ssl_util.c revision d54a31567fc49f1841d27a14796ae726016c54aa
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** _ __ ___ ___ __| | ___ ___| | mod_ssl
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** | | | | | | (_) | (_| | \__ \__ \ | www.modssl.org
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** |_| |_| |_|\___/ \__,_|___|___/___/_| ftp.modssl.org
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** Utility Functions
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse/* ====================================================================
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * The Apache Software License, Version 1.1
bc8fd1b0b1afdf89b8d28eefa8cd74e26ba97986fielding * Copyright (c) 2000-2002 The Apache Software Foundation. All rights
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * reserved.
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * Redistribution and use in source and binary forms, with or without
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * modification, are permitted provided that the following conditions
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * are met:
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * 1. Redistributions of source code must retain the above copyright
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * notice, this list of conditions and the following disclaimer.
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * 2. Redistributions in binary form must reproduce the above copyright
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * notice, this list of conditions and the following disclaimer in
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * the documentation and/or other materials provided with the
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * distribution.
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * 3. The end-user documentation included with the redistribution,
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * if any, must include the following acknowledgment:
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * "This product includes software developed by the
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * Apache Software Foundation (http://www.apache.org/)."
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * Alternately, this acknowledgment may appear in the software itself,
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * if and wherever such third-party acknowledgments normally appear.
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * 4. The names "Apache" and "Apache Software Foundation" must
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * not be used to endorse or promote products derived from this
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * software without prior written permission. For written
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * permission, please contact apache@apache.org.
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * 5. Products derived from this software may not be called "Apache",
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * nor may "Apache" appear in their name, without prior written
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * permission of the Apache Software Foundation.
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
d86ef5503dcbc38e87c0e03cd3e1f16458cb6323rse * SUCH DAMAGE.
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * ====================================================================
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse /* ``Every day of my life
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse I am forced to add another
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse name to the list of people
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse who piss me off!''
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse -- Calvin */
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse/* _________________________________________________________________
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** Utility Functions
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse** _________________________________________________________________
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse if (s->port != 0)
05413593151a238718198cc04ca849b2426be106rse id = apr_psprintf(p, "%s:%lu", host, (unsigned long)port);
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse for (; *s; ++s)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrsevoid ssl_util_uuencode(char *szTo, const char *szFrom, BOOL bPad)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse (const unsigned char *)szFrom,
421d9002d73db52972bcca8f4497fe5d603b6b8eaaron const unsigned char *szFrom,
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse const unsigned char *s;
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse *szTo++ = ssl_util_uuencode_six2pr[(s[0] << 4 | s[1] >> 4) & 0x3f];
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse if (--nLength == 0) {
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse *szTo++ = ssl_util_uuencode_six2pr[(s[1] << 2 | s[2] >> 6) & 0x3f];
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse if (--nLength == 0) {
87a1c79b7b37702a254920ca5214fb282a4fb085dougmapr_file_t *ssl_util_ppopen(server_rec *s, apr_pool_t *p, const char *cmd,
87a1c79b7b37702a254920ca5214fb282a4fb085dougm const char * const *argv)
bb0b94431dc9a1591a0a38a6c48925c6d9213c83rse if (apr_procattr_io_set(procattr, APR_FULL_BLOCK, APR_FULL_BLOCK,
bb0b94431dc9a1591a0a38a6c48925c6d9213c83rse if (apr_procattr_cmdtype_set(procattr, APR_PROGRAM) != APR_SUCCESS)
bb0b94431dc9a1591a0a38a6c48925c6d9213c83rse if ((proc = (apr_proc_t *)apr_pcalloc(p, sizeof(apr_proc_t))) == NULL)
87a1c79b7b37702a254920ca5214fb282a4fb085dougm if (apr_proc_create(proc, cmd, argv, NULL, procattr, p) != APR_SUCCESS)
bb0b94431dc9a1591a0a38a6c48925c6d9213c83rsevoid ssl_util_ppclose(server_rec *s, apr_pool_t *p, apr_file_t *fp)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * Run a filter program and read the first line of its stdout output
87a1c79b7b37702a254920ca5214fb282a4fb085dougmchar *ssl_util_readfilter(server_rec *s, apr_pool_t *p, const char *cmd,
87a1c79b7b37702a254920ca5214fb282a4fb085dougm const char * const *argv)
87a1c79b7b37702a254920ca5214fb282a4fb085dougm /* XXX: we are reading 1 byte at a time here */
bb0b94431dc9a1591a0a38a6c48925c6d9213c83rse for (k = 0; apr_file_read(fp, &c, &nbytes) == APR_SUCCESS
03181bdde77be8e10ed297a02db5d8f98ecb703ewroweBOOL ssl_util_path_check(ssl_pathcheck_t pcm, const char *path, apr_pool_t *p)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrsessl_algo_t ssl_util_algotypeof(X509 *pCert, EVP_PKEY *pKey)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse switch (t) {
421d9002d73db52972bcca8f4497fe5d603b6b8eaaronchar *ssl_util_ptxtsub(apr_pool_t *p, const char *cpLine,
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * Pass 1: find substitution locations and calculate sizes
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse if (i == 0)
cc003103e52ff9d5fe9bed567ef9438613ab4fbfrse * Pass 2: allocate memory and assemble result
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * certain key and cert data needs to survive restarts,
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * which are stored in the user data table of s->process->pool.
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * to prevent "leaking" of this data, we use malloc/free
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * rather than apr_palloc and these wrappers to help make sure
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * we do not leak the malloc-ed data.
a0e0d20b666cfc453ac76506079eb50e03997eefdougm const char *key,
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * if a value for this key already exists,
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * reuse as much of the already malloc-ed data
a0e0d20b666cfc453ac76506079eb50e03997eefdougm * as possible.
a0e0d20b666cfc453ac76506079eb50e03997eefdougm asn1->source_mtime = 0; /* used as a note for encrypted private keys */
a0e0d20b666cfc453ac76506079eb50e03997eefdougm return asn1->cpData; /* caller will assign a value to this */
a0e0d20b666cfc453ac76506079eb50e03997eefdougm const char *key)
a0e0d20b666cfc453ac76506079eb50e03997eefdougm return (ssl_asn1_t *)apr_hash_get(table, key, APR_HASH_KEY_STRING);
a0e0d20b666cfc453ac76506079eb50e03997eefdougm const char *key)
22357f10585a847ebf7b084cbe1db07ba071aeb6dougmstatic const char *ssl_asn1_key_types[] = {"RSA", "DSA"};
dd7c683f683624b082d430935b594df7406782c2dougm const char *id,
d94fd18ee21dc9b8c1f422144a881e941687d41fdougm * To ensure thread-safetyness in OpenSSL - work in progress
0ccb8cf8cbc291aca5e8da62cde6cc6948e2081eben/* FIXME: CRYPTO_NUM_LOCKS may vary between releases - replace with
0ccb8cf8cbc291aca5e8da62cde6cc6948e2081eben CRYPT_num_locks() [Ben, Jan 2002] */
dd9940ba9b4d9c09f034b910d1569db4a5111c75dougmstatic unsigned long ssl_util_thr_id(void)
e62985c7a1b46a5036a247f35bddac1308985758dougm return (unsigned long) apr_os_thread_current();
8464a9c46b967001e38fe3c8afff51a649e9de51dougmstatic apr_status_t ssl_util_thread_cleanup(void *data)
8464a9c46b967001e38fe3c8afff51a649e9de51dougm for (i = 0; i < CRYPTO_NUM_LOCKS; i++) {
d94fd18ee21dc9b8c1f422144a881e941687d41fdougmvoid ssl_util_thread_setup(server_rec *s, apr_pool_t *p)
e18e68b42830409bf48de0df9eed3fe363664aa7aaron /* This variable is not used? -aaron
d94fd18ee21dc9b8c1f422144a881e941687d41fdougm SSLModConfigRec *mc = myModConfig(s);
e18e68b42830409bf48de0df9eed3fe363664aa7aaron lock_cs = apr_palloc(p, CRYPTO_NUM_LOCKS * sizeof(apr_thread_mutex_t *));
8464a9c46b967001e38fe3c8afff51a649e9de51dougm * XXX: CRYPTO_NUM_LOCKS == 28
8464a9c46b967001e38fe3c8afff51a649e9de51dougm * should determine if there are lock types we do not need
8464a9c46b967001e38fe3c8afff51a649e9de51dougm * for example: debug_malloc, debug_malloc2 (see crypto/cryptlib.c)
8464a9c46b967001e38fe3c8afff51a649e9de51dougm for (i = 0; i < CRYPTO_NUM_LOCKS; i++) {
e18e68b42830409bf48de0df9eed3fe363664aa7aaron /* XXX: Can we remove the lock_count now that apr_thread_mutex_t
e18e68b42830409bf48de0df9eed3fe363664aa7aaron * can support nested (aka recursive) locks? -aaron */