ctx->sc is set during init

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94275 13f79535-47bb-0310-9956-ffa450edef68

switch from SSLSrvConfigRec* to modssl_ctx_t* in the ssl_init_ctx*
functions

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94274 13f79535-47bb-0310-9956-ffa450edef68

make merging of modssl_ctx_t's generic

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94273 13f79535-47bb-0310-9956-ffa450edef68

moving cfgMerge macros to ssl_engine_config.c, they are not used anywhere else

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94271 13f79535-47bb-0310-9956-ffa450edef68

remove unused cfgMerge{Table,Ctx} macros

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94269 13f79535-47bb-0310-9956-ffa450edef68

moving protocol location

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94268 13f79535-47bb-0310-9956-ffa450edef68

breakup SSLSrvConfigRec in preparation for proxy support:
+ modssl_pk_server_t - certs/keys for the server
+ modssl_pk_proxy_t  - certs/keys for the proxy
+ modssl_auth_ctx_t  - stuff related to authentication that can also
                       be per-dir, used by both server and proxy
+ modssl_ctx_t       - context that can be used by both server and proxy
+ SSLSrvConfigRec    - now contains original stuff specific to the
                       server config and modssl_ctx_t *server, *proxy

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94267 13f79535-47bb-0310-9956-ffa450edef68

ripping out some proxy stuff that isn't currently in use and is going
to change anyhow.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94266 13f79535-47bb-0310-9956-ffa450edef68

already added configure check for SSL_set_cert_store

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94265 13f79535-47bb-0310-9956-ffa450edef68

de-hungarian-ize server config member names which are going to stay

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94264 13f79535-47bb-0310-9956-ffa450edef68

reorder a bit of the server config structure, moving items that are
going to stay there to the top.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94263 13f79535-47bb-0310-9956-ffa450edef68

remove error msg hint that is no longer true

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94261 13f79535-47bb-0310-9956-ffa450edef68

fixup naming:
 ssl_init_ctx_* will be used for both proxy and server
 ssl_init_server_* is specific to the server

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94260 13f79535-47bb-0310-9956-ffa450edef68

move context callback setting to ssl_init_ctx_callbacks function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94259 13f79535-47bb-0310-9956-ffa450edef68

move server cert/key initialization to ssl_init_server_certs function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94258 13f79535-47bb-0310-9956-ffa450edef68

copy DSA params to server server during key import

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94257 13f79535-47bb-0310-9956-ffa450edef68

fix logic from last commit, need to always try importing _both_ rsa
and dsa

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94256 13f79535-47bb-0310-9956-ffa450edef68

fold some duplication into generic ssl_server_import_key function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94255 13f79535-47bb-0310-9956-ffa450edef68

fold some duplication into generic ssl_server_import_cert function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94253 13f79535-47bb-0310-9956-ffa450edef68

move server cert checking into generic ssl_check_public_cert function.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94252 13f79535-47bb-0310-9956-ffa450edef68

move server specific init config checks into ssl_init_check_server
function (ssl_init_check_proxy will be different)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94250 13f79535-47bb-0310-9956-ffa450edef68

break out certificate chain initialization into
ssl_init_cert_chain function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94249 13f79535-47bb-0310-9956-ffa450edef68

there is a heaping pile of:
 ssl_log(s, flags, "Init: (%s) ...", sc->szVHostID)
add SSL_INIT flag to cut down some noise and end up with:
 ssl_log(s, flags, "...")

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94247 13f79535-47bb-0310-9956-ffa450edef68

break out certificate revocation list initialization into
ssl_init_crl function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94246 13f79535-47bb-0310-9956-ffa450edef68

break out cipher suite initialization into ssl_init_cipher_suite function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94245 13f79535-47bb-0310-9956-ffa450edef68

"new" is a c++ keyword; s/new/mrg/g in config merge functions

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94244 13f79535-47bb-0310-9956-ffa450edef68

move warning about session cache not being configured to ssl_scache_init

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94243 13f79535-47bb-0310-9956-ffa450edef68

break out SSL_CTX session initialization into
ssl_init_session_cache_ctx function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94242 13f79535-47bb-0310-9956-ffa450edef68

add license

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94239 13f79535-47bb-0310-9956-ffa450edef68

"Oops" has two o's in it.  :)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94235 13f79535-47bb-0310-9956-ffa450edef68

break SSL_CTX initialization into ssl_init_ctx function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94234 13f79535-47bb-0310-9956-ffa450edef68

(starting to break apart the init code into smaller, generic functions,
preparing for proxy support)

break out verify code into ssl_init_verify function.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94233 13f79535-47bb-0310-9956-ffa450edef68

bringing back MOD_SSL_VERSION macro, define it to AP_SERVER_BASEVERSION

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94231 13f79535-47bb-0310-9956-ffa450edef68

adjustment for sslc where its PEM_read_bio_PrivateKey does not take a
callback arg.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94230 13f79535-47bb-0310-9956-ffa450edef68

static-ize {write,read}tty variables

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94227 13f79535-47bb-0310-9956-ffa450edef68

move prototype for modssl_session_get_time to ssl_util_ssl.h

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94226 13f79535-47bb-0310-9956-ffa450edef68

add modssl_dh_configure() function to fold some duplication in
get_dh{512,1024} and provide toolkit compat for sslc 2.x

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94225 13f79535-47bb-0310-9956-ffa450edef68

add configure checks for ssl functions:
-SSL_set_state: macro in OpenSSL, might be a function in a patched sslc
-SSL_set_cert_store: patch submitted to OpenSSL, might be applied to
OpenSSL or sslc

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94223 13f79535-47bb-0310-9956-ffa450edef68

fix doofo in last commit

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94218 13f79535-47bb-0310-9956-ffa450edef68

sslc 1.x does not have an x509v3.h

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94217 13f79535-47bb-0310-9956-ffa450edef68

sslc does not currently support X509V3_EXT_d2i

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94216 13f79535-47bb-0310-9956-ffa450edef68

toolkit compat for PEM_read_bio_PrivateKey

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94215 13f79535-47bb-0310-9956-ffa450edef68

use compat macro for another PEM_read_bio_X509

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94214 13f79535-47bb-0310-9956-ffa450edef68

toolkit compat for PEM_read_bio_X509

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94213 13f79535-47bb-0310-9956-ffa450edef68

adjust to another const char vs char mismatch between OpenSSL and sslc

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94212 13f79535-47bb-0310-9956-ffa450edef68

use SSL_SESSION_ api since SSL_SESSION cannot be dereferenced when using sslc

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94211 13f79535-47bb-0310-9956-ffa450edef68

typo fix s/EDG/EGD/g

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94210 13f79535-47bb-0310-9956-ffa450edef68

modssl_set_cipher_list was in the wrong place for OpenSSL

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94209 13f79535-47bb-0310-9956-ffa450edef68

RAND_status macro was in the wrong place

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94208 13f79535-47bb-0310-9956-ffa450edef68

sslc does not currently support RAND_egd or RAND_status

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94207 13f79535-47bb-0310-9956-ffa450edef68

in sslc PEM_F_DEF_CALLBACK == PEM_F_DEF_CB

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94206 13f79535-47bb-0310-9956-ffa450edef68

2nd arg to SSL_set_cipher_list in sslc is char *

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94205 13f79535-47bb-0310-9956-ffa450edef68

sslc 1.x SSL_set_verify only takes 2 args

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94204 13f79535-47bb-0310-9956-ffa450edef68

sslc does not currently implement an SSL_set_state function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94203 13f79535-47bb-0310-9956-ffa450edef68

sslc adds a second, unused param to X509_verify_cert

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94202 13f79535-47bb-0310-9956-ffa450edef68

sslc does not have a safestack.h, implement a minimal subset required
for mod_ssl

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94201 13f79535-47bb-0310-9956-ffa450edef68

some compat macros for sslc 1.x

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94200 13f79535-47bb-0310-9956-ffa450edef68

moving OpenSSL+sslc compat foo to ssl_toolkit_compat.h

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94199 13f79535-47bb-0310-9956-ffa450edef68

3rd arg of BIO callbacks in 'const char' in OpenSSL and 'char' in sslc,
make both happy.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94198 13f79535-47bb-0310-9956-ffa450edef68

OpenSSL uses void * for callback data, sslc uses char *,
cast to void * to make both happy.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94197 13f79535-47bb-0310-9956-ffa450edef68

add modssl_session_get_time() function to give mod_ssl what it needs
from SSL_SESSION_get_time() if using OpenSSL or sslc.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94195 13f79535-47bb-0310-9956-ffa450edef68

another step towards compatiblity with rsa sslc:
define the STACK_OF macro if not already defined.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94194 13f79535-47bb-0310-9956-ffa450edef68

configure already checks OpenSSL version so dont bother here

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94193 13f79535-47bb-0310-9956-ffa450edef68

note about the temporary DH keys

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94181 13f79535-47bb-0310-9956-ffa450edef68

a few updates

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94180 13f79535-47bb-0310-9956-ffa450edef68

per-dir SSLCACertificate{File,Path} cannot use SSL_CTX_set_cert_store
as the 1.x based module does, since the function is not thread-safe.
a patch has been submitted to OpenSSL to support SSL_set_cert_store
which is thread safe.  this feature is enabled by default in the
current 1.x based module, we only enable it if the SSL_set_cert_store
function is available.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94179 13f79535-47bb-0310-9956-ffa450edef68

constificationization of some char * config items

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94177 13f79535-47bb-0310-9956-ffa450edef68

performance enhancement: mod_ssl config directives that can have both
a per-server and per-dir context were configuring the per-dir context
for per-server commands.  this triggered ssl_hook_Access to always
compare the per-server context against per-dir configs that were
exactly the same.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94176 13f79535-47bb-0310-9956-ffa450edef68

correct comment in previous change

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94171 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:
fix bug seen on win32 with netscape client where output filter is run
triggered by lingering_close after ssl_hook_CloseConnection has been called

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94170 13f79535-47bb-0310-9956-ffa450edef68

the mod_ssl provided with Apache >= 2.0 no longer has an independent
version number

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@94111 13f79535-47bb-0310-9956-ffa450edef68

Fix a possibly-uninitialized warning and a boolean logic bug

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93992 13f79535-47bb-0310-9956-ffa450edef68

Fix some possibly-uninitialized warnings and some incorrect format strings

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93991 13f79535-47bb-0310-9956-ffa450edef68

  Clear up a const warning, and recognize some arrays by changing the
  variable names to the plural [rather than aszFoo, which I hope continues
  to be cleaned up as folks have time.]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93982 13f79535-47bb-0310-9956-ffa450edef68

  Fix a signedness emit based on session_id_length [unsigned]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93981 13f79535-47bb-0310-9956-ffa450edef68

  Lost the prior log message ... [this is an empty commit]

  Prior revision fixes the last ap_server_root_relative() NULL return
  code potential segfaults.  It also quits trying to server_root_relative
  a logging pipe, since log pipes generally take arguments.  However, it
  ignores the PassPhraseDialog exec: since the argument to that shell
  mechanism is the server name itself.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93972 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93971 13f79535-47bb-0310-9956-ffa450edef68

  Silly module, we don't need compat.h :)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93964 13f79535-47bb-0310-9956-ffa450edef68

get rid of some -Wall warnings

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93947 13f79535-47bb-0310-9956-ffa450edef68

remove stray log message (from madhu)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93946 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:   Madhusudan Mathihalli <madhusudan_mathihalli@hp.com>
Reviewed by: dougm
implement SSLSessionCache shmht and shmcb based on apr_rmm and apr_shm

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93942 13f79535-47bb-0310-9956-ffa450edef68

deal with the rename of kill_after_timeout to APR_KILL_AFTER_TIMEOUT

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93940 13f79535-47bb-0310-9956-ffa450edef68

fix comment

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93932 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:
fix bug in ssl_io_input_getline():
in most cases we get all the headers on the first SSL_read.
however, in certain cases SSL_read will only get a partial
chunk of the headers, so we now try to read until LF is seen.

bug seen with netscape client (running both on linux and win32) and
server running on win32.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93931 13f79535-47bb-0310-9956-ffa450edef68

Update our copyright for this year.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93918 13f79535-47bb-0310-9956-ffa450edef68

use ssl_asn1_keystr

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93913 13f79535-47bb-0310-9956-ffa450edef68

add ssl_asn1_keystr() util function that returns string representation
(RSA or DSA) of the key index.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93912 13f79535-47bb-0310-9956-ffa450edef68

use ssl_asn1_table_keyfmt() function and only format each (rsa,dsa)
lookup key once, rather than twice.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93911 13f79535-47bb-0310-9956-ffa450edef68

use ssl_asn1_table_keyfmt() function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93910 13f79535-47bb-0310-9956-ffa450edef68

add ssl_asn1_table_keyfmt() function for clarity

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93909 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:   Madhusudan Mathihalli <madhusudan_mathihalli@hp.com>
Reviewed by: dougm
adjust to SSL_SESSION_id2sz() prototype change

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93907 13f79535-47bb-0310-9956-ffa450edef68

generalize session logging into ssl_session_log() function

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93906 13f79535-47bb-0310-9956-ffa450edef68

SSL_SESSION_id2sz() was NOT THREAD SAFE.  it returned a pointer to a
static variable.  fixed.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93899 13f79535-47bb-0310-9956-ffa450edef68

SSL_SESSION_id2sz() is somewhat expensive, make sure we only call it
if SSLLogLevel >= info

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93898 13f79535-47bb-0310-9956-ffa450edef68

cleanup logging of CRL, includes ridding of some malloc/frees

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93897 13f79535-47bb-0310-9956-ffa450edef68

couple o minor style/log fixos

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93896 13f79535-47bb-0310-9956-ffa450edef68

use ptemp in ssl_init_FindCAList() rather than creating a subpool.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93895 13f79535-47bb-0310-9956-ffa450edef68

switch to ptemp pool for ssl_pphrase_Handle

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93894 13f79535-47bb-0310-9956-ffa450edef68

only call: ssl_rand_seed(s, p, SSL_RSCTX_STARTUP, "Init: ");

once at startup.  if there is value in calling it more than once at
startup, it should be done explicitly rather than hidden in
ssl_tmp_keys_init().

switch to ptemp pool when calling ssl_rand_seed() at startup.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93893 13f79535-47bb-0310-9956-ffa450edef68

remove ssl_engine_ds.c

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@93892 13f79535-47bb-0310-9956-ffa450edef68