httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From do...@apache.org
Subject cvs commit: httpd-2.0/modules/ssl ssl_engine_pphrase.c
Date Sun, 03 Mar 2002 00:46:07 GMT
dougm       02/03/02 16:46:07

  Modified:    modules/ssl ssl_engine_pphrase.c
  Log:
  reuse existing private key if possible for all SSLPassPhraseDialog
  types, not just builtin.  on win32 for example, a pipe dialog might
  allocate a wintty for prompting, which results in 4 prompts at
  startup, 2 for each child and 2 within each when httpd "restarts
  itself".
  update comments on this and wrap them a bit.
  
  Revision  Changes    Path
  1.20      +19 -10    httpd-2.0/modules/ssl/ssl_engine_pphrase.c
  
  Index: ssl_engine_pphrase.c
  ===================================================================
  RCS file: /home/cvs/httpd-2.0/modules/ssl/ssl_engine_pphrase.c,v
  retrieving revision 1.19
  retrieving revision 1.20
  diff -u -r1.19 -r1.20
  --- ssl_engine_pphrase.c	28 Feb 2002 01:47:26 -0000	1.19
  +++ ssl_engine_pphrase.c	3 Mar 2002 00:46:07 -0000	1.20
  @@ -299,17 +299,26 @@
                   }
   
                   /*
  -                 * if the private key is encrypted and SSLPassPhraseDialog is configured
to "builtin"
  -                 * it isn't possible to prompt for a password.  in this case if we already
have a
  -                 * private key and the file name/mtime hasn't changed, then reuse the existing
key.
  -                 * of course this will not work if the server was started without LoadModule
ssl_module
  -                 * configured, then restarted with it configured.  but we fall through
with a chance of
  -                 * success if the key is not encrypted.  and in the case of fallthrough,
pkey_mtime and
  -                 * isatty() are used to give a better idea as to what failed.
  -                 * even if we could prompt for password again, users won't like getting
prompted twice
  -                 * at startup.
  +                 * if the private key is encrypted and SSLPassPhraseDialog
  +                 * is configured to "builtin" it isn't possible to prompt for
  +                 * a password after httpd has detached from the tty.
  +                 * in this case if we already have a private key and the
  +                 * file name/mtime hasn't changed, then reuse the existing key.
  +                 * we also reuse existing private keys that were encrypted for
  +                 * exec: and pipe: dialogs to minimize chances to snoop the
  +                 * password.  that and pipe: dialogs might prompt the user
  +                 * for password, which on win32 for example could happen 4
  +                 * times at startup.  twice for each child and twice within
  +                 * each since apache "restarts itself" on startup.
  +                 * of course this will not work for the builtin dialog if
  +                 * the server was started without LoadModule ssl_module
  +                 * configured, then restarted with it configured.
  +                 * but we fall through with a chance of success if the key
  +                 * is not encrypted or can be handled via exec or pipe dialog.
  +                 * and in the case of fallthrough, pkey_mtime and isatty()
  +                 * are used to give a better idea as to what failed.
                    */
  -                if (sc->nPassPhraseDialogType == SSL_PPTYPE_BUILTIN) {
  +                if (pkey_mtime) {
                       char *key_id = apr_psprintf(p, "%s:%s", cpVHostID, "RSA"); /* XXX:
check for DSA key too? */
                       ssl_asn1_t *asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id);
                       
  
  
  

Mime
View raw message