canl_mod_ssl-private.h
Go to the documentation of this file.
/*
Copyright (c) 2003-8, Andrew McNab, University of Manchester
All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, are permitted provided that the following
conditions are met:
o Redistributions of source code must retain the above
copyright notice, this list of conditions and the following
disclaimer.
o Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
*/
/*
Portions of this code are derived from Apache mod_ssl, and are covered
by the Apache Software License:
* Copyright 2001-2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
This work has been partially funded by the EU Commission (contract
INFSO-RI-222667) under the EGEE-III collaboration.
*/
/*------------------------------------------------------------------*
* This program is part of GridSite: http://www.gridsite.org/ *
*------------------------------------------------------------------*/
/*
* After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
* in ssl_private.h, which is not installed along with httpd-devel (eg in
* the FC2 RPM.) This include file provides SIMPLIFIED structures for use
* by mod_gridsite: for example, pointers to unused structures are replaced
* by void * and some of the structures are truncated when only the early
* members are used.
*
* CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
*/
#include <openssl/ssl.h>
#ifndef BOOL
#define BOOL unsigned int
#endif
typedef enum {
SSL_SHUTDOWN_TYPE_UNSET,
SSL_SHUTDOWN_TYPE_STANDARD,
SSL_SHUTDOWN_TYPE_UNCLEAN,
SSL_SHUTDOWN_TYPE_ACCURATE
} ssl_shutdown_type_e;
typedef enum {
SSL_ENABLED_UNSET = -1,
SSL_ENABLED_FALSE = 0,
SSL_ENABLED_TRUE = 1,
SSL_ENABLED_OPTIONAL = 3
} ssl_enabled_t;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef enum {
SSL_CVERIFY_UNSET = -1,
SSL_CVERIFY_NONE = 0,
SSL_CVERIFY_OPTIONAL = 1,
SSL_CVERIFY_REQUIRE = 2,
SSL_CVERIFY_OPTIONAL_NO_CA = 3
} ssl_verify_t;
#endif
typedef struct {
SSL *ssl;
const char *client_dn;
X509 *client_cert;
ssl_shutdown_type_e shutdown_type;
const char *verify_info;
const char *verify_error;
int verify_depth;
int is_proxy;
int disabled;
int non_ssl_request;
} SSLConnRec;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef struct {
const char *ca_cert_path;
const char *ca_cert_file;
const char *cipher_suite;
int verify_depth;
ssl_verify_t verify_mode;
} modssl_auth_ctx_t;
#endif
typedef struct {
void *sc; /* pointer back to server config */
SSL_CTX *ssl_ctx;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
void *pks;
void *pkp;
int protocol;
int pphrase_dialog_type;
const char *pphrase_dialog_path;
const char *cert_chain;
const char *crl_path;
const char *crl_file;
X509_STORE *crl;
modssl_auth_ctx_t auth;
#endif
} modssl_ctx_t;
/* original SSLSrvConfigRec */
typedef struct {
void *mc;
BOOL enabled;
BOOL proxy_enabled;
const char *vhost_id;
int vhost_id_len;
int session_cache_timeout;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
BOOL cipher_server_pref;
#endif
modssl_ctx_t *server;
modssl_ctx_t *proxy;
} SSLSrvConfigRec;
/* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
typedef struct {
void *mc;
unsigned int enabled;
unsigned int proxy_enabled;
const char *vhost_id;
int vhost_id_len;
int session_cache_timeout;
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
BOOL cipher_server_pref;
#endif
/* this is the member that was added */
int insecure_reneg;
modssl_ctx_t *server;
modssl_ctx_t *proxy;
} SSLSrvConfigRec2;
/* The server and proxy members of SSLSrvConfigRec must only be accessed
using these macros: */
#define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
#define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
#if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
typedef struct {
BOOL bSSLRequired;
apr_array_header_t *aRequirement;
int nOptions;
int nOptionsAdd;
int nOptionsDel;
const char *szCipherSuite;
ssl_verify_t nVerifyClient;
int nVerifyDepth;
const char *szCACertificatePath;
const char *szCACertificateFile;
const char *szUserName;
} SSLDirConfigRec;
#endif
extern module AP_MODULE_DECLARE_DATA ssl_module;
ssl_enabled_t
ssl_enabled_t
Definition canl_mod_ssl-private.h:86
SSL_ENABLED_TRUE
@ SSL_ENABLED_TRUE
Definition canl_mod_ssl-private.h:89
SSL_ENABLED_UNSET
@ SSL_ENABLED_UNSET
Definition canl_mod_ssl-private.h:87
SSL_ENABLED_FALSE
@ SSL_ENABLED_FALSE
Definition canl_mod_ssl-private.h:88
SSL_ENABLED_OPTIONAL
@ SSL_ENABLED_OPTIONAL
Definition canl_mod_ssl-private.h:90
ssl_verify_t
ssl_verify_t
Definition canl_mod_ssl-private.h:94
SSL_CVERIFY_OPTIONAL
@ SSL_CVERIFY_OPTIONAL
Definition canl_mod_ssl-private.h:97
SSL_CVERIFY_OPTIONAL_NO_CA
@ SSL_CVERIFY_OPTIONAL_NO_CA
Definition canl_mod_ssl-private.h:99
SSL_CVERIFY_UNSET
@ SSL_CVERIFY_UNSET
Definition canl_mod_ssl-private.h:95
SSL_CVERIFY_NONE
@ SSL_CVERIFY_NONE
Definition canl_mod_ssl-private.h:96
SSL_CVERIFY_REQUIRE
@ SSL_CVERIFY_REQUIRE
Definition canl_mod_ssl-private.h:98
ssl_shutdown_type_e
ssl_shutdown_type_e
Definition canl_mod_ssl-private.h:79
SSL_SHUTDOWN_TYPE_STANDARD
@ SSL_SHUTDOWN_TYPE_STANDARD
Definition canl_mod_ssl-private.h:81
SSL_SHUTDOWN_TYPE_UNCLEAN
@ SSL_SHUTDOWN_TYPE_UNCLEAN
Definition canl_mod_ssl-private.h:82
SSL_SHUTDOWN_TYPE_ACCURATE
@ SSL_SHUTDOWN_TYPE_ACCURATE
Definition canl_mod_ssl-private.h:83
SSL_SHUTDOWN_TYPE_UNSET
@ SSL_SHUTDOWN_TYPE_UNSET
Definition canl_mod_ssl-private.h:80
SSLConnRec
Definition canl_mod_ssl-private.h:104
SSLConnRec::is_proxy
int is_proxy
Definition canl_mod_ssl-private.h:112
SSLConnRec::verify_error
const char * verify_error
Definition canl_mod_ssl-private.h:110
SSLConnRec::verify_info
const char * verify_info
Definition canl_mod_ssl-private.h:109
SSLConnRec::client_dn
const char * client_dn
Definition canl_mod_ssl-private.h:106
SSLConnRec::disabled
int disabled
Definition canl_mod_ssl-private.h:113
SSLConnRec::shutdown_type
ssl_shutdown_type_e shutdown_type
Definition canl_mod_ssl-private.h:108
SSLConnRec::verify_depth
int verify_depth
Definition canl_mod_ssl-private.h:111
SSLConnRec::non_ssl_request
int non_ssl_request
Definition canl_mod_ssl-private.h:114
SSLConnRec::client_cert
X509 * client_cert
Definition canl_mod_ssl-private.h:107
SSLConnRec::ssl
SSL * ssl
Definition canl_mod_ssl-private.h:105
SSLDirConfigRec
Definition canl_mod_ssl-private.h:189
SSLDirConfigRec::bSSLRequired
BOOL bSSLRequired
Definition canl_mod_ssl-private.h:190
SSLDirConfigRec::nVerifyClient
ssl_verify_t nVerifyClient
Definition canl_mod_ssl-private.h:196
SSLDirConfigRec::szCACertificatePath
const char * szCACertificatePath
Definition canl_mod_ssl-private.h:198
SSLDirConfigRec::szCACertificateFile
const char * szCACertificateFile
Definition canl_mod_ssl-private.h:199
SSLDirConfigRec::szCipherSuite
const char * szCipherSuite
Definition canl_mod_ssl-private.h:195
SSLDirConfigRec::nOptionsAdd
int nOptionsAdd
Definition canl_mod_ssl-private.h:193
SSLDirConfigRec::nVerifyDepth
int nVerifyDepth
Definition canl_mod_ssl-private.h:197
SSLDirConfigRec::nOptionsDel
int nOptionsDel
Definition canl_mod_ssl-private.h:194
SSLDirConfigRec::aRequirement
apr_array_header_t * aRequirement
Definition canl_mod_ssl-private.h:191
SSLDirConfigRec::nOptions
int nOptions
Definition canl_mod_ssl-private.h:192
SSLDirConfigRec::szUserName
const char * szUserName
Definition canl_mod_ssl-private.h:200
SSLSrvConfigRec2
Definition canl_mod_ssl-private.h:167
SSLSrvConfigRec2::insecure_reneg
int insecure_reneg
Definition canl_mod_ssl-private.h:178
SSLSrvConfigRec2::vhost_id
const char * vhost_id
Definition canl_mod_ssl-private.h:171
SSLSrvConfigRec2::server
modssl_ctx_t * server
Definition canl_mod_ssl-private.h:179
SSLSrvConfigRec2::proxy
modssl_ctx_t * proxy
Definition canl_mod_ssl-private.h:180
SSLSrvConfigRec2::cipher_server_pref
BOOL cipher_server_pref
Definition canl_mod_ssl-private.h:175
SSLSrvConfigRec2::session_cache_timeout
int session_cache_timeout
Definition canl_mod_ssl-private.h:173
SSLSrvConfigRec2::proxy_enabled
unsigned int proxy_enabled
Definition canl_mod_ssl-private.h:170
SSLSrvConfigRec2::mc
void * mc
Definition canl_mod_ssl-private.h:168
SSLSrvConfigRec2::enabled
unsigned int enabled
Definition canl_mod_ssl-private.h:169
SSLSrvConfigRec2::vhost_id_len
int vhost_id_len
Definition canl_mod_ssl-private.h:172
SSLSrvConfigRec
Definition canl_mod_ssl-private.h:152
SSLSrvConfigRec::vhost_id
const char * vhost_id
Definition canl_mod_ssl-private.h:156
SSLSrvConfigRec::enabled
BOOL enabled
Definition canl_mod_ssl-private.h:154
SSLSrvConfigRec::vhost_id_len
int vhost_id_len
Definition canl_mod_ssl-private.h:157
SSLSrvConfigRec::server
modssl_ctx_t * server
Definition canl_mod_ssl-private.h:162
SSLSrvConfigRec::mc
void * mc
Definition canl_mod_ssl-private.h:153
SSLSrvConfigRec::cipher_server_pref
BOOL cipher_server_pref
Definition canl_mod_ssl-private.h:160
SSLSrvConfigRec::proxy
modssl_ctx_t * proxy
Definition canl_mod_ssl-private.h:163
SSLSrvConfigRec::session_cache_timeout
int session_cache_timeout
Definition canl_mod_ssl-private.h:158
SSLSrvConfigRec::proxy_enabled
BOOL proxy_enabled
Definition canl_mod_ssl-private.h:155
modssl_auth_ctx_t
Definition canl_mod_ssl-private.h:118
modssl_auth_ctx_t::verify_mode
ssl_verify_t verify_mode
Definition canl_mod_ssl-private.h:125
modssl_auth_ctx_t::cipher_suite
const char * cipher_suite
Definition canl_mod_ssl-private.h:122
modssl_auth_ctx_t::ca_cert_file
const char * ca_cert_file
Definition canl_mod_ssl-private.h:120
modssl_auth_ctx_t::verify_depth
int verify_depth
Definition canl_mod_ssl-private.h:124
modssl_auth_ctx_t::ca_cert_path
const char * ca_cert_path
Definition canl_mod_ssl-private.h:119
modssl_ctx_t
Definition canl_mod_ssl-private.h:129
modssl_ctx_t::crl
X509_STORE * crl
Definition canl_mod_ssl-private.h:145
modssl_ctx_t::auth
modssl_auth_ctx_t auth
Definition canl_mod_ssl-private.h:147
modssl_ctx_t::ssl_ctx
SSL_CTX * ssl_ctx
Definition canl_mod_ssl-private.h:131
modssl_ctx_t::protocol
int protocol
Definition canl_mod_ssl-private.h:136
modssl_ctx_t::crl_path
const char * crl_path
Definition canl_mod_ssl-private.h:143
modssl_ctx_t::sc
void * sc
Definition canl_mod_ssl-private.h:130
modssl_ctx_t::pphrase_dialog_path
const char * pphrase_dialog_path
Definition canl_mod_ssl-private.h:139
modssl_ctx_t::pks
void * pks
Definition canl_mod_ssl-private.h:133
modssl_ctx_t::pphrase_dialog_type
int pphrase_dialog_type
Definition canl_mod_ssl-private.h:138
modssl_ctx_t::crl_file
const char * crl_file
Definition canl_mod_ssl-private.h:144
modssl_ctx_t::pkp
void * pkp
Definition canl_mod_ssl-private.h:134
modssl_ctx_t::cert_chain
const char * cert_chain
Definition canl_mod_ssl-private.h:141