ssl_util_ssl.c revision 53e2218c565ed45d3a7c69dd4c4ef6b1aad5f70a
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Additional Utility Functions for OpenSSL
*/
#include "ssl_private.h"
/* _________________________________________________________________
**
** Additional High-Level Functions for OpenSSL
** _________________________________________________________________
*/
/* we initialize this index at startup time
* and never write to it at request time,
* so this static is thread safe.
* also note that OpenSSL increments at static variable when
* SSL_get_ex_new_index() is called, so we _must_ do this at startup.
*/
static int SSL_app_data2_idx = -1;
void SSL_init_app_data2_idx(void)
{
int i;
if (SSL_app_data2_idx > -1) {
return;
}
/* we _do_ need to call this twice */
for (i=0; i<=1; i++) {
"Second Application Data for SSL",
}
}
{
}
{
return;
}
/* _________________________________________________________________
**
** High-Level Certificate / Private Key Loading
** _________________________________________________________________
*/
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
}
return rc;
}
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
EVP_PKEY_free(*key);
}
return rc;
}
/* _________________________________________________________________
**
** Smart shutdown
** _________________________________________________________________
*/
{
int i;
int rc;
/*
* Repeat the calls, because SSL_shutdown internally dispatches through a
* little state machine. Usually only one or two interation should be
* needed, so we restrict the total number of restrictions in order to
* avoid process hangs in case the client played bad with the socket
* connection and OpenSSL cannot recognize it.
*/
rc = 0;
for (i = 0; i < 4 /* max 2x pending + 2x data = 4 */; i++) {
break;
}
return rc;
}
/* _________________________________________________________________
**
** Certificate Checks
** _________________________________________________________________
*/
/* check whether cert contains extended key usage with a SGC tag */
{
int ext_nid;
int i;
if (sk) {
for (i = 0; i < sk_ASN1_OBJECT_num(sk); i++) {
break;
}
}
}
return is_sgc;
}
/* retrieve basic constraints ingredients */
{
char *cp;
return FALSE;
return FALSE;
return FALSE;
}
return TRUE;
}
/* convert a NAME_ENTRY to UTF8 string */
{
int len;
return NULL;
return result;
}
/*
* convert an X509_NAME to an RFC 2253 formatted string, optionally truncated
* to maxlen characters (specify a maxlen of 0 for no length limit)
*/
{
int len;
return NULL;
if (len > 0) {
if (maxlen > 2) {
/* insert trailing ellipsis if there's enough space */
}
} else {
}
}
return result;
}
/* return an array of (RFC 6125 coined) DNS-IDs and CN-IDs in a certificate */
{
char **cpp;
int i, n;
return FALSE;
}
/* First, the DNS-IDs (dNSName entries in the subjectAltName extension) */
for (i = 0; i < sk_GENERAL_NAME_num(names); i++) {
n = BIO_pending(bio);
if (n > 0) {
}
}
}
}
if (names)
/* Second, the CN-IDs (commonName attributes in the subject DN) */
i = -1;
}
}
/* _________________________________________________________________
**
** Low-Level CA Certificate Loading
** _________________________________________________________________
*/
const char *filename)
{
return FALSE;
}
return FALSE;
}
return TRUE;
}
const char *pathname)
{
/* XXX: this dir read code is exactly the same as that in
* ssl_engine_init.c, only the call to handle the fullname is different,
* should fold the duplication.
*/
const char *fullname;
return FALSE;
}
continue; /* don't try to load directories */
}
NULL);
}
}
return ok;
}
/* _________________________________________________________________
**
** Extra Server Certificate Chain Support
** _________________________________________________________________
*/
/*
* Read a file that optionally contains the server certificate in PEM
* format, possibly followed by a sequence of CA certificates that
* should be sent to the peer in the SSL Certificate message.
*/
{
unsigned long err;
int n;
return -1;
return -1;
}
/* optionally skip a leading server certificate */
if (skipfirst) {
return -1;
}
}
/* free a perhaps already configured extra chain */
#ifdef OPENSSL_NO_SSL_INTERN
#else
}
#endif
/* create new extra chain by loading the certs */
n = 0;
return -1;
}
n++;
}
/* Make sure that only the error is just an EOF */
if ((err = ERR_peek_error()) > 0) {
return -1;
}
while (ERR_get_error() > 0) ;
}
return n;
}
/* _________________________________________________________________
**
** Session Stuff
** _________________________________________________________________
*/
{
char *cp;
int n;
for (n = 0; n < idlen && n < SSL_MAX_SSL_SESSION_ID_LENGTH; n++) {
cp += 2;
}
return str;
}