ssl_util_ssl.c revision 1640d64f4f55300ae8e627bb6e9351938dbad5e8
/* _ _
** _ __ ___ ___ __| | ___ ___| | mod_ssl
** | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
** | | | | | | (_) | (_| | \__ \__ \ | www.modssl.org
** |_| |_| |_|\___/ \__,_|___|___/___/_| ftp.modssl.org
** |_____|
** Additional Utility Functions for OpenSSL
*/
/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2002 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*/
#include "mod_ssl.h"
/* _________________________________________________________________
**
** Additional High-Level Functions for OpenSSL
** _________________________________________________________________
*/
/* we initialize this index at startup time
* and never write to it at request time,
* so this static is thread safe.
* also note that OpenSSL increments at static variable when
* SSL_get_ex_new_index() is called, so we _must_ do this at startup.
*/
static int SSL_app_data2_idx = -1;
void SSL_init_app_data2_idx(void)
{
int i;
if (SSL_app_data2_idx > -1) {
return;
}
/* we _do_ need to call this twice */
for (i=0; i<=1; i++) {
"Second Application Data for SSL",
}
}
{
}
{
return;
}
/* _________________________________________________________________
**
** High-Level Certificate / Private Key Loading
** _________________________________________________________________
*/
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
}
return rc;
}
#if SSL_LIBRARY_VERSION <= 0x00904100
{
return ((EVP_PKEY *)ASN1_d2i_bio(
(char *(*)())EVP_PKEY_new,
(char *(*)())d2i_PrivateKey,
}
#endif
EVP_PKEY *SSL_read_PrivateKey(char* filename, EVP_PKEY **key, int (*cb)(char*,int,int,void*), void *s)
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
EVP_PKEY_free(*key);
}
return rc;
}
/* _________________________________________________________________
**
** Smart shutdown
** _________________________________________________________________
*/
{
int i;
int rc;
/*
* Repeat the calls, because SSL_shutdown internally dispatches through a
* little state machine. Usually only one or two interation should be
* needed, so we restrict the total number of restrictions in order to
* avoid process hangs in case the client played bad with the socket
* connection and OpenSSL cannot recognize it.
*/
rc = 0;
for (i = 0; i < 4 /* max 2x pending + 2x data = 4 */; i++) {
break;
}
return rc;
}
/* _________________________________________________________________
**
** Certificate Revocation List (CRL) Storage
** _________________________________________________________________
*/
{
return NULL;
return NULL;
return NULL;
}
}
return NULL;
}
}
return pStore;
}
{
int rc;
return rc;
}
/* _________________________________________________________________
**
** Cipher Suite Spec String Creation
** _________________________________________________________________
*/
{
SSL_CIPHER *c;
int i;
int l;
char *cpCipherSuite;
char *cp;
return "";
return "";
l = 0;
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
c = sk_SSL_CIPHER_value(sk, i);
}
if (l == 0)
return "";
cp = cpCipherSuite;
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
c = sk_SSL_CIPHER_value(sk, i);
l = strlen(SSL_CIPHER_get_name(c));
cp += l;
*cp++ = '/';
*cp++ = ':';
}
return cpCipherSuite;
}
/* _________________________________________________________________
**
** Certificate Checks
** _________________________________________________________________
*/
/* check whether cert contains extended key usage with a SGC tag */
{
#ifdef HAVE_SSL_X509V3_EXT_d2i
int ext_nid;
int idx;
int i;
if (idx >= 0) {
break;
}
}
}
}
return is_sgc;
#else
return FALSE;
#endif
}
/* retrieve basic constraints ingredients */
{
#ifdef HAVE_SSL_X509V3_EXT_d2i
int idx;
char *cp;
return FALSE;
return FALSE;
return FALSE;
return FALSE;
return FALSE;
}
return TRUE;
#else
return FALSE;
#endif
}
/* retrieve subject CommonName of certificate */
{
int i, nid;
char *data_ptr;
int data_len;
X509_NAME_get_entries(xsn)); i++) {
X509_NAME_get_entries(xsn), i);
if (nid == NID_commonName) {
#ifdef CHARSET_EBCDIC
#endif
return TRUE;
}
}
return FALSE;
}
/* _________________________________________________________________
**
** Low-Level CA Certificate Loading
** _________________________________________________________________
*/
#ifdef SSL_EXPERIMENTAL_PROXY
{
return FALSE;
return FALSE;
}
#if SSL_LIBRARY_VERSION < 0x00904000
#else
#endif
return TRUE;
}
{
apr_pool_t *sp;
char *fullname;
return FALSE;
}
continue;
}
return ok;
}
#endif /* SSL_EXPERIMENTAL_PROXY */
/* _________________________________________________________________
**
** Extra Server Certificate Chain Support
** _________________________________________________________________
*/
/*
* Read a file that optionally contains the server certificate in PEM
* format, possibly followed by a sequence of CA certificates that
* should be sent to the peer in the SSL Certificate message.
*/
{
unsigned long err;
int n;
return -1;
return -1;
}
/* optionally skip a leading server certificate */
if (skipfirst) {
return -1;
}
}
/* free a perhaps already configured extra chain */
if (extra_certs != NULL) {
}
/* create new extra chain by loading the certs */
n = 0;
#if SSL_LIBRARY_VERSION < 0x00904000
#else
#endif
return -1;
}
n++;
}
/* Make sure that only the error is just an EOF */
if ((err = ERR_peek_error()) > 0) {
return -1;
}
while (ERR_get_error() > 0) ;
}
return n;
}
/* _________________________________________________________________
**
** Session Stuff
** _________________________________________________________________
*/
{
char *cp;
int n;
for (n = 0; n < idlen && n < SSL_MAX_SSL_SESSION_ID_LENGTH; n++) {
cp += 2;
}
return str;
}
/* sslc+OpenSSL compat */
{
#ifdef OPENSSL_VERSION_NUMBER
return SSL_SESSION_get_time(session);
#else /* assume sslc */
return CRYPTO_time_to_int(&ct);
#endif
}