mod_ssl-private.h
Go to the documentation of this file.
1 /*
2  Copyright (c) 2003-8, Andrew McNab, University of Manchester
3  All rights reserved.
4 
5  Redistribution and use in source and binary forms, with or
6  without modification, are permitted provided that the following
7  conditions are met:
8 
9  o Redistributions of source code must retain the above
10  copyright notice, this list of conditions and the following
11  disclaimer.
12  o Redistributions in binary form must reproduce the above
13  copyright notice, this list of conditions and the following
14  disclaimer in the documentation and/or other materials
15  provided with the distribution.
16 
17  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
18  CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
20  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
22  BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
23  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
24  TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
26  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  POSSIBILITY OF SUCH DAMAGE.
30 */
31 
32 /*
33 
34  Portions of this code are derived from Apache mod_ssl, and are covered
35  by the Apache Software License:
36 
37  * Copyright 2001-2004 The Apache Software Foundation
38  *
39  * Licensed under the Apache License, Version 2.0 (the "License");
40  * you may not use this file except in compliance with the License.
41  * You may obtain a copy of the License at
42  *
43  * http://www.apache.org/licenses/LICENSE-2.0
44  *
45  * Unless required by applicable law or agreed to in writing, software
46  * distributed under the License is distributed on an "AS IS" BASIS,
47  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
48  * See the License for the specific language governing permissions and
49  * limitations under the License.
50  */
51 
52 /*
53  This work has been partially funded by the EU Commission (contract
54  INFSO-RI-222667) under the EGEE-III collaboration.
55 */
56 
57 /*------------------------------------------------------------------*
58  * This program is part of GridSite: http://www.gridsite.org/ *
59  *------------------------------------------------------------------*/
60 
61 
62 /*
63  * After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
64  * in ssl_private.h, which is not installed along with httpd-devel (eg in
65  * the FC2 RPM.) This include file provides SIMPLIFIED structures for use
66  * by mod_gridsite: for example, pointers to unused structures are replaced
67  * by void * and some of the structures are truncated when only the early
68  * members are used.
69  *
70  * CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
71  */
72 
73 #include <openssl/ssl.h>
74 
75 #ifndef BOOL
76 #define BOOL unsigned int
77 #endif
78 
79 typedef enum {
85 
86 typedef enum {
92 
93 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
94 typedef enum {
100 } ssl_verify_t;
101 
102 #define ssl_verify_error_is_optional(errnum) \
103  ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) \
104  || (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) \
105  || (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) \
106  || (errnum == X509_V_ERR_CERT_UNTRUSTED) \
107  || (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
108 
109 #endif
110 
111 typedef struct {
112  SSL *ssl;
113  const char *client_dn;
114  X509 *client_cert;
115  ssl_shutdown_type_e shutdown_type;
116  const char *verify_info;
117  const char *verify_error;
118  int verify_depth;
119  int is_proxy;
120  int disabled;
121  int non_ssl_request;
122 } SSLConnRec;
123 
124 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
125 typedef struct {
126  const char *ca_cert_path;
127  const char *ca_cert_file;
128 
129  const char *cipher_suite;
130 
131  int verify_depth;
132  ssl_verify_t verify_mode;
134 #endif
135 
136 typedef struct {
137  void *sc; /* pointer back to server config */
138  SSL_CTX *ssl_ctx;
139 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
140  void *pks;
141  void *pkp;
142 
143  int protocol;
144 
145  int pphrase_dialog_type;
146  const char *pphrase_dialog_path;
147 
148  const char *cert_chain;
149 
150  const char *crl_path;
151  const char *crl_file;
152  X509_STORE *crl;
153 
154  modssl_auth_ctx_t auth;
155 #endif
156 } modssl_ctx_t;
157 
158 /* original SSLSrvConfigRec */
159 typedef struct {
160  void *mc;
161  BOOL enabled;
162  BOOL proxy_enabled;
163  const char *vhost_id;
164  int vhost_id_len;
165  int session_cache_timeout;
166 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
167  BOOL cipher_server_pref;
168 #endif
169  modssl_ctx_t *server;
170  modssl_ctx_t *proxy;
172 
173 /* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
174 typedef struct {
175  void *mc;
176  unsigned int enabled;
177  unsigned int proxy_enabled;
178  const char *vhost_id;
179  int vhost_id_len;
180  int session_cache_timeout;
181 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
182  BOOL cipher_server_pref;
183 #endif
184  /* this is the member that was added */
185  int insecure_reneg;
186  modssl_ctx_t *server;
187  modssl_ctx_t *proxy;
189 
190 /* The server and proxy members of SSLSrvConfigRec must only be accessed
191  using these macros: */
192 #define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
193 #define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
194 
195 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
196 typedef struct {
197  BOOL bSSLRequired;
198  apr_array_header_t *aRequirement;
199  int nOptions;
200  int nOptionsAdd;
201  int nOptionsDel;
202  const char *szCipherSuite;
203  ssl_verify_t nVerifyClient;
204  int nVerifyDepth;
205  const char *szCACertificatePath;
206  const char *szCACertificateFile;
207  const char *szUserName;
209 #endif
210 
211 extern module AP_MODULE_DECLARE_DATA ssl_module;
ssl_verify_t
Definition: mod_ssl-private.h:94
Definition: mod_ssl-private.h:96
Definition: canl_mod_ssl-private.h:167
Definition: canl_mod_ssl-private.h:189
ssl_shutdown_type_e
Definition: mod_ssl-private.h:79
module AP_MODULE_DECLARE_DATA ssl_module
Definition: mod_ssl-private.h:98
Definition: canl_mod_ssl-private.h:118
Definition: mod_ssl-private.h:80
Definition: mod_ssl-private.h:95
Definition: mod_ssl-private.h:90
Definition: canl_mod_ssl-private.h:129
Definition: mod_ssl-private.h:83
Definition: mod_ssl-private.h:81
Definition: canl_mod_ssl-private.h:152
Definition: mod_ssl-private.h:89
ssl_enabled_t
Definition: mod_ssl-private.h:86
Definition: mod_ssl-private.h:87
Definition: mod_ssl-private.h:88
ssl_shutdown_type_e
Definition: canl_mod_ssl-private.h:79
Definition: mod_ssl-private.h:99
Definition: mod_ssl-private.h:97
ssl_verify_t
Definition: canl_mod_ssl-private.h:94
Definition: mod_ssl-private.h:82
Definition: canl_mod_ssl-private.h:104