ssl_engine_config.c revision e8f95a682820a599fe41b22977010636be5c2717
/* Copyright 2001-2005 The Apache Software Foundation or its licensors, as
* applicable.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Apache Configuration Directives
*/
/* ``Damned if you do,
damned if you don't.''
-- Unknown */
#include "ssl_private.h"
/* _________________________________________________________________
**
** Support for Global Configuration
** _________________________________________________________________
*/
#define SSL_MOD_CONFIG_KEY "ssl_module"
{
void *vmc;
if (vmc) {
return vmc; /* reused for lifetime of the server */
}
/*
* allocate an own subpool which survives server restarts
*/
/*
* initialize per-module configuration
*/
mc->nSessionCacheDataSize = 0;
sizeof(ssl_randseed_t));
#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
#endif
pool);
return mc;
}
{
}
{
}
/* _________________________________________________________________
**
** Configuration handling
** _________________________________________________________________
*/
{
}
apr_pool_t *p)
{
}
apr_pool_t *p)
{
}
{
modssl_ctx_init_proxy(sc, p);
modssl_ctx_init_server(sc, p);
return sc;
}
/*
* Create per-server SSL configuration
*/
{
return sc;
}
{
}
{
}
{
int i;
for (i = 0; i < SSL_AIDX_MAX; i++) {
}
}
/*
* Merge per-server SSL configurations
*/
{
return mrg;
}
/*
* Create per-directory SSL configuration
*/
{
return dc;
}
/*
* Merge per-directory SSL configurations
*/
{
mrg->nOptionsAdd =
mrg->nOptionsDel =
}
else {
}
return mrg;
}
/*
* Configuration functions for particular directives
*/
void *dcfg,
const char *arg_)
{
const char *err;
/* Split arg_ into meth and file */
if (file) {
*(file++) = '\0';
if (!*file) {
}
}
return err;
}
if (ssl_config_global_isfixed(mc)) {
return NULL;
}
return NULL;
}
/* APR determines temporary filename unless overridden below,
* we presume file indicates an szMutexFile is a file path
* unless the method sets szMutexFile=file and NULLs file
*/
/* NOTE: previously, 'yes' implied 'sem' */
}
}
#endif
}
#endif
* if provided and fall back on APR's default if not. Today, APR
* will ignore it, but once supported it has an absurdly short limit.
*/
if (file) {
}
}
#endif
#if APR_HAS_SYSVSEM_SERIALIZE && !defined(PERCHILD_MPM)
}
#endif
}
#endif
else {
}
/* Unless the method above assumed responsibility for setting up
* mc->szMutexFile and NULLing out file, presume it is a file we
* are looking to use
*/
if (file) {
if (!mc->szMutexFile) {
}
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
}
"Invalid SSLPassPhraseDialog exec: path ",
}
{
"SSLPassPhraseDialog: file '",
"' does not exist", NULL);
}
}
}
else {
return "SSLPassPhraseDialog: Invalid argument";
}
return NULL;
}
#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
void *dcfg,
const char *arg)
{
const char *err;
ENGINE *e;
return err;
}
}
else if ((e = ENGINE_by_id(arg))) {
ENGINE_free(e);
}
else {
err = "SSLCryptoDevice: Invalid argument; must be one of: "
"'builtin' (none)";
e = ENGINE_get_first();
while (e) {
en = ENGINE_get_next(e);
ENGINE_free(e);
e = en;
}
return err;
}
return NULL;
}
#endif
void *dcfg,
const char *arg1,
const char *arg2,
const char *arg3)
{
const char *err;
return err;
}
if (ssl_config_global_isfixed(mc)) {
return NULL;
}
}
}
else {
NULL);
}
}
}
#ifdef HAVE_SSL_RAND_EGD
#else
return "egd not supported with this SSL toolkit";
#endif
}
}
else {
}
"Invalid SSLRandomSeed path ",
}
"SSLRandomSeed: source path '",
}
}
if (!arg3) {
}
else {
return "SSLRandomSeed: byte specification not "
"allowed for builtin seed source";
}
return "SSLRandomSeed: invalid number of bytes specified";
}
}
return NULL;
}
{
return NULL;
}
return NULL;
}
return NULL;
}
return "Argument must be On, Off, or Optional";
}
void *dcfg,
const char *arg)
{
}
else {
}
return NULL;
}
#define SSL_FLAGS_CHECK_FILE \
#define SSL_FLAGS_CHECK_DIR \
const char **file)
{
if (!filepath) {
}
return NULL;
}
": file '", *file,
"' does not exist or is empty", NULL);
}
{
return NULL;
#else
return "SSLHonorCiperOrder unsupported; not implemented by the SSL library";
#endif
}
const char **dir)
{
if (!dirpath) {
}
return NULL;
}
": directory '", *dir,
"' does not exist", NULL);
}
#define SSL_AIDX_CERTS 1
#define SSL_AIDX_KEYS 2
const char *arg,
int idx)
{
int i;
return err;
}
switch (idx) {
case SSL_AIDX_CERTS:
desc = "certificates";
break;
case SSL_AIDX_KEYS:
desc = "private keys";
break;
}
for (i = 0; i < SSL_AIDX_MAX; i++) {
if (!files[i]) {
return NULL;
}
}
"%s: only up to %d "
"different %s per virtual host allowed",
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
#define NO_PER_DIR_SSL_CA \
"Your ssl library does not have support for per-directory CA"
#ifdef HAVE_SSL_SET_CERT_STORE
# define MODSSL_HAVE_SSL_SET_CERT_STORE 1
#else
# define MODSSL_HAVE_SSL_SET_CERT_STORE 0
#endif
#define MODSSL_SET_CA(f) \
else \
return NO_PER_DIR_SSL_CA; \
else \
void *dcfg,
const char *arg)
{
/*SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;*/
const char *err;
return err;
}
/* XXX: bring back per-dir */
return NULL;
}
void *dcfg,
const char *arg)
{
/*SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;*/
const char *err;
return err;
}
/* XXX: bring back per-dir */
return NULL;
}
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg,
{
*id = SSL_CVERIFY_NONE;
}
}
}
}
else {
NULL);
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
}
else {
}
return NULL;
}
const char *arg,
int *depth)
{
return NULL;
}
NULL);
}
void *dcfg,
const char *arg)
{
int depth;
const char *err;
return err;
}
}
else {
}
return NULL;
}
#define MODSSL_NO_SHARED_MEMORY_ERROR \
"SSLSessionCache: shared memory cache not useable on this platform"
void *dcfg,
const char *arg)
{
return err;
}
if (ssl_config_global_isfixed(mc)) {
return NULL;
}
}
}
if (!mc->szSessionCacheDataFile) {
"SSLSessionCache: Invalid cache file path %s",
arg+4);
}
}
return MODSSL_NO_SHARED_MEMORY_ERROR;
#endif
if (!mc->szSessionCacheDataFile) {
"SSLSessionCache: Invalid cache file path %s",
colon+1);
}
return "SSLSessionCache: Invalid argument: "
"no closing parenthesis";
}
return "SSLSessionCache: Invalid argument: "
"size has to be >= 8192 bytes";
}
"SSLSessionCache: Invalid argument: "
"size has to be < %d bytes on this "
"platform", APR_SHM_MAXSIZE);
}
}
}
#ifdef HAVE_DISTCACHE
if (!mc->szSessionCacheDataFile) {
"SSLSessionCache: Invalid cache file path: ",
}
#else
return "SSLSessionCache: distcache support disabled";
#endif
}
else {
return "SSLSessionCache: Invalid argument";
}
return NULL;
}
void *dcfg,
const char *arg)
{
if (sc->session_cache_timeout < 0) {
return "SSLSessionCacheTimeout: Invalid argument";
}
return NULL;
}
void *dcfg,
const char *arg)
{
char action, *w;
while (*arg) {
if ((*w == '+') || (*w == '-')) {
action = *(w++);
}
else if (first) {
}
if (strcEQ(w, "StdEnvVars")) {
}
else if (strcEQ(w, "ExportCertData")) {
}
else if (strcEQ(w, "FakeBasicAuth")) {
}
else if (strcEQ(w, "StrictRequire")) {
}
else if (strcEQ(w, "OptRenegotiate")) {
}
else {
"SSLOptions: Illegal option '", w, "'",
NULL);
}
if (action == '-') {
}
else if (action == '+') {
}
else {
}
}
return NULL;
}
{
return NULL;
}
void *dcfg,
const char *arg)
{
ssl_expr_get_error(), NULL);
}
return NULL;
}
const char *arg,
{
while (*arg) {
char action = '\0';
if ((*w == '+') || (*w == '-')) {
action = *(w++);
}
if (strcEQ(w, "SSLv2")) {
}
else if (strcEQ(w, "SSLv3")) {
}
else if (strcEQ(w, "TLSv1")) {
}
else if (strcEQ(w, "all")) {
}
else {
": Illegal protocol '",
w, "'", NULL);
}
if (action == '-') {
}
else if (action == '+') {
}
else {
}
}
return NULL;
}
void *dcfg,
const char *arg)
{
}
{
return NULL;
}
void *dcfg,
const char *arg)
{
}
void *dcfg,
const char *arg)
{
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
int depth;
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
void *dcfg,
const char *arg)
{
const char *err;
return err;
}
return NULL;
}
const char *arg)
{
return NULL;
}
{
if (!ap_exists_config_define("DUMP_CERTS")) {
return;
}
/* Dump the filenames of all configured server certificates to
* stdout. */
while (s) {
int i;
}
}
s = s->next;
}
}