mod_ssl-private.h
Go to the documentation of this file.
1 /*
2  Copyright (c) 2003-8, Andrew McNab, University of Manchester
3  All rights reserved.
4 
5  Redistribution and use in source and binary forms, with or
6  without modification, are permitted provided that the following
7  conditions are met:
8 
9  o Redistributions of source code must retain the above
10  copyright notice, this list of conditions and the following
11  disclaimer.
12  o Redistributions in binary form must reproduce the above
13  copyright notice, this list of conditions and the following
14  disclaimer in the documentation and/or other materials
15  provided with the distribution.
16 
17  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
18  CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
20  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
22  BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
23  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
24  TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
26  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  POSSIBILITY OF SUCH DAMAGE.
30 */
31 
32 /*
33 
34  Portions of this code are derived from Apache mod_ssl, and are covered
35  by the Apache Software License:
36 
37  * Copyright 2001-2004 The Apache Software Foundation
38  *
39  * Licensed under the Apache License, Version 2.0 (the "License");
40  * you may not use this file except in compliance with the License.
41  * You may obtain a copy of the License at
42  *
43  * http://www.apache.org/licenses/LICENSE-2.0
44  *
45  * Unless required by applicable law or agreed to in writing, software
46  * distributed under the License is distributed on an "AS IS" BASIS,
47  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
48  * See the License for the specific language governing permissions and
49  * limitations under the License.
50  */
51 
52 /*
53  This work has been partially funded by the EU Commission (contract
54  INFSO-RI-222667) under the EGEE-III collaboration.
55 */
56 
57 /*------------------------------------------------------------------*
58  * This program is part of GridSite: http://www.gridsite.org/ *
59  *------------------------------------------------------------------*/
60 
61 
62 /*
63  * After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
64  * in ssl_private.h, which is not installed along with httpd-devel (eg in
65  * the FC2 RPM.) This include file provides SIMPLIFIED structures for use
66  * by mod_gridsite: for example, pointers to unused structures are replaced
67  * by void * and some of the structures are truncated when only the early
68  * members are used.
69  *
70  * CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
71  */
72 
73 #include <openssl/ssl.h>
74 
75 #ifndef BOOL
76 #define BOOL unsigned int
77 #endif
78 
79 typedef enum {
85 
86 typedef enum {
92 
93 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
94 typedef enum {
100 } ssl_verify_t;
101 
102 #define ssl_verify_error_is_optional(errnum) \
103  ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) \
104  || (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) \
105  || (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) \
106  || (errnum == X509_V_ERR_CERT_UNTRUSTED) \
107  || (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
108 
109 #endif
110 
111 typedef struct {
112  SSL *ssl;
113  const char *client_dn;
114  X509 *client_cert;
116  const char *verify_info;
117  const char *verify_error;
119  int is_proxy;
120  int disabled;
122 } SSLConnRec;
123 
124 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
125 typedef struct {
126  const char *ca_cert_path;
127  const char *ca_cert_file;
128 
129  const char *cipher_suite;
130 
134 #endif
135 
136 typedef struct {
137  void *sc; /* pointer back to server config */
138  SSL_CTX *ssl_ctx;
139 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
140  void *pks;
141  void *pkp;
142 
143  int protocol;
144 
146  const char *pphrase_dialog_path;
147 
148  const char *cert_chain;
149 
150  const char *crl_path;
151  const char *crl_file;
152  X509_STORE *crl;
153 
155 #endif
156 } modssl_ctx_t;
157 
158 /* original SSLSrvConfigRec */
159 typedef struct {
160  void *mc;
161  BOOL enabled;
163  const char *vhost_id;
166 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
168 #endif
172 
173 /* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
174 typedef struct {
175  void *mc;
176  unsigned int enabled;
177  unsigned int proxy_enabled;
178  const char *vhost_id;
181 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
183 #endif
184  /* this is the member that was added */
189 
190 /* The server and proxy members of SSLSrvConfigRec must only be accessed
191  using these macros: */
192 #define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
193 #define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
194 
195 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
196 typedef struct {
198  apr_array_header_t *aRequirement;
199  int nOptions;
202  const char *szCipherSuite;
205  const char *szCACertificatePath;
206  const char *szCACertificateFile;
207  const char *szUserName;
209 #endif
210 
211 extern module AP_MODULE_DECLARE_DATA ssl_module;
int insecure_reneg
Definition: mod_ssl-private.h:185
ssl_verify_t
Definition: mod_ssl-private.h:94
int pphrase_dialog_type
Definition: mod_ssl-private.h:145
int verify_depth
Definition: mod_ssl-private.h:118
int is_proxy
Definition: mod_ssl-private.h:119
modssl_ctx_t * server
Definition: mod_ssl-private.h:186
Definition: mod_ssl-private.h:96
BOOL proxy_enabled
Definition: mod_ssl-private.h:162
const char * vhost_id
Definition: mod_ssl-private.h:178
unsigned int proxy_enabled
Definition: mod_ssl-private.h:177
const char * cert_chain
Definition: mod_ssl-private.h:148
ssl_verify_t nVerifyClient
Definition: mod_ssl-private.h:203
ssl_verify_t verify_mode
Definition: mod_ssl-private.h:132
const char * verify_info
Definition: mod_ssl-private.h:116
SSL * ssl
Definition: mod_ssl-private.h:112
const char * crl_path
Definition: mod_ssl-private.h:150
modssl_ctx_t * server
Definition: mod_ssl-private.h:169
ssl_shutdown_type_e shutdown_type
Definition: mod_ssl-private.h:115
int nVerifyDepth
Definition: mod_ssl-private.h:204
int non_ssl_request
Definition: mod_ssl-private.h:121
const char * szCipherSuite
Definition: mod_ssl-private.h:202
Definition: mod_ssl-private.h:174
modssl_ctx_t * proxy
Definition: mod_ssl-private.h:170
X509_STORE * crl
Definition: mod_ssl-private.h:152
int vhost_id_len
Definition: mod_ssl-private.h:164
Definition: mod_ssl-private.h:196
ssl_shutdown_type_e
Definition: mod_ssl-private.h:79
int verify_depth
Definition: mod_ssl-private.h:131
BOOL cipher_server_pref
Definition: mod_ssl-private.h:182
module AP_MODULE_DECLARE_DATA ssl_module
void * pks
Definition: mod_ssl-private.h:140
const char * szCACertificatePath
Definition: mod_ssl-private.h:205
apr_array_header_t * aRequirement
Definition: mod_ssl-private.h:198
int vhost_id_len
Definition: mod_ssl-private.h:179
modssl_auth_ctx_t auth
Definition: mod_ssl-private.h:154
int nOptionsAdd
Definition: mod_ssl-private.h:200
Definition: mod_ssl-private.h:98
Definition: mod_ssl-private.h:125
Definition: mod_ssl-private.h:80
const char * ca_cert_file
Definition: mod_ssl-private.h:127
const char * verify_error
Definition: mod_ssl-private.h:117
unsigned int enabled
Definition: mod_ssl-private.h:176
Definition: mod_ssl-private.h:95
void * sc
Definition: mod_ssl-private.h:137
Definition: mod_ssl-private.h:90
int session_cache_timeout
Definition: mod_ssl-private.h:180
X509 * client_cert
Definition: mod_ssl-private.h:114
modssl_ctx_t * proxy
Definition: mod_ssl-private.h:187
Definition: mod_ssl-private.h:136
Definition: mod_ssl-private.h:83
BOOL cipher_server_pref
Definition: mod_ssl-private.h:167
const char * pphrase_dialog_path
Definition: mod_ssl-private.h:146
int disabled
Definition: mod_ssl-private.h:120
const char * szUserName
Definition: mod_ssl-private.h:207
Definition: mod_ssl-private.h:81
void * mc
Definition: mod_ssl-private.h:175
const char * client_dn
Definition: mod_ssl-private.h:113
Definition: mod_ssl-private.h:159
Definition: mod_ssl-private.h:89
const char * szCACertificateFile
Definition: mod_ssl-private.h:206
ssl_enabled_t
Definition: mod_ssl-private.h:86
Definition: mod_ssl-private.h:87
BOOL enabled
Definition: mod_ssl-private.h:161
const char * vhost_id
Definition: mod_ssl-private.h:163
Definition: mod_ssl-private.h:88
int protocol
Definition: mod_ssl-private.h:143
const char * ca_cert_path
Definition: mod_ssl-private.h:126
void * mc
Definition: mod_ssl-private.h:160
Definition: mod_ssl-private.h:99
void * pkp
Definition: mod_ssl-private.h:141
SSL_CTX * ssl_ctx
Definition: mod_ssl-private.h:138
int nOptions
Definition: mod_ssl-private.h:199
const char * crl_file
Definition: mod_ssl-private.h:151
const char * cipher_suite
Definition: mod_ssl-private.h:129
Definition: mod_ssl-private.h:97
int session_cache_timeout
Definition: mod_ssl-private.h:165
int nOptionsDel
Definition: mod_ssl-private.h:201
Definition: mod_ssl-private.h:82
BOOL bSSLRequired
Definition: mod_ssl-private.h:197
Definition: mod_ssl-private.h:111