Bug 101514

Summary:	mod_ssl from apache is compiled with SSL_CONSERVATIVE (bad)
Product:	[Retired] Red Hat Linux	Reporter:	mattb
Component:	mod_ssl	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9	CC:	mitr
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2003-10-09 08:16:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description mattb 2003-08-02 05:09:28 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030630

Description of problem:
mod_ssl from httpd is compiled with -DSSL_CONSERVATIVE which yields erroneous
behavior when attempting to negotiate an SSL connection with a client presenting
a certificate during a POST operation:

http://www.mail-archive.com/modssl-users@modssl.org/msg16177.html
http://www.mail-archive.com/modssl-users@modssl.org/msg15667.html

Having SSLVerifyClient work with POSTs is absolutely essential in using Apache's
httpd as a commercial Web Services provider, since HTTP POSTs are the
transportation of choice for protocols like SOAP and REST, and client
certificate authentication is necessary for securing those transactions.

The results of compiling with SSL_CONSERVATIVE have far-reaching negative
effects into SSL POST operations in PHP, FastCGI servers, and just about
everything else you can think of.

Version-Release number of selected component (if applicable):
httpd-2.0.40-21.3

How reproducible:
Always

Steps to Reproduce:
You can see that the operations have been left out of RedHat's version of httpd
by doing the following:

# This should print out at least one function name
strings /etc/httpd/modules/mod_ssl.so | grep suck

Actual Results:  As it now stands, the appropriate functions are missing from
the binary version of httpd, and a POST using SSL will fail if SSLVerifyClient
is anything other than "none", resulting in a message in
/etc/httpd/logs/ssl_error_log:

"SSL Re-negotiation in conjunction with POST method not supported!!hint: t
ry SSLOptions +OptRenegotiate"

Expected Results:  If SSL_CONSERVATIVE was not given as a compile flag to
mod_ssl, then an SSL POST with SSLVerifyClient set to "optional_no_ca" should
work just as it would with SSLVerifyClient set to "none".

Additional info:

Comment 1 mattb 2003-08-02 05:52:17 UTC

Okay, this is actually not a bug for RedHat. SSL_CONSERVATIVE has been removed
and its functionality has become part of the standard Apache 2.0 web server. The
problem is the functions which fix this behavior have not been rewritten to take
advantage of the Apache 2 API.

I'm not sure what the appropriate resolved state is, so I'll leave that to
someone who knows better, but this is not a RedHat build issue.

Comment 2 Joe Orton 2003-10-09 08:16:44 UTC

This is being tracked upstream as:

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=18395

Thanks for the report.