1 /* Licensed to the Apache Software Foundation (ASF) under one or more 2 * contributor license agreements. See the NOTICE file distributed with 3 * this work for additional information regarding copyright ownership. 4 * The ASF licenses this file to You under the Apache License, Version 2.0 5 * (the "License"); you may not use this file except in compliance with 6 * the License. You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef SSL_PRIVATE_H 18 #define SSL_PRIVATE_H 19 20 /* Exclude unused OpenSSL features 21 * even if the OpenSSL supports them 22 */ 23 #ifndef OPENSSL_NO_IDEA 24 #define OPENSSL_NO_IDEA 25 #endif 26 #ifndef OPENSSL_NO_KRB5 27 #define OPENSSL_NO_KRB5 28 #endif 29 #ifndef OPENSSL_NO_MDC2 30 #define OPENSSL_NO_MDC2 31 #endif 32 #ifndef OPENSSL_NO_RC5 33 #define OPENSSL_NO_RC5 34 #endif 35 36 /* OpenSSL headers */ 37 #include <openssl/opensslv.h> 38 #include <openssl/ssl.h> 39 #include <openssl/err.h> 40 #include <openssl/x509.h> 41 #include <openssl/pem.h> 42 #include <openssl/pkcs12.h> 43 #include <openssl/crypto.h> 44 #include <openssl/evp.h> 45 #include <openssl/rand.h> 46 #include <openssl/x509v3.h> 47 #include <openssl/dh.h> 48 #include <openssl/bn.h> 49 /* Avoid tripping over an engine build installed globally and detected 50 * when the user points at an explicit non-engine flavor of OpenSSL 51 */ 52 #ifndef OPENSSL_NO_ENGINE 53 #include <openssl/engine.h> 54 #endif 55 56 #ifndef RAND_MAX 57 #include <limits.h> 58 #define RAND_MAX INT_MAX 59 #endif 60 61 #define SSL_AIDX_RSA (0) 62 #define SSL_AIDX_DSA (1) 63 #define SSL_AIDX_ECC (3) 64 #define SSL_AIDX_MAX (4) 65 66 /* 67 * Define the SSL options 68 */ 69 #define SSL_OPT_NONE (0) 70 #define SSL_OPT_RELSET (1<<0) 71 #define SSL_OPT_STDENVVARS (1<<1) 72 #define SSL_OPT_EXPORTCERTDATA (1<<3) 73 #define SSL_OPT_FAKEBASICAUTH (1<<4) 74 #define SSL_OPT_STRICTREQUIRE (1<<5) 75 #define SSL_OPT_OPTRENEGOTIATE (1<<6) 76 #define SSL_OPT_ALL (SSL_OPT_STDENVVARS|SSL_OPT_EXPORTCERTDATA|SSL_OPT_FAKEBASICAUTH|SSL_OPT_STRICTREQUIRE|SSL_OPT_OPTRENEGOTIATE) 77 78 /* 79 * Define the SSL Protocol options 80 */ 81 #define SSL_PROTOCOL_NONE (0) 82 #define SSL_PROTOCOL_SSLV2 (1<<0) 83 #define SSL_PROTOCOL_SSLV3 (1<<1) 84 #define SSL_PROTOCOL_TLSV1 (1<<2) 85 #define SSL_PROTOCOL_TLSV1_1 (1<<3) 86 #define SSL_PROTOCOL_TLSV1_2 (1<<4) 87 #define SSL_PROTOCOL_TLSV1_3 (1<<5) 88 89 #define SSL_MODE_CLIENT (0) 90 #define SSL_MODE_SERVER (1) 91 #define SSL_MODE_COMBINED (2) 92 93 #define SSL_BIO_FLAG_RDONLY (1<<0) 94 #define SSL_BIO_FLAG_CALLBACK (1<<1) 95 #define SSL_DEFAULT_CACHE_SIZE (256) 96 #define SSL_DEFAULT_VHOST_NAME ("_default_:443") 97 #define SSL_MAX_STR_LEN (2048) 98 #define SSL_MAX_PASSWORD_LEN (256) 99 100 #define SSL_CVERIFY_UNSET (-1) 101 #define SSL_CVERIFY_NONE (0) 102 #define SSL_CVERIFY_OPTIONAL (1) 103 #define SSL_CVERIFY_REQUIRE (2) 104 #define SSL_CVERIFY_OPTIONAL_NO_CA (3) 105 #define SSL_VERIFY_PEER_STRICT (SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT) 106 107 #define SSL_SHUTDOWN_TYPE_UNSET (0) 108 #define SSL_SHUTDOWN_TYPE_STANDARD (1) 109 #define SSL_SHUTDOWN_TYPE_UNCLEAN (2) 110 #define SSL_SHUTDOWN_TYPE_ACCURATE (3) 111 112 #define SSL_TO_APR_ERROR(X) (APR_OS_START_USERERR + 1000 + X) 113 114 #define SSL_INFO_SESSION_ID (0x0001) 115 #define SSL_INFO_CIPHER (0x0002) 116 #define SSL_INFO_CIPHER_USEKEYSIZE (0x0003) 117 #define SSL_INFO_CIPHER_ALGKEYSIZE (0x0004) 118 #define SSL_INFO_CIPHER_VERSION (0x0005) 119 #define SSL_INFO_CIPHER_DESCRIPTION (0x0006) 120 #define SSL_INFO_PROTOCOL (0x0007) 121 122 #define SSL_INFO_CLIENT_S_DN (0x0010) 123 #define SSL_INFO_CLIENT_I_DN (0x0020) 124 #define SSL_INFO_SERVER_S_DN (0x0040) 125 #define SSL_INFO_SERVER_I_DN (0x0080) 126 127 #define SSL_INFO_DN_COUNTRYNAME (0x0001) 128 #define SSL_INFO_DN_STATEORPROVINCENAME (0x0002) 129 #define SSL_INFO_DN_LOCALITYNAME (0x0003) 130 #define SSL_INFO_DN_ORGANIZATIONNAME (0x0004) 131 #define SSL_INFO_DN_ORGANIZATIONALUNITNAME (0x0005) 132 #define SSL_INFO_DN_COMMONNAME (0x0006) 133 #define SSL_INFO_DN_TITLE (0x0007) 134 #define SSL_INFO_DN_INITIALS (0x0008) 135 #define SSL_INFO_DN_GIVENNAME (0x0009) 136 #define SSL_INFO_DN_SURNAME (0x000A) 137 #define SSL_INFO_DN_DESCRIPTION (0x000B) 138 #define SSL_INFO_DN_UNIQUEIDENTIFIER (0x000C) 139 #define SSL_INFO_DN_EMAILADDRESS (0x000D) 140 141 #define SSL_INFO_CLIENT_MASK (0x0100) 142 143 #define SSL_INFO_CLIENT_M_VERSION (0x0101) 144 #define SSL_INFO_CLIENT_M_SERIAL (0x0102) 145 #define SSL_INFO_CLIENT_V_START (0x0103) 146 #define SSL_INFO_CLIENT_V_END (0x0104) 147 #define SSL_INFO_CLIENT_A_SIG (0x0105) 148 #define SSL_INFO_CLIENT_A_KEY (0x0106) 149 #define SSL_INFO_CLIENT_CERT (0x0107) 150 #define SSL_INFO_CLIENT_V_REMAIN (0x0108) 151 152 #define SSL_INFO_SERVER_MASK (0x0200) 153 154 #define SSL_INFO_SERVER_M_VERSION (0x0201) 155 #define SSL_INFO_SERVER_M_SERIAL (0x0202) 156 #define SSL_INFO_SERVER_V_START (0x0203) 157 #define SSL_INFO_SERVER_V_END (0x0204) 158 #define SSL_INFO_SERVER_A_SIG (0x0205) 159 #define SSL_INFO_SERVER_A_KEY (0x0206) 160 #define SSL_INFO_SERVER_CERT (0x0207) 161 #define SSL_INFO_CLIENT_CERT_CHAIN (0x0400) 162 163 #define SSL_VERIFY_ERROR_IS_OPTIONAL(errnum) \ 164 ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) \ 165 || (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) \ 166 || (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) \ 167 || (errnum == X509_V_ERR_CERT_UNTRUSTED) \ 168 || (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) 169 170 #define SSL_DEFAULT_PASS_PROMPT "Some of your private key files are encrypted for security reasons.\n" \ 171 "In order to read them you have to provide the pass phrases.\n" \ 172 "Enter password :" 173 174 #define SSL_CIPHERS_ALWAYS_DISABLED ("!aNULL:!eNULL:!EXP:") 175 176 #if defined(SSL_OP_NO_TLSv1_1) 177 #define HAVE_TLSV1_1 178 #endif 179 180 #if defined(SSL_OP_NO_TLSv1_2) 181 #define HAVE_TLSV1_2 182 #endif 183 184 #if defined(SSL_OP_NO_TLSv1_3) 185 #define HAVE_TLSV1_3 186 #endif 187 188 /* Check for SSL_CONF support */ 189 #if defined(SSL_CONF_FLAG_FILE) 190 #define HAVE_SSL_CONF_CMD 191 #endif 192 193 /** 194 * The following features all depend on TLS extension support. 195 * Within this block, check again for features (not version numbers). 196 */ 197 #if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) 198 199 #define HAVE_TLSEXT 200 201 /* ECC */ 202 #if !defined(OPENSSL_NO_EC) && defined(TLSEXT_ECPOINTFORMAT_uncompressed) 203 #define HAVE_ECC 204 #endif 205 206 /* OCSP stapling */ 207 #if !defined(OPENSSL_NO_OCSP) && defined(SSL_CTX_set_tlsext_status_cb) 208 #define HAVE_OCSP_STAPLING 209 #define OCSP_STATUS_OK 0 210 #define OCSP_STATUS_REVOKED 1 211 #define OCSP_STATUS_UNKNOWN 2 212 #endif 213 214 #endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */ 215 216 /* OpenSSL 1.0.2 compatibility */ 217 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) 218 #define OpenSSL_version SSLeay_version 219 #define OpenSSL_version_num SSLeay 220 #define OPENSSL_VERSION SSLEAY_VERSION 221 #define OPENSSL_malloc_init CRYPTO_malloc_init 222 #define BN_get_rfc2409_prime_768 get_rfc2409_prime_768 223 #define BN_get_rfc2409_prime_1024 get_rfc2409_prime_1024 224 #define BN_get_rfc3526_prime_1536 get_rfc3526_prime_1536 225 #define BN_get_rfc3526_prime_2048 get_rfc3526_prime_2048 226 #define BN_get_rfc3526_prime_3072 get_rfc3526_prime_3072 227 #define BN_get_rfc3526_prime_4096 get_rfc3526_prime_4096 228 #define BN_get_rfc3526_prime_6144 get_rfc3526_prime_6144 229 #define BN_get_rfc3526_prime_8192 get_rfc3526_prime_8192 230 #define BIO_get_init(x) (x->init) 231 #define BIO_set_init(x,v) (x->init=v) 232 #define BIO_get_data(x) (x->ptr) 233 #define BIO_set_data(x,v) (x->ptr=v) 234 #define BIO_set_shutdown(x,v) (x->shutdown=v) 235 #define X509_REVOKED_get0_serialNumber(x) x->serialNumber 236 #define X509_STORE_CTX_get0_untrusted(x) (x->untrusted) 237 #define X509_OBJECT_free(x) {X509_OBJECT_free_contents(obj);\ 238 OPENSSL_free(obj);} 239 #define TLS_method SSLv23_method 240 #define TLS_client_method SSLv23_client_method 241 #define TLS_server_method SSLv23_server_method 242 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) */ 243 244 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) 245 #define HAVE_KEYLOG_CALLBACK 246 #endif 247 248 #define MAX_ALPN_NPN_PROTO_SIZE 65535 249 #define SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL 1 250 251 typedef struct { 252 /* client can have any number of cert/key pairs */ 253 const char *cert_file; 254 const char *cert_path; 255 STACK_OF(X509_INFO) *certs; 256 } ssl_pkc_t; 257 258 typedef struct tcn_ssl_ctxt_t tcn_ssl_ctxt_t; 259 260 typedef struct { 261 char password[SSL_MAX_PASSWORD_LEN]; 262 const char *prompt; 263 tcn_callback_t cb; 264 } tcn_pass_cb_t; 265 266 extern tcn_pass_cb_t tcn_password_callback; 267 268 struct tcn_ssl_ctxt_t { 269 apr_pool_t *pool; 270 SSL_CTX *ctx; 271 BIO *bio_os; 272 BIO *bio_is; 273 274 unsigned char context_id[SHA_DIGEST_LENGTH]; 275 276 int protocol; 277 /* we are one or the other */ 278 int mode; 279 280 /* certificate revocation list */ 281 X509_STORE *crl; 282 /* pointer to the context verify store */ 283 X509_STORE *store; 284 X509 *certs[SSL_AIDX_MAX]; 285 EVP_PKEY *keys[SSL_AIDX_MAX]; 286 287 int ca_certs; 288 int shutdown_type; 289 char *rand_file; 290 291 const char *cipher_suite; 292 /* for client or downstream server authentication */ 293 int verify_depth; 294 int verify_mode; 295 tcn_pass_cb_t *cb_data; 296 297 /* for client: List of protocols to request via ALPN. 298 * for server: List of protocols to accept via ALPN. 299 */ 300 /* member alpn is array of protocol strings encoded as a list of bytes 301 * of length alpnlen, each protocol string is prepended with a byte 302 * containing the protocol string length (max 255), then follows the 303 * protocol string itself. 304 */ 305 char *alpn; 306 int alpnlen; 307 /* Add from netty-tcnative */ 308 /* certificate verifier callback */ 309 jobject verifier; 310 jmethodID verifier_method; 311 312 unsigned char *next_proto_data; 313 unsigned int next_proto_len; 314 int next_selector_failure_behavior; 315 316 /* Holds the alpn protocols, each of them prefixed with the len of the protocol */ 317 unsigned char *alpn_proto_data; 318 unsigned int alpn_proto_len; 319 int alpn_selector_failure_behavior; 320 /* End add from netty-tcnative */ 321 }; 322 323 #ifdef HAVE_SSL_CONF_CMD 324 typedef struct tcn_ssl_conf_ctxt_t tcn_ssl_conf_ctxt_t; 325 326 struct tcn_ssl_conf_ctxt_t { 327 apr_pool_t *pool; 328 SSL_CONF_CTX *cctx; 329 }; 330 #endif 331 332 typedef struct { 333 apr_pool_t *pool; 334 tcn_ssl_ctxt_t *ctx; 335 SSL *ssl; 336 X509 *peer; 337 int shutdown_type; 338 /* Track the handshake/renegotiation state for the connection so 339 * that all client-initiated renegotiations can be rejected, as a 340 * partial fix for CVE-2009-3555. 341 */ 342 enum { 343 RENEG_INIT = 0, /* Before initial handshake */ 344 RENEG_REJECT, /* After initial handshake; any client-initiated 345 * renegotiation should be rejected 346 */ 347 RENEG_ALLOW, /* A server-initated renegotiation is taking 348 * place (as dictated by configuration) 349 */ 350 RENEG_ABORT /* Renegotiation initiated by client, abort the 351 * connection 352 */ 353 } reneg_state; 354 enum { 355 PHA_NONE = 0, /* Before PHA */ 356 PHA_STARTED, /* PHA req sent to client but no response */ 357 PHA_COMPLETE /* Client has returned cert */ 358 } pha_state; 359 apr_socket_t *sock; 360 apr_pollset_t *pollset; 361 } tcn_ssl_conn_t; 362 363 364 /* 365 * Additional Functions 366 */ 367 void SSL_init_app_data_idx(void); 368 /* The app_data2 is used to store the tcn_ssl_ctxt_t pointer for the SSL instance. */ 369 void *SSL_get_app_data2(SSL *); 370 void SSL_set_app_data2(SSL *, void *); 371 /* The app_data3 is used to store the handshakeCount pointer for the SSL instance. */ 372 void *SSL_get_app_data3(const SSL *); 373 void SSL_set_app_data3(SSL *, void *); 374 /* The app_data4 is used to store the destroyCount pointer for the SSL instance. */ 375 void *SSL_get_app_data4(const SSL *); 376 void SSL_set_app_data4(SSL *, void *); 377 int SSL_password_prompt(tcn_pass_cb_t *); 378 int SSL_password_callback(char *, int, int, void *); 379 void SSL_BIO_close(BIO *); 380 void SSL_BIO_doref(BIO *); 381 DH *SSL_get_dh_params(unsigned keylen); 382 DH *SSL_dh_GetParamFromFile(const char *); 383 #ifdef HAVE_ECC 384 EC_GROUP *SSL_ec_GetParamFromFile(const char *); 385 #endif 386 DH *SSL_callback_tmp_DH(SSL *, int, int); 387 void SSL_callback_handshake(const SSL *, int, int); 388 int SSL_CTX_use_certificate_chain(SSL_CTX *, const char *, int); 389 int SSL_callback_SSL_verify(int, X509_STORE_CTX *); 390 int SSL_rand_seed(const char *file); 391 int SSL_callback_next_protos(SSL *, const unsigned char **, unsigned int *, void *); 392 int SSL_callback_select_next_proto(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int,void *); 393 int SSL_callback_alpn_select_proto(SSL *, const unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *); 394 #ifdef HAVE_KEYLOG_CALLBACK 395 void SSL_callback_add_keylog(SSL_CTX *); 396 #endif 397 398 #if (OPENSSL_VERSION_NUMBER < 0x10100000L) && ! (defined(WIN32) || defined(WIN64)) 399 unsigned long SSL_ERR_get(void); 400 void SSL_ERR_clear(void); 401 #else 402 #define SSL_ERR_get() ERR_get_error() 403 #define SSL_ERR_clear() ERR_clear_error() 404 #endif 405 406 #endif /* SSL_PRIVATE_H */ 407