: Obtained from: Submitted by: Madhusudan Mathihalli <madhusudan_mathihalli@hp.com> Reviewed by: dougm

support "SSLVerifyClient optional_no_ca"

Add some appropriate constness to the config

register ssl_var_lookup() as an optional function

Complete the rename of the ssl_scache_status_register and ssl_ext_proxy_register (which has yet to be renamed for it's future location, since I'm not going further at the moment with implementing it's functionallity, all my focus is on the ssl_var_register arm.)

Remove a ton o' cruft. Moves the mod_log_config 'var' extensions to ssl_engine_vars.c.

Use uniform wrapping for unistd.h, and don't include it if it's aready included via fileio.h

remove unused ssl_io_ functions

Add the openssl/include/openssl directory to the INCLUDES variable. This allows us to remove the openssl from the #include lines in the mod_ssl files. This makes it easier to use a different SSL library, with fewer changes to the mod_ssl files.

Missed a small bit

Register for %X, %c (we gotta make a decision, please vote if you care... use %c's meaning from the historical SSL modules, or Bill Stoddard's connection-terminated meaning? One will have to give.)

Take care of folk's assert() undefined errors.

Since mpm.h wraps unixd.h and scoreboard.h nicely, and win32 has no unixd.h, well...

Workaround till connection_hook details are resolved [MATHIHALLI,MADHUSUDAN <madhusudan_mathihalli@hp.com>]

Apply mod_ssl MEGA porting patch. This is a cleaned up version of the latest patches from Madhusudan which makes mod_ssl 95% working inside Apache 2.0. There is still a lot of more work (both porting and cleanup) to do be done. See modules/ssl/README for details. Submitted by: Madhusudan Mathihalli <madhusudan_mathihalli@hp.com>

Merge in part II of a set of mod_ssl porting changes. Submitted by: Madhusudan Mathihalli <madhusudan_mathihalli@hp.com>

One cannot have an entirely empty struct ... this is just to make things actually compile, and exclude an include we don't have on Win32.

Port ssl_util.c stuff to APR.

Port ssl_util_ssl.[ch] stuff to APR.

Use different namespace for internal defines.

Port ssl_engine_ds.c to APR.

Kick out all old mutex code and base SSLMutex on APR locks.

Change mostly all old module structure hooks and EAPI hooks to ap_hook_xxx equivalents. More work has to be done here to clean all this up and reduce to a minimum...

Axe most WIN32 stuff from Apache 1.3. In Apache 2.0 we either use APR later for this or we don't do it at all. But we certainly no longer want to see any platform specific things inside a module.

Axe out SSL_CONSERVATIVE stuff which for Apache 1.3 did I/O data pre-sucking on POST requests and I/O re-injection in case of SSL renegotiations. This all either cannot be solved any longer or at least has to be implemented totally different through I/O layering/filtering.

Axe out SSL_USE_SDBM stuff, i.e., get rid of the local SDBM copy and use APR's DBM API instead. The remaining question just is whether APR's DBM allows "larger" things like SSL sessions to be stored...

Axe out the complete SSL_COMPAT stuff. Because Apache 2.0 is already incompatible at many places to Apache 1.3 we also don't want this stuff anymore. Apache 2.0's mod_ssl will be mostly compatibile with Apache 1.3's mod_ssl, of course. But we really no longer want to be compatible to Sioux and other obsolete SSL things...

Axe out EAPI-based SSL_VENDOR stuff. If we want this later again, we have to do it differently anyway. So, for now we try to strip down mod_ssl as heavy as possible and hence we kick out this stuff at all.

Activate the command_rec structure.

Integrate mod_ssl into the Autoconf facility. (currently only stub files are compiled)

mod_ssl integration step 2: transfer copyright of all code to ASF by using Apache Software License v1.1

Initial revision