canl_mod_ssl-private.h

Go to the documentation of this file.
00001 /*
00002    Copyright (c) 2003-8, Andrew McNab, University of Manchester
00003    All rights reserved.
00004 
00005    Redistribution and use in source and binary forms, with or
00006    without modification, are permitted provided that the following
00007    conditions are met:
00008 
00009      o Redistributions of source code must retain the above
00010        copyright notice, this list of conditions and the following
00011        disclaimer. 
00012      o Redistributions in binary form must reproduce the above
00013        copyright notice, this list of conditions and the following
00014        disclaimer in the documentation and/or other materials
00015        provided with the distribution. 
00016 
00017    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
00018    CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
00019    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
00020    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
00021    DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
00022    BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
00023    EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
00024    TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
00025    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
00026    ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
00027    OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
00028    OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
00029    POSSIBILITY OF SUCH DAMAGE.
00030 */
00031 
00032 /*
00033 
00034  Portions of this code are derived from Apache mod_ssl, and are covered
00035  by the Apache Software License:
00036 
00037  * Copyright 2001-2004 The Apache Software Foundation
00038  *
00039  * Licensed under the Apache License, Version 2.0 (the "License");
00040  * you may not use this file except in compliance with the License.
00041  * You may obtain a copy of the License at
00042  *
00043  *     http://www.apache.org/licenses/LICENSE-2.0
00044  *
00045  * Unless required by applicable law or agreed to in writing, software
00046  * distributed under the License is distributed on an "AS IS" BASIS,
00047  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00048  * See the License for the specific language governing permissions and
00049  * limitations under the License.
00050  */
00051 
00052 /*
00053    This work has been partially funded by the EU Commission (contract 
00054    INFSO-RI-222667) under the EGEE-III collaboration.
00055 */
00056 
00057 /*------------------------------------------------------------------*
00058  * This program is part of GridSite: http://www.gridsite.org/       *
00059  *------------------------------------------------------------------*/
00060 
00061 
00062 /*
00063  * After 2.0.49, Apache mod_ssl has most of the mod_ssl structures defined
00064  * in ssl_private.h, which is not installed along with httpd-devel (eg in
00065  * the FC2 RPM.) This include file provides SIMPLIFIED structures for use
00066  * by mod_gridsite: for example, pointers to unused structures are replaced
00067  * by  void *  and some of the structures are truncated when only the early
00068  * members are used.
00069  *
00070  * CLEARLY, THIS WILL BREAK IF THERE ARE MAJOR CHANGES TO ssl_private.h!!!
00071  */
00072 
00073 #include <openssl/ssl.h>
00074 
00075 #ifndef BOOL
00076 #define BOOL unsigned int
00077 #endif
00078 
00079 typedef enum {
00080     SSL_SHUTDOWN_TYPE_UNSET,
00081     SSL_SHUTDOWN_TYPE_STANDARD,
00082     SSL_SHUTDOWN_TYPE_UNCLEAN,
00083     SSL_SHUTDOWN_TYPE_ACCURATE
00084 } ssl_shutdown_type_e;
00085 
00086 typedef enum {
00087     SSL_ENABLED_UNSET    = -1,
00088     SSL_ENABLED_FALSE    = 0,
00089     SSL_ENABLED_TRUE     = 1,
00090     SSL_ENABLED_OPTIONAL = 3
00091 } ssl_enabled_t;
00092 
00093 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00094 typedef enum {
00095     SSL_CVERIFY_UNSET           = -1,
00096     SSL_CVERIFY_NONE            = 0,
00097     SSL_CVERIFY_OPTIONAL        = 1,
00098     SSL_CVERIFY_REQUIRE         = 2,
00099     SSL_CVERIFY_OPTIONAL_NO_CA  = 3
00100 } ssl_verify_t;
00101 
00102 #endif
00103 
00104 typedef struct {
00105   SSL *ssl;
00106   const char *client_dn;
00107   X509 *client_cert;
00108   ssl_shutdown_type_e shutdown_type;
00109   const char *verify_info;
00110   const char *verify_error;
00111   int verify_depth;
00112   int is_proxy;
00113   int disabled;
00114   int non_ssl_request;
00115 } SSLConnRec;
00116 
00117 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00118 typedef struct {
00119     const char  *ca_cert_path;
00120     const char  *ca_cert_file;
00121 
00122     const char  *cipher_suite;
00123 
00124     int          verify_depth;
00125     ssl_verify_t verify_mode;
00126 } modssl_auth_ctx_t;
00127 #endif
00128 
00129 typedef struct {
00130   void    *sc; /* pointer back to server config */
00131   SSL_CTX *ssl_ctx;
00132 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00133   void *pks;
00134   void *pkp;
00135 
00136   int  protocol;
00137 
00138   int           pphrase_dialog_type;
00139   const char   *pphrase_dialog_path;
00140 
00141   const char  *cert_chain;
00142 
00143   const char  *crl_path;
00144   const char  *crl_file;
00145   X509_STORE  *crl;
00146 
00147   modssl_auth_ctx_t auth;
00148 #endif
00149 } modssl_ctx_t;
00150 
00151 /* original SSLSrvConfigRec */
00152 typedef struct {
00153   void            *mc;
00154   BOOL             enabled;
00155   BOOL             proxy_enabled;
00156   const char      *vhost_id;
00157   int              vhost_id_len;
00158   int              session_cache_timeout;
00159 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00160   BOOL             cipher_server_pref;
00161 #endif
00162   modssl_ctx_t    *server;
00163   modssl_ctx_t    *proxy;
00164 } SSLSrvConfigRec;
00165 
00166 /* SSLSrvConfigRec after mod_ssl patch for CVE-2009-3555 */
00167 typedef struct {
00168   void            *mc;
00169   unsigned int     enabled;
00170   unsigned int     proxy_enabled;
00171   const char      *vhost_id;
00172   int              vhost_id_len;
00173   int              session_cache_timeout;
00174 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00175   BOOL             cipher_server_pref;
00176 #endif
00177   /* this is the member that was added */
00178   int              insecure_reneg;
00179   modssl_ctx_t    *server;
00180   modssl_ctx_t    *proxy;
00181 } SSLSrvConfigRec2;
00182 
00183 /* The server and proxy members of SSLSrvConfigRec must only be accessed
00184    using these macros: */
00185 #define SSLSrvConfigRec_server(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->server) : (((SSLSrvConfigRec *) sc)->server))
00186 #define SSLSrvConfigRec_proxy(sc) (mod_ssl_with_insecure_reneg ? (((SSLSrvConfigRec2 *) sc)->proxy) : (((SSLSrvConfigRec *) sc)->proxy))
00187 
00188 #if AP_MODULE_MAGIC_AT_LEAST(20051115,0)
00189 typedef struct {
00190     BOOL          bSSLRequired;
00191     apr_array_header_t *aRequirement;
00192     int           nOptions;
00193     int           nOptionsAdd;
00194     int           nOptionsDel;
00195     const char   *szCipherSuite;
00196     ssl_verify_t  nVerifyClient;
00197     int           nVerifyDepth;
00198     const char   *szCACertificatePath;
00199     const char   *szCACertificateFile;
00200     const char   *szUserName;
00201 } SSLDirConfigRec;
00202 #endif
00203 
00204 extern module AP_MODULE_DECLARE_DATA ssl_module;

Generated on 23 Sep 2013 by  doxygen 1.6.1