ssl_engine_config.c revision 8f2700898323915da289644dc1f3ee11a5e5b4ea
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Apache Configuration Directives
*/
/* ``Damned if you do,
damned if you don't.''
-- Unknown */
#include "ssl_private.h"
#include "util_mutex.h"
#include "ap_provider.h"
/* _________________________________________________________________
**
** Support for Global Configuration
** _________________________________________________________________
*/
#define SSL_MOD_CONFIG_KEY "ssl_module"
{
void *vmc;
if (vmc) {
return vmc; /* reused for lifetime of the server */
}
/*
* allocate an own subpool which survives server restarts
*/
/*
* initialize per-module configuration
*/
sizeof(ssl_randseed_t));
#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
#endif
pool);
return mc;
}
{
}
{
}
/* _________________________________________________________________
**
** Configuration handling
** _________________________________________________________________
*/
{
}
apr_pool_t *p)
{
}
apr_pool_t *p)
{
}
{
modssl_ctx_init_proxy(sc, p);
modssl_ctx_init_server(sc, p);
return sc;
}
/*
* Create per-server SSL configuration
*/
{
return sc;
}
{
}
{
}
{
int i;
for (i = 0; i < SSL_AIDX_MAX; i++) {
}
}
/*
* Merge per-server SSL configurations
*/
{
return mrg;
}
/*
* Create per-directory SSL configuration
*/
{
return dc;
}
/*
* Merge per-directory SSL configurations
*/
{
mrg->nOptionsAdd =
mrg->nOptionsDel =
}
else {
}
return mrg;
}
/*
* Configuration functions for particular directives
*/
void *dcfg,
const char *arg_)
{
const char *err;
return err;
}
if (ssl_config_global_isfixed(mc)) {
return NULL;
}
if (rv == APR_ENOLOCK) {
return NULL;
} else if (rv == APR_ENOTIMPL) {
} else if (rv == APR_BADARG) {
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
}
"Invalid SSLPassPhraseDialog exec: path ",
}
{
"SSLPassPhraseDialog: file '",
"' does not exist", NULL);
}
}
}
else {
return "SSLPassPhraseDialog: Invalid argument";
}
return NULL;
}
#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
void *dcfg,
const char *arg)
{
const char *err;
ENGINE *e;
return err;
}
}
else if ((e = ENGINE_by_id(arg))) {
ENGINE_free(e);
}
else {
err = "SSLCryptoDevice: Invalid argument; must be one of: "
"'builtin' (none)";
e = ENGINE_get_first();
while (e) {
en = ENGINE_get_next(e);
ENGINE_free(e);
e = en;
}
return err;
}
return NULL;
}
#endif
void *dcfg,
const char *arg1,
const char *arg2,
const char *arg3)
{
const char *err;
return err;
}
if (ssl_config_global_isfixed(mc)) {
return NULL;
}
}
}
else {
NULL);
}
}
}
#ifdef HAVE_SSL_RAND_EGD
#else
return "egd not supported with this SSL toolkit";
#endif
}
}
else {
}
"Invalid SSLRandomSeed path ",
}
"SSLRandomSeed: source path '",
}
}
if (!arg3) {
}
else {
return "SSLRandomSeed: byte specification not "
"allowed for builtin seed source";
}
return "SSLRandomSeed: invalid number of bytes specified";
}
}
return NULL;
}
{
return NULL;
}
return NULL;
}
return NULL;
}
return "Argument must be On, Off, or Optional";
}
void *dcfg,
const char *arg)
{
}
else {
}
return NULL;
}
#define SSL_FLAGS_CHECK_FILE \
#define SSL_FLAGS_CHECK_DIR \
const char **file)
{
if (!filepath) {
}
return NULL;
}
": file '", *file,
"' does not exist or is empty", NULL);
}
{
return NULL;
#else
return "SSLHonorCiperOrder unsupported; not implemented by the SSL library";
#endif
}
const char **dir)
{
if (!dirpath) {
}
return NULL;
}
": directory '", *dir,
"' does not exist", NULL);
}
#define SSL_AIDX_CERTS 1
#define SSL_AIDX_KEYS 2
const char *arg,
int idx)
{
int i;
return err;
}
switch (idx) {
case SSL_AIDX_CERTS:
desc = "certificates";
break;
case SSL_AIDX_KEYS:
desc = "private keys";
break;
}
for (i = 0; i < SSL_AIDX_MAX; i++) {
if (!files[i]) {
return NULL;
}
}
"%s: only up to %d "
"different %s per virtual host allowed",
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
#define NO_PER_DIR_SSL_CA \
"Your SSL library does not have support for per-directory CA"
void *dcfg,
const char *arg)
{
/*SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;*/
const char *err;
return err;
}
return NO_PER_DIR_SSL_CA;
}
/* XXX: bring back per-dir */
return NULL;
}
void *dcfg,
const char *arg)
{
/*SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;*/
const char *err;
return err;
}
return NO_PER_DIR_SSL_CA;
}
/* XXX: bring back per-dir */
return NULL;
}
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg,
{
*id = SSL_CVERIFY_NONE;
}
}
}
}
else {
NULL);
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
}
else {
}
return NULL;
}
const char *arg,
int *depth)
{
return NULL;
}
NULL);
}
void *dcfg,
const char *arg)
{
int depth;
const char *err;
return err;
}
}
else {
}
return NULL;
}
void *dcfg,
const char *arg)
{
long enabled_flags;
return err;
}
/* The OpenSSL session cache mode must have both the flags
* SSL_SESS_CACHE_SERVER and SSL_SESS_CACHE_NO_INTERNAL set if a
* session cache is configured; NO_INTERNAL prevents the
* OpenSSL-internal session cache being used in addition to the
* "external" (mod_ssl-provided) cache, which otherwise causes
* additional memory consumption. */
/* Nothing to do; session cache will be off. */
}
/* ### Having a separate mode for this seems logically
* unnecessary; the stated purpose of sending non-empty
* session IDs would be better fixed in OpenSSL or simply
* doing it by default if "none" is used. */
}
else {
/* Argument is of form 'name:args' or just 'name'. */
if (sep) {
sep++;
}
else {
}
/* Find the provider of given name. */
name,
/* Cache found; create it, passing anything beyond the colon. */
}
else {
const char *all_names;
/* Build a comma-separated list of all registered provider
* names: */
}
}
if (err) {
}
return NULL;
}
void *dcfg,
const char *arg)
{
if (sc->session_cache_timeout < 0) {
return "SSLSessionCacheTimeout: Invalid argument";
}
return NULL;
}
void *dcfg,
const char *arg)
{
}
}
}
else {
NULL);
}
return NULL;
}
void *dcfg,
const char *arg)
{
char action, *w;
while (*arg) {
if ((*w == '+') || (*w == '-')) {
action = *(w++);
}
else if (first) {
}
if (strcEQ(w, "StdEnvVars")) {
}
else if (strcEQ(w, "ExportCertData")) {
}
else if (strcEQ(w, "FakeBasicAuth")) {
}
else if (strcEQ(w, "StrictRequire")) {
}
else if (strcEQ(w, "OptRenegotiate")) {
}
else {
"SSLOptions: Illegal option '", w, "'",
NULL);
}
if (action == '-') {
}
else if (action == '+') {
}
else {
}
}
return NULL;
}
{
return NULL;
}
void *dcfg,
const char *arg)
{
ssl_expr_get_error(), NULL);
}
return NULL;
}
{
if (dc->nRenegBufferSize < 0) {
}
return NULL;
}
const char *arg,
{
while (*arg) {
char action = '\0';
if ((*w == '+') || (*w == '-')) {
action = *(w++);
}
if (strcEQ(w, "SSLv2")) {
}
else if (strcEQ(w, "SSLv3")) {
}
else if (strcEQ(w, "TLSv1")) {
}
else if (strcEQ(w, "all")) {
}
else {
": Illegal protocol '",
w, "'", NULL);
}
if (action == '-') {
}
else if (action == '+') {
}
else {
}
}
return NULL;
}
void *dcfg,
const char *arg)
{
}
{
return NULL;
}
void *dcfg,
const char *arg)
{
}
void *dcfg,
const char *arg)
{
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
int depth;
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg)
{
return NULL;
}
{
#ifndef HAVE_OCSP
if (flag) {
return "OCSP support not detected in SSL library; cannot enable "
"OCSP validation";
}
#endif
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
if (!ap_exists_config_define("DUMP_CERTS")) {
return;
}
/* Dump the filenames of all configured server certificates to
* stdout. */
while (s) {
int i;
}
}
s = s->next;
}
}