mod_ssl-private.h
Go to the documentation of this file.
1
/*
2
Copyright (c) 2003-8, Andrew McNab, University of Manchester
3
All rights reserved.
4
5
Redistribution and use in source and binary forms, with or
6
without modification, are permitted provided that the following
7
conditions are met:
8
9
o Redistributions of source code must retain the above
10
copyright notice, this list of conditions and the following
11
disclaimer.
12
o Redistributions in binary form must reproduce the above
13
copyright notice, this list of conditions and the following
14
disclaimer in the documentation and/or other materials
15
provided with the distribution.
16
17
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
18
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
20
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
22
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
23
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
24
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
26
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
POSSIBILITY OF SUCH DAMAGE.
30
*/
31
32
/*
33
34
Portions of this code are derived from Apache mod_ssl, and are covered
35
by the Apache Software License:
36
37
* Copyright 2001-2004 The Apache Software Foundation
38
*
39
* Licensed under the Apache License, Version 2.0 (the "License");
40
* you may not use this file except in compliance with the License.
41
* You may obtain a copy of the License at
42
*
43
* http://www.apache.org/licenses/LICENSE-2.0
44
*
45
* Unless required by applicable law or agreed to in writing, software
46
* distributed under the License is distributed on an "AS IS" BASIS,
47
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
48
* See the License for the specific language governing permissions and
49
* limitations under the License.
50
*/
51
52
/*
53
This work has been partially funded by the EU Commission (contract
54
INFSO-RI-222667) under the EGEE-III collaboration.
55
*/
56
57
/*------------------------------------------------------------------*
58
* This program is part of GridSite: http://www.gridsite.org/ *
59
*------------------------------------------------------------------*/
60
61
62
/*
63
* After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
64
* in ssl_private.h, which is not installed along with httpd-devel (eg in
65
* the FC2 RPM.) This include file provides SIMPLIFIED structures for use
66
* by mod_gridsite: for example, pointers to unused structures are replaced
67
* by void * and some of the structures are truncated when only the early
68
* members are used.
69
*
70
* CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
71
*/
72
73
#include <openssl/ssl.h>
74
75
#ifndef BOOL
76
#define BOOL unsigned int
77
#endif
78
79
typedef
enum
{
80
SSL_SHUTDOWN_TYPE_UNSET
,
81
SSL_SHUTDOWN_TYPE_STANDARD
,
82
SSL_SHUTDOWN_TYPE_UNCLEAN
,
83
SSL_SHUTDOWN_TYPE_ACCURATE
84
}
ssl_shutdown_type_e
;
85
86
typedef
enum
{
87
SSL_ENABLED_UNSET
= -1,
88
SSL_ENABLED_FALSE
= 0,
89
SSL_ENABLED_TRUE
= 1,
90
SSL_ENABLED_OPTIONAL
= 3
91
}
ssl_enabled_t
;
92
93
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
94
typedef
enum
{
95
SSL_CVERIFY_UNSET
= -1,
96
SSL_CVERIFY_NONE
= 0,
97
SSL_CVERIFY_OPTIONAL
= 1,
98
SSL_CVERIFY_REQUIRE
= 2,
99
SSL_CVERIFY_OPTIONAL_NO_CA
= 3
100
}
ssl_verify_t
;
101
102
#define ssl_verify_error_is_optional(errnum) \
103
((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) \
104
|| (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) \
105
|| (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) \
106
|| (errnum == X509_V_ERR_CERT_UNTRUSTED) \
107
|| (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
108
109
#endif
110
111
typedef
struct
{
112
SSL *
ssl
;
113
const
char
*
client_dn
;
114
X509 *
client_cert
;
115
ssl_shutdown_type_e
shutdown_type
;
116
const
char
*
verify_info
;
117
const
char
*
verify_error
;
118
int
verify_depth
;
119
int
is_proxy
;
120
int
disabled
;
121
int
non_ssl_request
;
122
}
SSLConnRec
;
123
124
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
125
typedef
struct
{
126
const
char
*
ca_cert_path
;
127
const
char
*
ca_cert_file
;
128
129
const
char
*
cipher_suite
;
130
131
int
verify_depth
;
132
ssl_verify_t
verify_mode
;
133
}
modssl_auth_ctx_t
;
134
#endif
135
136
typedef
struct
{
137
void
*
sc
;
/* pointer back to server config */
138
SSL_CTX *
ssl_ctx
;
139
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
140
void
*
pks
;
141
void
*
pkp
;
142
143
int
protocol
;
144
145
int
pphrase_dialog_type
;
146
const
char
*
pphrase_dialog_path
;
147
148
const
char
*
cert_chain
;
149
150
const
char
*
crl_path
;
151
const
char
*
crl_file
;
152
X509_STORE *
crl
;
153
154
modssl_auth_ctx_t
auth
;
155
#endif
156
}
modssl_ctx_t
;
157
158
/* original SSLSrvConfigRec */
159
typedef
struct
{
160
void
*
mc
;
161
BOOL
enabled
;
162
BOOL
proxy_enabled
;
163
const
char
*
vhost_id
;
164
int
vhost_id_len
;
165
int
session_cache_timeout
;
166
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
167
BOOL
cipher_server_pref
;
168
#endif
169
modssl_ctx_t
*
server
;
170
modssl_ctx_t
*
proxy
;
171
}
SSLSrvConfigRec
;
172
173
/* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
174
typedef
struct
{
175
void
*
mc
;
176
unsigned
int
enabled
;
177
unsigned
int
proxy_enabled
;
178
const
char
*
vhost_id
;
179
int
vhost_id_len
;
180
int
session_cache_timeout
;
181
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
182
BOOL
cipher_server_pref
;
183
#endif
184
/* this is the member that was added */
185
int
insecure_reneg
;
186
modssl_ctx_t
*
server
;
187
modssl_ctx_t
*
proxy
;
188
}
SSLSrvConfigRec2
;
189
190
/* The server and proxy members of SSLSrvConfigRec must only be accessed
191
using these macros: */
192
#define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
193
#define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
194
195
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
196
typedef
struct
{
197
BOOL
bSSLRequired
;
198
apr_array_header_t *
aRequirement
;
199
int
nOptions
;
200
int
nOptionsAdd
;
201
int
nOptionsDel
;
202
const
char
*
szCipherSuite
;
203
ssl_verify_t
nVerifyClient
;
204
int
nVerifyDepth
;
205
const
char
*
szCACertificatePath
;
206
const
char
*
szCACertificateFile
;
207
const
char
*
szUserName
;
208
}
SSLDirConfigRec
;
209
#endif
210
211
extern
module AP_MODULE_DECLARE_DATA
ssl_module
;
Generated on Wed Jul 11 2012 14:19:44 by
1.8.1.1