mod_ssl.c revision 807c436563a054c3513648163fd2e36612b68c9a
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder/* Licensed to the Apache Software Foundation (ASF) under one or more
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * contributor license agreements. See the NOTICE file distributed with
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * this work for additional information regarding copyright ownership.
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * The ASF licenses this file to You under the Apache License, Version 2.0
75a6279dbae159d018ef812185416cf6df386c10Till Mossakowski * (the "License"); you may not use this file except in compliance with
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * the License. You may obtain a copy of the License at
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder *
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * http://www.apache.org/licenses/LICENSE-2.0
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder *
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * Unless required by applicable law or agreed to in writing, software
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * distributed under the License is distributed on an "AS IS" BASIS,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * See the License for the specific language governing permissions and
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * limitations under the License.
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder */
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder/* _ _
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * _ __ ___ ___ __| | ___ ___| | mod_ssl
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * | | | | | | (_) | (_| | \__ \__ \ |
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * |_| |_| |_|\___/ \__,_|___|___/___/_|
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * |_____|
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * mod_ssl.c
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * Apache API interface structures
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder */
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include "ssl_private.h"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include "mod_ssl.h"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include "util_md5.h"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include "util_mutex.h"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include "ap_provider.h"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include <assert.h>
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#if HAVE_VALGRIND
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#include <valgrind.h>
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maederint ssl_running_on_valgrind = 0;
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#endif
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder/*
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski * the table of configuration directives we provide
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski */
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#define SSL_CMD_ALL(name, args, desc) \
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder NULL, RSRC_CONF|OR_AUTHCFG, desc),
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#define SSL_CMD_SRV(name, args, desc) \
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder NULL, RSRC_CONF, desc),
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder#define SSL_CMD_DIR(name, type, args, desc) \
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder NULL, OR_##type, desc),
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder#define AP_END_CMD { NULL }
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowskistatic const command_rec ssl_config_cmds[] = {
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /*
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder * Global (main-server) context configuration directives
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder */
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder SSL_CMD_SRV(PassPhraseDialog, TAKE1,
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "SSL dialog mechanism for the pass phrase query "
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "('builtin', '|/path/to/pipe_program', "
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "or 'exec:/path/to/cgi_program')")
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder SSL_CMD_SRV(SessionCache, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Session Cache storage "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('none', 'nonenotnull', 'dbm:/path/to/file')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CryptoDevice, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL external Crypto Device usage "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "('builtin', '...')")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski#endif
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_SRV(RandomSeed, TAKE23,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "SSL Pseudo Random Number Generator (PRNG) seeding source "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "('startup|connect builtin|file:/path|exec:/path [bytes]')")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski /*
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski * Per-server context configuration directives
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski */
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_SRV(Engine, TAKE1,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "SSL switch for the protocol engine "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "('on', 'off')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(FIPS, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Enable FIPS-140 mode "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "(`on', `off')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_ALL(CipherSuite, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Colon-delimited list of permitted SSL Ciphers "
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "('XXX:...:XXX' - see manual)")
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder SSL_CMD_SRV(CertificateFile, TAKE1,
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "SSL Server Certificate file "
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "('/path/to/file' - PEM or DER encoded)")
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder SSL_CMD_SRV(CertificateKeyFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Server Private Key file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM or DER encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CertificateChainFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Server CA Certificate Chain file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(PKCS7CertificateFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "PKCS#7 file containing server certificate and chain"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder " certificates ('/path/to/file' - PEM encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#ifdef HAVE_TLS_SESSION_TICKETS
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(SessionTicketKeyFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "TLS session ticket encryption/decryption key file (RFC 5077) "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - file with 48 bytes of random data)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#endif
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_ALL(CACertificatePath, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Certificate path "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/dir' - contains PEM encoded files)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_ALL(CACertificateFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Certificate file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CADNRequestPath, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Distinguished Name path "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/dir' - symlink hashes to PEM of acceptable CA names to request)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CADNRequestFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Distinguished Name file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded to derive acceptable CA names to request)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CARevocationPath, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Certificate Revocation List (CRL) path "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/dir' - contains PEM encoded files)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CARevocationFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Certificate Revocation List (CRL) file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(CARevocationCheck, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL CA Certificate Revocation List (CRL) checking mode")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_ALL(VerifyClient, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Client verify type "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('none', 'optional', 'require', 'optional_no_ca')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_ALL(VerifyDepth, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Client verify depth "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('N' - number of intermediate certificates)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(SessionCacheTimeout, TAKE1,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "SSL Session Cache object lifetime "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('N' - number of seconds)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#ifdef HAVE_TLSV1_X
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#define SSL_PROTOCOLS "SSLv3|TLSv1|TLSv1.1|TLSv1.2"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#else
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#define SSL_PROTOCOLS "SSLv3|TLSv1"
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#endif
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(Protocol, RAW_ARGS,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Enable or disable various SSL protocols "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(HonorCipherOrder, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Use the server's cipher ordering preference")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(Compression, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Enable SSL level compression "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "(`on', `off')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(InsecureRenegotiation, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Enable support for insecure renegotiation")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_ALL(UserName, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Set user name to SSL variable value")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(StrictSNIVHostCheck, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "Strict SNI virtual host checking")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#ifndef OPENSSL_NO_SRP
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(SRPVerifierFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SRP verifier file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - created by srptool)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(SRPUnknownUserSeed, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SRP seed for unknown users (to avoid leaking a user's existence) "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('some secret text')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder#endif
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder /*
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder * Proxy configuration for remote SSL connections
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder */
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(ProxyEngine, FLAG,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL switch for the proxy protocol engine "
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder "('on', 'off')")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(ProxyProtocol, RAW_ARGS,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: enable or disable SSL protocol flavors "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('[+-][" SSL_PROTOCOLS "] ...' - see manual)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCipherSuite, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: colon-delimited list of permitted SSL ciphers "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('XXX:...:XXX' - see manual)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyVerify, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: whether to verify the remote certificate "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('on' or 'off')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyVerifyDepth, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: maximum certificate verification depth "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('N' - number of intermediate certificates)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCACertificateFile, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: file containing server certificates "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('/path/to/file' - PEM encoded certificates)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCACertificatePath, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: directory containing server certificates "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "('/path/to/dir' - contains PEM encoded certificates)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCARevocationPath, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: CA Certificate Revocation List (CRL) path "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/dir' - contains PEM encoded files)")
4b6aa93c12e4db86ccc7694a48a73e9cf7262d06Christian Maeder SSL_CMD_SRV(ProxyCARevocationFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Proxy: CA Certificate Revocation List (CRL) file "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(ProxyCARevocationCheck, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Proxy: CA Certificate Revocation List (CRL) checking mode")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(ProxyMachineCertificateFile, TAKE1,
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "SSL Proxy: file containing client certificates "
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder "('/path/to/file' - PEM encoded certificates)")
01aafb6a9520f05df5ff467b591ecb5474dcfc86Christian Maeder SSL_CMD_SRV(ProxyMachineCertificatePath, TAKE1,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "SSL Proxy: directory containing client certificates "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "('/path/to/dir' - contains PEM encoded certificates)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyMachineCertificateChainFile, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: file containing issuing certificates "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "of the client certificate "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "(`/path/to/file' - PEM encoded certificates)")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCheckPeerExpire, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: check the peer certificate's expiration date")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCheckPeerCN, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: check the peer certificate's CN")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(ProxyCheckPeerName, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Proxy: check the peer certificate's name "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "(must be present in subjectAltName extension or CN")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /*
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * Per-directory context configuration directives
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski */
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_DIR(Options, OPTIONS, RAW_ARGS,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "Set one or more options to configure the SSL engine"
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "('[+-]option[=value] ...' - see manual)")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_DIR(RequireSSL, AUTHCFG, NO_ARGS,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "Require the SSL protocol for the per-directory context "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "(no arguments)")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_DIR(Require, AUTHCFG, RAW_ARGS,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "Require a boolean expression to evaluate to true for granting access"
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "(arbitrary complex boolean expression - see manual)")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_DIR(RenegBufferSize, AUTHCFG, TAKE1,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "Configure the amount of memory that will be used for buffering the "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "request body if a per-location SSL renegotiation is required due to "
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "changed access control requirements")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_SRV(OCSPEnable, FLAG,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "Enable use of OCSP to verify certificate revocation ('on', 'off')")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_SRV(OCSPDefaultResponder, TAKE1,
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski "URL of the default OCSP Responder")
b10d6cef708b7a659f2d3b367e8e0db0d03ae3f5Till Mossakowski SSL_CMD_SRV(OCSPOverrideResponder, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "Force use of the default responder URL ('on', 'off')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(OCSPResponseTimeSkew, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "Maximum time difference in OCSP responses")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(OCSPResponseMaxAge, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "Maximum age of OCSP responses")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(OCSPResponderTimeout, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "OCSP responder query timeout")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#ifdef HAVE_OCSP_STAPLING
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /*
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * OCSP Stapling options
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski */
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingCache, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL Stapling Response Cache storage "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "(`dbm:/path/to/file')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(UseStapling, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL switch for the OCSP Stapling protocol " "(`on', `off')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingResponseTimeSkew, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option for maximum time difference in OCSP responses")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingResponderTimeout, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option for OCSP responder timeout")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingResponseMaxAge, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option for maximum age of OCSP responses")
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski SSL_CMD_SRV(StaplingStandardCacheTimeout, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option for normal OCSP Response Cache Lifetime")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingReturnResponderErrors, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling switch to return Status Errors Back to Client"
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "(`on', `off')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingFakeTryLater, FLAG,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling switch to send tryLater response to client on error "
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "(`on', `off')")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingErrorCacheTimeout, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option for OCSP Response Error Cache Lifetime")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(StaplingForceURL, TAKE1,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSL stapling option to Force the OCSP Stapling URL")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#endif
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#ifdef HAVE_SSL_CONF_CMD
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski SSL_CMD_SRV(OpenSSLConfCmd, TAKE2,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "OpenSSL configuration command")
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#endif
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /* Deprecated directives. */
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSLLog directive is no longer supported - use ErrorLog."),
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski AP_INIT_RAW_ARGS("SSLLogLevel", ap_set_deprecated, NULL, OR_ALL,
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski "SSLLogLevel directive is no longer supported - use LogLevel."),
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski AP_END_CMD
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski};
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski/*
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * the various processing hooks
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski */
5e46b572ed576c0494768998b043d9d340594122Till Mossakowskistatic apr_status_t ssl_cleanup_pre_config(void *data)
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski{
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /*
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * Try to kill the internals of the SSL library.
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski */
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski /* Corresponds to OPENSSL_load_builtin_modules():
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski * XXX: borrowed from apps.h, but why not CONF_modules_free()
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski * which also invokes CONF_modules_finish()?
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski */
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski CONF_modules_unload(1);
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /* Corresponds to SSL_library_init: */
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski EVP_cleanup();
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski ENGINE_cleanup();
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#endif
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#if OPENSSL_VERSION_NUMBER >= 0x1000000fL
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski ERR_remove_thread_state(NULL);
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#else
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski ERR_remove_state(0);
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski#endif
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski /* Don't call ERR_free_strings here; ERR_load_*_strings only
5e46b572ed576c0494768998b043d9d340594122Till Mossakowski * actually load the error strings once per process due to static
a938729e277da5c7742bb88946ab2c150416fd5dTill Mossakowski * variable abuse in OpenSSL. */
/* Also don't call CRYPTO_cleanup_all_ex_data here; any registered
* ex_data indices may have been cached in static variables in
* OpenSSL; removing them may cause havoc. Notably, with OpenSSL
* versions >= 0.9.8f, COMP_CTX cleanups would not be run, which
* could result in a per-connection memory leak (!). */
/*
* TODO: determine somewhere we can safely shove out diagnostics
* (when enabled) at this late stage in the game:
* CRYPTO_mem_leaks_fp(stderr);
*/
return APR_SUCCESS;
}
static int ssl_hook_pre_config(apr_pool_t *pconf,
apr_pool_t *plog,
apr_pool_t *ptemp)
{
#if HAVE_VALGRIND
ssl_running_on_valgrind = RUNNING_ON_VALGRIND;
#endif
/* We must register the library in full, to ensure our configuration
* code can successfully test the SSL environment.
*/
CRYPTO_malloc_init();
ERR_load_crypto_strings();
SSL_load_error_strings();
SSL_library_init();
#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
ENGINE_load_builtin_engines();
#endif
OpenSSL_add_all_algorithms();
OPENSSL_load_builtin_modules();
/*
* Let us cleanup the ssl library when the module is unloaded
*/
apr_pool_cleanup_register(pconf, NULL, ssl_cleanup_pre_config,
apr_pool_cleanup_null);
/* Register us to handle mod_log_config %c/%x variables */
ssl_var_log_config_register(pconf);
/* Register to handle mod_status status page generation */
ssl_scache_status_register(pconf);
/* Register mutex type names so they can be configured with Mutex */
ap_mutex_register(pconf, SSL_CACHE_MUTEX_TYPE, NULL, APR_LOCK_DEFAULT, 0);
#ifdef HAVE_OCSP_STAPLING
ap_mutex_register(pconf, SSL_STAPLING_MUTEX_TYPE, NULL, APR_LOCK_DEFAULT, 0);
#endif
return OK;
}
static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
{
SSLConnRec *sslconn = myConnConfig(c);
if (sslconn) {
return sslconn;
}
sslconn = apr_pcalloc(c->pool, sizeof(*sslconn));
sslconn->server = c->base_server;
sslconn->verify_depth = UNSET;
myConnConfigSet(c, sslconn);
return sslconn;
}
static int ssl_proxy_enable(conn_rec *c)
{
SSLSrvConfigRec *sc;
SSLConnRec *sslconn = ssl_init_connection_ctx(c);
sc = mySrvConfig(sslconn->server);
if (!sc->proxy_enabled) {
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
"SSL Proxy requested for %s but not enabled "
"[Hint: SSLProxyEngine]", sc->vhost_id);
return 0;
}
sslconn->is_proxy = 1;
sslconn->disabled = 0;
return 1;
}
static int ssl_engine_disable(conn_rec *c)
{
SSLSrvConfigRec *sc;
SSLConnRec *sslconn = myConnConfig(c);
if (sslconn) {
sc = mySrvConfig(sslconn->server);
}
else {
sc = mySrvConfig(c->base_server);
}
if (sc->enabled == SSL_ENABLED_FALSE) {
return 0;
}
sslconn = ssl_init_connection_ctx(c);
sslconn->disabled = 1;
return 1;
}
static int modssl_register_npn(conn_rec *c,
ssl_npn_advertise_protos advertisefn,
ssl_npn_proto_negotiated negotiatedfn)
{
#ifdef HAVE_TLS_NPN
SSLConnRec *sslconn = myConnConfig(c);
if (!sslconn) {
return DECLINED;
}
if (!sslconn->npn_advertfns) {
sslconn->npn_advertfns =
apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos));
sslconn->npn_negofns =
apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated));
}
if (advertisefn)
APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) =
advertisefn;
if (negotiatedfn)
APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) =
negotiatedfn;
return OK;
#else
return DECLINED;
#endif
}
int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
{
SSLSrvConfigRec *sc;
SSL *ssl;
SSLConnRec *sslconn = myConnConfig(c);
char *vhost_md5;
modssl_ctx_t *mctx;
server_rec *server;
if (!sslconn) {
sslconn = ssl_init_connection_ctx(c);
}
server = sslconn->server;
sc = mySrvConfig(server);
/*
* Seed the Pseudo Random Number Generator (PRNG)
*/
ssl_rand_seed(server, c->pool, SSL_RSCTX_CONNECT, "");
mctx = sslconn->is_proxy ? sc->proxy : sc->server;
/*
* Create a new SSL connection with the configured server SSL context and
* attach this to the socket. Additionally we register this attachment
* so we can detach later.
*/
if (!(ssl = SSL_new(mctx->ssl_ctx))) {
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01962)
"Unable to create a new SSL connection from the SSL "
"context");
ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, server);
c->aborted = 1;
return DECLINED; /* XXX */
}
vhost_md5 = ap_md5_binary(c->pool, (unsigned char *)sc->vhost_id,
sc->vhost_id_len);
if (!SSL_set_session_id_context(ssl, (unsigned char *)vhost_md5,
APR_MD5_DIGESTSIZE*2))
{
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01963)
"Unable to set session id context to '%s'", vhost_md5);
ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, server);
c->aborted = 1;
return DECLINED; /* XXX */
}
SSL_set_app_data(ssl, c);
SSL_set_app_data2(ssl, NULL); /* will be request_rec */
sslconn->ssl = ssl;
/*
* Configure callbacks for SSL connection
*/
SSL_set_tmp_rsa_callback(ssl, ssl_callback_TmpRSA);
SSL_set_tmp_dh_callback(ssl, ssl_callback_TmpDH);
#ifndef OPENSSL_NO_EC
SSL_set_tmp_ecdh_callback(ssl, ssl_callback_TmpECDH);
#endif
SSL_set_verify_result(ssl, X509_V_OK);
ssl_io_filter_init(c, r, ssl);
return APR_SUCCESS;
}
static const char *ssl_hook_http_scheme(const request_rec *r)
{
SSLSrvConfigRec *sc = mySrvConfig(r->server);
if (sc->enabled == SSL_ENABLED_FALSE || sc->enabled == SSL_ENABLED_OPTIONAL) {
return NULL;
}
return "https";
}
static apr_port_t ssl_hook_default_port(const request_rec *r)
{
SSLSrvConfigRec *sc = mySrvConfig(r->server);
if (sc->enabled == SSL_ENABLED_FALSE || sc->enabled == SSL_ENABLED_OPTIONAL) {
return 0;
}
return 443;
}
static int ssl_hook_pre_connection(conn_rec *c, void *csd)
{
SSLSrvConfigRec *sc;
SSLConnRec *sslconn = myConnConfig(c);
if (sslconn) {
sc = mySrvConfig(sslconn->server);
}
else {
sc = mySrvConfig(c->base_server);
}
/*
* Immediately stop processing if SSL is disabled for this connection
*/
if (!(sc && (sc->enabled == SSL_ENABLED_TRUE ||
(sslconn && sslconn->is_proxy))))
{
return DECLINED;
}
/*
* Create SSL context
*/
if (!sslconn) {
sslconn = ssl_init_connection_ctx(c);
}
if (sslconn->disabled) {
return DECLINED;
}
/*
* Remember the connection information for
* later access inside callback functions
*/
ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO(01964)
"Connection to child %ld established "
"(server %s)", c->id, sc->vhost_id);
return ssl_init_ssl_connection(c, NULL);
}
/*
* the module registration phase
*/
static void ssl_register_hooks(apr_pool_t *p)
{
/* ssl_hook_ReadReq needs to use the BrowserMatch settings so must
* run after mod_setenvif's post_read_request hook. */
static const char *pre_prr[] = { "mod_setenvif.c", NULL };
ssl_io_filter_register(p);
ap_hook_pre_connection(ssl_hook_pre_connection,NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_test_config (ssl_hook_ConfigTest, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_post_config (ssl_init_Module, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_http_scheme (ssl_hook_http_scheme, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_default_port (ssl_hook_default_port, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_pre_config (ssl_hook_pre_config, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_child_init (ssl_init_Child, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_check_authn (ssl_hook_UserCheck, NULL,NULL, APR_HOOK_FIRST,
AP_AUTH_INTERNAL_PER_CONF);
ap_hook_fixups (ssl_hook_Fixup, NULL,NULL, APR_HOOK_MIDDLE);
ap_hook_check_access (ssl_hook_Access, NULL,NULL, APR_HOOK_MIDDLE,
AP_AUTH_INTERNAL_PER_CONF);
ap_hook_check_authz (ssl_hook_Auth, NULL,NULL, APR_HOOK_MIDDLE,
AP_AUTH_INTERNAL_PER_CONF);
ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
ssl_var_register(p);
APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
APR_REGISTER_OPTIONAL_FN(modssl_register_npn);
ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl",
AUTHZ_PROVIDER_VERSION,
&ssl_authz_provider_require_ssl,
AP_AUTH_INTERNAL_PER_CONF);
ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl-verify-client",
AUTHZ_PROVIDER_VERSION,
&ssl_authz_provider_verify_client,
AP_AUTH_INTERNAL_PER_CONF);
}
module AP_MODULE_DECLARE_DATA ssl_module = {
STANDARD20_MODULE_STUFF,
ssl_config_perdir_create, /* create per-dir config structures */
ssl_config_perdir_merge, /* merge per-dir config structures */
ssl_config_server_create, /* create per-server config structures */
ssl_config_server_merge, /* merge per-server config structures */
ssl_config_cmds, /* table of configuration directives */
ssl_register_hooks /* register hooks */
};