changes

apach加密模块

      format.

   *) Removed more source code relicts of SSLeay by replacing
      them with the official OpenSSL variants.

   *) Added ap_{mm,MM}* function list to src/support/httpd.exp

   *) Update ap_mm.{c,h} for MM 1.0.3, i.e. add stubs for new
      ap_{MM,mm,mm_core}_permission() function.

   *) Replaced all references to EAY's old email address with the new one.

   *) Fixed source tree creation: ap_mm.[ch] wasn't installed.
  
   *) Removed -l option from yacc call in src/modules/ssl/Makefile.tmpl and
      touch the pre-generated scanner/parser files so the generation isn't
      done for end users.

   *) Give more reasonable error message on pass phrase dialog by
      distinguishing between "Pass phrase incorrect" and "Private key not
      found" situations.

   *) Fixed configure and configure.bat scripts: ssl.crl wasn't created
      and server.csr wasn't installed under Win32.

   *) Added a new ``SSLOptions +StrictRequire'' This _forces_ forbidden
      access when SSLRequireSSL or SSLRequire successfully decided that access
      should be forbidden. Usually the default is that at least a used
      ``Satisfy any'' can cancel such access denies (when other access
      restrictions were passed), because that's how the Apache Satisfy
      mechanism should work.  But for strict access restriction you can use
      SSLRequireSSL and/or SSLRequire in combination with an ``SSLOptions
      +StrictRequire''. Then an additional ``Satisfy Any'' has no chance once
      mod_ssl has decided to deny access.

   *) Removed all direct Apache-SSL related comparsions from the mod_ssl FAQ
      chapter of the user manual to finally avoid any more blames by Ben
      Laurie.
   
   *) Upgraded to the forthcoming OpenSSL 0.9.3 API. Because of too much API
      changes (constifications, STACK_OF, etc.) we cannot provide support for
      older versions any longer without making the mod_ssl source code ugly.
      OTOH for mkcert.sh we already want >= 0.9.3, so drop support for all
      older versions now.

   *) Switched all addresses and references to new modssl.org domain.

   *) Updated the User Manual for version 2.3

   *) Various stylistic source code cleanups.

   *) EBCDIC-related fix for variable lookup functions.

   *) Added generic Shared Memory support to Extended API (EAPI) via the new
      MM library (available externally).  First two new ap_mm.c/ap_mm.h source
      files provide new functions ap_mm_xxx() which are either stubs (when no
      shared memory support is available via the MM library) or call the
      mm_xxx() counterparts of the MM library.  Second, shared memory pools
      are patched into alloc.c/alloc.h which uses the ap_mm_xxx() functions in
      the background.

   *) Added support for X.509 CA Certificate Revocation Lists (CRL).  For this
      the two new directives SSLCARevocationPath and SSLCARevocationFile
      (similar to SSLCACertificate{Path,File}) are provided where one can
      store CRL files.  The preconfigured default directory for CRLs is
      PREFIX/conf/ssl.crl. The SSLCARevocationPath is a directory where the
      CRLs are looked up via hash symlinks. For this a ssl.crl/Makefile is
      provided similar to ssl.crt/Makefile.

   *) Kicked out all remaining SSLeay references and dependencies.  The
      minimum SSL library version which is now required is OpenSSL 0.9.2b.

      ____    ____  
     |___ \  |___ \ 
       __) |   __) |
      / __/ _ / __/ 
  __ |_____(_)_____| _________________________________________
               
  Changes with mod_ssl 2.2.8 (29-Mar-1999 to 12-Apr-1999)
   
   *) Use SSL_smart_shutdown() also for SSL proxy stuff.

   *) Fixed some compat variable mappings and updated ssl_compat.wml
      document to reflect the current compat state.

   *) Added ssl_log_applies() function in advance for forthcoming feature
      commits.

   *) Added NEWS file to distribution which summarizes the major changes and
      this way gives a faster overview for the impatient users.

   *) Added a new pkg.contrib/cca.sh script which I used for client auth
      testing with the latest OpenSSL versions.  Additionally adjust old
      mca.sh script for OpenSSL.
   
   *) Added the missing ssl_template.inc file to the distribution

   *) Various source code cleanups to make forthcoming patches more clean.

  Changes with mod_ssl 2.2.7 (24-Mar-1999 to 29-Mar-1999)

   *) Fixed the ``HTTPS request received for child'' log entries: Now no
      longer multiple copies of a message occur, because mod_ssl logs them
      only on initial requests (and no longer on sub-requests and internal
      redirects).

   *) Fixed a few more memory leaks which occured on server restarts.

   *) Added entry to the FAQ for the MSIE work-around with
      ``SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown''.

   *) Added support for two SetEnvIf variables: ssl-unclean-shutdown and
      ssl-accurate-shutdown. These can be used to for instance force different
      shutdown approaches for particular browsers. An ``SetEnvIf User-Agent
      ".*MSIE.*" ssl-unclean-shutdown'' now forces the old mod_ssl 2.1
      behaviour where no close notify messages are sent at all before
      connection close. An ``SetEnvIf User-Agent ".*Lynx.*"
      ssl-accurate-shutdown'' forces an accurate shutdown when the client is
      Lynx+OpenSSL where mod_ssl both sends it's close notify alert and waits
      for the close notify alert of the client.

   *) Updated source file dependecies in src/modules/ssl/Makefile.tmpl.

  Changes with mod_ssl 2.2.6 (18-Mar-1999 to 24-Mar-1999)

   *) Now mod_ssl logs the current Apache, mod_ssl and OpenSSL versions at
      startup which makes it easier to distinguish which software combination
      is actually running by just looking into the log.

   *) Added support for new 56/1024 bit export ciphersuites (idea overtaken
      from Apache-SSL 1.32) and sign-only-certificate situations where
      stronger (1024 instead of 512 bit) temporary keys are reasonable to use.

   *) Upgrade to new upstream version Apache 1.3.6 on vendor branch.
      [Version 1.3.5 was not released because of last minute problems]

   *) *** SECURITY *** SECURITY *** SECURITY ***
      In the OpenSSL project we discovered that a terrible security hole
      exists for _all_ SSLeay/OpenSSL server applications that use virtual
      hosting. Here sessions could be resumed in the wrong context thus
      bypassing client certificate protection! This hole is now fixed in
      OpenSSL 0.9.2b by an ad-hoc solution were SSL sessions cannot be resumed
      unless the server application tags it with a unique context id per
      virtual host. mod_ssl now also performs this tagging to prevent this
      exploit.

   *) Added the nifty EAPI-based mod_define module to the source tree.  This
      modules provides variable definitions for arbitrary directive lines,
      i.e.  you can expand ${xxx} on any(!) directive line. This module is
      disabled per default in src/Configuration.tmpl (need an
      --enable-module=define) and it lives in the new pkg.addon area.

   *) Added Stronghold's table look and feel to mod_status' display page.
      This patch is harmless and enabled per default and lives in the new
      pkg.addon area.

   *) Opened another distribution package subdir: pkg.addon/.
      Here addons will be stored which are not directly/physically related to
      mod_ssl and EAPI, but indirectly.

   *) Cleaned up the generation of the signature table in ap_hook.c
      and updated the hook list with the still missing vendor hooks.

   *) Renamed recently added vendor hooks to from ssl::vendor::xxx to
      ap::mod_ssl::vendor::xxx to be consistent with remaining EAPI hook
      names.

   *) Upgrade to new upstream version Apache 1.3.5 on vendor branch

   *) Fixed a segfault in the HTTPS support for mod_proxy which
      occured when the proxy couldn't connect to the remote host.

   *) Be 100% conservative and clean and use SSL_clean() after SSL_new().

  Changes with mod_ssl 2.2.5 (04-Mar-1999 to 18-Mar-1999)

   *) Fixed the situation were we discovered processes consuming
      100% CPU time. This occured under various not exactly known
      circumstances, but it seems it was always when the client plays bad with
      the socket connection and OpenSSL cannot recognize it. Then the state
      machine of SSL_shutdown() seems to loop endless. It's now fixed by not
      limiting the iterations.

   *) Fixed a typo in the SSL_CERTIFICATE_FILE define, although this
      variable is still not used.

   *) Fixed the POST-problem where kept-alive HTTPS connections hang or
      resulted in an I/O error inside the browser because the ``SSL close
      notify'' alert couldn't be sent correctly because of Apache's internal
      ``lingering close'' handling. EAPI was changed to now correctly call the
      close_connection module hook also on timeout and linger closes. This
      EAPI change means you cannot upgrade your libssl.so with --with-apxs to
      this version. A complete Apache rebuild with the updated EAPI code is
      necessary.

   *) The SSLCertificateFile and SSLCertificateKeyFile directives now can read
      PEM (=DER+Base64+headers), DER+Base64 (without headers) and plain DER
      format certificate and private key files. This is mostly provided for
      convinience reasons.

   *) Add FAQ entry: How to convert PEM into DER.
  
  Changes with mod_ssl 2.2.4 (21-Feb-1999 to 04-Mar-1999)

   *) Add important note to INSTALL/INSTALL.Win32 that all
      documentation references already use the term OpenSSL, the file and
      program names `openssl', etc. although most of the users are still using
      SSLeay and don't have any `openssl' command, etc.

   *) Fixed two export warnings for ssl_expr_parse.c under Win32.

   *) In correspondence with the SSLeay to OpenSSL transition
      we changed the --with-ssleay=DIR option to --with-ssl=DIR (but the old
      variant is still recognized for backward compatibility, of course).  For
      consistency we also renamed --with-rsaref=DIR to --with-rsa=DIR.

   *) Ported src/support/ca-fix tool to OpenSSL 0.9.2, although after final
      switching to OpenSSL 0.9.2 as the minimum required toolkit version we
      will no longer need this tool.  But until then let us be friendly and
      support the OpenSSL snapshots ;-)

   *) Added the first cut of Vendor extension support.  This stuff is
      currently _NOT_ compiled in per default. It has to be enabled with the
      new APACI --enable-rule=SSL_VENDOR option. The idea is this: the mod_ssl
      sources contain EAPI vendor hooks (`ssl::vendor::xxxx') and internal
      EAPI context variables which can be used to change or extend mod_ssl by
      a vendor without patching the source code. Grep for `ssl::vendor::'
      inside src/modules/ssl/ for more details.  Additionally vendors can now
      add their own source code as files named ssl_vendor.c, ssl_vendor_XXX.c,
      etc.  The libssl.module script automatically picks these up under
      configuration time and mod_ssl under run-time calls the functions `void
      ssl_vendor_register(void)' and `void ssl_vendor_unregister(void)' inside
      these objects to bootstrap them.  Read the src/modules/ssl/README file
      for more details.

   *) Fixed two old Stronghold directive compatibility mappings, added missing
      Stronghold directive mappings and added a bunch of additional Stronghold
      variable mappings.

   *) Big and official switch from the name `Apache Interface to SSLeay' to
      `Apache Interface to OpenSSL', from any SSLeay-references to
      OpenSSL-references, etc. There is still support for SSLeay, of course.
      But this renaming cleanup has to be done, because in the near future
      support for SSLeay has to be completely dropped due to non-optional
      support for new features like DSA/DH, etc (which is only possible with
      OpenSSL).

   *) Made the error messages of `configure' even more idiot-proof :-(

   *) Fixed the connection closing phase: First, mod_ssl no longer hooks into
      this phase by using ap_register_cleanup() (with the connection pool)
      because the cleanup functions are called by Apache's API a lot too late
      (actually _after_ the socket was already closed!).  Instead a new EAPI
      hook `close_connection' was added to register a hook which is run
      directly _before_ the socket is closed.  Second, the SSL ``Close
      Notify'' alert is now always sent (even when older IE browsers display
      the message in the window), because not sending the alert is a violation
      of the SSL/TLS standard.
      !! ATTENTION: THIS HAD TO CHANGE EAPI, SO YOU HAVE TO RECOMPILE APACHE !!

   *) Enhance the output of alert messages under `SSLLogLevel trace'.
   
   *) Make mod_ssl aware of the forthcoming OpenSSL 0.9.2 version
      where some callback function signatures will be changed 
      and a few new TLSv1 export ciphers are added.

   *) Fixed restarts which were broken due to recent changes to the cert/key
      handling (DER/internal conversions). Now mod_ssl again surives server
      restarts without problems.

   *) Replaced `%0 %*' with `%0 %1 %2 %3 %4 %5 %6 %7 %8 %9' in configure.bat
      because Windows 98 is even more braindead than anyone can image.

   *) Added AP_HOOK_DECLTMP return code semantic to EAPI's hook mechanism
      which is needed in the forthcoming vendor hooks to avoid local temporary
      variables.

   *) Fixed the `SSLLogLevel debug' output where confusing `Ops, no memory