ssl_engine_vars.c revision 1ce78cf71b5baaf2c1ab48e818cb1f2397df5010
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Variable Lookup Facility
*/
/* ``Those of you who think they
know everything are very annoying
to those of us who do.''
-- Unknown */
#include "ssl_private.h"
#include "mod_ssl.h"
#include "apr_time.h"
/* _________________________________________________________________
**
** Variable Lookup
** _________________________________________________________________
*/
static int ssl_is_https(conn_rec *c)
{
}
void ssl_var_register(void)
{
return;
}
/* This function must remain safe to use for a non-SSL connection. */
{
const char *result;
/*
* When no pool is given try to find one
*/
if (p == NULL) {
if (r != NULL)
p = r->pool;
else if (c != NULL)
p = c->pool;
else
}
/*
* Request dependent stuff
*/
if (r != NULL) {
switch (var[0]) {
case 'H':
case 'h':
/* all other headers from which we are still not know about */
break;
case 'R':
case 'r':
result = ap_http_scheme(r);
REMOTE_NAME, NULL);
result = ap_get_remote_logname(r);
break;
case 'S':
case 's':
result = ap_get_server_name(r);
break;
default:
result = ap_document_root(r);
result = r->ap_auth_type;
result = r->the_request;
break;
}
}
/*
* Connection stuff
*/
result = "on";
else
result = "off";
}
}
/*
* Totally independent stuff
*/
}
}
}
}
}
}
}
}
result = apr_psprintf(p,
}
/* all other env-variables from the parent Apache process */
}
}
result = "";
return (char *)result;
}
{
char *result;
}
}
char buf[SSL_SESSION_ID_STRING_LEN];
if (pSession) {
}
}
}
}
result = ssl_var_lookup_ssl_cert_verify(p, c);
}
}
}
}
}
return result;
}
{
char *result;
int nid;
char *cp;
}
}
}
}
}
}
}
}
}
result = apr_pstrdup(p,
}
result = apr_pstrdup(p,
}
}
return result;
}
static const struct {
char *name;
int nid;
} ssl_var_lookup_ssl_cert_dn_rec[] = {
{ "C", NID_countryName },
{ "L", NID_localityName },
{ "O", NID_organizationName },
{ "OU", NID_organizationalUnitName },
{ "CN", NID_commonName },
{ "T", NID_title },
{ "I", NID_initials },
{ "G", NID_givenName },
{ "S", NID_surname },
{ "D", NID_description },
#ifdef NID_x500UniqueIdentifier /* new name as of Openssl 0.9.7 */
{ "UID", NID_x500UniqueIdentifier },
#else /* old name, OpenSSL < 0.9.7 */
{ "UID", NID_uniqueIdentifier },
#endif
{ "Email", NID_pkcs9_emailAddress },
{ NULL, 0 }
};
{
int i, j, n, idx = 0;
/* if an _N suffix is used, find the Nth attribute of given name */
} else {
}
j++) {
X509_NAME_get_entries(xsname), j);
/* cast needed from unsigned char to char */
#endif /* APR_CHARSET_EBCDIC */
break;
}
}
break;
}
}
return result;
}
{
char *result;
int n;
return NULL;
n = BIO_pending(bio);
return result;
}
/* Return a string giving the number of days remaining until 'tm', or
* "0" if this can't be determined. */
{
apr_time_exp_t exp = {0};
long diff;
/* Fail if the time isn't a valid ASN.1 UTCTIME; RFC3280 mandates
* that the seconds digits are present even though ASN.1
* doesn't. */
return apr_pstrdup(p, "0");
}
return apr_pstrdup(p, "0");
}
}
{
char *result;
int n;
return NULL;
n = BIO_pending(bio);
return result;
}
{
char *result;
int n;
if (n < sk_X509_num(sk)) {
}
}
return result;
}
{
char *result;
int n;
return NULL;
n = BIO_pending(bio);
return result;
}
{
char *result;
long vrc;
const char *verr;
const char *vinfo;
/* no client verification done at all */
result = "NONE";
/* client verification done successful */
result = "SUCCESS";
/* client verification done in generous way */
result = "GENEROUS";
else
/* client verification failed */
if (xs)
return result;
}
{
char *result;
int usekeysize, algkeysize;
}
}
}
return result;
}
{
*usekeysize = 0;
*algkeysize = 0;
return;
}
{
char *result;
#if defined(SSL_PRODUCT_NAME) && defined(SSL_PRODUCT_VERSION)
#else
#endif
}
}
*cp = '/';
}
}
return result;
}
const char *extension)
{
int count = 0, j;
return NULL;
}
/* We accept the "extension" string to be converted as
* a long name (nsComment), short name (DN) or
* numeric OID (1.2.3.4).
*/
if (!oid) {
"Failed to create an object for extension '%s'",
return NULL;
}
return NULL;
}
/* Create an array large enough to accomodate every extension. This is
* likely overkill, but safe.
*/
for (j = 0; j < count; j++) {
/* We want to obtain a string representation of the extensions
* value and add it to the array we're building.
* X509V3_EXT_print() doesn't know about all the possible
* data types, but the value is stored as an ASN1_OCTET_STRING
* allowing us a fallback in case of X509V3_EXT_print
* not knowing how to handle the data.
*/
} else {
"Found an extension '%s', but failed to "
"create a string from it", extension);
}
}
}
if (peer) {
/* only SSL_get_peer_certificate raises the refcount */
}
return array;
}
{
char *result = "NULL";
#ifdef OPENSSL_VERSION_NUMBER
#if (OPENSSL_VERSION_NUMBER >= 0x00908000)
if (pSession) {
switch (pSession->compress_meth) {
case 0:
/* default "NULL" already set */
break;
/* Defined by RFC 3749, deflate is coded by "1" */
case 1:
result = "DEFLATE";
break;
/* IANA assigned compression number for LZS */
case 0x40:
result = "LZS";
break;
default:
result = "UNKNOWN";
break;
}
}
#endif
#endif
return result;
}
/* _________________________________________________________________
**
** SSL Extension to mod_log_config
** _________________________________________________________________
*/
#include "../../modules/loggers/mod_log_config.h"
static const char *ssl_var_log_handler_c(request_rec *r, char *a);
static const char *ssl_var_log_handler_x(request_rec *r, char *a);
/*
* register us for the mod_log_config function registering phase
* to establish %{...}c and to be able to expand %{...}x variables.
*/
void ssl_var_log_config_register(apr_pool_t *p)
{
if (log_pfn_register) {
}
return;
}
/*
* implement the %{..}c log function
* (we are the only function)
*/
static const char *ssl_var_log_handler_c(request_rec *r, char *a)
{
char *result;
return NULL;
if (strEQ(a, "version"))
else if (strEQ(a, "cipher"))
else if (strEQ(a, "errcode"))
result = "-";
else if (strEQ(a, "errstr"))
return result;
}
/*
* extend the implementation of the %{..}x log function
* (there can be more functions)
*/
static const char *ssl_var_log_handler_x(request_rec *r, char *a)
{
char *result;
return result;
}