www/apache
www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-06-04 21:42:15 +03:00
Code
apache/modules/ssl/ssl_util.c
Joe Orton 3ca3524c31 Move mod_ssl-internal interfaces into ssl_private.h; allow mod_ssl.h 
to be included even when mod_ssl is not enabled.

* Makefile.in (install-include): Only install mod_ssl.h.

* modules/ssl/ssl_private.h: New file.

* modules/ssl/mod_ssl.h: Move everything apart from than the optional
hook definitions into ssl_private.h.

* modules/ssl/*.c: Include ssl_private.h not mod_ssl.h

* modules/ssl/config.m4: Always add the mod_ssl directory to the
include path so other modules can find mod_ssl.h.

* modules/proxy/mod_proxy.c: Include mod_ssl.h to pick up the optional
hook definitions rather than copy'n'pasting them.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102803 13f79535-47bb-0310-9956-ffa450edef68
2004-02-28 18:06:35 +00:00

449 lines
12 KiB
C
Raw Blame History

/* Copyright 2001-2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* ssl_util.c
* Utility Functions
*/
/* ``Every day of my life
I am forced to add another
name to the list of people
who piss me off!''
-- Calvin */
#include "ssl_private.h"
#include "ap_mpm.h"
#include "apr_thread_mutex.h"
/* _________________________________________________________________
**
** Utility Functions
** _________________________________________________________________
*/
char *ssl_util_vhostid(apr_pool_t *p, server_rec *s)
{
char *id;
SSLSrvConfigRec *sc;
char *host;
apr_port_t port;
host = s->server_hostname;
if (s->port != 0)
port = s->port;
else {
sc = mySrvConfig(s);
if (sc->enabled == TRUE)
port = DEFAULT_HTTPS_PORT;
else
port = DEFAULT_HTTP_PORT;
}
id = apr_psprintf(p, "%s:%lu", host, (unsigned long)port);
return id;
}
void ssl_util_strupper(char *s)
{
for (; *s; ++s)
*s = apr_toupper(*s);
return;
}
static const char ssl_util_uuencode_six2pr[64+1] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
void ssl_util_uuencode(char *szTo, const char *szFrom, BOOL bPad)
{
ssl_util_uuencode_binary((unsigned char *)szTo,
(const unsigned char *)szFrom,
strlen(szFrom), bPad);
}
void ssl_util_uuencode_binary(unsigned char *szTo,
const unsigned char *szFrom,
int nLength, BOOL bPad)
{
const unsigned char *s;
int nPad = 0;
for (s = szFrom; nLength > 0; s += 3) {
*szTo++ = ssl_util_uuencode_six2pr[s[0] >> 2];
*szTo++ = ssl_util_uuencode_six2pr[(s[0] << 4 | s[1] >> 4) & 0x3f];
if (--nLength == 0) {
nPad = 2;
break;
}
*szTo++ = ssl_util_uuencode_six2pr[(s[1] << 2 | s[2] >> 6) & 0x3f];
if (--nLength == 0) {
nPad = 1;
break;
}
*szTo++ = ssl_util_uuencode_six2pr[s[2] & 0x3f];
--nLength;
}
while(bPad && nPad--) {
*szTo++ = NUL;
}
*szTo = NUL;
return;
}
apr_file_t *ssl_util_ppopen(server_rec *s, apr_pool_t *p, const char *cmd,
const char * const *argv)
{
apr_procattr_t *procattr;
apr_proc_t *proc;
if (apr_procattr_create(&procattr, p) != APR_SUCCESS)
return NULL;
if (apr_procattr_io_set(procattr, APR_FULL_BLOCK, APR_FULL_BLOCK,
APR_FULL_BLOCK) != APR_SUCCESS)
return NULL;
if (apr_procattr_dir_set(procattr,
ap_make_dirstr_parent(p, cmd)) != APR_SUCCESS)
return NULL;
if (apr_procattr_cmdtype_set(procattr, APR_PROGRAM) != APR_SUCCESS)
return NULL;
if ((proc = (apr_proc_t *)apr_pcalloc(p, sizeof(apr_proc_t))) == NULL)
return NULL;
if (apr_proc_create(proc, cmd, argv, NULL, procattr, p) != APR_SUCCESS)
return NULL;
return proc->out;
}
void ssl_util_ppclose(server_rec *s, apr_pool_t *p, apr_file_t *fp)
{
apr_file_close(fp);
return;
}
/*
* Run a filter program and read the first line of its stdout output
*/
char *ssl_util_readfilter(server_rec *s, apr_pool_t *p, const char *cmd,
const char * const *argv)
{
static char buf[MAX_STRING_LEN];
apr_file_t *fp;
apr_size_t nbytes = 1;
char c;
int k;
if ((fp = ssl_util_ppopen(s, p, cmd, argv)) == NULL)
return NULL;
/* XXX: we are reading 1 byte at a time here */
for (k = 0; apr_file_read(fp, &c, &nbytes) == APR_SUCCESS
&& nbytes == 1 && (k < MAX_STRING_LEN-1) ; ) {
if (c == '\n' || c == '\r')
break;
buf[k++] = c;
}
buf[k] = NUL;
ssl_util_ppclose(s, p, fp);
return buf;
}
BOOL ssl_util_path_check(ssl_pathcheck_t pcm, const char *path, apr_pool_t *p)
{
apr_finfo_t finfo;
if (path == NULL)
return FALSE;
if (pcm & SSL_PCM_EXISTS && apr_stat(&finfo, path,
APR_FINFO_TYPE|APR_FINFO_SIZE, p) != 0)
return FALSE;
if (pcm & SSL_PCM_ISREG && finfo.filetype != APR_REG)
return FALSE;
if (pcm & SSL_PCM_ISDIR && finfo.filetype != APR_DIR)
return FALSE;
if (pcm & SSL_PCM_ISNONZERO && finfo.size <= 0)
return FALSE;
return TRUE;
}
ssl_algo_t ssl_util_algotypeof(X509 *pCert, EVP_PKEY *pKey)
{
ssl_algo_t t;
t = SSL_ALGO_UNKNOWN;
if (pCert != NULL)
pKey = X509_get_pubkey(pCert);
if (pKey != NULL) {
switch (EVP_PKEY_key_type(pKey)) {
case EVP_PKEY_RSA:
t = SSL_ALGO_RSA;
break;
case EVP_PKEY_DSA:
t = SSL_ALGO_DSA;
break;
default:
break;
}
}
return t;
}
char *ssl_util_algotypestr(ssl_algo_t t)
{
char *cp;
cp = "UNKNOWN";
switch (t) {
case SSL_ALGO_RSA:
cp = "RSA";
break;
case SSL_ALGO_DSA:
cp = "DSA";
break;
default:
break;
}
return cp;
}
char *ssl_util_ptxtsub(apr_pool_t *p, const char *cpLine,
const char *cpMatch, char *cpSubst)
{
#define MAX_PTXTSUB 100
char *cppMatch[MAX_PTXTSUB];
char *cpResult;
int nResult;
int nLine;
int nSubst;
int nMatch;
char *cpI;
char *cpO;
char *cp;
int i;
/*
* Pass 1: find substitution locations and calculate sizes
*/
nLine = strlen(cpLine);
nMatch = strlen(cpMatch);
nSubst = strlen(cpSubst);
for (cpI = (char *)cpLine, i = 0, nResult = 0;
cpI < cpLine+nLine && i < MAX_PTXTSUB; ) {
if ((cp = strstr(cpI, cpMatch)) != NULL) {
cppMatch[i++] = cp;
nResult += ((cp-cpI)+nSubst);
cpI = (cp+nMatch);
}
else {
nResult += strlen(cpI);
break;
}
}
cppMatch[i] = NULL;
if (i == 0)
return NULL;
/*
* Pass 2: allocate memory and assemble result
*/
cpResult = apr_pcalloc(p, nResult+1);
for (cpI = (char *)cpLine, cpO = cpResult, i = 0;
cppMatch[i] != NULL;
i++) {
apr_cpystrn(cpO, cpI, cppMatch[i]-cpI+1);
cpO += (cppMatch[i]-cpI);
apr_cpystrn(cpO, cpSubst, nSubst+1);
cpO += nSubst;
cpI = (cppMatch[i]+nMatch);
}
apr_cpystrn(cpO, cpI, cpResult+nResult-cpO+1);
return cpResult;
}
/*
* certain key and cert data needs to survive restarts,
* which are stored in the user data table of s->process->pool.
* to prevent "leaking" of this data, we use malloc/free
* rather than apr_palloc and these wrappers to help make sure
* we do not leak the malloc-ed data.
*/
unsigned char *ssl_asn1_table_set(apr_hash_t *table,
const char *key,
long int length)
{
apr_ssize_t klen = strlen(key);
ssl_asn1_t *asn1 = apr_hash_get(table, key, klen);
/*
* if a value for this key already exists,
* reuse as much of the already malloc-ed data
* as possible.
*/
if (asn1) {
if (asn1->nData != length) {
free(asn1->cpData); /* XXX: realloc? */
asn1->cpData = NULL;
}
}
else {
asn1 = malloc(sizeof(*asn1));
asn1->source_mtime = 0; /* used as a note for encrypted private keys */
asn1->cpData = NULL;
}
asn1->nData = length;
if (!asn1->cpData) {
asn1->cpData = malloc(length);
}
apr_hash_set(table, key, klen, asn1);
return asn1->cpData; /* caller will assign a value to this */
}
ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
const char *key)
{
return (ssl_asn1_t *)apr_hash_get(table, key, APR_HASH_KEY_STRING);
}
void ssl_asn1_table_unset(apr_hash_t *table,
const char *key)
{
apr_ssize_t klen = strlen(key);
ssl_asn1_t *asn1 = apr_hash_get(table, key, klen);
if (!asn1) {
return;
}
if (asn1->cpData) {
free(asn1->cpData);
}
free(asn1);
apr_hash_set(table, key, klen, NULL);
}
static const char *ssl_asn1_key_types[] = {"RSA", "DSA"};
const char *ssl_asn1_keystr(int keytype)
{
if (keytype >= SSL_AIDX_MAX) {
return NULL;
}
return ssl_asn1_key_types[keytype];
}
const char *ssl_asn1_table_keyfmt(apr_pool_t *p,
const char *id,
int keytype)
{
const char *keystr = ssl_asn1_keystr(keytype);
return apr_pstrcat(p, id, ":", keystr, NULL);
}
#if APR_HAS_THREADS
/*
* To ensure thread-safetyness in OpenSSL - work in progress
*/
static apr_thread_mutex_t **lock_cs;
static int lock_num_locks;
#ifdef HAVE_SSLC
#if SSLC_VERSION_NUMBER >= 0x2000
static int ssl_util_thr_lock(int mode, int type,
char *file, int line)
#else
static void ssl_util_thr_lock(int mode, int type,
char *file, int line)
#endif
#else
static void ssl_util_thr_lock(int mode, int type,
const char *file, int line)
#endif
{
if (type < lock_num_locks) {
if (mode & CRYPTO_LOCK) {
apr_thread_mutex_lock(lock_cs[type]);
}
else {
apr_thread_mutex_unlock(lock_cs[type]);
}
#ifdef HAVE_SSLC
#if SSLC_VERSION_NUMBER >= 0x2000
return 1;
}
else {
return -1;
#endif
#endif
}
}
static unsigned long ssl_util_thr_id(void)
{
/* OpenSSL needs this to return an unsigned long. On OS/390, the pthread
* id is a structure twice that big. Use the TCB pointer instead as a
* unique unsigned long.
*/
#ifdef __MVS__
struct PSA {
char unmapped[540];
unsigned long PSATOLD;
} *psaptr = 0;
return psaptr->PSATOLD;
#else
return (unsigned long) apr_os_thread_current();
#endif
}
static apr_status_t ssl_util_thread_cleanup(void *data)
{
CRYPTO_set_locking_callback(NULL);
CRYPTO_set_id_callback(NULL);
/* Let the registered mutex cleanups do their own thing
*/
return APR_SUCCESS;
}
void ssl_util_thread_setup(apr_pool_t *p)
{
int i;
lock_num_locks = CRYPTO_num_locks();
lock_cs = apr_palloc(p, lock_num_locks * sizeof(*lock_cs));
for (i = 0; i < lock_num_locks; i++) {
apr_thread_mutex_create(&(lock_cs[i]), APR_THREAD_MUTEX_DEFAULT, p);
}
CRYPTO_set_id_callback(ssl_util_thr_id);
CRYPTO_set_locking_callback(ssl_util_thr_lock);
apr_pool_cleanup_register(p, NULL, ssl_util_thread_cleanup,
apr_pool_cleanup_null);
}
#endif
View Git Blame Copy Permalink