ssl_util_ssl.c revision 70535d6421eb979ac79d8f49d31cd94d75dd8b2f
/* Copyright 2001-2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Additional Utility Functions for OpenSSL
*/
#include "ssl_private.h"
/* _________________________________________________________________
**
** Additional High-Level Functions for OpenSSL
** _________________________________________________________________
*/
/* we initialize this index at startup time
* and never write to it at request time,
* so this static is thread safe.
* also note that OpenSSL increments at static variable when
* SSL_get_ex_new_index() is called, so we _must_ do this at startup.
*/
static int SSL_app_data2_idx = -1;
void SSL_init_app_data2_idx(void)
{
int i;
if (SSL_app_data2_idx > -1) {
return;
}
/* we _do_ need to call this twice */
for (i=0; i<=1; i++) {
"Second Application Data for SSL",
}
}
{
}
{
return;
}
/* _________________________________________________________________
**
** High-Level Certificate / Private Key Loading
** _________________________________________________________________
*/
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
}
return rc;
}
#if SSL_LIBRARY_VERSION <= 0x00904100
{
return ((EVP_PKEY *)ASN1_d2i_bio(
(char *(*)())EVP_PKEY_new,
(char *(*)())d2i_PrivateKey,
}
#endif
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
EVP_PKEY_free(*key);
}
return rc;
}
/* _________________________________________________________________
**
** Smart shutdown
** _________________________________________________________________
*/
{
int i;
int rc;
/*
* Repeat the calls, because SSL_shutdown internally dispatches through a
* little state machine. Usually only one or two interation should be
* needed, so we restrict the total number of restrictions in order to
* avoid process hangs in case the client played bad with the socket
* connection and OpenSSL cannot recognize it.
*/
rc = 0;
for (i = 0; i < 4 /* max 2x pending + 2x data = 4 */; i++) {
break;
}
return rc;
}
/* _________________________________________________________________
**
** Certificate Revocation List (CRL) Storage
** _________________________________________________________________
*/
{
return NULL;
return NULL;
return NULL;
}
}
return NULL;
}
}
return pStore;
}
{
int rc;
return rc;
}
/* _________________________________________________________________
**
** Cipher Suite Spec String Creation
** _________________________________________________________________
*/
{
SSL_CIPHER *c;
int i;
int l;
char *cpCipherSuite;
char *cp;
return "";
return "";
l = 0;
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
c = sk_SSL_CIPHER_value(sk, i);
}
if (l == 0)
return "";
cp = cpCipherSuite;
for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
c = sk_SSL_CIPHER_value(sk, i);
l = strlen(SSL_CIPHER_get_name(c));
cp += l;
*cp++ = '/';
*cp++ = ':';
}
return cpCipherSuite;
}
/* _________________________________________________________________
**
** Certificate Checks
** _________________________________________________________________
*/
/* check whether cert contains extended key usage with a SGC tag */
{
#ifdef HAVE_SSL_X509V3_EXT_d2i
int ext_nid;
int idx;
int i;
if (idx >= 0) {
break;
}
}
}
}
return is_sgc;
#else
return FALSE;
#endif
}
/* retrieve basic constraints ingredients */
{
#ifdef HAVE_SSL_X509V3_EXT_d2i
int idx;
char *cp;
return FALSE;
return FALSE;
return FALSE;
return FALSE;
return FALSE;
}
return TRUE;
#else
return FALSE;
#endif
}
/* retrieve subject CommonName of certificate */
{
int i, nid;
unsigned char *data_ptr;
int data_len;
X509_NAME_get_entries(xsn)); i++) {
X509_NAME_get_entries(xsn), i);
if (nid == NID_commonName) {
return TRUE;
}
}
return FALSE;
}
/* _________________________________________________________________
**
** Low-Level CA Certificate Loading
** _________________________________________________________________
*/
const char *filename)
{
return FALSE;
}
return FALSE;
}
return TRUE;
}
const char *pathname)
{
/* XXX: this dir read code is exactly the same as that in
* ssl_engine_init.c, only the call to handle the fullname is different,
* should fold the duplication.
*/
const char *fullname;
return FALSE;
}
continue; /* don't try to load directories */
}
NULL);
}
}
return ok;
}
/* _________________________________________________________________
**
** Extra Server Certificate Chain Support
** _________________________________________________________________
*/
/*
* Read a file that optionally contains the server certificate in PEM
* format, possibly followed by a sequence of CA certificates that
* should be sent to the peer in the SSL Certificate message.
*/
{
unsigned long err;
int n;
return -1;
return -1;
}
/* optionally skip a leading server certificate */
if (skipfirst) {
return -1;
}
}
/* free a perhaps already configured extra chain */
if (extra_certs != NULL) {
}
/* create new extra chain by loading the certs */
n = 0;
return -1;
}
n++;
}
/* Make sure that only the error is just an EOF */
if ((err = ERR_peek_error()) > 0) {
return -1;
}
while (ERR_get_error() > 0) ;
}
return n;
}
/* _________________________________________________________________
**
** Session Stuff
** _________________________________________________________________
*/
{
char *cp;
int n;
for (n = 0; n < idlen && n < SSL_MAX_SSL_SESSION_ID_LENGTH; n++) {
cp += 2;
}
return str;
}
/* sslc+OpenSSL compat */
{
#ifdef OPENSSL_VERSION_NUMBER
return SSL_SESSION_get_time(session);
#else /* assume sslc */
return CRYPTO_time_to_int(&ct);
#endif
}
#ifndef SSLC_VERSION_NUMBER
#define SSLC_VERSION_NUMBER 0x0000
#endif
unsigned char *g, int glen)
{
return NULL;
}
return NULL;
}
#else
#endif
return dh;
}