Request 27 (accepted)

Overview

Request 27 (accepted)

Add to Kolab:Development

Created by vanmeeuwen about 11 years ago
In state accepted

Submit mod_nss

Submit package home:vanmeeuwen...lab:Development / mod_nss to package Kolab:Development / mod_nss

apache2-mod_nss.changes Added

@@ -0,0 +1,50 @@
+-------------------------------------------------------------------
+Fri Aug  2 08:29:35 UTC 2013 - meissner@suse.com
+
+- mod_nss-tlsv1_1.patch: nss.conf.in missed for TLSv1.2 default.
+- mod_nss-clientauth.patch: merged from RHEL6 pkg
+- mod_nss-PK11_ListCerts_2.patch: merged from RHEL6 pkg
+- mod_nss-no_shutdown_if_not_init_2.patch: merged from RHEL6 pkg
+- mod_nss-sslmultiproxy.patch: merged from RHEL6 pkg
+- make it build on both Apache2 2.4 and 2.2 systems
+
+-------------------------------------------------------------------
+Thu Aug  1 15:06:55 UTC 2013 - meissner@suse.com
+
+- Add support for TLS v1.1 and TLS v1.2 
+  (TLS v1.2 requires mozilla nss 3.15.1 or newer.)
+  - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch
+    from redhat to allow tls v1.1 too.
+  - ported the tls v1.1 patch to be tls v1.2 aware
+  - added mod_nss-proxyvariables.patch (from RHEL6 package)
+  - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2)
+- mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun
+
+-------------------------------------------------------------------
+Fri Jul 12 10:42:06 UTC 2013 - aj@ajaissle.de
+
+- Changed source to original tar.gz 
+
+-------------------------------------------------------------------
+Thu Jul 11 14:50:42 UTC 2013 - aj@ajaissle.de
+
+- Added mod_nns-httpd24.patch to support build with apache 2.4
+
+-------------------------------------------------------------------
+Tue Jan 22 09:35:41 UTC 2013 - aj@ajaissle.de
+
+-  Changed mod_nss-conf.patch to adjust mod_nss.conf to match SUSE 
+   dir layout [bnc#799483]
+-  Cleaned up license tag
+
+-------------------------------------------------------------------
+Sun Apr 15 14:17:19 UTC 2012 - wr@rosenauer.org
+
+- import some patches from Fedora
+- removed autoreconf call
+
+-------------------------------------------------------------------
+Wed Feb 17 13:30:47 UTC 2010 - nix@opensuse.org
+
+- Fix mod_nss-conf.patch to work on SUSE
+- Rename package from mod_nss to apache2-mod_nss

apache2-mod_nss.spec Added

@@ -0,0 +1,181 @@
+#
+# spec file for package apache2-mod_nss
+#
+# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via http://bugs.opensuse.org/
+#
+
+
+Name:           apache2-mod_nss
+Summary:        SSL/TLS module for the Apache HTTP server
+License:        Apache-2.0
+Group:          Productivity/Networking/Web/Servers
+Version:        1.0.8
+Release:        0
+Url:            http://directory.fedoraproject.org/wiki/Mod_nss
+Source:         http://directory.fedoraproject.org/sources/mod_nss-%{version}.tar.gz
+Provides:       mod_nss
+Requires:       apache2 >= 2.0.52
+Requires:       findutils
+Requires(post): mozilla-nss-tools
+BuildRequires:  apache2-devel >= 2.0.52
+BuildRequires:  bison
+BuildRequires:  findutils
+BuildRequires:  flex
+BuildRequires:  gcc-c++
+BuildRequires:  libapr-util1-devel
+BuildRequires:  libapr1-devel
+BuildRequires:  mozilla-nspr-devel >= 4.6.3
+BuildRequires:  mozilla-nss-devel >= 3.12.6
+BuildRequires:  pkgconfig
+# [bnc#799483] Patch to adjust mod_nss.conf to match SUSE dir layout
+Patch1:         mod_nss-conf.patch
+Patch2:         mod_nss-gencert.patch
+Patch3:         mod_nss-wouldblock.patch
+Patch4:         mod_nss-negotiate.patch
+Patch5:         mod_nss-reverseproxy.patch
+Patch6:         mod_nss-pcachesignal.h
+Patch7:         mod_nss-reseterror.patch
+Patch8:         mod_nss-lockpcache.patch
+# Fix build with apache 2.4
+Patch9:         mod_nss-httpd24.patch
+
+Patch10:        mod_nss-proxyvariables.patch
+Patch11:        mod_nss-tlsv1_1.patch
+Patch12:        mod_nss-array_overrun.patch
+Patch13:        mod_nss-clientauth.patch
+Patch14:        mod_nss-no_shutdown_if_not_init_2.patch
+Patch15:        mod_nss-PK11_ListCerts_2.patch
+Patch16:        mod_nss-sslmultiproxy.patch
+Patch17:        mod_nss-overlapping_memcpy.patch
+BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+%define    apxs /usr/sbin/apxs2
+%define    apache apache2
+%define    apache_libexecdir %(%{apxs} -q LIBEXECDIR)
+%define    apache_sysconfdir %(%{apxs} -q SYSCONFDIR)
+%define    apache_includedir %(%{apxs} -q INCLUDEDIR)
+%define    apache_serverroot %(%{apxs} -q PREFIX)
+%define    apache_mmn        %(MMN=$(%{apxs} -q LIBEXECDIR)_MMN; test -x $MMN && $MMN)
+
+%description
+The mod_nss module provides strong cryptography for the Apache Web
+server via the Secure Sockets Layer (SSL) and Transport Layer
+Security (TLS) protocols using the Network Security Services (NSS)
+security library.
+
+%prep
+%setup -q -n mod_nss-%{version}
+%patch1 -p1 -b .conf
+%patch2 -p1 -b .gencert
+%patch3 -p1 -b .wouldblock
+%patch4 -p1 -b .negotiate
+%patch5 -p1 -b .reverseproxy
+%patch6 -p1 -b .pcachesignal.h
+%patch7 -p1 -b .reseterror
+%patch8 -p1 -b .lockpcache
+%patch10 -p1 -b .proxyvariables
+%patch11 -p1 -b .tlsv1_1
+%patch12 -p1 -b .array_overrun
+%patch13 -p1 -b .clientauth.patch
+%patch14 -p1 -b .no_shutdown_if_not_init_2
+%patch15 -p1 -b .PK11_ListCerts_2
+%patch16 -p1 -b .sslmultiproxy
+%patch17 -p1 -b .overlapping_memcpy
+
+# keep this last, otherwise we get fuzzyness from above
+%if 0%{?suse_version} >= 1300
+%patch9 -p1 -b .http24
+%endif
+
+# Touch expression parser sources to prevent regenerating it
+touch nss_expr_*.[chyl]
+
+%build
+CFLAGS="$RPM_OPT_FLAGS"
+export CFLAGS
+NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --variable=includedir nspr`
+NSPR_LIB_DIR=`/usr/bin/pkg-config --variable=libdir nspr`
+NSS_INCLUDE_DIR=`/usr/bin/pkg-config --variable=includedir nss`
+NSS_LIB_DIR=`/usr/bin/pkg-config --variable=libdir nss`
+NSS_BIN=`/usr/bin/pkg-config --variable=exec_prefix nss`
+# For some reason mod_nss can't find nss on SUSE unless we do the following
+C_INCLUDE_PATH="/usr/include/nss3:/usr/include/nspr4:/usr/include/apache2-prefork/"
+export C_INCLUDE_PATH
+#autoreconf -fvi
+%configure \
+    --with-nss-lib=$NSS_LIB_DIR \
+    --with-nss-inc=$NSS_INCLUDE_DIR \
+    --with-nspr-lib=$NSPR_LIB_DIR \
+    --with-nspr-inc=$NSPR_INCLUDE_DIR \
+    --with-apxs=%{apxs} \
+    --with-apr-config
+make %{?_smp_mflags} all
+
+%install
+# The install target of the Makefile isn't used because that uses apxs
+# which tries to enable the module in the build host httpd instead of in
+# the build root.
+mkdir -p $RPM_BUILD_ROOT/%{apache_libexecdir}
+mkdir -p $RPM_BUILD_ROOT%{apache_sysconfdir}/conf.d
+mkdir -p $RPM_BUILD_ROOT%{_sbindir}
+mkdir -p $RPM_BUILD_ROOT%{apache_sysconfdir}/alias
+
+%if 0%{?suse_version}
+perl -pi -e "s|\@apache_lib\@|%{_libdir}\/apache2|g" nss.conf
+%endif
+
+install -m 644 nss.conf $RPM_BUILD_ROOT%{apache_sysconfdir}/conf.d/
+install -m 755 .libs/libmodnss.so $RPM_BUILD_ROOT%{apache_libexecdir}
+install -m 755 nss_pcache $RPM_BUILD_ROOT%{_sbindir}/
+install -m 755 gencert $RPM_BUILD_ROOT%{_sbindir}/
+
+#ln -s $RPM_BUILD_ROOT/%%{apache_libexecdir}/libnssckbi.so $RPM_BUILD_ROOT%%{apache_sysconfdir}/alias/
+touch $RPM_BUILD_ROOT%{apache_sysconfdir}/alias/secmod.db
+touch $RPM_BUILD_ROOT%{apache_sysconfdir}/alias/cert8.db
+touch $RPM_BUILD_ROOT%{apache_sysconfdir}/alias/key3.db
+touch $RPM_BUILD_ROOT%{apache_sysconfdir}/alias/install.log
+perl -pi -e "s:$NSS_LIB_DIR:$NSS_BIN:" $RPM_BUILD_ROOT%{_sbindir}/gencert
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%post
+umask 077
+if [ "$1" -eq 1 ] ; then
+    if [ ! -e %{apache_sysconfdir}/alias/key3.db ]; then
+        %{_sbindir}/gencert %{apache_sysconfdir}/alias > %{apache_sysconfdir}/alias/install.log 2>&1
+        echo ""
+        echo "%{name} certificate database generated."
+        echo ""
+    fi
+    # Make sure that the database ownership is setup properly.
+    find %{apache_sysconfdir}/alias -user root -name "*.db" -exec /bin/chgrp www {} \;
+    find %{apache_sysconfdir}/alias -user root -name "*.db" -exec /bin/chmod g+r {} \;
+fi
+
+%files
+%defattr(-,root,root,-)
+%doc README LICENSE docs/mod_nss.html
+%config(noreplace) %{apache_sysconfdir}/conf.d/nss.conf
+%dir %{apache_libexecdir}
+%{apache_libexecdir}/libmodnss.so
+%dir %{apache_sysconfdir}/alias/
+%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconfdir}/alias/secmod.db
+%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconfdir}/alias/cert8.db
+%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconfdir}/alias/key3.db
+%ghost %config(noreplace) %{apache_sysconfdir}/alias/install.log
+#%%{apache_sysconfdir}/alias/libnssckbi.so
+%{_sbindir}/nss_pcache
+%{_sbindir}/gencert
+
+%changelog

mod_nss-PK11_ListCerts_2.patch Added

@@ -0,0 +1,201 @@
+diff -pu mod_nss.h mod_nss.h.PK11_ListCerts
+--- ./mod_nss.h   2010-09-08 21:06:49.000000000 +0800
++++ ./mod_nss.h.PK11_ListCerts    2010-09-08 21:06:22.000000000 +0800
+@@ -406,7 +406,7 @@ const char *nss_cmd_NSSProxyNickname(cmd
+ /*  module initialization  */
+ int  nss_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
+ void nss_init_Child(apr_pool_t *, server_rec *);
+-void nss_init_ConfigureServer(server_rec *, apr_pool_t *, apr_pool_t *, SSLSrvConfigRec *);
++void nss_init_ConfigureServer(server_rec *, apr_pool_t *, apr_pool_t *, SSLSrvConfigRec *, const CERTCertList*);
+ apr_status_t nss_init_ModuleKill(void *data);
+ apr_status_t nss_init_ChildKill(void *data);
+ int nss_parse_ciphers(server_rec *s, char *ciphers, PRBool cipher_list[ciphernum]);
+diff -up nss_engine_init.c nss_engine_init.c.PK11_ListCerts
+--- ./nss_engine_init.c   2010-09-08 21:07:13.000000000 +0800
++++ ./nss_engine_init.c.PK11_ListCerts    2010-09-09 00:21:59.000000000 +0800
+@@ -26,7 +26,7 @@
+ static SECStatus ownBadCertHandler(void *arg, PRFileDesc * socket);
+ static SECStatus ownHandshakeCallback(PRFileDesc * socket, void *arg);
+ static SECStatus NSSHandshakeCallback(PRFileDesc *socket, void *arg);
+-static CERTCertificate* FindServerCertFromNickname(const char* name);
++static CERTCertificate* FindServerCertFromNickname(const char* name, const CERTCertList* clist);
+ SECStatus nss_AuthCertificate(void *arg, PRFileDesc *socket, PRBool checksig, PRBool isServer);
+
+ /*
+@@ -485,6 +485,8 @@ int nss_init_Module(apr_pool_t *p, apr_p
+         ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server,
+                      "Init: Initializing (virtual) servers for SSL");
+
++        CERTCertList* clist = PK11_ListCerts(PK11CertListUser, NULL);
++
+         for (s = base_server; s; s = s->next) {
+             sc = mySrvConfig(s);
+             /*
+@@ -496,7 +498,11 @@ int nss_init_Module(apr_pool_t *p, apr_p
+             /*
+              * Read the server certificate and key
+              */
+-            nss_init_ConfigureServer(s, p, ptemp, sc);
++            nss_init_ConfigureServer(s, p, ptemp, sc, clist);
++        }
++
++        if (clist) {
++            CERT_DestroyCertList(clist);
+         }
+     }
+
+@@ -880,7 +886,8 @@ static void nss_init_certificate(server_
+                                  SECKEYPrivateKey **serverkey,
+                                  SSLKEAType *KEAtype,
+                                  PRFileDesc *model,
+-                                 int enforce)
++                                 int enforce,
++                                 const CERTCertList* clist)
+ {
+     SECCertTimeValidity certtimestatus;
+     SECStatus secstatus;
+@@ -894,17 +901,15 @@ static void nss_init_certificate(server_
+     ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+          "Using nickname %s.", nickname);
+
+-    *servercert = FindServerCertFromNickname(nickname);
++    *servercert = FindServerCertFromNickname(nickname, clist);
+
+     /* Verify the certificate chain. */
+     if (*servercert != NULL) {
+         SECCertificateUsage usage = certificateUsageSSLServer;
+
+-        if (CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), *servercert, PR_TRUE, usage, NULL, NULL) != SECSuccess)  {
+-            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                "Certificate not verified: '%s'", nickname);
++        if (enforce) {
++            if (CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), *servercert, PR_TRUE, usage, NULL, NULL) != SECSuccess)  {
+             nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
+-            if (enforce) {
+                 ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                     "Unable to verify certificate '%s'. Add \"NSSEnforceValidCerts off\" to nss.conf so the server can start until the problem can be resolved.", nickname);
+                 nss_die();
+@@ -994,7 +999,8 @@ static void nss_init_certificate(server_
+ static void nss_init_server_certs(server_rec *s,
+                                   apr_pool_t *p,
+                                   apr_pool_t *ptemp,
+-                                  modnss_ctx_t *mctx)
++                                  modnss_ctx_t *mctx,
++                                  const CERTCertList* clist)
+ {
+     SECStatus secstatus;
+
+@@ -1015,11 +1021,11 @@ static void nss_init_server_certs(server
+
+         nss_init_certificate(s, mctx->nickname, &mctx->servercert,
+                              &mctx->serverkey, &mctx->serverKEAType,
+-                             mctx->model, mctx->enforce);
++                             mctx->model, mctx->enforce, clist);
+ #ifdef NSS_ENABLE_ECC
+         nss_init_certificate(s, mctx->eccnickname, &mctx->eccservercert,
+                              &mctx->eccserverkey, &mctx->eccserverKEAType,
+-                             mctx->model, mctx->enforce);
++                             mctx->model, mctx->enforce, clist);
+ #endif
+     }
+
+@@ -1043,23 +1049,25 @@ static void nss_init_server_certs(server
+ static void nss_init_proxy_ctx(server_rec *s,
+                                 apr_pool_t *p,
+                                 apr_pool_t *ptemp,
+-                                SSLSrvConfigRec *sc)
++                                SSLSrvConfigRec *sc,
++                                const CERTCertList* clist)
+ {
+     nss_init_ctx(s, p, ptemp, sc->proxy);
+
+-    nss_init_server_certs(s, p, ptemp, sc->proxy);
++    nss_init_server_certs(s, p, ptemp, sc->proxy, clist);
+ }
+
+ static void nss_init_server_ctx(server_rec *s,
+                                 apr_pool_t *p,
+                                 apr_pool_t *ptemp,
+-                                SSLSrvConfigRec *sc)
++                                SSLSrvConfigRec *sc,
++                                const CERTCertList* clist)
+ {
+     nss_init_server_check(s, p, ptemp, sc->server);
+
+     nss_init_ctx(s, p, ptemp, sc->server);
+
+-    nss_init_server_certs(s, p, ptemp, sc->server);
++    nss_init_server_certs(s, p, ptemp, sc->server, clist);
+ }
+
+ /*
+@@ -1068,18 +1076,19 @@ static void nss_init_server_ctx(server_r
+ void nss_init_ConfigureServer(server_rec *s,
+                               apr_pool_t *p,
+                               apr_pool_t *ptemp,
+-                              SSLSrvConfigRec *sc)
++                              SSLSrvConfigRec *sc,
++                              const CERTCertList* clist)
+ {
+     if (sc->enabled == TRUE) {
+         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+                      "Configuring server for SSL protocol");
+-        nss_init_server_ctx(s, p, ptemp, sc);
++        nss_init_server_ctx(s, p, ptemp, sc, clist);
+     }
+
+     if (sc->proxy_enabled == TRUE) {
+         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+                      "Enabling proxy.");
+-        nss_init_proxy_ctx(s, p, ptemp, sc);
++        nss_init_proxy_ctx(s, p, ptemp, sc, clist);
+     }
+ }
+
+@@ -1131,10 +1140,14 @@ void nss_init_Child(apr_pool_t *p, serve
+     nss_init_SSLLibrary(base_server);
+
+     /* Configure all virtual servers */
++    CERTCertList* clist = PK11_ListCerts(PK11CertListUser, NULL);
+     for (s = base_server; s; s = s->next) {
+         sc = mySrvConfig(s);
+         if (sc->server->servercert == NULL && NSS_IsInitialized())
+-            nss_init_ConfigureServer(s, p, mc->ptemp, sc);
++            nss_init_ConfigureServer(s, p, mc->ptemp, sc, clist);
++    }
++    if (clist) {
++        CERT_DestroyCertList(clist);
+     }
+
+     /* 
+@@ -1323,9 +1336,8 @@ cert_IsNewer(CERTCertificate *certa, CER
+  * newest, valid server certificate.
+  */
+ static CERTCertificate*
+-FindServerCertFromNickname(const char* name)
++FindServerCertFromNickname(const char* name, const CERTCertList* clist)
+ {
+-    CERTCertList* clist;
+     CERTCertificate* bestcert = NULL;
+
+     CERTCertListNode *cln;
+@@ -1335,8 +1347,6 @@ FindServerCertFromNickname(const char* n
+     if (name == NULL)
+         return NULL;
+
+-    clist = PK11_ListCerts(PK11CertListUser, NULL);
+-
+     for (cln = CERT_LIST_HEAD(clist); !CERT_LIST_END(cln,clist);
+         cln = CERT_LIST_NEXT(cln)) {
+         CERTCertificate* cert = cln->cert;
+@@ -1401,9 +1411,6 @@ FindServerCertFromNickname(const char* n
+     if (bestcert) {
+         bestcert = CERT_DupCertificate(bestcert);
+     }
+-    if (clist) {
+-        CERT_DestroyCertList(clist);
+-    }
+     return bestcert;
+ }
+
+

mod_nss-array_overrun.patch Added

mod_nss-clientauth.patch Added

@@ -0,0 +1,50 @@
+The first fix is to retrieve the full certificate subject instead of just the
+CN for FakeBasicAuth and prefix it with / to be compatible with OpenSSL.
+
+The second always attempts to retrieve the client certificate in
+nss_hook_ReadReq().
+
+https://bugzilla.redhat.com/show_bug.cgi?id=702437
+--- mod_nss-1.0.8.orig/nss_engine_io.c	2011-05-10 15:45:49.000000000 -0400
++++ mod_nss-1.0.8.orig/nss_engine_io.c	2011-05-11 15:21:30.000000000 -0400
+@@ -1364,13 +1364,9 @@ nss_AuthCertificate(void *arg, PRFileDes
+ 
+     status = SSL_AuthCertificate(arg, socket, checksig, isServer);
+ 
+-    if (status == SECSuccess) {
+-        conn_rec *c = filter_ctx->c;
+-        SSLConnRec *sslconn = myConnConfig(c);
+-
+-        sslconn->client_cert = SSL_PeerCertificate(socket);
+-        sslconn->client_dn = NULL;
+-    }
++    /* The certificate is copied to sslconn->client_cert in
++     * nss_hook_ReadReq()
++     */
+ 
+     return status;
+ }
+--- mod_nss-1.0.8.orig/nss_engine_kernel.c	2007-05-31 17:36:03.000000000 -0400
++++ mod_nss-1.0.8.orig/nss_engine_kernel.c	2011-05-11 15:30:38.000000000 -0400
+@@ -84,6 +84,11 @@ int nss_hook_ReadReq(request_rec *r)
+                      nss_util_vhostid(r->pool, r->server));
+     }
+ 
++    if (sslconn->client_cert != NULL)
++        CERT_DestroyCertificate(sslconn->client_cert);
++    sslconn->client_cert = SSL_PeerCertificate(ssl);
++    sslconn->client_dn = NULL;
++
+     return DECLINED;
+ }
+ 
+@@ -626,8 +631,8 @@ int nss_hook_UserCheck(request_rec *r)
+     }
+ 
+     if (!sslconn->client_dn) {
+-        char * cp = CERT_GetCommonName(&sslconn->client_cert->subject);
+-        sslconn->client_dn = apr_pstrdup(r->connection->pool, cp);
++        char * cp = CERT_NameToAscii(&sslconn->client_cert->subject);
++        sslconn->client_dn = apr_pstrcat(r->connection->pool, "/", cp, NULL);
+         PORT_Free(cp);
+     }

mod_nss-conf.patch Added

@@ -0,0 +1,70 @@
+--- mod_nss-1.0.6/nss.conf.in.orig	2006-10-20 11:08:42.000000000 -0400
++++ mod_nss-1.0.6/nss.conf.in	2013-01-22 10:33:25.000000000 +0100
+@@ -8,14 +8,16 @@
+ # consult the online docs. You have been warned. 
+ #
+ 
++LoadModule nss_module @apache_lib@/libmodnss.so
++
+ #
+ # When we also provide SSL we have to listen to the 
+ # standard HTTP port (see above) and to the HTTPS port
+ #
+ # Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
+-# Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
++# Listen directives: "Listen [::]:8443" and "Listen 0.0.0.0:443"
+ #
+-Listen 443
++Listen 8443
+ 
+ ##
+ ## SSL Global Context
+@@ -40,7 +42,7 @@
+ # Pass Phrase Helper:
+ # This helper program stores the token password pins between
+ # restarts of Apache.
+-NSSPassPhraseHelper @apache_bin@/nss_pcache
++NSSPassPhraseHelper /usr/sbin/nss_pcache
+ 
+ # Configure the SSL Session Cache. 
+ # NSSSessionCacheSize is the number of entries in the cache.
+@@ -68,17 +70,17 @@
+ ## SSL Virtual Host Context
+ ##
+ 
+-<VirtualHost _default_:443>
++<VirtualHost _default_:8443>
+ 
+ # General setup for the virtual host
+ #DocumentRoot "@apache_prefix@/htdocs"
+-#ServerName www.example.com:443
++#ServerName www.example.com:8443
+ #ServerAdmin you@example.com
+ 
+ # mod_nss can log to separate log files, you can choose to do that if you'd like
+ # LogLevel is not inherited from httpd.conf.
+-#ErrorLog @apache_prefix@/logs/error_log
+-#TransferLog @apache_prefix@/logs/access_log
++ErrorLog /var/log/apache2/error_log
++TransferLog /var/log/apache2/access_log
+ LogLevel warn
+ 
+ # SSL Engine Switch:
+@@ -113,7 +115,7 @@
+ # The NSS security database directory that holds the certificates and
+ # keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
+ # Provide the directory that these files exist.
+-NSSCertificateDatabase @apache_conf@
++NSSCertificateDatabase @apache_conf@/alias
+ 
+ # Database Prefix:
+ # In order to be able to store multiple NSS databases in one directory
+@@ -189,7 +191,7 @@
+ <Files ~ "\.(cgi|shtml|phtml|php3?)$">
+ NSSOptions +StdEnvVars
+ </Files>
+-<Directory "@apache_prefix@/cgi-bin">
++<Directory "@apache_prefix@/cgi-bin">
+ NSSOptions +StdEnvVars
+ </Directory>
+

mod_nss-gencert.patch Added

mod_nss-httpd24.patch Added

@@ -0,0 +1,142 @@
+Index: mod_nss-1.0.8/mod_nss.c
+===================================================================
+--- mod_nss-1.0.8.orig/mod_nss.c
++++ mod_nss-1.0.8/mod_nss.c
+@@ -362,7 +362,7 @@ static int nss_hook_pre_connection(conn_
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, c->base_server,
+ "Connection to child %ld established "
+ "(server %s, client %s)", c->id, sc->vhost_id, 
+- c->remote_ip ? c->remote_ip : "unknown");
++ c->client_ip ? c->client_ip : "unknown");
+ 
+ mctx = sslconn->is_proxy ? sc->proxy : sc->server;
+ 
+Index: mod_nss-1.0.8/mod_nss.h
+===================================================================
+--- mod_nss-1.0.8.orig/mod_nss.h
++++ mod_nss-1.0.8/mod_nss.h
+@@ -28,7 +28,6 @@
+ #include "mod_ssl.h"
+ #include "util_script.h"
+ #include "util_filter.h"
+-#include "mpm.h"
+ #include "apr.h"
+ #include "apr_strings.h"
+ #define APR_WANT_STRFUNC
+@@ -481,7 +480,7 @@ int nss_rand_seed(server_rec *s, apr_poo
+ SECStatus nss_Init_Tokens(server_rec *s);
+ 
+ /* Logging */
+-void nss_log_nss_error(const char *file, int line, int level, server_rec *s);
++void nss_log_nss_error(const char *file, int line, int module_index, int level, server_rec *s);
+ void nss_die(void);
+ 
+ /* NSS callback */
+Index: mod_nss-1.0.8/nss_engine_init.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_init.c
++++ mod_nss-1.0.8/nss_engine_init.c
+@@ -15,7 +15,7 @@
+ 
+ #include "mod_nss.h"
+ #include "apr_thread_proc.h"
+-#include "ap_mpm.h"
++#include "mpm_common.h"
+ #include "secmod.h"
+ #include "sslerr.h"
+ #include "pk11func.h"
+Index: mod_nss-1.0.8/nss_engine_io.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_io.c
++++ mod_nss-1.0.8/nss_engine_io.c
+@@ -620,13 +620,13 @@ static apr_status_t nss_filter_io_shutdo
+ PR_Close(ssl);
+ 
+ /* log the fact that we've closed the connection */
+- if (c->base_server->loglevel >= APLOG_INFO) {
++ if (c->base_server->log.level >= APLOG_INFO) {
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, c->base_server,
+ "Connection to child %ld closed "
+ "(server %s, client %s)",
+ c->id,
+ nss_util_vhostid(c->pool, c->base_server),
+- c->remote_ip ? c->remote_ip : "unknown");
++ c->client_ip ? c->client_ip : "unknown");
+ }
+ 
+ /* deallocate the SSL connection */
+@@ -1164,7 +1164,7 @@ static PRStatus PR_CALLBACK nspr_filter_
+ filter_ctx = (nss_filter_ctx_t *)(fd->secret);
+ c = filter_ctx->c;
+ 
+- return PR_StringToNetAddr(c->remote_ip, addr);
++ return PR_StringToNetAddr(c->client_ip, addr);
+ }
+ 
+ /* 
+Index: mod_nss-1.0.8/nss_engine_kernel.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_kernel.c
++++ mod_nss-1.0.8/nss_engine_kernel.c
+@@ -73,7 +73,7 @@ int nss_hook_ReadReq(request_rec *r)
+ /*
+ * Log information about incoming HTTPS requests
+ */
+- if (r->server->loglevel >= APLOG_INFO && ap_is_initial_req(r)) {
++ if (r->server->log.level >= APLOG_INFO && ap_is_initial_req(r)) {
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,
+ "%s HTTPS request received for child %ld (server %s)",
+ (r->connection->keepalives <= 0 ?
+@@ -530,7 +530,7 @@ int nss_hook_Access(request_rec *r)
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,
+ "Access to %s denied for %s "
+ "(requirement expression not fulfilled)",
+- r->filename, r->connection->remote_ip);
++ r->filename, r->connection->client_ip);
+ 
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,
+ "Failed expression: %s", req->cpExpr);
+Index: mod_nss-1.0.8/nss_engine_log.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_log.c
++++ mod_nss-1.0.8/nss_engine_log.c
+@@ -321,7 +321,7 @@ void nss_die(void)
+ exit(1); 
+ }
+ 
+-void nss_log_nss_error(const char *file, int line, int level, server_rec *s)
++void nss_log_nss_error(const char *file, int line, int module_index, int level, server_rec *s)
+ {
+ const char *err;
+ PRInt32 error;
+@@ -340,7 +340,7 @@ void nss_log_nss_error(const char *file,
+ err = "Unknown";
+ }
+ 
+- ap_log_error(file, line, level, 0, s,
++ ap_log_error(file, line, module_index, level, 0, s,
+ "SSL Library Error: %d %s",
+ error, err);
+ }
+Index: mod_nss-1.0.8/nss_engine_vars.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_vars.c
++++ mod_nss-1.0.8/nss_engine_vars.c
+@@ -196,7 +196,7 @@ char *nss_var_lookup(apr_pool_t *p, serv
+ && sslconn && sslconn->ssl)
+ result = nss_var_lookup_ssl(p, c, var+4);
+ else if (strcEQ(var, "REMOTE_ADDR"))
+- result = c->remote_ip;
++ result = c->client_ip;
+ else if (strcEQ(var, "HTTPS")) {
+ if (sslconn && sslconn->ssl)
+ result = "on";
+@@ -212,7 +212,7 @@ char *nss_var_lookup(apr_pool_t *p, serv
+ if (strlen(var) > 12 && strcEQn(var, "SSL_VERSION_", 12))
+ result = nss_var_lookup_nss_version(p, var+12);
+ else if (strcEQ(var, "SERVER_SOFTWARE"))
+- result = (char *)ap_get_server_version();
++ result = (char *)ap_get_server_banner();
+ else if (strcEQ(var, "API_VERSION")) {
+ result = apr_psprintf(p, "%d", MODULE_MAGIC_NUMBER);
+ resdup = FALSE;

mod_nss-lockpcache.patch Added

@@ -0,0 +1,240 @@
+diff -u --recursive mod_nss-1.0.8/mod_nss.c mod_nss-1.0.8.lock/mod_nss.c
+--- mod_nss-1.0.8/mod_nss.c	2011-03-02 16:19:52.000000000 -0500
++++ mod_nss-1.0.8.lock/mod_nss.c	2011-03-02 16:17:48.000000000 -0500
+@@ -152,6 +152,8 @@
+ AP_INIT_RAW_ARGS("NSSLogLevel", ap_set_deprecated, NULL, OR_ALL, 
+ "SSLLogLevel directive is no longer supported - use LogLevel."),
+ #endif
++ AP_INIT_TAKE1("User", set_user, NULL, RSRC_CONF,
++ "Apache user. Comes from httpd.conf."),
+ 
+ AP_END_CMD
+ };
+diff -u --recursive mod_nss-1.0.8/mod_nss.h mod_nss-1.0.8.lock/mod_nss.h
+--- mod_nss-1.0.8/mod_nss.h	2011-03-02 16:19:52.000000000 -0500
++++ mod_nss-1.0.8.lock/mod_nss.h	2011-03-02 16:17:48.000000000 -0500
+@@ -41,6 +41,9 @@
+ #include "apr_shm.h"
+ #include "apr_global_mutex.h"
+ #include "apr_optional.h"
++#include <sys/types.h>
++#include <sys/ipc.h>
++#include <sys/sem.h>
+ 
+ #define MOD_NSS_VERSION AP_SERVER_BASEREVISION
+ 
+@@ -244,6 +247,9 @@
+ struct {
+ void *pV1, *pV2, *pV3, *pV4, *pV5, *pV6, *pV7, *pV8, *pV9, *pV10;
+ } rCtx;
++
++ int semid;
++ const char *user;
+ } SSLModConfigRec;
+ 
+ typedef struct SSLSrvConfigRec SSLSrvConfigRec;
+@@ -412,6 +418,7 @@
+ const char *nss_cmd_NSSProxyCipherSuite(cmd_parms *, void *, const char *);
+ const char *nss_cmd_NSSProxyNickname(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char *nss_cmd_NSSProxyCheckPeerCN(cmd_parms *cmd, void *dcfg, int flag);
++const char *set_user(cmd_parms *cmd, void *dummy, const char *arg);
+ 
+ /* module initialization */
+ int nss_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
+diff -u --recursive mod_nss-1.0.8/nss_engine_config.c mod_nss-1.0.8.lock/nss_engine_config.c
+--- mod_nss-1.0.8/nss_engine_config.c	2011-03-02 16:19:52.000000000 -0500
++++ mod_nss-1.0.8.lock/nss_engine_config.c	2011-03-02 16:17:48.000000000 -0500
+@@ -830,3 +830,12 @@
+ 
+ return NULL;
+ }
++
++const char *set_user(cmd_parms *cmd, void *dummy, const char *arg)
++{
++ SSLModConfigRec *mc = myModConfig(cmd->server);
++
++ mc->user = arg;
++
++ return NULL;
++}
+diff -u --recursive mod_nss-1.0.8/nss_engine_init.c mod_nss-1.0.8.lock/nss_engine_init.c
+--- mod_nss-1.0.8/nss_engine_init.c	2011-03-02 16:19:49.000000000 -0500
++++ mod_nss-1.0.8.lock/nss_engine_init.c	2011-03-02 16:17:48.000000000 -0500
+@@ -312,6 +312,7 @@
+ int sslenabled = FALSE;
+ int fipsenabled = FALSE;
+ int threaded = 0;
++ struct semid_ds status;
+ 
+ mc->nInitCount++;
+ 
+@@ -412,10 +413,26 @@
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+ "Init: %snitializing NSS library", mc->nInitCount == 1 ? "I" : "Re-i");
+ 
++ /* The first pass through this function will create the semaphore that
++ * will be used to lock the pipe. The user is still root at that point
++ * so for any later calls the semaphore ops will fail with permission
++ * errors. So switch the user to the Apache user.
++ */
++ if (mc->semid) {
++ uid_t user_id;
++
++ user_id = ap_uname2id(mc->user);
++ semctl(mc->semid, 0, IPC_STAT, &status);
++ status.sem_perm.uid = user_id;
++ semctl(mc->semid,0,IPC_SET,&status);
++ }
++
+ /* Do we need to fire up our password helper? */
+ if (mc->nInitCount == 1) {
+ const char * child_argv[5];
+ apr_status_t rv;
++ struct sembuf sb;
++ char sembuf[32];
+ 
+ if (mc->pphrase_dialog_helper == NULL) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+@@ -423,11 +440,31 @@
+ nss_die();
+ }
+ 
++ mc->semid = semget(IPC_PRIVATE, 1, IPC_CREAT | IPC_EXCL | 0600);
++ if (mc->semid == -1) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++ "Unable to obtain semaphore.");
++ nss_die();
++ }
++
++ /* Initialize the semaphore */
++ sb.sem_num = 0;
++ sb.sem_op = 1;
++ sb.sem_flg = 0;
++ if ((semop(mc->semid, &sb, 1)) == -1) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++ "Unable to initialize semaphore.");
++ nss_die();
++ }
++
++ PR_snprintf(sembuf, 32, "%d", mc->semid);
++
+ child_argv[0] = mc->pphrase_dialog_helper;
+- child_argv[1] = fipsenabled ? "on" : "off";
+- child_argv[2] = mc->pCertificateDatabase;
+- child_argv[3] = mc->pDBPrefix;
+- child_argv[4] = NULL;
++ child_argv[1] = sembuf;
++ child_argv[2] = fipsenabled ? "on" : "off";
++ child_argv[3] = mc->pCertificateDatabase;
++ child_argv[4] = mc->pDBPrefix;
++ child_argv[5] = NULL;
+ 
+ rv = apr_procattr_create(&mc->procattr, mc->pPool);
+ 
+diff -u --recursive mod_nss-1.0.8/nss_engine_pphrase.c mod_nss-1.0.8.lock/nss_engine_pphrase.c
+--- mod_nss-1.0.8/nss_engine_pphrase.c	2008-07-02 10:54:37.000000000 -0400
++++ mod_nss-1.0.8.lock/nss_engine_pphrase.c	2011-03-02 16:17:48.000000000 -0500
+@@ -279,6 +279,16 @@
+ char buf[1024];
+ apr_status_t rv;
+ apr_size_t nBytes = 1024;
++ struct sembuf sb;
++
++ /* lock the pipe */
++ sb.sem_num = 0;
++ sb.sem_op = -1;
++ sb.sem_flg = SEM_UNDO;
++ if (semop(parg->mc->semid, &sb, 1) == -1) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
++ "Unable to reserve semaphore resource");
++ }
+ 
+ snprintf(buf, 1024, "RETR\t%s", token_name);
+ rv = apr_file_write_full(parg->mc->proc.in, buf, strlen(buf), NULL);
+@@ -293,6 +303,13 @@
+ */
+ memset(buf, 0, sizeof(buf));
+ rv = apr_file_read(parg->mc->proc.out, buf, &nBytes);
++ sb.sem_op = 1;
++ if (semop(parg->mc->semid, &sb, 1) == -1) {
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
++ "Unable to free semaphore resource");
++ /* perror("semop free resource id"); */
++ }
++
+ if (rv != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
+ "Unable to read from pin store for slot: %s APR err: %d", PK11_GetTokenName(slot), rv);
+diff -u --recursive mod_nss-1.0.8/nss_pcache.c mod_nss-1.0.8.lock/nss_pcache.c
+--- mod_nss-1.0.8/nss_pcache.c	2011-03-02 16:19:55.000000000 -0500
++++ mod_nss-1.0.8.lock/nss_pcache.c	2011-03-02 16:19:10.000000000 -0500
+@@ -21,6 +21,9 @@
+ #include <pk11func.h>
+ #include <secmod.h>
+ #include <signal.h>
++#include <sys/types.h>
++#include <sys/ipc.h>
++#include <sys/sem.h>
+ #include "nss_pcache.h"
+ 
+ static char * getstr(const char * cmd, int el);
+@@ -70,6 +73,13 @@
+ unsigned char *crypt;
+ };
+ 
++union semun {
++ int val;
++ struct semid_ds *buf;
++ unsigned short *array;
++ struct seminfo *__buf;
++};
++
+ /*
+ * Node - for maintaining link list of tokens with cached PINs
+ */
+@@ -304,15 +314,19 @@
+ char * tokenName;
+ char * tokenpw;
+ int fipsmode = 0;
++ int semid = 0;
++ union semun semarg;
+ 
+- if (argc < 3 || argc > 4) {
+- fprintf(stderr, "Usage: nss_pcache <fips on/off> <directory> <prefix>\n");
++ if (argc < 4 || argc > 5) {
++ fprintf(stderr, "Usage: nss_pcache <semid> <fips on/off> <directory> <prefix>\n");
+ exit(1);
+ }
+ 
+ signal(SIGHUP, SIG_IGN);
+ 
+- if (!strcasecmp(argv[1], "on"))
++ semid = strtol(argv[1], NULL, 10);
++
++ if (!strcasecmp(argv[2], "on"))
+ fipsmode = 1;
+ 
+ /* Initialize NSPR */
+@@ -322,7 +336,7 @@
+ PK11_ConfigurePKCS11(NULL,NULL,NULL, INTERNAL_TOKEN_NAME, NULL, NULL,NULL,NULL,8,1);
+ 
+ /* Initialize NSS and open the certificate database read-only. */
+- rv = NSS_Initialize(argv[2], argc == 4 ? argv[3] : NULL, argc == 4 ? argv[3] : NULL, "secmod.db", NSS_INIT_READONLY);
++ rv = NSS_Initialize(argv[3], argc == 4 ? argv[4] : NULL, argc == 5 ? argv[4] : NULL, "secmod.db", NSS_INIT_READONLY);
+ 
+ if (rv != SECSuccess) {
+ fprintf(stderr, "Unable to initialize NSS database: %d\n", rv);
+@@ -437,6 +451,11 @@
+ }
+ freeList(pinList);
+ PR_Close(in);
++ /* Remove the semaphore used for locking here. This is because this
++ * program only goes away when Apache shuts down so we don't have to
++ * worry about reloads.
++ */
++ semctl(semid, 0, IPC_RMID, semarg);
+ return 0;
+ }
+ 
+Only in mod_nss-1.0.8.lock/: nss_pcache.c.orig
+Only in mod_nss-1.0.8.lock/: nss_pcache.c.rej

mod_nss-negotiate.patch Added

@@ -0,0 +1,180 @@
+
+diff -up ./mod_nss.c.norego ./mod_nss.c
+--- ./mod_nss.c.norego	2010-01-28 20:42:14.000000000 +0100
++++ ./mod_nss.c	2010-01-28 20:44:49.000000000 +0100
+@@ -97,6 +97,14 @@ static const command_rec nss_config_cmds
+     SSL_CMD_SRV(Nickname, TAKE1,
+                 "SSL RSA Server Certificate nickname "
+                 "(`Server-Cert'")
++#ifdef SSL_ENABLE_RENEGOTIATION
++    SSL_CMD_SRV(Renegotiation, FLAG,
++                "Enable SSL Renegotiation (default off) "
++                "(`on', `off')")
++    SSL_CMD_SRV(RequireSafeNegotiation, FLAG,
++                "If Rengotiation is allowed, require safe negotiation (default off) "
++                "(`on', `off')")
++#endif
+ #ifdef NSS_ENABLE_ECC
+     SSL_CMD_SRV(ECCNickname, TAKE1,
+                 "SSL ECC Server Certificate nickname "
+diff -up ./mod_nss.h.norego ./mod_nss.h
+--- ./mod_nss.h.norego	2010-01-28 20:42:14.000000000 +0100
++++ ./mod_nss.h	2010-01-28 20:44:49.000000000 +0100
+@@ -269,6 +269,10 @@ typedef struct {
+     int tls;
+     int tlsrollback;
+     int enforce;
++#ifdef SSL_ENABLE_RENEGOTIATION
++    int enablerenegotiation;
++    int requiresafenegotiation;
++#endif
+     const char *nickname;
+ #ifdef NSS_ENABLE_ECC
+     const char *eccnickname;
+@@ -383,6 +387,10 @@ const char *nss_cmd_NSSCipherSuite(cmd_p
+ const char *nss_cmd_NSSVerifyClient(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char *nss_cmd_NSSProtocol(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char *nss_cmd_NSSNickname(cmd_parms *cmd, void *dcfg, const char *arg);
++#ifdef SSL_ENABLE_RENEGOTIATION
++const char *nss_cmd_NSSRenegotiation(cmd_parms *cmd, void *dcfg, int flag);
++const char *nss_cmd_NSSRequireSafeNegotiation(cmd_parms *cmd, void *dcfg, int flag);
++#endif
+ #ifdef NSS_ENABLE_ECC
+ const char *nss_cmd_NSSECCNickname(cmd_parms *cmd, void *dcfg, const char *arg);
+ #endif
+diff -up ./nss_engine_config.c.norego ./nss_engine_config.c
+--- ./nss_engine_config.c.norego	2010-01-28 20:42:14.000000000 +0100
++++ ./nss_engine_config.c	2010-01-28 20:44:49.000000000 +0100
+@@ -78,6 +78,10 @@ static void modnss_ctx_init(modnss_ctx_t
+     mctx->tls                 = PR_FALSE;
+     mctx->tlsrollback         = PR_FALSE;
+ 
++#ifdef SSL_ENABLE_RENEGOTIATION
++    mctx->enablerenegotiation   = PR_FALSE;
++    mctx->requiresafenegotiation = PR_FALSE;
++#endif
+     mctx->enforce             = PR_TRUE;
+     mctx->nickname            = NULL;
+ #ifdef NSS_ENABLE_ECC
+@@ -174,6 +178,10 @@ static void modnss_ctx_cfg_merge(modnss_
+     cfgMerge(eccnickname, NULL);
+ #endif
+     cfgMerge(enforce, PR_TRUE);
++#ifdef SSL_ENABLE_RENEGOTIATION
++    cfgMerge(enablerenegotiation, PR_FALSE);
++    cfgMerge(requiresafenegotiation, PR_FALSE);
++#endif
+ }
+ 
+ static void modnss_ctx_cfg_merge_proxy(modnss_ctx_t *base,
+@@ -461,6 +469,26 @@ const char *nss_cmd_NSSNickname(cmd_parm
+     return NULL;
+ }
+ 
++#ifdef SSL_ENABLE_RENEGOTIATION
++const char *nss_cmd_NSSRenegotiation(cmd_parms *cmd, void *dcfg, int flag)
++{
++    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
++
++    sc->server->enablerenegotiation = flag ? PR_TRUE : PR_FALSE;
++ 
++    return NULL;
++}
++
++const char *nss_cmd_NSSRequireSafeNegotiation(cmd_parms *cmd, void *dcfg, int flag)
++{
++    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
++
++    sc->server->requiresafenegotiation = flag ? PR_TRUE : PR_FALSE;
++ 
++    return NULL;
++}
++#endif
++
+ #ifdef NSS_ENABLE_ECC
+ const char *nss_cmd_NSSECCNickname(cmd_parms *cmd,
+                                 void *dcfg,
+diff -up ./nss_engine_init.c.norego ./nss_engine_init.c
+--- ./nss_engine_init.c.norego	2010-01-28 20:42:14.000000000 +0100
++++ ./nss_engine_init.c	2010-01-28 20:48:42.000000000 +0100
+@@ -548,6 +548,24 @@ static void nss_init_ctx_socket(server_r
+             nss_die();
+         }
+     }
++#ifdef SSL_ENABLE_RENEGOTIATION
++    if (SSL_OptionSet(mctx->model, SSL_ENABLE_RENEGOTIATION,
++            mctx->enablerenegotiation ?
++              SSL_RENEGOTIATE_REQUIRES_XTN : SSL_RENEGOTIATE_NEVER
++              ) != SECSuccess) {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                    "Unable to set SSL renegotiation");
++            nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
++            nss_die();
++    }
++    if (SSL_OptionSet(mctx->model, SSL_REQUIRE_SAFE_NEGOTIATION,
++            mctx->requiresafenegotiation) != SECSuccess) {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                    "Unable to set SSL safe negotiation");
++            nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
++            nss_die();
++    }
++#endif
+ }
+ 
+ static void nss_init_ctx_protocol(server_rec *s,
+
+diff -up ./nss.conf.in.norego ./nss.conf.in
+--- ./nss.conf.in.norego 20 Oct 2006 15:23:39 -0000
++++ ./nss.conf.in 18 Mar 2010 18:34:46 -0000
+@@ -64,6 +64,17 @@
+ #NSSRandomSeed startup file:/dev/random  512
+ #NSSRandomSeed startup file:/dev/urandom 512
+ 
++#
++# TLS Negotiation configuration under RFC 5746
++#
++# Only renegotiate if the peer's hello bears the TLS renegotiation_info
++# extension. Default off.
++NSSRenegotiation off
++
++# Peer must send Signaling Cipher Suite Value (SCSV) or
++# Renegotiation Info (RI) extension in ALL handshakes.  Default: off
++NSSRequireSafeNegotiation off
++
+ ##
+ ## SSL Virtual Host Context
+ ##
+
+diff -up ./nss_engine_log.c.norego ./nss_engine_log.c
+--- ./nss_engine_log.c.norego    17 Oct 2006 16:45:57 -0000
++++ ./nss_engine_log.c    18 Mar 2010 19:39:10 -0000
+@@ -27,7 +27,7 @@
+ #define LIBSEC_ERROR_BASE		(-8192)
+ #define LIBSEC_MAX_ERROR		(LIBSEC_ERROR_BASE + 155)
+ #define LIBSSL_ERROR_BASE		(-12288)
+-#define LIBSSL_MAX_ERROR		(LIBSSL_ERROR_BASE + 102)
++#define LIBSSL_MAX_ERROR		(LIBSSL_ERROR_BASE + 114)
+ 
+ typedef struct l_error_t {
+     int errorNumber;
+@@ -296,7 +296,19 @@
+     { 99, "Server requires ciphers more secure than those supported by client" },
+     { 100, "Peer reports it experienced an internal error" },
+     { 101, "Peer user canceled handshake" },
+-    { 102, "Peer does not permit renegotiation of SSL security parameters" }
++    { 102, "Peer does not permit renegotiation of SSL security parameters" },
++    { 103, "Server cache not configured" },
++    { 104, "Unsupported extension" },
++    { 105, "Certificate unobtainable" },
++    { 106, "Unrecognized name" },
++    { 107, "Bad certificate status" },
++    { 108, "Bad certificate hash value" },
++    { 109, "Unexpected new session ticket" },
++    { 110, "Malformed new session ticket" },
++    { 111, "Decompression failure" },
++    { 112, "Renegotiation not allowed" },
++    { 113, "Safe negotiation required but not provided by client" },
++    { 114, "Unexpected uncompressed record" },
+ };
+ 
+ void nss_die(void)

mod_nss-no_shutdown_if_not_init_2.patch Added

mod_nss-overlapping_memcpy.patch Added

mod_nss-proxyvariables.patch Added

@@ -0,0 +1,83 @@
+diff -rupN mod_nss-1.0.8.orig/nss_engine_init.c mod_nss-1.0.8/nss_engine_init.c
+--- mod_nss-1.0.8.orig/nss_engine_init.c	2012-10-03 14:28:50.751794000 -0700
++++ mod_nss-1.0.8/nss_engine_init.c	2012-10-04 16:33:08.278929000 -0700
+@@ -628,8 +628,21 @@ static void nss_init_ctx_protocol(server
+         tls = 1;
+     } else {
+         if (mctx->auth.protocols == NULL) {
+-            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
+-                "NSSProtocols not set; using: SSLv3 and TLSv1");
++            /*
++             * Since this routine will be invoked individually for every
++             * thread associated with each 'server' object as well as for
++             * every thread associated with each 'proxy' object, issue a
++             * single per-thread 'warning' message for either a 'server'
++             * or a 'proxy' based upon the thread's object type.
++             */
++            if (mctx == mctx->sc->server) {
++                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
++                    "NSSProtocol value not set; using: SSLv3 and TLSv1");
++            } else if (mctx == mctx->sc->proxy) {
++                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
++                    "NSSProxyProtocol value not set; using: SSLv3 and TLSv1");
++            }
++
+             ssl3 = tls = 1;
+         } else {
+             lprotocols = strdup(mctx->auth.protocols);
+@@ -786,8 +799,25 @@ static void nss_init_ctx_cipher_suite(se
+      *  Configure SSL Cipher Suite
+      */
+     if (!suite) {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                     "Required value NSSCipherSuite not set.");
++        /*
++         * Since this is a 'fatal' error, regardless of whether this
++         * particular invocation is from a 'server' object or a 'proxy'
++         * object, issue all error message(s) as appropriate.
++         */
++        if ((mctx->sc->enabled == TRUE) &&
++            (mctx->sc->server) &&
++            (!mctx->sc->server->auth.cipher_suite)) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++                "NSSEngine on; required value NSSCipherSuite not set.");
++        }
++
++        if ((mctx->sc->proxy_enabled == TRUE) &&
++            (mctx->sc->proxy) &&
++            (!mctx->sc->proxy->auth.cipher_suite)) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++                "NSSProxyEngine on; required value NSSProxyCipherSuite not set.");
++        }
++
+         nss_die();
+     }
+     ciphers = strdup(suite);
+@@ -1069,8 +1099,25 @@ static void nss_init_server_certs(server
+         if (mctx->nickname == NULL)
+ #endif
+         {
+-            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                "No certificate nickname provided.");
++            /*
++             * Since this is a 'fatal' error, regardless of whether this
++             * particular invocation is from a 'server' object or a 'proxy'
++             * object, issue all error message(s) as appropriate.
++             */
++            if ((mctx->sc->enabled == TRUE) &&
++                (mctx->sc->server) &&
++                (mctx->sc->server->nickname == NULL)) {
++                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++                    "NSSEngine on; no certificate nickname provided by NSSNickname.");
++            }
++
++            if ((mctx->sc->proxy_enabled == TRUE) &&
++                (mctx->sc->proxy) &&
++                (mctx->sc->proxy->nickname == NULL)) {
++                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++                    "NSSProxyEngine on; no certificate nickname provided by NSSProxyNickname.");
++            }
++
+             nss_die();
+         }
+

mod_nss-reseterror.patch Added

mod_nss-reverseproxy.patch Added

@@ -0,0 +1,182 @@
+mod_proxy now sets the requested remote host name. Use this to compare
+to the CN value of the peer certificate and reject the request if they 
+do not match (and we are have NSSProxyCheckPeerCN set to on).
+
+diff -u --recursive mod_nss-1.0.8.orig/docs/mod_nss.html mod_nss-1.0.8/docs/mod_nss.html
+--- mod_nss-1.0.8.orig/docs/mod_nss.html	2006-09-05 10:58:56.000000000 -0400
++++ mod_nss-1.0.8/docs/mod_nss.html	2010-05-13 11:25:42.000000000 -0400
+@@ -1028,7 +1028,21 @@
+ 
+ Example 
+ 
+-<code>NSSProxyNickname beta</code> 
++<code>NSSProxyNickname beta 
++ 
++</code><big><big>NSSProxyCheckPeerCN</big></big> 
++ 
++Compare the CN value of the peer certificate with the hostname being
++requested. If this is set to on, the default, then the request will
++fail if they do not match. If this is set to off then this comparison
++is not done. Note that this test is your only protection against a
++man-in-the-middle attack so leaving this as on is strongly recommended. 
++ 
++Example 
++ 
++NSSProcyCheckPeerCN<code>
++on 
++</code> 
+ <h1><a name="Environment"></a>Environment Variables</h1>
+ Quite a few environment variables (for CGI and SSI) may be set
+ depending on the NSSOptions configuration. It can be expensive to set
+@@ -1435,42 +1449,9 @@
+ <h1><a name="FAQ"></a>Frequently Asked Questions</h1>
+ Q. Does mod_nss support mod_proxy? 
+ 
+-A. In order to use the mod_nss proxy support you will need to build
+-your own mod_proxy by applying a patch found in bug <a
+- href="http://issues.apache.org/bugzilla/show_bug.cgi?id=36468">36468</a>.
+-The patch is needed so we can compare the hostname contained in the
+-remote certificate with the hostname you meant to visit. This prevents
+-man-in-the-middle attacks. 
+- 
+-You also have to change the SSL functions that mod_proxy looks to use.
+-You'll need to apply this patch: 
+- 
+-<code>1038,1039c1038,1039 
+-&lt; APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *)); 
+-&lt; APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *)); 
+---- 
+-&gt; APR_DECLARE_OPTIONAL_FN(int, nss_proxy_enable, (conn_rec *)); 
+-&gt; APR_DECLARE_OPTIONAL_FN(int, nss_engine_disable, (conn_rec *)); 
+-1041,1042c1041,1042 
+-&lt; static APR_OPTIONAL_FN_TYPE(ssl_proxy_enable) *proxy_ssl_enable =
+-NULL; 
+-&lt; static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *proxy_ssl_disable
+-= NULL; 
+---- 
+-&gt; static APR_OPTIONAL_FN_TYPE(nss_proxy_enable) *proxy_ssl_enable =
+-NULL; 
+-&gt; static APR_OPTIONAL_FN_TYPE(nss_engine_disable) *proxy_ssl_disable
+-= NULL; 
+-1069,1070c1069,1070 
+-&lt;&nbsp;&nbsp;&nbsp;&nbsp; proxy_ssl_enable =
+-APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable); 
+-&lt;&nbsp;&nbsp;&nbsp;&nbsp; proxy_ssl_disable =
+-APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable); 
+---- 
+-&gt;&nbsp;&nbsp;&nbsp;&nbsp; proxy_ssl_enable =
+-APR_RETRIEVE_OPTIONAL_FN(nss_proxy_enable); 
+-&gt;&nbsp;&nbsp;&nbsp;&nbsp; proxy_ssl_disable =
+-APR_RETRIEVE_OPTIONAL_FN(nss_engine_disable); 
+-</code> 
++A. Yes but you need to make sure that mod_ssl is not loaded. mod_proxy
++provides a single interface for SSL providers and mod_nss defers to
++mod_ssl
++if it is loaded.
+ </body>
+ </html>
+diff -u --recursive mod_nss-1.0.8.orig/mod_nss.c mod_nss-1.0.8/mod_nss.c
+--- mod_nss-1.0.8.orig/mod_nss.c	2010-05-13 11:24:49.000000000 -0400
++++ mod_nss-1.0.8/mod_nss.c	2010-05-13 11:25:42.000000000 -0400
+@@ -142,6 +142,8 @@
+ SSL_CMD_SRV(ProxyNickname, TAKE1,
+ "SSL Proxy: client certificate Nickname to be for proxy connections "
+ "(`nickname')")
++ SSL_CMD_SRV(ProxyCheckPeerCN, FLAG,
++ "SSL Proxy: check the peers certificate CN")
+ 
+ #ifdef IGNORE
+ /* Deprecated directives. */
+@@ -238,23 +240,30 @@
+ SECStatus NSSBadCertHandler(void *arg, PRFileDesc * socket)
+ {
+ conn_rec *c = (conn_rec *)arg;
++ SSLSrvConfigRec *sc = mySrvConfig(c->base_server);
+ PRErrorCode err = PR_GetError();
+ SECStatus rv = SECFailure;
+ CERTCertificate *peerCert = SSL_PeerCertificate(socket);
++ const char *hostname_note;
+ 
+ switch (err) {
+ case SSL_ERROR_BAD_CERT_DOMAIN:
+- if (c->remote_host != NULL) {
+- rv = CERT_VerifyCertName(peerCert, c->remote_host);
+- if (rv != SECSuccess) {
+- char *remote = CERT_GetCommonName(&peerCert->subject);
++ if (sc->proxy_ssl_check_peer_cn == TRUE) {
++ if ((hostname_note = apr_table_get(c->notes, "proxy-request-hostname")) != NULL) {
++ apr_table_unset(c->notes, "proxy-request-hostname");
++ rv = CERT_VerifyCertName(peerCert, hostname_note);
++ if (rv != SECSuccess) {
++ char *remote = CERT_GetCommonName(&peerCert->subject);
++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
++ "SSL Proxy: Possible man-in-the-middle attack. The remove server is %s, we expected %s", remote, hostname_note);
++ PORT_Free(remote);
++ }
++ } else {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
+- "SSL Proxy: Possible man-in-the-middle attack. The remove server is %s, we expected %s", remote, c->remote_host);
+- PORT_Free(remote);
++ "SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up.");
+ }
+ } else {
+- ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
+- "SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up. Hint: See Apache bug 36468.");
++ rv = SECSuccess;
+ }
+ break;
+ default:
+diff -u --recursive mod_nss-1.0.8.orig/mod_nss.h mod_nss-1.0.8/mod_nss.h
+--- mod_nss-1.0.8.orig/mod_nss.h	2010-05-13 11:24:49.000000000 -0400
++++ mod_nss-1.0.8/mod_nss.h	2010-05-13 11:25:42.000000000 -0400
+@@ -306,6 +306,7 @@
+ int vhost_id_len;
+ modnss_ctx_t *server;
+ modnss_ctx_t *proxy;
++ BOOL proxy_ssl_check_peer_cn;
+ };
+ 
+ /*
+@@ -410,6 +411,7 @@
+ const char *nss_cmd_NSSProxyProtocol(cmd_parms *, void *, const char *);
+ const char *nss_cmd_NSSProxyCipherSuite(cmd_parms *, void *, const char *);
+ const char *nss_cmd_NSSProxyNickname(cmd_parms *cmd, void *dcfg, const char *arg);
++const char *nss_cmd_NSSProxyCheckPeerCN(cmd_parms *cmd, void *dcfg, int flag);
+ 
+ /* module initialization */
+ int nss_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
+diff -u --recursive mod_nss-1.0.8.orig/nss_engine_config.c mod_nss-1.0.8/nss_engine_config.c
+--- mod_nss-1.0.8.orig/nss_engine_config.c	2010-05-13 11:24:49.000000000 -0400
++++ mod_nss-1.0.8/nss_engine_config.c	2010-05-13 11:25:42.000000000 -0400
+@@ -140,6 +140,7 @@
+ sc->vhost_id_len = 0; /* set during module init */
+ sc->proxy = NULL;
+ sc->server = NULL;
++ sc->proxy_ssl_check_peer_cn = TRUE;
+ 
+ modnss_ctx_init_proxy(sc, p);
+ 
+@@ -214,6 +215,7 @@
+ cfgMergeBool(fips);
+ cfgMergeBool(enabled);
+ cfgMergeBool(proxy_enabled);
++ cfgMergeBool(proxy_ssl_check_peer_cn);
+ 
+ modnss_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
+ 
+@@ -544,6 +546,15 @@
+ return NULL;
+ }
+ 
++const char *nss_cmd_NSSProxyCheckPeerCN(cmd_parms *cmd, void *dcfg, int flag)
++{
++ SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
++
++ sc->proxy_ssl_check_peer_cn = flag ? TRUE : FALSE;
++
++ return NULL;
++}
++
+ const char *nss_cmd_NSSEnforceValidCerts(cmd_parms *cmd,
+ void *dcfg,
+ int flag)

mod_nss-sslmultiproxy.patch Added

@@ -0,0 +1,214 @@
+Index: mod_nss-1.0.8/mod_nss.c
+===================================================================
+--- mod_nss-1.0.8.orig/mod_nss.c
++++ mod_nss-1.0.8/mod_nss.c
+@@ -192,6 +192,9 @@ static SSLConnRec *nss_init_connection_c
+     return sslconn;
+ }
+ 
++static APR_OPTIONAL_FN_TYPE(ssl_proxy_enable) *othermod_proxy_enable;
++static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
++
+ int nss_proxy_enable(conn_rec *c)
+ {
+     SSLSrvConfigRec *sc = mySrvConfig(c->base_server);
+@@ -199,6 +202,12 @@ int nss_proxy_enable(conn_rec *c)
+     SSLConnRec *sslconn = nss_init_connection_ctx(c);
+ 
+     if (!sc->proxy_enabled) {
++        if (othermod_proxy_enable) {
++            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
++                          "mod_nss proxy not configured, passing through to mod_ssl module");
++            return othermod_proxy_enable(c);
++        }
++
+         ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server,
+                      "SSL Proxy requested for %s but not enabled "
+                      "[Hint: NSSProxyEngine]", sc->vhost_id);
+@@ -212,7 +221,7 @@ int nss_proxy_enable(conn_rec *c)
+     return 1;
+ }
+ 
+-int ssl_proxy_enable(conn_rec *c) {
++static int ssl_proxy_enable(conn_rec *c) {
+     return nss_proxy_enable(c);
+ }
+ 
+@@ -222,6 +231,10 @@ int nss_engine_disable(conn_rec *c)
+ 
+     SSLConnRec *sslconn;
+ 
++    if (othermod_engine_disable) {
++        othermod_engine_disable(c);
++    }
++
+     if (sc->enabled == FALSE) {
+         return 0;
+     }
+@@ -233,7 +246,7 @@ int nss_engine_disable(conn_rec *c)
+     return 1;
+ }
+ 
+-int ssl_engine_disable(conn_rec *c) {
++static int ssl_engine_disable(conn_rec *c) {
+     return nss_engine_disable(c);
+ }
+ 
+@@ -455,14 +468,17 @@ static void nss_register_hooks(apr_pool_
+ 
+     nss_var_register();
+ 
++    /* Always register these mod_nss optional functions */
+     APR_REGISTER_OPTIONAL_FN(nss_proxy_enable);
+     APR_REGISTER_OPTIONAL_FN(nss_engine_disable);
+ 
+-    /* If mod_ssl is not loaded then mod_nss can work with mod_proxy */
+-    if (APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable) == NULL)
+-        APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+-    if (APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable) == NULL)
+-        APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
++    /* Save the state of any previously registered mod_ssl functions */
++    othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable);
++    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
++
++    /* Always register these local mod_ssl optional functions */
++    APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
++    APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+ }
+ 
+ module AP_MODULE_DECLARE_DATA nss_module = {
+Index: mod_nss-1.0.8/mod_nss.h
+===================================================================
+--- mod_nss-1.0.8.orig/mod_nss.h
++++ mod_nss-1.0.8/mod_nss.h
+@@ -13,8 +13,8 @@
+  * limitations under the License.
+  */
+ 
+-#ifndef __MOD_SSL_H__
+-#define __MOD_SSL_H__
++#ifndef __MOD_NSS_H__
++#define __MOD_NSS_H__
+ 
+ /* Apache headers */
+ #include "httpd.h"
+@@ -25,6 +25,7 @@
+ #include "http_connection.h"
+ #include "http_request.h"
+ #include "http_protocol.h"
++#include "mod_ssl.h"
+ #include "util_script.h"
+ #include "util_filter.h"
+ #include "mpm.h"
+@@ -438,34 +439,24 @@ int nss_hook_ReadReq(request_rec *r);
+ /*  Variables  */
+ void         nss_var_register(void);
+ char        *nss_var_lookup(apr_pool_t *, server_rec *, conn_rec *, request_rec *, char *);
+-char        *ssl_var_lookup(apr_pool_t *, server_rec *, conn_rec *, request_rec *, char *);
+ void         nss_var_log_config_register(apr_pool_t *p);
+ 
+ APR_DECLARE_OPTIONAL_FN(char *, nss_var_lookup,
+                         (apr_pool_t *, server_rec *,
+                          conn_rec *, request_rec *, 
+                          char *));
+-APR_DECLARE_OPTIONAL_FN(char *, ssl_var_lookup,
+-                        (apr_pool_t *, server_rec *,
+-                         conn_rec *, request_rec *, 
+-                         char *));
+ 
+ /* An optional function which returns non-zero if the given connection
+  * is using SSL/TLS. */
+ APR_DECLARE_OPTIONAL_FN(int, nss_is_https, (conn_rec *));
+-APR_DECLARE_OPTIONAL_FN(int, ssl_is_https, (conn_rec *));
+ 
+ /* Proxy Support */
+ int nss_proxy_enable(conn_rec *c);
+ int nss_engine_disable(conn_rec *c);
+-int ssl_proxy_enable(conn_rec *c);
+-int ssl_engine_disable(conn_rec *c);
+ 
+ APR_DECLARE_OPTIONAL_FN(int, nss_proxy_enable, (conn_rec *));
+-APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *));
+ 
+ APR_DECLARE_OPTIONAL_FN(int, nss_engine_disable, (conn_rec *));
+-APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
+ 
+ /* I/O */
+ PRFileDesc * nss_io_new_fd();
+@@ -495,4 +486,4 @@ void nss_die(void);
+ 
+ /* NSS callback */
+ SECStatus nss_AuthCertificate(void *arg, PRFileDesc *socket, PRBool checksig, PRBool isServer);
+-#endif /* __MOD_SSL_H__ */
++#endif /* __MOD_NSS_H__ */
+Index: mod_nss-1.0.8/nss_engine_vars.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_vars.c
++++ mod_nss-1.0.8/nss_engine_vars.c
+@@ -39,11 +39,17 @@ static char *nss_var_lookup_nss_cert_ver
+ static char *nss_var_lookup_nss_cipher(apr_pool_t *p, conn_rec *c, char *var);
+ static char *nss_var_lookup_nss_version(apr_pool_t *p, char *var);
+ static char *nss_var_lookup_protocol_version(apr_pool_t *p, conn_rec *c);
++static char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, char *var);
++
++static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
++static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
+ 
+ static int nss_is_https(conn_rec *c)
+ {
+     SSLConnRec *sslconn = myConnConfig(c);
+-    return sslconn && sslconn->ssl;
++
++    return (sslconn && sslconn->ssl)
++        || (othermod_is_https && othermod_is_https(c));
+ }
+ 
+ static int ssl_is_https(conn_rec *c) {
+@@ -52,14 +58,17 @@ static int ssl_is_https(conn_rec *c) {
+ 
+ void nss_var_register(void)
+ {
++    /* Always register these mod_nss optional functions */
+     APR_REGISTER_OPTIONAL_FN(nss_is_https);
+     APR_REGISTER_OPTIONAL_FN(nss_var_lookup);
+ 
+-    /* These can only be registered if mod_ssl is not loaded */
+-    if (APR_RETRIEVE_OPTIONAL_FN(ssl_is_https) == NULL)
+-        APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+-    if (APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup) == NULL)
+-        APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
++    /* Save the state of any previously registered mod_ssl functions */
++    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
++    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
++
++    /* Always register these local mod_ssl optional functions */
++    APR_REGISTER_OPTIONAL_FN(ssl_is_https);
++    APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+ 
+     return;
+ }
+@@ -174,6 +183,15 @@ char *nss_var_lookup(apr_pool_t *p, serv
+      */
+     if (result == NULL && c != NULL) {
+         SSLConnRec *sslconn = myConnConfig(c);
++
++        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
++            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
++            /* If mod_ssl is registered for this connection,
++             * pass any SSL_* variable through to the mod_ssl module
++             */
++            return othermod_var_lookup(p, s, c, r, var);
++        }
++
+         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) 
+                  && sslconn && sslconn->ssl)
+             result = nss_var_lookup_ssl(p, c, var+4);
+@@ -252,7 +270,7 @@ char *nss_var_lookup(apr_pool_t *p, serv
+     return result;
+ }
+ 
+-char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, char *var) {
++static char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, char *var) {
+     return nss_var_lookup(p, s, c, r, var);
+ }
+

mod_nss-tlsv1_1.patch Added

@@ -0,0 +1,767 @@
+Index: mod_nss-1.0.8/docs/mod_nss.html
+===================================================================
+--- mod_nss-1.0.8.orig/docs/mod_nss.html
++++ mod_nss-1.0.8/docs/mod_nss.html
+@@ -466,7 +466,7 @@ Example 
+ Enables or disables FIPS 140 mode. This replaces the standard
+ internal PKCS#11 module with a FIPS-enabled one. It also forces the
+-enabled protocols to TLSv1 and disables all ciphers but the
++enabled protocols to TLSv1.2 - TLS v1.0 and disables all ciphers but the
+ FIPS ones. You may still select which ciphers you would like
+ limited to those that are FIPS-certified. Any non-FIPS that are
+ included in the NSSCipherSuite entry are automatically disabled.
+@@ -570,7 +570,7 @@ definition 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_3DES_EDE_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1 
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2 
+ </td>
+ </tr>
+ <tr>
+@@ -578,106 +578,106 @@ definition 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_DES_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_null_md5 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_NULL_MD5 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_null_sha 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_NULL_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_rc2_40_md5</td>
+ <td style="vertical-align: top;">SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_rc4_128_md5</td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_RC4_128_MD5 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_rc4_128_sha</td>
+ <td style="vertical-align: top;">SSL_RSA_WITH_RC4_128_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_rc4_40_md5</td>
+ <td style="vertical-align: top;">SSL_RSA_EXPORT_WITH_RC4_40_MD5 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">fortezza 
+ </td>
+ <td style="vertical-align: top;">SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">fortezza_rc4_128_sha 
+ </td>
+ <td style="vertical-align: top;">SSL_FORTEZZA_DMS_WITH_RC4_128_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">fortezza_null 
+ </td>
+ <td style="vertical-align: top;">SSL_FORTEZZA_DMS_WITH_NULL_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">fips_des_sha 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_FIPS_WITH_DES_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">fips_3des_sha 
+ </td>
+ <td style="vertical-align: top;">SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_des_56_sha</td>
+ <td style="vertical-align: top;">TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSL3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_rc4_56_sha</td>
+ <td style="vertical-align: top;">TLS_RSA_EXPORT1024_WITH_RC4_56_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_aes_128_sha 
+ </td>
+ <td style="vertical-align: top;">TLS_RSA_WITH_AES_128_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td style="vertical-align: top;">rsa_aes_256_sha 
+ </td>
+ <td style="vertical-align: top;">TLS_RSA_WITH_AES_256_CBC_SHA 
+ </td>
+- <td style="vertical-align: top;">SSLv3/TLSv1</td>
++ <td style="vertical-align: top;">SSLv3/TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ </tbody>
+ </table>
+@@ -698,127 +698,127 @@ Definition 
+ <tr>
+ <td>ecdh_ecdsa_null_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_NULL_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_rc4_128_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_RC4_128_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_3des_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_aes_128_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_ecdsa_aes_256_sha</td>
+ <td>TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_null_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_NULL_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_rc4_128_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_3des_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_aes_128_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_ecdsa_aes_256_sha</td>
+ <td>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_null_sha</td>
+ <td>TLS_ECDH_RSA_WITH_NULL_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_128_sha</td>
+ <td>TLS_ECDH_RSA_WITH_RC4_128_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_3des_sha</td>
+ <td>TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_aes_128_sha</td>
+ <td>TLS_ECDH_RSA_WITH_AES_128_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_rsa_aes_256_sha</td>
+ <td>TLS_ECDH_RSA_WITH_AES_256_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>echde_rsa_null</td>
+ <td>TLS_ECDHE_RSA_WITH_NULL_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_rc4_128_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_RC4_128_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_3des_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_aes_128_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdhe_rsa_aes_256_sha</td>
+ <td>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_null_sha</td>
+ <td>TLS_ECDH_anon_WITH_NULL_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_rc4_128sha</td>
+ <td>TLS_ECDH_anon_WITH_RC4_128_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_3des_sha</td>
+ <td>TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_aes_128_sha</td>
+ <td>TLS_ECDH_anon_WITH_AES_128_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ <tr>
+ <td>ecdh_anon_aes_256_sha</td>
+ <td>TLS_ECDH_anon_WITH_AES_256_CBC_SHA</td>
+- <td>TLSv1</td>
++ <td>TLSv1.0/TLSv1.1/TLSv1.2</td>
+ </tr>
+ </tbody>
+ </table>
+@@ -839,16 +839,36 @@ specifically but allows ciphers for that
+ Options are: 
+ <ul>
+ <li><code>SSLv3</code></li>
+- <li><code>TLSv1</code></li>
++ <li><code>TLSv1 (legacy only; replaced by TLSv1.0)</code></li>
++ <li><code>TLSv1.0</code></li>
++ <li><code>TLSv1.1</code></li>
++ <li><code>TLSv1.2</code></li>
+ <li><code>All</code></li>
+ </ul>
+ Note that this differs from mod_ssl in that you can't add or subtract
+ protocols. 
++ 
++If no NSSProtocol is specified, mod_nss will default to allowing the use of
++the SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2 protocols, where SSLv3 will be set to be the
++minimum protocol allowed, and TLSv1.2 will be set to be the maximum protocol
++allowed.
++ 
++If values for NSSProtocol are specified, mod_nss will set both the minimum
++and the maximum allowed protocols based upon these entries allowing for the
++inclusion of every protocol in-between. For example, if only SSLv3 and TLSv1.2
++are specified, SSLv3, TLSv1.0, TLSv1.1 and TLSv1.2 will all be allowed, as NSS utilizes
++protocol ranges to accept all protocols inclusively
++(TLS 1.2 -&gt;TLS 1.1 -&gt; TLS 1.0 -&gt; SSL 3.0), and does not allow exclusion of any protocols
++in the middle of a range (e. g. - TLS 1.0). 
++ 
++Finally, NSS will always automatically negotiate the use of the strongest
++possible protocol that has been specified which is acceptable to both sides of
++a given connection. 
+ <a href="#SSLv2">SSLv2</a> is not supported by default at this time. 
+ 
+ Example 
+ 
+-<code>NSSProtocol SSLv3,TLSv1</code> 
++<code>NSSProtocol SSLv3,TLSv1.0,TLSv1.1,TLSv1.2</code> 
+ 
+ <big><big>NSSNickname 
+ </big></big> 
+@@ -1101,7 +1121,7 @@ was compiled against. 
+ <tr>
+ <td style="vertical-align: top; width: 45%;"><code>SSL_PROTOCOL 
+ </code></td>
+- <td style="vertical-align: top;">SSLv2, SSLv3 or TLSv1 
++ <td style="vertical-align: top;">SSLv2, SSLv3, TLSv1.0, TLSv1.1, or TLSv1.2 
+ </td>
+ </tr>
+ <tr>
+@@ -1443,7 +1463,7 @@ Opera, and
+ Safari) support SSL 3 and TLS so there is no need for a web server to
+ support
+ SSL 2. There are some known attacks against SSL 2 that are handled by
+-SSL 3/TLS. SSL2 also doesn't support useful features like client
++SSL 3/TLS. SSLv2 also doesn't support useful features like client
+ authentication.
+ 
+ <h1><a name="FAQ"></a>Frequently Asked Questions</h1>
+Index: mod_nss-1.0.8/mod_nss.c
+===================================================================
+--- mod_nss-1.0.8.orig/mod_nss.c
++++ mod_nss-1.0.8/mod_nss.c
+@@ -90,7 +90,7 @@ static const command_rec nss_config_cmds
+ "(`[+-]XXX,...,[+-]XXX' - see manual)")
+ SSL_CMD_SRV(Protocol, RAW_ARGS,
+ "Enable the various SSL protocols"
+- "(`[SSLv2|SSLv3|TLSv1|all] ...' - see manual)")
++ "(`[SSLv2|SSLv3|TLSv1.0|TLSv1.1|TLSv1.2|all] ...' - see manual)")
+ SSL_CMD_ALL(VerifyClient, TAKE1,
+ "SSL Client Authentication "
+ "(`none', `optional', `require'")
+@@ -135,7 +135,7 @@ static const command_rec nss_config_cmds
+ "(`on', `off')")
+ SSL_CMD_SRV(ProxyProtocol, RAW_ARGS,
+ "SSL Proxy: enable or disable SSL protocol flavors "
+- "(`[+-][SSLv2|SSLv3|TLSv1] ...' - see manual)")
++ "(`[+-][SSLv2|SSLv3|TLSv1.0|TLSv1.1|TLSv1.2] ...' - see manual)")
+ SSL_CMD_SRV(ProxyCipherSuite, TAKE1,
+ "SSL Proxy: colon-delimited list of permitted SSL ciphers "
+ "(`XXX:...:XXX' - see manual)")
+Index: mod_nss-1.0.8/nss.conf.in
+===================================================================
+--- mod_nss-1.0.8.orig/nss.conf.in
++++ mod_nss-1.0.8/nss.conf.in
+@@ -111,7 +111,16 @@ NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4
+ # ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography
+ #NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha
+ 
+-NSSProtocol SSLv3,TLSv1
++# SSL Protocol:
++# Cryptographic protocols that provide communication security.
++# NSS handles the specified protocols as "ranges", and automatically
++# negotiates the use of the strongest protocol for a connection starting
++# with the maximum specified protocol and downgrading as necessary to the
++# minimum specified protocol that can be used between two processes.
++# Since all protocol ranges are completely inclusive, and no protocol in the
++# middle of a range may be excluded, the entry "NSSProtocol SSLv3,TLSv1.2"
++# is identical to the entry "NSSProtocol SSLv3,TLSv1.0,TLSv1.1,TLSv1.2".
++NSSProtocol SSLv3,TLSv1.0,TLSv1.1,TLSv1.2
+ 
+ # SSL Certificate Nickname:
+ # The nickname of the RSA server certificate you are going to use.
+Index: mod_nss-1.0.8/nss_engine_init.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_init.c
++++ mod_nss-1.0.8/nss_engine_init.c
+@@ -610,62 +610,103 @@ static void nss_init_ctx_protocol(server
+ apr_pool_t *ptemp,
+ modnss_ctx_t *mctx)
+ {
+- int ssl2, ssl3, tls;
++ int ssl2, ssl3, tls, tls1_1, tls1_2;
++ char *protocol_marker = NULL;
+ char *lprotocols = NULL;
+ SECStatus stat;
++ SSLVersionRange enabledVersions;
+ 
+- ssl2 = ssl3 = tls = 0;
++ ssl2 = ssl3 = tls = tls1_1 = tls1_2 = 0;
++
++ /*
++ * Since this routine will be invoked individually for every thread
++ * associated with each 'server' object as well as for every thread
++ * associated with each 'proxy' object, identify the protocol marker
++ * ('NSSProtocol' for 'server' versus 'NSSProxyProtocol' for 'proxy')
++ * via each thread's object type and apply this useful information to
++ * all log messages.
++ */
++ if (mctx == mctx->sc->server) {
++ protocol_marker = "NSSProtocol";
++ } else if (mctx == mctx->sc->proxy) {
++ protocol_marker = "NSSProxyProtocol";
++ }
+ 
+ if (mctx->sc->fips) {
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+- "In FIPS mode, enabling TLSv1");
+- tls = 1;
++ "In FIPS mode ignoring %s list, enabling TLSv1.0, TLSv1.1 and TLSv1.2",
++ protocol_marker);
++ tls = tls1_1 = tls1_2 = 1;
+ } else {
+ if (mctx->auth.protocols == NULL) {
+- /*
+- * Since this routine will be invoked individually for every
+- * thread associated with each 'server' object as well as for
+- * every thread associated with each 'proxy' object, issue a
+- * single per-thread 'warning' message for either a 'server'
+- * or a 'proxy' based upon the thread's object type.
+- */
+- if (mctx == mctx->sc->server) {
+- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
+- "NSSProtocol value not set; using: SSLv3 and TLSv1");
+- } else if (mctx == mctx->sc->proxy) {
+- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
+- "NSSProxyProtocol value not set; using: SSLv3 and TLSv1");
+- }
++ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
++ "%s value not set; using: SSLv3, TLSv1.0, TLSv1.1 and TLSv1.2",
++ protocol_marker);
+ 
+- ssl3 = tls = 1;
++ ssl3 = tls = tls1_1 = tls1_2 = 1;
+ } else {
+ lprotocols = strdup(mctx->auth.protocols);
+ ap_str_tolower(lprotocols);
+ 
+ if (strstr(lprotocols, "all") != NULL) {
+ #ifdef WANT_SSL2
+- ssl2 = ssl3 = tls = 1;
++ ssl2 = ssl3 = tls = tls1_1= tls1_2 = 1;
+ #else
+- ssl3 = tls = 1;
++ ssl3 = tls = tls1_1 = tls1_2 = 1;
+ #endif
+ } else {
+- if (strstr(lprotocols, "sslv2") != NULL) {
++ char *protocol_list = NULL;
++ char *saveptr = NULL;
++ char *token = NULL;
++
++ for (protocol_list = lprotocols; ; protocol_list = NULL) {
++ token = strtok_r(protocol_list, ",", &saveptr);
++ if (token == NULL) {
++ break;
++ } else if (strcmp(token, "sslv2") == 0) {
+ #ifdef WANT_SSL2
+- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "Enabling SSL2");
+- ssl2 = 1;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling SSL2",
++ protocol_marker);
++ ssl2 = 1;
+ #else
+- ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, "SSL2 is not supported");
++ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
++ "%s: SSL2 is not supported",
++ protocol_marker);
+ #endif
+- }
+-
+- if (strstr(lprotocols, "sslv3") != NULL) {
+- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "Enabling SSL3");
+- ssl3 = 1;
+- }
+-
+- if (strstr(lprotocols, "tlsv1") != NULL) {
+- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, "Enabling TLS");
+- tls = 1;
++ } else if (strcmp(token, "sslv3") == 0) {
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling SSL3",
++ protocol_marker);
++ ssl3 = 1;
++ } else if (strcmp(token, "tlsv1") == 0) {
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling TLSv1.0 via TLSv1",
++ protocol_marker);
++ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
++ "%s: The 'TLSv1' protocol name has been deprecated; please change 'TLSv1' to 'TLSv1.0'.",
++ protocol_marker);
++ tls = 1;
++ } else if (strcmp(token, "tlsv1.0") == 0) {
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling TLSv1.0",
++ protocol_marker);
++ tls = 1;
++ } else if (strcmp(token, "tlsv1.1") == 0) {
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling TLSv1.1",
++ protocol_marker);
++ tls1_1 = 1;
++ } else if (strcmp(token, "tlsv1.2") == 0) {
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: Enabling TLSv1.2",
++ protocol_marker);
++ tls1_2 = 1;
++ } else {
++ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
++ "%s: Unknown protocol '%s' not supported",
++ protocol_marker, token);
++ }
+ }
+ }
+ free(lprotocols);
+@@ -680,31 +721,110 @@ static void nss_init_ctx_protocol(server
+ stat = SSL_OptionSet(mctx->model, SSL_ENABLE_SSL2, PR_FALSE);
+ }
+ 
++ /* Set protocol version ranges:
++ *
++ * (1) Set the minimum protocol accepted
++ * (2) Set the maximum protocol accepted
++ * (3) Protocol ranges extend from maximum down to minimum protocol
++ * (4) All protocol ranges are completely inclusive;
++ * no protocol in the middle of a range may be excluded
++ * (5) NSS automatically negotiates the use of the strongest protocol
++ * for a connection starting with the maximum specified protocol
++ * and downgrading as necessary to the minimum specified protocol
++ *
++ * For example, if SSL 3.0 is chosen as the minimum protocol, and
++ * TLS 1.1 is chosen as the maximum protocol, SSL 3.0, TLS 1.0, and
++ * TLS 1.1 will all be accepted as protocols, as TLS 1.0 will not and
++ * cannot be excluded from this range. NSS will automatically negotiate
++ * to utilize the strongest acceptable protocol for a connection starting
++ * with the maximum specified protocol and downgrading as necessary to the
++ * minimum specified protocol (TLS 1.1 -> TLS 1.0 -> SSL 3.0).
++ */
+ if (stat == SECSuccess) {
++ /* Set minimum protocol version (lowest -> highest)
++ *
++ * SSL 3.0 -> TLS 1.0 -> TLS 1.1
++ */
+ if (ssl3 == 1) {
+- stat = SSL_OptionSet(mctx->model, SSL_ENABLE_SSL3, PR_TRUE);
++ enabledVersions.min = SSL_LIBRARY_VERSION_3_0;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [SSL 3.0] (minimum)",
++ protocol_marker);
++ } else if (tls == 1) {
++ enabledVersions.min = SSL_LIBRARY_VERSION_TLS_1_0;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.0] (minimum)",
++ protocol_marker);
++ } else if (tls1_1 == 1) {
++ enabledVersions.min = SSL_LIBRARY_VERSION_TLS_1_1;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.1] (minimum)",
++ protocol_marker);
++ } else if (tls1_2 == 1) {
++ enabledVersions.min = SSL_LIBRARY_VERSION_TLS_1_2;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.2] (minimum)",
++ protocol_marker);
+ } else {
+- stat = SSL_OptionSet(mctx->model, SSL_ENABLE_SSL3, PR_FALSE);
++ /* Set default minimum protocol version to SSL 3.0 */
++ enabledVersions.min = SSL_LIBRARY_VERSION_3_0;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [SSL 3.0] (default minimum)",
++ protocol_marker);
+ }
+- }
+- if (stat == SECSuccess) {
+- if (tls == 1) {
+- stat = SSL_OptionSet(mctx->model, SSL_ENABLE_TLS, PR_TRUE);
++
++ /* Set maximum protocol version (highest -> lowest)
++ *
++ * TLS 1.2 -> TLS 1.1 -> TLS 1.0 -> SSL 3.0
++ */
++ if (tls1_2 == 1) {
++ enabledVersions.max = SSL_LIBRARY_VERSION_TLS_1_2;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.2] (maximum)",
++ protocol_marker);
++ } else if (tls1_1 == 1) {
++ enabledVersions.max = SSL_LIBRARY_VERSION_TLS_1_1;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.1] (maximum)",
++ protocol_marker);
++ } else if (tls == 1) {
++ enabledVersions.max = SSL_LIBRARY_VERSION_TLS_1_0;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.0] (maximum)",
++ protocol_marker);
++ } else if (ssl3 == 1) {
++ enabledVersions.max = SSL_LIBRARY_VERSION_3_0;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [SSL 3.0] (maximum)",
++ protocol_marker);
+ } else {
+- stat = SSL_OptionSet(mctx->model, SSL_ENABLE_TLS, PR_FALSE);
++ /* Set default maximum protocol version to TLS 1.2 */
++ enabledVersions.max = SSL_LIBRARY_VERSION_TLS_1_2;
++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++ "%s: [TLS 1.2] (default maximum)",
++ protocol_marker);
+ }
++
++ stat = SSL_VersionRangeSet(mctx->model, &enabledVersions);
+ }
+ 
+ if (stat != SECSuccess) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+- "SSL protocol initialization failed.");
++ "%s: SSL/TLS protocol initialization failed.",
++ protocol_marker);
+ nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
+ nss_die();
+ }
+ 
+ mctx->ssl2 = ssl2;
+ mctx->ssl3 = ssl3;
+- mctx->tls = tls;
++ if (tls1_2 == 1) {
++ mctx->tls = tls1_2;
++ } else if (tls1_1 == 1) {
++ mctx->tls = tls1_1;
++ } else {
++ mctx->tls = tls;
++ }
+ }
+ 
+ static void nss_init_ctx_session_cache(server_rec *s,
+@@ -785,6 +905,8 @@ static void nss_init_ctx_cipher_suite(se
+ PRBool cipher_state[ciphernum];
+ PRBool fips_state[ciphernum];
+ const char *suite = mctx->auth.cipher_suite; 
++ char * object_type = NULL;
++ char * cipher_suite_marker = NULL;
+ char * ciphers;
+ char * fipsciphers = NULL;
+ int i;
+@@ -814,6 +936,23 @@ static void nss_init_ctx_cipher_suite(se
+ 
+ nss_die();
+ }
++
++ /*
++ * Since this routine will be invoked individually for every thread
++ * associated with each 'server' object as well as for every thread
++ * associated with each 'proxy' object, identify the cipher suite markers
++ * ('NSSCipherSuite' for 'server' versus 'NSSProxyCipherSuite' for 'proxy')
++ * via each thread's object type and apply this useful information to
++ * all log messages.
++ */
++ if (mctx == mctx->sc->server) {
++ object_type = "server";
++ cipher_suite_marker = "NSSCipherSuite";
++ } else if (mctx == mctx->sc->proxy) {
++ object_type = "proxy";
++ cipher_suite_marker = "NSSProxyCipherSuite";
++ }
++
+ ciphers = strdup(suite);
+ 
+ #define CIPHERSIZE 2048
+@@ -848,13 +987,13 @@ static void nss_init_ctx_cipher_suite(se
+ }
+ 
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+- "FIPS mode enabled, permitted SSL ciphers are: [%s]",
+- fipsciphers);
++ "FIPS mode enabled on this %s, permitted SSL ciphers are: [%s]",
++ object_type, fipsciphers);
+ }
+ 
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+- "Configuring permitted SSL ciphers [%s]",
+- suite);
++ "%s: Configuring permitted SSL ciphers [%s]",
++ cipher_suite_marker, suite);
+ 
+ /* Disable all NSS supported cipher suites. This is to prevent any new
+ * NSS cipher suites from getting automatically and unintentionally
+@@ -893,7 +1032,7 @@ static void nss_init_ctx_cipher_suite(se
+ for (i=0; i<ciphernum; i++) {
+ if (cipher_state[i] == PR_TRUE && fips_state[i] == PR_FALSE) {
+ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
+- "Cipher %s is enabled but this is not a FIPS cipher, disabling.", ciphers_def[i].name);
++ "Cipher %s is enabled for this %s, but this is not a FIPS cipher, disabling.", ciphers_def[i].name, object_type);
+ cipher_state[i] = PR_FALSE;
+ }
+ }
+@@ -902,19 +1041,22 @@ static void nss_init_ctx_cipher_suite(se
+ /* See if any ciphers have been enabled for a given protocol */
+ if (mctx->ssl2 && countciphers(cipher_state, SSL2) == 0) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+- "SSL2 is enabled but no SSL2 ciphers are enabled.");
++ "%s: SSL2 is enabled but no SSL2 ciphers are enabled.",
++ cipher_suite_marker);
+ nss_die();
+ }
+ 
+ if (mctx->ssl3 && countciphers(cipher_state, SSL3) == 0) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+- "SSL3 is enabled but no SSL3 ciphers are enabled.");
++ "%s: SSL3 is enabled but no SSL3 ciphers are enabled.",
++ cipher_suite_marker);
+ nss_die();
+ }
+ 
+ if (mctx->tls && countciphers(cipher_state, TLS) == 0) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+- "TLS is enabled but no TLS ciphers are enabled.");
++ "%s: TLS is enabled but no TLS ciphers are enabled.",
++ cipher_suite_marker);
+ nss_die();
+ }
+ 
+Index: mod_nss-1.0.8/nss_engine_vars.c
+===================================================================
+--- mod_nss-1.0.8.orig/nss_engine_vars.c
++++ mod_nss-1.0.8/nss_engine_vars.c
+@@ -722,9 +722,13 @@ static char *nss_var_lookup_protocol_ver
+ case SSL_LIBRARY_VERSION_3_0:
+ result = "SSLv3";
+ break;
+- case SSL_LIBRARY_VERSION_3_1_TLS:
++ case SSL_LIBRARY_VERSION_TLS_1_0:
++ /* 'TLSv1' has been deprecated; specify 'TLSv1.0' */
+ result = "TLSv1";
+ break;
++ case SSL_LIBRARY_VERSION_TLS_1_1:
++ result = "TLSv1.1";
++ break;
+ }
+ }
+ }

mod_nss-wouldblock.patch Added

debian.changelog Added

debian.control Added

debian.rules Added

@@ -0,0 +1,90 @@
+#!/usr/bin/make -f
+
+include /usr/share/quilt/quilt.make  
+
+# These are used for cross-compiling and for saving the configure script
+# from having to guess our platform (since we know it already)
+DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_BUILD_ARCH  ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+UPSTREAM_VERSION := $(shell dpkg-parsechangelog | sed -n 's/^Version: *$.*$-.*$$/\1/ p' | sed -e 's/~.*//')
+MOD_MAJOR_VERSION := $(word 1, $(subst ., ,$(UPSTREAM_VERSION)))
+MOD_MINOR_VERSION := $(word 2, $(subst ., ,$(UPSTREAM_VERSION)))
+MOD_PATCH_VERSION := $(word 3, $(subst ., ,$(UPSTREAM_VERSION)))
+
+CFLAGS := -Wall -pipe
+
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -O0
+else
+	CFLAGS += -O2 -fno-strict-aliasing
+endif
+
+CFLAGS += -g
+CONFIGURE_SWITCHES := --prefix=/usr \
+			--exec-prefix=/usr \
+			--sysconfdir=/usr \
+			--mandir=/usr/share/man \
+			--with-apxs=/usr/bin/apxs2 \
+			--enable-ecc
+
+
+configure: configure-stamp
+configure-stamp: $(QUILT_STAMPFN)
+ifneq "$(wildcard /usr/share/misc/config.sub)" "" 
+	cp -f /usr/share/misc/config.sub config.sub 
+endif 
+ifneq "$(wildcard /usr/share/misc/config.guess)" "" 
+	cp -f /usr/share/misc/config.guess config.guess 
+endif 
+
+	autoreconf -i -f
+	dh_testdir
+	./configure $(CONFIGURE_SWITCHES)
+	touch $@
+
+build: build-stamp
+build-stamp: configure-stamp
+	dh_testdir
+	$(MAKE)
+	touch $@
+
+clean: clean-patched unpatch
+clean-patched:
+	dh_testdir
+	dh_testroot
+	[ ! -f Makefile ] || $(MAKE) distclean
+	rm -f build-stamp configure-stamp install-stamp config.log
+	dh_clean
+
+install: build install-stamp
+install-stamp:
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+	# FIXME: brrrr
+	mv $(CURDIR)/.libs/libmodnss.so $(CURDIR)/.libs/mod_nss.so
+	touch install-stamp
+
+binary-indep: build install 
+binary-arch: build install
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -a
+	dh_installdocs -a
+	dh_install
+	dh_link -a
+	dh_strip
+	dh_compress -a
+	dh_fixperms -a
+	dh_installdeb -a
+	dh_shlibdeps -a -L libapache2-mod-nss -l debian/libapache2-mod-nss/usr/lib/apache2/modules
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-arch
+
+.PHONY: clean install build binary-indep binary-arch binary

debian.tar.gz Added

libapache2-mod-nss.dsc Added

mod_nss-1.0.8.tar.gz Added

mod_nss-pcachesignal.h Added

Build Results
RPM Lint

Refresh

Mentioned Issues (1)

boo#799483	ajaissle	Closed
server:Kolab:UNSTABLE: Bug

Comments for request 27 0

Request History

vanmeeuwen created request about 11 years ago

Add to Kolab:Development

vanmeeuwen accepted request about 11 years ago