modules/ssl/mod_ssl.c

	mod_ssl.c revision 2b7078b0c4fd5b6054f6f2d4f626177844f5c6f7
967e5f3c25249c779575864692935627004d3f9eChristian Maeder/*                      _             _
967e5f3c25249c779575864692935627004d3f9eChristian Maeder**  _ __ ___   ___   __| |    ___ ___| |  mod_ssl
81d182b21020b815887e9057959228546cf61b6bChristian Maeder** | '_ ` _ \ / _ \ / _` |   / __/ __| |  Apache Interface to OpenSSL
f11f713bebd8e1e623a0a4361065df256033de47Christian Maeder** | | | | | | (_) | (_| |   \__ \__ \ |  www.modssl.org
98890889ffb2e8f6f722b00e265a211f13b5a861Corneliu-Claudiu Prodescu** |_| |_| |_|\___/ \__,_|___|___/___/_|  ftp.modssl.org
967e5f3c25249c779575864692935627004d3f9eChristian Maeder**                      |_____|
3f69b6948966979163bdfe8331c38833d5d90ecdChristian Maeder**  mod_ssl.c
967e5f3c25249c779575864692935627004d3f9eChristian Maeder**  Apache API interface structures
89054b2b95a3f92e78324dc852f3d34704e2ca49Christian Maeder*/
f3a94a197960e548ecd6520bb768cb0d547457bbChristian Maeder
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder/* ====================================================================
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder * The Apache Software License, Version 1.1
967e5f3c25249c779575864692935627004d3f9eChristian Maeder *
967e5f3c25249c779575864692935627004d3f9eChristian Maeder * Copyright (c) 2000-2003 The Apache Software Foundation.  All rights
967e5f3c25249c779575864692935627004d3f9eChristian Maeder * reserved.
967e5f3c25249c779575864692935627004d3f9eChristian Maeder *
fd896e2068ad7e50aed66ac18c3720ea7ff2619fChristian Maeder * Redistribution and use in source and binary forms, with or without
7221c71b38c871ce66eee4537cb681d468308dfbChristian Maeder * modification, are permitted provided that the following conditions
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder * are met:
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder *
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder * 1. Redistributions of source code must retain the above copyright
ac19f8695aa1b2d2d1cd1319da2530edd8f46a96Christian Maeder *    notice, this list of conditions and the following disclaimer.
8b9fda012e5ee53b7b2320c0638896a0ff6e99f3Christian Maeder *
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder * 2. Redistributions in binary form must reproduce the above copyright
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder *    notice, this list of conditions and the following disclaimer in
e1839fb37a3a2ccd457464cb0dcc5efd466dbe22Christian Maeder *    the documentation and/or other materials provided with the
4ef2a978e66e2246ff0b7f00c77deb7aabb28b8eChristian Maeder *    distribution.
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder *
fd896e2068ad7e50aed66ac18c3720ea7ff2619fChristian Maeder * 3. The end-user documentation included with the redistribution,
967e5f3c25249c779575864692935627004d3f9eChristian Maeder *    if any, must include the following acknowledgment:
8e9c3881fb6e710b1e08bf5ac8ff9d393df2e74eChristian Maeder *       "This product includes software developed by the
78eeae099616e255ccf2e5f9122387bb10c68338Christian Maeder *        Apache Software Foundation (http://www.apache.org/)."
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder *    Alternately, this acknowledgment may appear in the software itself,
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder *    if and wherever such third-party acknowledgments normally appear.
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder *
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder * 4. The names "Apache" and "Apache Software Foundation" must
ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder *    not be used to endorse or promote products derived from this
fd896e2068ad7e50aed66ac18c3720ea7ff2619fChristian Maeder *    software without prior written permission. For written
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder *    permission, please contact apache@apache.org.
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder *
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder * 5. Products derived from this software may not be called "Apache",
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder *    nor may "Apache" appear in their name, without prior written
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder *    permission of the Apache Software Foundation.
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder *
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
51fb5d7edd9369c367dda2f8b15ddd6f8a146606Christian Maeder * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
51fb5d7edd9369c367dda2f8b15ddd6f8a146606Christian Maeder * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder * SUCH DAMAGE.
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder * ====================================================================
72b9099aeec0762bae4546db3bc4b48721027bf4Christian Maeder */
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder#include "mod_ssl.h"
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder#include "util_md5.h"
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder#include <assert.h>
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder
7a879b08ae0ca30006f9be887a73212b07f10204Christian Maeder/*
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder *  the table of configuration directives we provide
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder */
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#define SSL_CMD_ALL(name, args, desc) \
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder        AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                       NULL, RSRC_CONF|OR_AUTHCFG, desc),
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#define SSL_CMD_SRV(name, args, desc) \
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder        AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                       NULL, RSRC_CONF, desc),
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#define SSL_CMD_DIR(name, type, args, desc) \
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder        AP_INIT_##args("SSL"#name, ssl_cmd_SSL##name, \
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder                       NULL, OR_##type, desc),
7a879b08ae0ca30006f9be887a73212b07f10204Christian Maeder
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#define AP_END_CMD { NULL }
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maederconst char ssl_valid_ssl_mutex_string[] =
a89389521ddf76109168a0b339031575aafbd512Christian Maeder    "Valid SSLMutex mechanisms are: `none', `default'"
a89389521ddf76109168a0b339031575aafbd512Christian Maeder#if APR_HAS_FLOCK_SERIALIZE
a89389521ddf76109168a0b339031575aafbd512Christian Maeder    ", `flock:/path/to/file'"
a89389521ddf76109168a0b339031575aafbd512Christian Maeder#endif
a89389521ddf76109168a0b339031575aafbd512Christian Maeder#if APR_HAS_FCNTL_SERIALIZE
a89389521ddf76109168a0b339031575aafbd512Christian Maeder    ", `fcntl:/path/to/file'"
a89389521ddf76109168a0b339031575aafbd512Christian Maeder#endif
a89389521ddf76109168a0b339031575aafbd512Christian Maeder#if APR_HAS_SYSVSEM_SERIALIZE && !defined(PERCHILD_MPM)
a89389521ddf76109168a0b339031575aafbd512Christian Maeder    ", `sysvsem'"
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder#endif
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder#if APR_HAS_POSIXSEM_SERIALIZE
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    ", `posixsem'"
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#endif
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder#if APR_HAS_PROC_PTHREAD_SERIALIZE
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    ", `pthread'"
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder#endif
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder#if APR_HAS_FLOCK_SERIALIZE || APR_HAS_FCNTL_SERIALIZE
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    ", `file:/path/to/file'"
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder#endif
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder#if (APR_HAS_SYSVSEM_SERIALIZE && !defined(PERCHILD_MPM)) || APR_HAS_POSIXSEM_SERIALIZE
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder    ", `sem'"
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder#endif
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder    " ";
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maederstatic const command_rec ssl_config_cmds[] = {
e77eadd37125110f448dd5ddec7da5b78d35285fChristian Maeder    /*
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder     * Global (main-server) context configuration directives
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder     */
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    SSL_CMD_SRV(Mutex, TAKE1, ssl_valid_ssl_mutex_string)
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    SSL_CMD_SRV(PassPhraseDialog, TAKE1,
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder                "SSL dialog mechanism for the pass phrase query "
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder                "(`builtin', `|/path/to/pipe_program`, "
ceef5f7843a1f96fe5a62e0f6880e38b3d5f4708Christian Maeder                "or `exec:/path/to/cgi_program')")
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder    SSL_CMD_SRV(SessionCache, TAKE1,
54ff63bb3b23ef18efbdc51b053a2ca6f348329aChristian Maeder                "SSL Session Cache storage "
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder                "(`none', `dbm:/path/to/file')")
67086e0fe40a985c5e8a3cf50e611f43234580c2Christian Maeder#ifdef HAVE_ENGINE_INIT
e77eadd37125110f448dd5ddec7da5b78d35285fChristian Maeder    SSL_CMD_SRV(CryptoDevice, TAKE1,
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder                "SSL external Crypto Device usage "
ee93fb771fcf3000d73c8e2f2000adb4b9a5158cChristian Maeder                "(`builtin', `...')")
67086e0fe40a985c5e8a3cf50e611f43234580c2Christian Maeder#endif
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder    SSL_CMD_SRV(RandomSeed, TAKE23,
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder                "SSL Pseudo Random Number Generator (PRNG) seeding source "
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder                "(`startup|connect builtin|file:/path|exec:/path [bytes]')")
d48085f765fca838c1d972d2123601997174583dChristian Maeder
d48085f765fca838c1d972d2123601997174583dChristian Maeder    /*
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder     * Per-server context configuration directives
d48085f765fca838c1d972d2123601997174583dChristian Maeder     */
d48085f765fca838c1d972d2123601997174583dChristian Maeder    SSL_CMD_SRV(Engine, TAKE1,
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder                "SSL switch for the protocol engine "
d48085f765fca838c1d972d2123601997174583dChristian Maeder                "(`on', `off')")
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder    SSL_CMD_ALL(CipherSuite, TAKE1,
717686b54b9650402e2ebfbaadf433eab8ba5171Christian Maeder                "Colon-delimited list of permitted SSL Ciphers "
e7ce154edb906685b3fa7f6c0a764e18a4658068Christian Maeder                "(`XXX:...:XXX' - see manual)")
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder    SSL_CMD_SRV(CertificateFile, TAKE1,
9b30898b139ee02f97ac933b6d935ef0a4206921Christian Maeder                "SSL Server Certificate file "
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder                "(`/path/to/file' - PEM or DER encoded)")
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    SSL_CMD_SRV(CertificateKeyFile, TAKE1,
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder                "SSL Server Private Key file "
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "(`/path/to/file' - PEM or DER encoded)")
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder    SSL_CMD_SRV(CertificateChainFile, TAKE1,
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "SSL Server CA Certificate Chain file "
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "(`/path/to/file' - PEM encoded)")
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder    SSL_CMD_ALL(CACertificatePath, TAKE1,
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder                "SSL CA Certificate path "
67d92da5e9610aabad39055a16031154b4dc3748Christian Maeder                "(`/path/to/dir' - contains PEM encoded files)")
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder    SSL_CMD_ALL(CACertificateFile, TAKE1,
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "SSL CA Certificate file "
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "(`/path/to/file' - PEM encoded)")
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    SSL_CMD_SRV(CARevocationPath, TAKE1,
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder                "SSL CA Certificate Revocation List (CRL) path "
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder                "(`/path/to/dir' - contains PEM encoded files)")
0a8ea95bcf0e3f84fed0b725c049ec2a956a4a28Christian Maeder    SSL_CMD_SRV(CARevocationFile, TAKE1,
967e5f3c25249c779575864692935627004d3f9eChristian Maeder                "SSL CA Certificate Revocation List (CRL) file "
18b513ff41708f24e1a7407f36b719add813ffeaChristian Maeder                "(`/path/to/file' - PEM encoded)")
dedabc954aa15f6ad0764472a9434dc6dafe3db2Christian Maeder    SSL_CMD_ALL(VerifyClient, TAKE1,
a89e661aad28f1b39f4fc9f9f9a4d46074234123Christian Maeder                "SSL Client verify type "
a23e572c8f957cc051a1b0831abd6fe9380d45c7Christian Maeder                "(`none', `optional', `require', `optional_no_ca')")
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder    SSL_CMD_ALL(VerifyDepth, TAKE1,
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder                "SSL Client verify depth "
3c8d067accf18572352351ec42ff905c7297a8a5Christian Maeder                "(`N' - number of intermediate certificates)")
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder    SSL_CMD_SRV(SessionCacheTimeout, TAKE1,
f2ee9fc53048ea92bad79e3f5d292d83efd7f8beMihai Codescu                "SSL Session Cache object lifetime "
3c8d067accf18572352351ec42ff905c7297a8a5Christian Maeder                "(`N' - number of seconds)")
81d182b21020b815887e9057959228546cf61b6bChristian Maeder    SSL_CMD_SRV(Protocol, RAW_ARGS,
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder                "Enable or disable various SSL protocols"
242397ba0f1cc490e892130bf0df239deeecf5daChristian Maeder                "(`[+-][SSLv2|SSLv3|TLSv1] ...' - see manual)")
2e9985cd67e4f2414becb670ef33b8f16513e41dChristian Maeder
242397ba0f1cc490e892130bf0df239deeecf5daChristian Maeder    /*
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder     * Proxy configuration for remote SSL connections
d769b9ca726a9b50d661847c0e58c41d6ef334b4Christian Maeder     */
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder    SSL_CMD_SRV(ProxyEngine, FLAG,
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder                "SSL switch for the proxy protocol engine "
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder                "(`on', `off')")
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder    SSL_CMD_SRV(ProxyProtocol, RAW_ARGS,
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder               "SSL Proxy: enable or disable SSL protocol flavors "
a74f814d3b445eadad6f68737a98a7a303698affChristian Maeder               "(`[+-][SSLv2|SSLv3|TLSv1] ...' - see manual)")
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder    SSL_CMD_SRV(ProxyCipherSuite, TAKE1,
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder               "SSL Proxy: colon-delimited list of permitted SSL ciphers "
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder               "(`XXX:...:XXX' - see manual)")
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder    SSL_CMD_SRV(ProxyVerify, TAKE1,
58b5ac21d1c88344246aaedab0c0bdc7b759d7c6Christian Maeder               "SSL Proxy: whether to verify the remote certificate "
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder               "(`on' or `off')")
c5c193a80459071696b68baf835f1b88f0f8c82eChristian Maeder    SSL_CMD_SRV(ProxyVerifyDepth, TAKE1,
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maeder               "SSL Proxy: maximum certificate verification depth "
dedabc954aa15f6ad0764472a9434dc6dafe3db2Christian Maeder               "(`N' - number of intermediate certificates)")
842eedc62639561781b6c33533d1949693ef6cc5Christian Maeder    SSL_CMD_SRV(ProxyCACertificateFile, TAKE1,
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder               "SSL Proxy: file containing server certificates "
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder               "(`/path/to/file' - PEM encoded certificates)")
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder    SSL_CMD_SRV(ProxyCACertificatePath, TAKE1,
842eedc62639561781b6c33533d1949693ef6cc5Christian Maeder               "SSL Proxy: directory containing server certificates "
bfa9e03532243ceb487f0384d0f6a447f1ce7670Till Mossakowski               "(`/path/to/dir' - contains PEM encoded certificates)")
967e5f3c25249c779575864692935627004d3f9eChristian Maeder    SSL_CMD_SRV(ProxyCARevocationPath, TAKE1,
967e5f3c25249c779575864692935627004d3f9eChristian Maeder                "SSL Proxy: CA Certificate Revocation List (CRL) path "
f2ee9fc53048ea92bad79e3f5d292d83efd7f8beMihai Codescu                "(`/path/to/dir' - contains PEM encoded files)")
967e5f3c25249c779575864692935627004d3f9eChristian Maeder    SSL_CMD_SRV(ProxyCARevocationFile, TAKE1,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder                "SSL Proxy: CA Certificate Revocation List (CRL) file "
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder                "(`/path/to/file' - PEM encoded)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    SSL_CMD_SRV(ProxyMachineCertificateFile, TAKE1,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "SSL Proxy: file containing client certificates "
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "(`/path/to/file' - PEM encoded certificates)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    SSL_CMD_SRV(ProxyMachineCertificatePath, TAKE1,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "SSL Proxy: directory containing client certificates "
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "(`/path/to/dir' - contains PEM encoded certificates)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    /*
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder     * Per-directory context configuration directives
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder     */
967e5f3c25249c779575864692935627004d3f9eChristian Maeder    SSL_CMD_DIR(Options, OPTIONS, RAW_ARGS,
967e5f3c25249c779575864692935627004d3f9eChristian Maeder               "Set one or more options to configure the SSL engine"
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder               "(`[+-]option[=value] ...' - see manual)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    SSL_CMD_DIR(RequireSSL, AUTHCFG, NO_ARGS,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "Require the SSL protocol for the per-directory context "
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "(no arguments)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    SSL_CMD_DIR(Require, AUTHCFG, RAW_ARGS,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "Require a boolean expression to evaluate to true for granting access"
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder               "(arbitrary complex boolean expression - see manual)")
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    /* Deprecated directives. */
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder      "SSLLog directive is no longer supported - use ErrorLog."),
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    AP_INIT_RAW_ARGS("SSLLogLevel", ap_set_deprecated, NULL, OR_ALL,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder      "SSLLogLevel directive is no longer supported - use LogLevel."),
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    AP_END_CMD
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder};
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder/*
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder *  the various processing hooks
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder */
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maederstatic apr_status_t ssl_cleanup_pre_config(void *data)
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder{
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    /*
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     * Try to kill the internals of the SSL library.
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     */
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder#ifdef OPENSSL_VERSION_NUMBER
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder#if OPENSSL_VERSION_NUMBER >= 0x00907001
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder    /* Corresponds to OPENSSL_load_builtin_modules():
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder     * XXX: borrowed from apps.h, but why not CONF_modules_free()
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder     * which also invokes CONF_modules_finish()?
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     */
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    CONF_modules_unload(1);
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder#endif
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder#endif
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder    /* Corresponds to SSL_library_init: */
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    EVP_cleanup();
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    ENGINE_cleanup();
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder#endif
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    CRYPTO_cleanup_all_ex_data();
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    ERR_remove_state(0);
9659c509ce5e78adc51d7b02a76274eddcba9338Christian Maeder    ERR_free_strings();
9659c509ce5e78adc51d7b02a76274eddcba9338Christian Maeder    /*
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     * TODO: determine somewhere we can safely shove out diagnostics
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     *       (when enabled) at this late stage in the game:
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     * CRYPTO_mem_leaks_fp(stderr);
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder     */
9659c509ce5e78adc51d7b02a76274eddcba9338Christian Maeder}
9659c509ce5e78adc51d7b02a76274eddcba9338Christian Maeder
551af0e4ba6d96bb24f3555f3b30ed648e22e34aChristian Maederstatic int ssl_hook_pre_config(apr_pool_t *pconf,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder                               apr_pool_t *plog,
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder                               apr_pool_t *ptemp)
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder{
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    /* We must register the library in full, to ensure our configuration
83814002b4922114cbe7e9ba728472a0bf44aac5Christian Maeder     * code can successfully test the SSL environment.
83814002b4922114cbe7e9ba728472a0bf44aac5Christian Maeder     */
a95f5379cabb30d3beb0545002cf50e9e4fc2c86Christian Maeder    CRYPTO_malloc_init();
97ee7048e63953c5617342ce38c30cbcb35cc0beChristian Maeder    ERR_load_crypto_strings();
97ee7048e63953c5617342ce38c30cbcb35cc0beChristian Maeder    SSL_library_init();
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    ENGINE_load_builtin_engines();
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder#endif
a74f814d3b445eadad6f68737a98a7a303698affChristian Maeder#ifdef OPENSSL_VERSION_NUMBER
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#if OPENSSL_VERSION_NUMBER >= 0x00907001
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    OPENSSL_load_builtin_modules();
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#endif
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder#endif
a74f814d3b445eadad6f68737a98a7a303698affChristian Maeder    SSL_load_error_strings();
b66eb6038bfbcd2fe520d87c151bb4f1f510e985Christian Maeder
2dfc7b04f2db681992ca04175f2beb0f127c9844Christian Maeder    /*
2dfc7b04f2db681992ca04175f2beb0f127c9844Christian Maeder     * Let us cleanup the ssl library when the module is unloaded
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder     */
a74f814d3b445eadad6f68737a98a7a303698affChristian Maeder    apr_pool_cleanup_register(pconf, NULL, ssl_cleanup_pre_config,
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder                                           apr_pool_cleanup_null);
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder    /* Register us to handle mod_log_config %c/%x variables */
1a75698c909ad515d59c76e65bd783f015c21c4dChristian Maeder    ssl_var_log_config_register(pconf);
588c0c022a0f4e129a89c3bc569daf6a835e182dChristian Maeder#if 0 /* XXX */
ad187062b0009820118c1b773a232e29b879a2faChristian Maeder    /* XXX: Register us to handle mod_status extensions that don't exist yet */
07b72edb610ee53b4832d132e96b0a3d8423f8ebChristian Maeder    ssl_scache_status_register(pconf);
#endif /* -0- */

    return OK;
}

static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
{
    SSLConnRec *sslconn = myConnConfig(c);

    if (sslconn) {
        return sslconn;
    }

    sslconn = apr_pcalloc(c->pool, sizeof(*sslconn));

    myConnConfigSet(c, sslconn);

    return sslconn;
}

int ssl_proxy_enable(conn_rec *c)
{
    SSLSrvConfigRec *sc = mySrvConfig(c->base_server);

    SSLConnRec *sslconn = ssl_init_connection_ctx(c);

    if (!sc->proxy_enabled) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server,
                     "SSL Proxy requested for %s but not enabled "
                     "[Hint: SSLProxyEngine]", sc->vhost_id);

        return 0;
    }

    sslconn->is_proxy = 1;
    sslconn->disabled = 0;

    return 1;
}

int ssl_engine_disable(conn_rec *c)
{
    SSLSrvConfigRec *sc = mySrvConfig(c->base_server);

    SSLConnRec *sslconn;

    if (!sc->enabled) {
        return 0;
    }

    sslconn = ssl_init_connection_ctx(c);

    sslconn->disabled = 1;

    return 1;
}

int ssl_init_ssl_connection(conn_rec *c)
{
    SSLSrvConfigRec *sc = mySrvConfig(c->base_server);
    SSL *ssl;
    SSLConnRec *sslconn = myConnConfig(c);
    char *vhost_md5;
    modssl_ctx_t *mctx;

    /*
     * Seed the Pseudo Random Number Generator (PRNG)
     */
    ssl_rand_seed(c->base_server, c->pool, SSL_RSCTX_CONNECT, "");

    if (!sslconn) {
        sslconn = ssl_init_connection_ctx(c);
    }

    mctx = sslconn->is_proxy ? sc->proxy : sc->server;

    /*
     * Create a new SSL connection with the configured server SSL context and
     * attach this to the socket. Additionally we register this attachment
     * so we can detach later.
     */
    if (!(ssl = SSL_new(mctx->ssl_ctx))) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server,
                     "Unable to create a new SSL connection from the SSL "
                     "context");
        ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, c->base_server);

        c->aborted = 1;

        return DECLINED; /* XXX */
    }

    vhost_md5 = ap_md5_binary(c->pool, (unsigned char *)sc->vhost_id,
                              sc->vhost_id_len);

    if (!SSL_set_session_id_context(ssl, (unsigned char *)vhost_md5,
                                    MD5_DIGESTSIZE*2))
    {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server,
                     "Unable to set session id context to `%s'", vhost_md5);
        ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, c->base_server);

        c->aborted = 1;

        return DECLINED; /* XXX */
    }

    SSL_set_app_data(ssl, c);
    SSL_set_app_data2(ssl, NULL); /* will be request_rec */

    sslconn->ssl = ssl;

    /*
     *  Configure callbacks for SSL connection
     */
    SSL_set_tmp_rsa_callback(ssl, ssl_callback_TmpRSA);
    SSL_set_tmp_dh_callback(ssl,  ssl_callback_TmpDH);

    SSL_set_verify_result(ssl, X509_V_OK);

    ssl_io_filter_init(c, ssl);

    return APR_SUCCESS;
}

static const char *ssl_hook_http_method(const request_rec *r)
{
    SSLSrvConfigRec *sc = mySrvConfig(r->server);

    if (sc->enabled == FALSE) {
        return NULL;
    }

    return "https";
}

static apr_port_t ssl_hook_default_port(const request_rec *r)
{
    SSLSrvConfigRec *sc = mySrvConfig(r->server);

    if (sc->enabled == FALSE) {
        return 0;
    }

    return 443;
}

static int ssl_hook_pre_connection(conn_rec *c, void *csd)
{
    SSLSrvConfigRec *sc = mySrvConfig(c->base_server);
    SSLConnRec *sslconn = myConnConfig(c);

    /*
     * Immediately stop processing if SSL is disabled for this connection
     */
    if (!(sc && (sc->enabled == TRUE ||
                 (sslconn && sslconn->is_proxy))))
    {
        return DECLINED;
    }

    /*
     * Create SSL context
     */
    if (!sslconn) {
        sslconn = ssl_init_connection_ctx(c);
    }

    if (sslconn->disabled) {
        return DECLINED;
    }

    /*
     * Remember the connection information for
     * later access inside callback functions
     */

    ap_log_error(APLOG_MARK, APLOG_INFO, 0, c->base_server,
                 "Connection to child %ld established "
                 "(server %s, client %s)", c->id, sc->vhost_id,
                 c->remote_ip ? c->remote_ip : "unknown");

    return ssl_init_ssl_connection(c);
}


static void ssl_hook_Insert_Filter(request_rec *r)
{
    SSLSrvConfigRec *sc = mySrvConfig(r->server);

    if (sc->enabled == UNSET) {
        ap_add_output_filter("UPGRADE_FILTER", NULL, r, r->connection);
    }
}

/*
 *  the module registration phase
 */

static void ssl_register_hooks(apr_pool_t *p)
{
    ssl_io_filter_register(p);

    ap_hook_pre_connection(ssl_hook_pre_connection,NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_post_config   (ssl_init_Module,        NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_http_method   (ssl_hook_http_method,   NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_default_port  (ssl_hook_default_port,  NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_pre_config    (ssl_hook_pre_config,    NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_child_init    (ssl_init_Child,         NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_translate_name(ssl_hook_Translate,     NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_check_user_id (ssl_hook_UserCheck,     NULL,NULL, APR_HOOK_FIRST);
    ap_hook_fixups        (ssl_hook_Fixup,         NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_access_checker(ssl_hook_Access,        NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_auth_checker  (ssl_hook_Auth,          NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_post_read_request(ssl_hook_ReadReq,    NULL,NULL, APR_HOOK_MIDDLE);
    ap_hook_insert_filter (ssl_hook_Insert_Filter, NULL,NULL, APR_HOOK_MIDDLE);
/*    ap_hook_handler       (ssl_hook_Upgrade,       NULL,NULL, APR_HOOK_MIDDLE); */

    ssl_var_register();

    APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
    APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
}

module AP_MODULE_DECLARE_DATA ssl_module = {
    STANDARD20_MODULE_STUFF,
    ssl_config_perdir_create,   /* create per-dir    config structures */
    ssl_config_perdir_merge,    /* merge  per-dir    config structures */
    ssl_config_server_create,   /* create per-server config structures */
    ssl_config_server_merge,    /* merge  per-server config structures */
    ssl_config_cmds,            /* table of configuration directives   */
    ssl_register_hooks          /* register hooks */
};