canl_mod_ssl-private.h
Go to the documentation of this file.
/*
Copyright (c) 2003-8, Andrew McNab, University of Manchester
All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, are permitted provided that the following
conditions are met:
o Redistributions of source code must retain the above
copyright notice, this list of conditions and the following
disclaimer.
o Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
*/
/*
Portions of this code are derived from Apache mod_ssl, and are covered
by the Apache Software License:
* Copyright 2001-2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
This work has been partially funded by the EU Commission (contract
INFSO-RI-222667) under the EGEE-III collaboration.
*/
/*------------------------------------------------------------------*
* This program is part of GridSite: http://www.gridsite.org/ *
*------------------------------------------------------------------*/
/*
* After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
* in ssl_private.h, which is not installed along with httpd-devel (eg in
* the FC2 RPM.) This include file provides SIMPLIFIED structures for use
* by mod_gridsite: for example, pointers to unused structures are replaced
* by void * and some of the structures are truncated when only the early
* members are used.
*
* CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
*/
#include <openssl/ssl.h>
#ifndef BOOL
#define BOOL unsigned int
#endif
typedef enum {
SSL_SHUTDOWN_TYPE_UNSET,
SSL_SHUTDOWN_TYPE_STANDARD,
SSL_SHUTDOWN_TYPE_UNCLEAN,
SSL_SHUTDOWN_TYPE_ACCURATE
} ssl_shutdown_type_e;
typedef enum {
SSL_ENABLED_UNSET = -1,
SSL_ENABLED_FALSE = 0,
SSL_ENABLED_TRUE = 1,
SSL_ENABLED_OPTIONAL = 3
} ssl_enabled_t;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef enum {
SSL_CVERIFY_UNSET = -1,
SSL_CVERIFY_NONE = 0,
SSL_CVERIFY_OPTIONAL = 1,
SSL_CVERIFY_REQUIRE = 2,
SSL_CVERIFY_OPTIONAL_NO_CA = 3
} ssl_verify_t;
#endif
typedef struct {
SSL *ssl;
const char *client_dn;
X509 *client_cert;
ssl_shutdown_type_e shutdown_type;
const char *verify_info;
const char *verify_error;
int verify_depth;
int is_proxy;
int disabled;
int non_ssl_request;
} SSLConnRec;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef struct {
const char *ca_cert_path;
const char *ca_cert_file;
const char *cipher_suite;
int verify_depth;
ssl_verify_t verify_mode;
} modssl_auth_ctx_t;
#endif
typedef struct {
void *sc; /* pointer back to server config */
SSL_CTX *ssl_ctx;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
void *pks;
void *pkp;
int protocol;
int pphrase_dialog_type;
const char *pphrase_dialog_path;
const char *cert_chain;
const char *crl_path;
const char *crl_file;
X509_STORE *crl;
modssl_auth_ctx_t auth;
#endif
} modssl_ctx_t;
/* original SSLSrvConfigRec */
typedef struct {
void *mc;
BOOL enabled;
BOOL proxy_enabled;
const char *vhost_id;
int vhost_id_len;
int session_cache_timeout;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
BOOL cipher_server_pref;
#endif
modssl_ctx_t *server;
modssl_ctx_t *proxy;
} SSLSrvConfigRec;
/* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
typedef struct {
void *mc;
unsigned int enabled;
unsigned int proxy_enabled;
const char *vhost_id;
int vhost_id_len;
int session_cache_timeout;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
BOOL cipher_server_pref;
#endif
/* this is the member that was added */
int insecure_reneg;
modssl_ctx_t *server;
modssl_ctx_t *proxy;
} SSLSrvConfigRec2;
/* The server and proxy members of SSLSrvConfigRec must only be accessed
using these macros: */
#define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
#define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef struct {
BOOL bSSLRequired;
apr_array_header_t *aRequirement;
int nOptions;
int nOptionsAdd;
int nOptionsDel;
const char *szCipherSuite;
ssl_verify_t nVerifyClient;
int nVerifyDepth;
const char *szCACertificatePath;
const char *szCACertificateFile;
const char *szUserName;
} SSLDirConfigRec;
#endif
extern module AP_MODULE_DECLARE_DATA ssl_module;
SSLSrvConfigRec2
Definition: canl_mod_ssl-private.h:167
SSLDirConfigRec::szCACertificateFile
const char * szCACertificateFile
Definition: canl_mod_ssl-private.h:199
SSLConnRec::non_ssl_request
int non_ssl_request
Definition: canl_mod_ssl-private.h:114
SSLConnRec::shutdown_type
ssl_shutdown_type_e shutdown_type
Definition: canl_mod_ssl-private.h:108
SSLConnRec::client_dn
const char * client_dn
Definition: canl_mod_ssl-private.h:106
SSLSrvConfigRec2::vhost_id
const char * vhost_id
Definition: canl_mod_ssl-private.h:171
SSLConnRec::disabled
int disabled
Definition: canl_mod_ssl-private.h:113
modssl_ctx_t::cert_chain
const char * cert_chain
Definition: canl_mod_ssl-private.h:141
modssl_ctx_t::crl
X509_STORE * crl
Definition: canl_mod_ssl-private.h:145
SSLSrvConfigRec2::proxy_enabled
unsigned int proxy_enabled
Definition: canl_mod_ssl-private.h:170
SSLSrvConfigRec::vhost_id
const char * vhost_id
Definition: canl_mod_ssl-private.h:156
SSLConnRec::verify_error
const char * verify_error
Definition: canl_mod_ssl-private.h:110
SSL_SHUTDOWN_TYPE_STANDARD
Definition: canl_mod_ssl-private.h:81
SSL_CVERIFY_NONE
Definition: canl_mod_ssl-private.h:96
SSLSrvConfigRec::proxy
modssl_ctx_t * proxy
Definition: canl_mod_ssl-private.h:163
modssl_ctx_t::crl_path
const char * crl_path
Definition: canl_mod_ssl-private.h:143
SSLConnRec::client_cert
X509 * client_cert
Definition: canl_mod_ssl-private.h:107
modssl_auth_ctx_t::verify_mode
ssl_verify_t verify_mode
Definition: canl_mod_ssl-private.h:125
SSLSrvConfigRec2::server
modssl_ctx_t * server
Definition: canl_mod_ssl-private.h:179
modssl_ctx_t::protocol
int protocol
Definition: canl_mod_ssl-private.h:136
SSLSrvConfigRec::server
modssl_ctx_t * server
Definition: canl_mod_ssl-private.h:162
SSLDirConfigRec::bSSLRequired
BOOL bSSLRequired
Definition: canl_mod_ssl-private.h:190
SSLSrvConfigRec2::cipher_server_pref
BOOL cipher_server_pref
Definition: canl_mod_ssl-private.h:175
modssl_ctx_t::auth
modssl_auth_ctx_t auth
Definition: canl_mod_ssl-private.h:147
SSLDirConfigRec::nVerifyClient
ssl_verify_t nVerifyClient
Definition: canl_mod_ssl-private.h:196
SSL_ENABLED_OPTIONAL
Definition: canl_mod_ssl-private.h:90
SSLDirConfigRec::szCACertificatePath
const char * szCACertificatePath
Definition: canl_mod_ssl-private.h:198
ssl_shutdown_type_e
ssl_shutdown_type_e
Definition: canl_mod_ssl-private.h:79
modssl_ctx_t::pkp
void * pkp
Definition: canl_mod_ssl-private.h:134
SSLConnRec::verify_info
const char * verify_info
Definition: canl_mod_ssl-private.h:109
modssl_ctx_t::sc
void * sc
Definition: canl_mod_ssl-private.h:130
modssl_ctx_t::ssl_ctx
SSL_CTX * ssl_ctx
Definition: canl_mod_ssl-private.h:131
SSLConnRec::verify_depth
int verify_depth
Definition: canl_mod_ssl-private.h:111
SSLDirConfigRec::nVerifyDepth
int nVerifyDepth
Definition: canl_mod_ssl-private.h:197
SSL_CVERIFY_OPTIONAL_NO_CA
Definition: canl_mod_ssl-private.h:99
SSLDirConfigRec::szCipherSuite
const char * szCipherSuite
Definition: canl_mod_ssl-private.h:195
modssl_auth_ctx_t
Definition: canl_mod_ssl-private.h:118
SSLSrvConfigRec::enabled
BOOL enabled
Definition: canl_mod_ssl-private.h:154
modssl_ctx_t::pks
void * pks
Definition: canl_mod_ssl-private.h:133
ssl_enabled_t
ssl_enabled_t
Definition: canl_mod_ssl-private.h:86
SSLDirConfigRec::aRequirement
apr_array_header_t * aRequirement
Definition: canl_mod_ssl-private.h:191
SSLSrvConfigRec::mc
void * mc
Definition: canl_mod_ssl-private.h:153
SSL_CVERIFY_OPTIONAL
Definition: canl_mod_ssl-private.h:97
SSLSrvConfigRec2::vhost_id_len
int vhost_id_len
Definition: canl_mod_ssl-private.h:172
SSLSrvConfigRec2::enabled
unsigned int enabled
Definition: canl_mod_ssl-private.h:169
SSL_ENABLED_UNSET
Definition: canl_mod_ssl-private.h:87
SSLDirConfigRec::nOptions
int nOptions
Definition: canl_mod_ssl-private.h:192
SSL_SHUTDOWN_TYPE_UNSET
Definition: canl_mod_ssl-private.h:80
SSL_SHUTDOWN_TYPE_UNCLEAN
Definition: canl_mod_ssl-private.h:82
SSLSrvConfigRec2::mc
void * mc
Definition: canl_mod_ssl-private.h:168
ssl_module
module AP_MODULE_DECLARE_DATA ssl_module
ssl_verify_t
ssl_verify_t
Definition: canl_mod_ssl-private.h:94
modssl_ctx_t
Definition: canl_mod_ssl-private.h:129
modssl_ctx_t::pphrase_dialog_path
const char * pphrase_dialog_path
Definition: canl_mod_ssl-private.h:139
SSLSrvConfigRec::session_cache_timeout
int session_cache_timeout
Definition: canl_mod_ssl-private.h:158
SSLDirConfigRec::nOptionsAdd
int nOptionsAdd
Definition: canl_mod_ssl-private.h:193
SSLDirConfigRec::szUserName
const char * szUserName
Definition: canl_mod_ssl-private.h:200
SSLSrvConfigRec2::session_cache_timeout
int session_cache_timeout
Definition: canl_mod_ssl-private.h:173
SSLSrvConfigRec2::proxy
modssl_ctx_t * proxy
Definition: canl_mod_ssl-private.h:180
SSLConnRec
Definition: canl_mod_ssl-private.h:104
modssl_auth_ctx_t::ca_cert_path
const char * ca_cert_path
Definition: canl_mod_ssl-private.h:119
SSL_CVERIFY_REQUIRE
Definition: canl_mod_ssl-private.h:98
SSLDirConfigRec
Definition: canl_mod_ssl-private.h:189
SSL_ENABLED_FALSE
Definition: canl_mod_ssl-private.h:88
SSLSrvConfigRec
Definition: canl_mod_ssl-private.h:152
SSLDirConfigRec::nOptionsDel
int nOptionsDel
Definition: canl_mod_ssl-private.h:194
modssl_auth_ctx_t::cipher_suite
const char * cipher_suite
Definition: canl_mod_ssl-private.h:122
SSLSrvConfigRec::cipher_server_pref
BOOL cipher_server_pref
Definition: canl_mod_ssl-private.h:160
modssl_auth_ctx_t::verify_depth
int verify_depth
Definition: canl_mod_ssl-private.h:124
modssl_ctx_t::pphrase_dialog_type
int pphrase_dialog_type
Definition: canl_mod_ssl-private.h:138
SSLConnRec::ssl
SSL * ssl
Definition: canl_mod_ssl-private.h:105
SSLConnRec::is_proxy
int is_proxy
Definition: canl_mod_ssl-private.h:112
SSL_ENABLED_TRUE
Definition: canl_mod_ssl-private.h:89
SSL_CVERIFY_UNSET
Definition: canl_mod_ssl-private.h:95
modssl_auth_ctx_t::ca_cert_file
const char * ca_cert_file
Definition: canl_mod_ssl-private.h:120
SSLSrvConfigRec2::insecure_reneg
int insecure_reneg
Definition: canl_mod_ssl-private.h:178
SSLSrvConfigRec::vhost_id_len
int vhost_id_len
Definition: canl_mod_ssl-private.h:157
SSLSrvConfigRec::proxy_enabled
BOOL proxy_enabled
Definition: canl_mod_ssl-private.h:155
modssl_ctx_t::crl_file
const char * crl_file
Definition: canl_mod_ssl-private.h:144
SSL_SHUTDOWN_TYPE_ACCURATE
Definition: canl_mod_ssl-private.h:83