ssl_util_ssl.c revision f4c3ded5dd561f8aa9779f227fed41303c15efaa
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* Additional Utility Functions for OpenSSL
*/
#include "ssl_private.h"
/* _________________________________________________________________
**
** Additional High-Level Functions for OpenSSL
** _________________________________________________________________
*/
/* we initialize this index at startup time
* and never write to it at request time,
* so this static is thread safe.
* also note that OpenSSL increments at static variable when
* SSL_get_ex_new_index() is called, so we _must_ do this at startup.
*/
static int SSL_app_data2_idx = -1;
void SSL_init_app_data2_idx(void)
{
int i;
if (SSL_app_data2_idx > -1) {
return;
}
/* we _do_ need to call this twice */
for (i=0; i<=1; i++) {
"Second Application Data for SSL",
}
}
{
}
{
return;
}
/* _________________________________________________________________
**
** High-Level Private Key Loading
** _________________________________________________________________
*/
{
/* 1. try PEM (= DER+Base64+headers) */
return NULL;
/* 2. try DER+Base64 */
return NULL;
return NULL;
}
/* 3. try plain DER */
return NULL;
}
}
EVP_PKEY_free(*key);
}
return rc;
}
/* _________________________________________________________________
**
** Smart shutdown
** _________________________________________________________________
*/
{
int i;
int rc;
int flush;
/*
* Repeat the calls, because SSL_shutdown internally dispatches through a
* little state machine. Usually only one or two interation should be
* needed, so we restrict the total number of restrictions in order to
* avoid process hangs in case the client played bad with the socket
* connection and OpenSSL cannot recognize it.
*/
rc = 0;
for (i = 0; i < 4 /* max 2x pending + 2x data = 4 */; i++) {
/* Once the close notity is sent through the output filters,
* ensure it is flushed through the socket.
*/
rc = -1;
break;
}
flush = 0;
}
if (rc != 0)
break;
}
return rc;
}
/* _________________________________________________________________
**
** Certificate Checks
** _________________________________________________________________
*/
/* retrieve basic constraints ingredients */
{
char *cp;
return FALSE;
return FALSE;
}
return FALSE;
}
}
return TRUE;
}
/* convert an ASN.1 string to a UTF-8 string (escaping control characters) */
{
int len;
return NULL;
if (len > 0) {
}
return result;
}
/* convert a NAME_ENTRY to UTF8 string */
{
return result;
}
/*
* convert an X509_NAME to an RFC 2253 formatted string, optionally truncated
* to maxlen characters (specify a maxlen of 0 for no length limit)
*/
{
int len;
return NULL;
if (len > 0) {
if (maxlen > 2) {
/* insert trailing ellipsis if there's enough space */
}
} else {
}
}
return result;
}
/*
* Return an array of subjectAltName entries of type "type". If idx is -1,
* return all entries of the given type, otherwise return an array consisting
* of the n-th occurrence of that type only. Currently supported types:
* GEN_EMAIL (rfc822Name)
* GEN_DNS (dNSName)
*/
{
!(*entries = apr_array_make(p, 0, sizeof(char *)))) {
return FALSE;
}
int i, n = 0;
const char *utf8str;
for (i = 0; i < sk_GENERAL_NAME_num(names); i++) {
switch (type) {
case GEN_EMAIL:
case GEN_DNS:
if (utf8str) {
}
break;
default:
/*
* Not implemented right now:
* GEN_OTHERNAME (otherName)
* GEN_X400 (x400Address)
* GEN_DIRNAME (directoryName)
* GEN_EDIPARTY (ediPartyName)
* GEN_URI (uniformResourceIdentifier)
* GEN_IPADD (iPAddress)
* GEN_RID (registeredID)
*/
break;
}
}
break;
}
}
}
}
/* return an array of (RFC 6125 coined) DNS-IDs and CN-IDs in a certificate */
{
int i = -1;
/* First, the DNS-IDs (dNSName entries in the subjectAltName extension) */
if (!x509 ||
return FALSE;
}
/* Second, the CN-IDs (commonName attributes in the subject DN) */
APR_ARRAY_PUSH(*ids, const char *) =
}
}
/*
* Check if a certificate matches for a particular name, by iterating over its
* DNS-IDs and CN-IDs (RFC 6125), optionally with basic wildcard matching.
*/
{
/*
* At some day in the future, this might be replaced with X509_check_host()
* (available in OpenSSL 1.0.2 and later), but two points should be noted:
* 1) wildcard matching in X509_check_host() might yield different
* results (by default, it supports a broader set of patterns, e.g.
* wildcards in non-initial positions);
* 2) we lose the option of logging each DNS- and CN-ID (until a match
* is found).
*/
const char *cp;
int i;
if (!id[i])
continue;
/*
* Determine if it is a wildcard ID - we're restrictive
* in the sense that we require the wildcard character to be
* THE left-most label (i.e., the ID must start with "*.")
*/
/*
* If the ID includes a wildcard character (and the caller is
* allowing wildcards), check if it matches for the left-most
* DNS label - i.e., the wildcard character is not allowed
* to match a dot. Otherwise, try a simple string compare.
*/
}
if (s) {
"[%s] SSL_X509_match_name: expecting name '%s', "
"%smatched by ID '%s'",
}
break;
}
}
}
if (s) {
(mySrvConfig(s))->vhost_id,
name);
}
return matched;
}
/* _________________________________________________________________
**
** Low-Level CA Certificate Loading
** _________________________________________________________________
*/
const char *filename)
{
return FALSE;
}
return FALSE;
}
return TRUE;
}
const char *pathname)
{
/* XXX: this dir read code is exactly the same as that in
* ssl_engine_init.c, only the call to handle the fullname is different,
* should fold the duplication.
*/
const char *fullname;
return FALSE;
}
continue; /* don't try to load directories */
}
NULL);
}
}
return ok;
}
/* _________________________________________________________________
**
** Custom (EC)DH parameter support
** _________________________________________________________________
*/
{
return NULL;
return (dh);
}
#ifdef HAVE_ECC
{
return NULL;
return (group);
}
#endif
/* _________________________________________________________________
**
** Extra Server Certificate Chain Support
** _________________________________________________________________
*/
/*
* Read a file that optionally contains the server certificate in PEM
* format, possibly followed by a sequence of CA certificates that
* should be sent to the peer in the SSL Certificate message.
*/
{
unsigned long err;
int n;
return -1;
return -1;
}
/* optionally skip a leading server certificate */
if (skipfirst) {
return -1;
}
}
/* free a perhaps already configured extra chain */
#ifdef OPENSSL_NO_SSL_INTERN
#else
}
#endif
/* create new extra chain by loading the certs */
n = 0;
return -1;
}
n++;
}
/* Make sure that only the error is just an EOF */
if ((err = ERR_peek_error()) > 0) {
return -1;
}
while (ERR_get_error() > 0) ;
}
return n;
}
/* _________________________________________________________________
**
** Session Stuff
** _________________________________________________________________
*/
{
/* We must ensure not to process more than what would fit in the
* destination buffer, including terminating NULL */
return str;
}