Jim, today I converted your commit to a path on 2.4.12 and tested it with mod_h2. All fine!
Then I got a trouble report that alpn negotiation always selected "http/1.1"
unless SSLAlpnPreference configured something else. This is due to the
deterministic ordering and "http/1.1." > "h2". So, I made a slight
modification, attached below.
Cheers,
Stefan
--- modules/ssl/ssl_engine_kernel.c 2015-04-01 15:23:48.000000000 +0200
+++ ../../mod-h2/sandbox/httpd/gen/httpd-2.4.12/modules/ssl/ssl_engine_kernel.c
2015-04-01 17:53:03.000000000 +0200
@@ -2177,7 +2152,7 @@
}
/*
- * Compare to ALPN protocol proposal. Result is similar to strcmp():
+ * Compare two ALPN protocol proposal. Result is similar to strcmp():
* 0 gives same precedence, >0 means proto1 is prefered.
*/
static int ssl_cmp_alpn_protos(modssl_ctx_t *ctx,
@@ -2254,14 +2229,8 @@
i += plen;
}
- /* Regardless of installed hooks, the http/1.1 protocol is always
- * supported by us. Add it to the proposals if the client also
- * offers it. */
proposed_protos = apr_array_make(c->pool, client_protos->nelts+1,
sizeof(char *));
- if (ssl_array_index(client_protos, alpn_http1) >= 0) {
- APR_ARRAY_PUSH(proposed_protos, const char*) = alpn_http1;
- }
if (sslconn->alpn_proposefns != NULL) {
/* Invoke our alpn_propos_proto hooks, giving other modules a chance to
@@ -2280,9 +2249,16 @@
}
if (proposed_protos->nelts <= 0) {
- ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02839)
- "none of the client alpn protocols are supported");
- return SSL_TLSEXT_ERR_ALERT_FATAL;
+ /* Regardless of installed hooks, the http/1.1 protocol is always
+ * supported by us. Choose it if none other matches. */
+ if (ssl_array_index(client_protos, alpn_http1) < 0) {
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02839)
+ "none of the client alpn protocols are supported");
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
+ }
+ *out = (const unsigned char*)alpn_http1;
+ *outlen = (unsigned char)strlen(alpn_http1);
+ return SSL_TLSEXT_ERR_OK;
}
/* Now select the most preferred protocol from the proposals. */
httpd-trunk2.unified.diff.patch
Description: Binary data
> Am 31.03.2015 um 21:12 schrieb Jim Jagielski <j...@jagunet.com>: > > Hmmm.. missed a patch. > > r1670434 >> On Mar 31, 2015, at 2:28 PM, Jim Jagielski <j...@jagunet.com> wrote: >> >> Hmmm... let me double check. >> >>> On Mar 31, 2015, at 2:22 PM, Ruediger Pluem <rpl...@apache.org> wrote: >>> >>> >>> >>> On 03/31/2015 08:08 PM, Jim Jagielski wrote: >>>> They are used by mod_spdy and/or mod_h2..., iirc >>> >>> They use private structures of mod_ssl directly? That does not sound like a >>> good idea. >>> >>> Regards >>> >>> Rüdiger >>> >>>> >>>>> On Mar 31, 2015, at 1:57 PM, Ruediger Pluem <rpl...@apache.org> wrote: >>>>> >>>>> >>>>> >>>>> On 03/31/2015 07:12 PM, j...@apache.org wrote: >>>>>> Author: jim >>>>>> Date: Tue Mar 31 17:12:51 2015 >>>>>> New Revision: 1670397 >>>>>> >>>>>> URL: http://svn.apache.org/r1670397 >>>>>> Log: >>>>>> ALPN support, based on mod_spdy/mod_h2 patch set >>>>>> >>>>>> Modified: >>>>>> httpd/httpd/trunk/modules/ssl/mod_ssl.c >>>>>> httpd/httpd/trunk/modules/ssl/mod_ssl.h >>>>>> httpd/httpd/trunk/modules/ssl/ssl_engine_config.c >>>>>> httpd/httpd/trunk/modules/ssl/ssl_engine_io.c >>>>>> httpd/httpd/trunk/modules/ssl/ssl_private.h >>>>> >>>>> >>>>> I don't know if I miss the obvious, but where do we use >>>>> >>>>> ssl_alpn_pref >>>>> alpn_proposefns >>>>> >>>>> ? >>>>> >>>>> I can only see that we set it, but I fail to see where it is used. >>>>> >>>>> Regards >>>>> >>>>> Rüdiger >>>> >>>> >> > <green/>bytes GmbH Hafenweg 16, 48155 Münster, Germany Phone: +49 251 2807760. Amtsgericht Münster: HRB5782
