| /* Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /* |
| * based on mod_tls.c - Apache SSL/TLS module for NetWare by Mike Gardiner. |
| * |
| * This module gives Apache the ability to do SSL/TLS with a minimum amount |
| * of effort. All of the SSL/TLS logic is already on NetWare versions 5 and |
| * above and is interfaced through WinSock on NetWare. As you can see in |
| * the code below SSL/TLS sockets can be created with three WinSock calls. |
| * |
| * To load, simply place the module in the modules directory under the main |
| * apache tree. Then add a "SecureListen" with two arguments. The first |
| * argument is an address and/or port. The second argument is the key pair |
| * name as created in ConsoleOne. |
| * |
| * Examples: |
| * |
| * SecureListen 443 "SSL CertificateIP" |
| * SecureListen 123.45.67.89:443 mycert |
| * |
| * The module also supports RFC 2817 / TLS Upgrade for HTTP 1.1. |
| * For this add a "NWSSLUpgradeable" with two arguments. The first |
| * argument is an address and/or port. The second argument is the key pair |
| * name as created in ConsoleOne. |
| * |
| * Examples: |
| * |
| * NWSSLUpgradeable 8080 "SSL CertificateIP" |
| * NWSSLUpgradeable 123.45.67.89:8080 mycert |
| * |
| */ |
| |
| #define WS_SSL |
| |
| #define MAX_ADDRESS 512 |
| #define MAX_KEY 80 |
| |
| |
| #include "httpd.h" |
| #include "http_config.h" |
| #include "http_connection.h" |
| #include "http_core.h" |
| #include "http_log.h" |
| #include "http_protocol.h" |
| #include "http_request.h" |
| #include "ap_listen.h" |
| #include "apr_strings.h" |
| #include "apr_portable.h" |
| #include "apr_optional.h" |
| |
| #include <unilib.h> |
| |
| #ifndef SO_TLS_UNCLEAN_SHUTDOWN |
| #define SO_TLS_UNCLEAN_SHUTDOWN 0 |
| #endif |
| |
| /* The ssl_var_lookup() optional function retrieves SSL environment |
| * variables. */ |
| APR_DECLARE_OPTIONAL_FN(char *, ssl_var_lookup, |
| (apr_pool_t *, server_rec *, |
| conn_rec *, request_rec *, |
| char *)); |
| |
| /* An optional function which returns non-zero if the given connection |
| * is using SSL/TLS. */ |
| APR_DECLARE_OPTIONAL_FN(int, ssl_is_https, (conn_rec *)); |
| |
| /* The ssl_proxy_enable() and ssl_engine_disable() optional functions |
| * are used by mod_proxy to enable use of SSL for outgoing |
| * connections. */ |
| APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *)); |
| APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *)); |
| |
| #define strEQ(s1,s2) (strcmp(s1,s2) == 0) |
| #define strNE(s1,s2) (strcmp(s1,s2) != 0) |
| #define strEQn(s1,s2,n) (strncmp(s1,s2,n) == 0) |
| #define strNEn(s1,s2,n) (strncmp(s1,s2,n) != 0) |
| |
| #define strcEQ(s1,s2) (strcasecmp(s1,s2) == 0) |
| #define strcNE(s1,s2) (strcasecmp(s1,s2) != 0) |
| #define strcEQn(s1,s2,n) (strncasecmp(s1,s2,n) == 0) |
| #define strcNEn(s1,s2,n) (strncasecmp(s1,s2,n) != 0) |
| |
| #define strIsEmpty(s) (s == NULL || s[0] == NUL) |
| |
| |
| module AP_MODULE_DECLARE_DATA nwssl_module; |
| |
| typedef struct NWSSLSrvConfigRec NWSSLSrvConfigRec; |
| typedef struct seclisten_rec seclisten_rec; |
| typedef struct seclistenup_rec seclistenup_rec; |
| typedef struct secsocket_data secsocket_data; |
| |
| struct seclisten_rec { |
| seclisten_rec *next; |
| struct sockaddr_in local_addr; /* local IP address and port */ |
| int fd; |
| int used; /* Only used during restart */ |
| char key[MAX_KEY]; |
| int mutual; |
| char *addr; |
| apr_port_t port; |
| }; |
| |
| struct seclistenup_rec { |
| seclistenup_rec *next; |
| char key[MAX_KEY]; |
| char *addr; |
| apr_port_t port; |
| }; |
| |
| struct NWSSLSrvConfigRec { |
| apr_table_t *sltable; |
| apr_table_t *slutable; |
| apr_pool_t *pPool; |
| }; |
| |
| struct secsocket_data { |
| apr_socket_t* csd; |
| int is_secure; |
| }; |
| |
| static apr_array_header_t *certlist = NULL; |
| static unicode_t** certarray = NULL; |
| static int numcerts = 0; |
| static seclisten_rec* ap_seclisteners = NULL; |
| static seclistenup_rec* ap_seclistenersup = NULL; |
| |
| static ap_listen_rec *nw_old_listeners; |
| |
| #define get_nwssl_cfg(srv) (NWSSLSrvConfigRec *) ap_get_module_config(srv->module_config, &nwssl_module) |
| |
| |
| static void build_cert_list(apr_pool_t *p) |
| { |
| int i; |
| char **rootcerts = (char **)certlist->elts; |
| |
| numcerts = certlist->nelts; |
| certarray = apr_palloc(p, sizeof(unicode_t*)*numcerts); |
| |
| for (i = 0; i < numcerts; ++i) { |
| unicode_t *unistr; |
| unistr = (unicode_t*)apr_palloc(p, strlen(rootcerts[i])*4); |
| loc2uni (UNI_LOCAL_DEFAULT, unistr, rootcerts[i], 0, 2); |
| certarray[i] = unistr; |
| } |
| } |
| |
| /* |
| * Parses a host of the form <address>[:port] |
| * :port is permitted if 'port' is not NULL |
| */ |
| static unsigned long parse_addr(const char *w, unsigned short *ports) |
| { |
| struct hostent *hep; |
| unsigned long my_addr; |
| char *p; |
| |
| p = strchr(w, ':'); |
| if (ports != NULL) { |
| *ports = 0; |
| if (p != NULL && strcmp(p + 1, "*") != 0) |
| *ports = atoi(p + 1); |
| } |
| |
| if (p != NULL) |
| *p = '\0'; |
| if (strcmp(w, "*") == 0) { |
| if (p != NULL) |
| *p = ':'; |
| return htonl(INADDR_ANY); |
| } |
| |
| my_addr = apr_inet_addr((char *)w); |
| if (my_addr != INADDR_NONE) { |
| if (p != NULL) |
| *p = ':'; |
| return my_addr; |
| } |
| |
| hep = gethostbyname(w); |
| |
| if ((!hep) || (hep->h_addrtype != AF_INET || !hep->h_addr_list[0])) { |
| /* XXX Should be echoing by h_errno the actual failure, no? |
| * ap_log_error would be good here. Better yet - APRize. |
| */ |
| fprintf(stderr, "Cannot resolve host name %s --- exiting!\n", w); |
| exit(1); |
| } |
| |
| if (hep->h_addr_list[1]) { |
| fprintf(stderr, "Host %s has multiple addresses ---\n", w); |
| fprintf(stderr, "you must choose one explicitly for use as\n"); |
| fprintf(stderr, "a secure port. Exiting!!!\n"); |
| exit(1); |
| } |
| |
| if (p != NULL) |
| *p = ':'; |
| |
| return ((struct in_addr *) (hep->h_addr))->s_addr; |
| } |
| |
| static int find_secure_listener(seclisten_rec *lr) |
| { |
| seclisten_rec *sl; |
| |
| for (sl = ap_seclisteners; sl; sl = sl->next) { |
| if (!memcmp(&sl->local_addr, &lr->local_addr, sizeof(sl->local_addr))) { |
| sl->used = 1; |
| return sl->fd; |
| } |
| } |
| return -1; |
| } |
| |
| static char *get_port_key(conn_rec *c) |
| { |
| seclistenup_rec *sl; |
| |
| for (sl = ap_seclistenersup; sl; sl = sl->next) { |
| if ((sl->port == (c->local_addr)->port) && |
| ((strcmp(sl->addr, "0.0.0.0") == 0) || |
| (strcmp(sl->addr, c->local_ip) == 0))) { |
| return sl->key; |
| } |
| } |
| return NULL; |
| } |
| |
| static int make_secure_socket(apr_pool_t *pconf, |
| const struct sockaddr_in *server, |
| char* key, int mutual, server_rec *sconf) |
| { |
| int s; |
| char addr[MAX_ADDRESS]; |
| struct sslserveropts opts; |
| unsigned int optParam; |
| WSAPROTOCOL_INFO SecureProtoInfo; |
| |
| if (server->sin_addr.s_addr != htonl(INADDR_ANY)) |
| apr_snprintf(addr, sizeof(addr), "address %s port %d", |
| inet_ntoa(server->sin_addr), ntohs(server->sin_port)); |
| else |
| apr_snprintf(addr, sizeof(addr), "port %d", ntohs(server->sin_port)); |
| |
| /* note that because we're about to slack we don't use psocket */ |
| memset(&SecureProtoInfo, 0, sizeof(WSAPROTOCOL_INFO)); |
| |
| SecureProtoInfo.iAddressFamily = AF_INET; |
| SecureProtoInfo.iSocketType = SOCK_STREAM; |
| SecureProtoInfo.iProtocol = IPPROTO_TCP; |
| SecureProtoInfo.iSecurityScheme = SECURITY_PROTOCOL_SSL; |
| |
| s = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, |
| (LPWSAPROTOCOL_INFO)&SecureProtoInfo, 0, 0); |
| |
| if (s == INVALID_SOCKET) { |
| ap_log_error(APLOG_MARK, APLOG_CRIT, WSAGetLastError(), sconf, |
| APLOGNO(02120) |
| "make_secure_socket: failed to get a socket for %s", |
| addr); |
| return -1; |
| } |
| |
| if (!mutual) { |
| optParam = SO_SSL_ENABLE | SO_SSL_SERVER; |
| |
| if (WSAIoctl(s, SO_SSL_SET_FLAGS, (char *)&optParam, |
| sizeof(optParam), NULL, 0, NULL, NULL, NULL)) { |
| ap_log_error(APLOG_MARK, APLOG_CRIT, WSAGetLastError(), sconf, |
| APLOGNO(02121) |
| "make_secure_socket: for %s, WSAIoctl: " |
| "(SO_SSL_SET_FLAGS)", addr); |
| return -1; |
| } |
| } |
| |
| opts.cert = key; |
| opts.certlen = strlen(key); |
| opts.sidtimeout = 0; |
| opts.sidentries = 0; |
| opts.siddir = NULL; |
| |
| if (WSAIoctl(s, SO_SSL_SET_SERVER, (char *)&opts, sizeof(opts), |
| NULL, 0, NULL, NULL, NULL) != 0) { |
| ap_log_error(APLOG_MARK, APLOG_CRIT, WSAGetLastError(), sconf, |
| APLOGNO(02122) |
| "make_secure_socket: for %s, WSAIoctl: " |
| "(SO_SSL_SET_SERVER)", addr); |
| return -1; |
| } |
| |
| if (mutual) { |
| optParam = 0x07; /* SO_SSL_AUTH_CLIENT */ |
| |
| if (WSAIoctl(s, SO_SSL_SET_FLAGS, (char*)&optParam, sizeof(optParam), |
| NULL, 0, NULL, NULL, NULL)) { |
| ap_log_error(APLOG_MARK, APLOG_CRIT, WSAGetLastError(), sconf, |
| APLOGNO(02123) |
| "make_secure_socket: for %s, WSAIoctl: " |
| "(SO_SSL_SET_FLAGS)", addr); |
| return -1; |
| } |
| } |
| |
| optParam = SO_TLS_UNCLEAN_SHUTDOWN; |
| WSAIoctl(s, SO_SSL_SET_FLAGS, (char *)&optParam, sizeof(optParam), |
| NULL, 0, NULL, NULL, NULL); |
| |
| return s; |
| } |
| |
| static int convert_secure_socket(conn_rec *c, apr_socket_t *csd) |
| { |
| int rcode; |
| struct tlsclientopts sWS2Opts; |
| struct nwtlsopts sNWTLSOpts; |
| struct sslserveropts opts; |
| unsigned long ulFlags; |
| SOCKET sock; |
| unicode_t keyFileName[60]; |
| |
| apr_os_sock_get(&sock, csd); |
| |
| /* zero out buffers */ |
| memset((char *)&sWS2Opts, 0, sizeof(struct tlsclientopts)); |
| memset((char *)&sNWTLSOpts, 0, sizeof(struct nwtlsopts)); |
| |
| /* turn on ssl for the socket */ |
| ulFlags = (numcerts ? SO_TLS_ENABLE : SO_TLS_ENABLE | SO_TLS_BLIND_ACCEPT); |
| rcode = WSAIoctl(sock, SO_TLS_SET_FLAGS, &ulFlags, sizeof(unsigned long), |
| NULL, 0, NULL, NULL, NULL); |
| if (SOCKET_ERROR == rcode) { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server, APLOGNO(02124) |
| "Error: %d with WSAIoctl(flag SO_TLS_ENABLE)", |
| WSAGetLastError()); |
| return rcode; |
| } |
| |
| ulFlags = SO_TLS_UNCLEAN_SHUTDOWN; |
| WSAIoctl(sock, SO_TLS_SET_FLAGS, &ulFlags, sizeof(unsigned long), |
| NULL, 0, NULL, NULL, NULL); |
| |
| /* setup the socket for SSL */ |
| memset (&sWS2Opts, 0, sizeof(sWS2Opts)); |
| memset (&sNWTLSOpts, 0, sizeof(sNWTLSOpts)); |
| sWS2Opts.options = &sNWTLSOpts; |
| |
| if (numcerts) { |
| sNWTLSOpts.walletProvider = WAL_PROV_DER; /* the wallet provider defined in wdefs.h */ |
| sNWTLSOpts.TrustedRootList = certarray; /* array of certs in UNICODE format */ |
| sNWTLSOpts.numElementsInTRList = numcerts; /* number of certs in TRList */ |
| } |
| else { |
| /* setup the socket for SSL */ |
| unicpy(keyFileName, L"SSL CertificateIP"); |
| sWS2Opts.wallet = keyFileName; /* no client certificate */ |
| sWS2Opts.walletlen = unilen(keyFileName); |
| |
| sNWTLSOpts.walletProvider = WAL_PROV_KMO; /* the wallet provider defined in wdefs.h */ |
| } |
| |
| /* make the IOCTL call */ |
| rcode = WSAIoctl(sock, SO_TLS_SET_CLIENT, &sWS2Opts, |
| sizeof(struct tlsclientopts), NULL, 0, NULL, |
| NULL, NULL); |
| |
| /* make sure that it was successful */ |
| if (SOCKET_ERROR == rcode ) { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server, APLOGNO(02125) |
| "Error: %d with WSAIoctl(SO_TLS_SET_CLIENT)", |
| WSAGetLastError()); |
| } |
| return rcode; |
| } |
| |
| static int SSLize_Socket(SOCKET socketHnd, char *key, request_rec *r) |
| { |
| int rcode; |
| struct tlsserveropts sWS2Opts; |
| struct nwtlsopts sNWTLSOpts; |
| unicode_t SASKey[512]; |
| unsigned long ulFlag; |
| |
| memset((char *)&sWS2Opts, 0, sizeof(struct tlsserveropts)); |
| memset((char *)&sNWTLSOpts, 0, sizeof(struct nwtlsopts)); |
| |
| ulFlag = SO_TLS_ENABLE; |
| rcode = WSAIoctl(socketHnd, SO_TLS_SET_FLAGS, &ulFlag, |
| sizeof(unsigned long), NULL, 0, NULL, NULL, NULL); |
| if (rcode) { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02126) |
| "Error: %d with WSAIoctl(SO_TLS_SET_FLAGS, SO_TLS_ENABLE)", |
| WSAGetLastError()); |
| goto ERR; |
| } |
| |
| |
| ulFlag = SO_TLS_SERVER; |
| rcode = WSAIoctl(socketHnd, SO_TLS_SET_FLAGS, &ulFlag, |
| sizeof(unsigned long),NULL, 0, NULL, NULL, NULL); |
| |
| if (rcode) { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02127) |
| "Error: %d with WSAIoctl(SO_TLS_SET_FLAGS, SO_TLS_SERVER)", |
| WSAGetLastError()); |
| goto ERR; |
| } |
| |
| loc2uni(UNI_LOCAL_DEFAULT, SASKey, key, 0, 0); |
| |
| /* setup the tlsserveropts struct */ |
| sWS2Opts.wallet = SASKey; |
| sWS2Opts.walletlen = unilen(SASKey); |
| sWS2Opts.sidtimeout = 0; |
| sWS2Opts.sidentries = 0; |
| sWS2Opts.siddir = NULL; |
| sWS2Opts.options = &sNWTLSOpts; |
| |
| /* setup the nwtlsopts structure */ |
| |
| sNWTLSOpts.walletProvider = WAL_PROV_KMO; |
| sNWTLSOpts.keysList = NULL; |
| sNWTLSOpts.numElementsInKeyList = 0; |
| sNWTLSOpts.reservedforfutureuse = NULL; |
| sNWTLSOpts.reservedforfutureCRL = NULL; |
| sNWTLSOpts.reservedforfutureCRLLen = 0; |
| sNWTLSOpts.reserved1 = NULL; |
| sNWTLSOpts.reserved2 = NULL; |
| sNWTLSOpts.reserved3 = NULL; |
| |
| rcode = WSAIoctl(socketHnd, |
| SO_TLS_SET_SERVER, |
| &sWS2Opts, |
| sizeof(struct tlsserveropts), |
| NULL, |
| 0, |
| NULL, |
| NULL, |
| NULL); |
| if (SOCKET_ERROR == rcode) { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02128) |
| "Error: %d with WSAIoctl(SO_TLS_SET_SERVER)", WSAGetLastError()); |
| goto ERR; |
| } |
| |
| ERR: |
| return rcode; |
| } |
| |
| static const char *set_secure_listener(cmd_parms *cmd, void *dummy, |
| const char *ips, const char* key, |
| const char* mutual) |
| { |
| NWSSLSrvConfigRec* sc = get_nwssl_cfg(cmd->server); |
| const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); |
| char *ports, *addr; |
| unsigned short port; |
| seclisten_rec *new; |
| ap_listen_rec **walk; |
| apr_sockaddr_t *sa; |
| int found_listener = 0; |
| |
| |
| if (err != NULL) |
| return err; |
| |
| ports = strchr(ips, ':'); |
| |
| if (ports != NULL) { |
| if (ports == ips) |
| return "Missing IP address"; |
| else if (ports[1] == '\0') |
| return "Address must end in :<port-number>"; |
| |
| *(ports++) = '\0'; |
| } |
| else { |
| ports = (char*)ips; |
| } |
| |
| new = apr_pcalloc(cmd->server->process->pool, sizeof(seclisten_rec)); |
| new->local_addr.sin_family = AF_INET; |
| |
| if (ports == ips) { |
| new->local_addr.sin_addr.s_addr = htonl(INADDR_ANY); |
| addr = apr_pstrdup(cmd->server->process->pool, "0.0.0.0"); |
| } |
| else { |
| new->local_addr.sin_addr.s_addr = parse_addr(ips, NULL); |
| addr = apr_pstrdup(cmd->server->process->pool, ips); |
| } |
| |
| port = atoi(ports); |
| |
| if (!port) |
| return "Port must be numeric"; |
| |
| /* If the specified addr:port was created previously, put the listen |
| socket record back on the ap_listeners list so that the socket |
| will be reused rather than recreated */ |
| for (walk = &nw_old_listeners; *walk;) { |
| sa = (*walk)->bind_addr; |
| if (sa) { |
| ap_listen_rec *new; |
| apr_port_t oldport; |
| |
| oldport = sa->port; |
| /* If both ports are equivalent, then if their names are equivalent, |
| * then we will re-use the existing record. |
| */ |
| if (port == oldport && |
| ((!addr && !sa->hostname) || |
| ((addr && sa->hostname) && !strcmp(sa->hostname, addr)))) { |
| new = *walk; |
| *walk = new->next; |
| new->next = ap_listeners; |
| ap_listeners = new; |
| found_listener = 1; |
| continue; |
| } |
| } |
| |
| walk = &(*walk)->next; |
| } |
| |
| apr_table_add(sc->sltable, ports, addr); |
| |
| /* If we found a pre-existing listen socket record, then there |
| is no need to create a new secure listen socket record. */ |
| if (found_listener) { |
| return NULL; |
| } |
| |
| new->local_addr.sin_port = htons(port); |
| new->fd = -1; |
| new->used = 0; |
| new->next = ap_seclisteners; |
| strcpy(new->key, key); |
| new->mutual = (mutual) ? 1 : 0; |
| new->addr = addr; |
| new->port = port; |
| ap_seclisteners = new; |
| return NULL; |
| } |
| |
| static const char *set_secure_upgradeable_listener(cmd_parms *cmd, void *dummy, |
| const char *ips, const char* key) |
| { |
| NWSSLSrvConfigRec* sc = get_nwssl_cfg(cmd->server); |
| const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); |
| char *ports, *addr; |
| unsigned short port; |
| seclistenup_rec *new; |
| |
| if (err != NULL) |
| return err; |
| |
| ports = strchr(ips, ':'); |
| |
| if (ports != NULL) { |
| if (ports == ips) |
| return "Missing IP address"; |
| else if (ports[1] == '\0') |
| return "Address must end in :<port-number>"; |
| |
| *(ports++) = '\0'; |
| } |
| else { |
| ports = (char*)ips; |
| } |
| |
| if (ports == ips) { |
| addr = apr_pstrdup(cmd->pool, "0.0.0.0"); |
| } |
| else { |
| addr = apr_pstrdup(cmd->pool, ips); |
| } |
| |
| port = atoi(ports); |
| |
| if (!port) |
| return "Port must be numeric"; |
| |
| apr_table_set(sc->slutable, ports, addr); |
| |
| new = apr_pcalloc(cmd->pool, sizeof(seclistenup_rec)); |
| new->next = ap_seclistenersup; |
| strcpy(new->key, key); |
| new->addr = addr; |
| new->port = port; |
| ap_seclistenersup = new; |
| |
| return err; |
| } |
| |
| static apr_status_t nwssl_socket_cleanup(void *data) |
| { |
| ap_listen_rec* slr = (ap_listen_rec*)data; |
| ap_listen_rec* lr; |
| |
| /* Remove our secure listener from the listener list */ |
| for (lr = ap_listeners; lr; lr = lr->next) { |
| /* slr is at the head of the list */ |
| if (lr == slr) { |
| ap_listeners = slr->next; |
| break; |
| } |
| /* slr is somewhere in between or at the end*/ |
| if (lr->next == slr) { |
| lr->next = slr->next; |
| break; |
| } |
| } |
| return APR_SUCCESS; |
| } |
| |
| static const char *set_trusted_certs(cmd_parms *cmd, void *dummy, char *arg) |
| { |
| char **ptr = (char **)apr_array_push(certlist); |
| |
| *ptr = arg; |
| return NULL; |
| } |
| |
| static int nwssl_pre_config(apr_pool_t *pconf, apr_pool_t *plog, |
| apr_pool_t *ptemp) |
| { |
| seclisten_rec* ap_old_seclisteners; |
| ap_listen_rec **walk; |
| seclisten_rec **secwalk; |
| apr_sockaddr_t *sa; |
| int found; |
| |
| /* Pull all of the listeners that were created by mod_nw_ssl out of the |
| ap_listeners list so that the normal listen socket processing does |
| automatically close them */ |
| nw_old_listeners = NULL; |
| ap_old_seclisteners = NULL; |
| |
| for (secwalk = &ap_seclisteners; *secwalk;) { |
| found = 0; |
| for (walk = &ap_listeners; *walk;) { |
| sa = (*walk)->bind_addr; |
| if (sa) { |
| ap_listen_rec *new; |
| seclisten_rec *secnew; |
| apr_port_t oldport; |
| |
| oldport = sa->port; |
| /* If both ports are equivalent, then if their names are equivalent, |
| * then we will re-use the existing record. |
| */ |
| if ((*secwalk)->port == oldport && |
| ((!(*secwalk)->addr && !sa->hostname) || |
| (((*secwalk)->addr && sa->hostname) && !strcmp(sa->hostname, (*secwalk)->addr)))) { |
| /* Move the listen socket from ap_listeners to nw_old_listeners */ |
| new = *walk; |
| *walk = new->next; |
| new->next = nw_old_listeners; |
| nw_old_listeners = new; |
| |
| /* Move the secure socket record to ap_old_seclisterners */ |
| secnew = *secwalk; |
| *secwalk = secnew->next; |
| secnew->next = ap_old_seclisteners; |
| ap_old_seclisteners = secnew; |
| found = 1; |
| break; |
| } |
| } |
| |
| walk = &(*walk)->next; |
| } |
| if (!found && &(*secwalk)->next) { |
| secwalk = &(*secwalk)->next; |
| } |
| } |
| |
| /* Restore the secure socket records list so that the post config can |
| process all of the sockets normally */ |
| ap_seclisteners = ap_old_seclisteners; |
| ap_seclistenersup = NULL; |
| certlist = apr_array_make(pconf, 1, sizeof(char *)); |
| |
| /* Now that we have removed all of the mod_nw_ssl created socket records, |
| allow the normal listen socket handling to occur. |
| NOTE: If for any reason mod_nw_ssl is removed as a built-in module, |
| the following call must be put back into the pre-config handler of the |
| MPM. It is only here to ensure that mod_nw_ssl fixes up the listen |
| socket list before anything else looks at it. */ |
| ap_listen_pre_config(); |
| |
| return OK; |
| } |
| |
| static int nwssl_pre_connection(conn_rec *c, void *csd) |
| { |
| |
| if (apr_table_get(c->notes, "nwconv-ssl")) { |
| convert_secure_socket(c, (apr_socket_t*)csd); |
| } |
| else { |
| secsocket_data *csd_data = apr_palloc(c->pool, sizeof(secsocket_data)); |
| |
| csd_data->csd = (apr_socket_t*)csd; |
| csd_data->is_secure = 0; |
| ap_set_module_config(c->conn_config, &nwssl_module, (void*)csd_data); |
| } |
| |
| return OK; |
| } |
| |
| static int nwssl_post_config(apr_pool_t *pconf, apr_pool_t *plog, |
| apr_pool_t *ptemp, server_rec *s) |
| { |
| seclisten_rec* sl; |
| ap_listen_rec* lr; |
| apr_socket_t* sd; |
| apr_status_t status; |
| seclistenup_rec *slu; |
| int found; |
| ap_listen_rec *walk; |
| seclisten_rec *secwalk, *lastsecwalk; |
| apr_sockaddr_t *sa; |
| |
| /* Walk the old listeners list and compare it to the secure |
| listeners list and remove any secure listener records that |
| are not being reused */ |
| for (walk = nw_old_listeners; walk; walk = walk->next) { |
| sa = walk->bind_addr; |
| if (sa) { |
| ap_listen_rec *new; |
| apr_port_t oldport; |
| |
| oldport = sa->port; |
| for (secwalk = ap_seclisteners, lastsecwalk = ap_seclisteners; secwalk; secwalk = lastsecwalk->next) { |
| unsigned short port = secwalk->port; |
| char *addr = secwalk->addr; |
| /* If both ports are equivalent, then if their names are equivalent, |
| * then we will re-use the existing record. |
| */ |
| if (port == oldport && |
| ((!addr && !sa->hostname) || |
| ((addr && sa->hostname) && !strcmp(sa->hostname, addr)))) { |
| if (secwalk == ap_seclisteners) { |
| ap_seclisteners = secwalk->next; |
| } |
| else { |
| lastsecwalk->next = secwalk->next; |
| } |
| apr_socket_close(walk->sd); |
| walk->active = 0; |
| break; |
| } |
| else { |
| lastsecwalk = secwalk; |
| } |
| } |
| } |
| } |
| |
| for (sl = ap_seclisteners; sl != NULL; sl = sl->next) { |
| /* If we find a pre-existing listen socket and it has already been |
| created, then no neeed to go any further, just reuse it. */ |
| if (((sl->fd = find_secure_listener(sl)) >= 0) && (sl->used)) { |
| continue; |
| } |
| |
| if (sl->fd < 0) |
| sl->fd = make_secure_socket(s->process->pool, &sl->local_addr, sl->key, sl->mutual, s); |
| |
| if (sl->fd >= 0) { |
| apr_os_sock_info_t sock_info; |
| |
| sock_info.os_sock = &(sl->fd); |
| sock_info.local = (struct sockaddr*)&(sl->local_addr); |
| sock_info.remote = NULL; |
| sock_info.family = APR_INET; |
| sock_info.type = SOCK_STREAM; |
| |
| apr_os_sock_make(&sd, &sock_info, s->process->pool); |
| |
| lr = apr_pcalloc(s->process->pool, sizeof(ap_listen_rec)); |
| |
| if (lr) { |
| lr->sd = sd; |
| if ((status = apr_sockaddr_info_get(&lr->bind_addr, sl->addr, APR_UNSPEC, sl->port, 0, |
| s->process->pool)) != APR_SUCCESS) { |
| ap_log_perror(APLOG_MARK, APLOG_CRIT, status, pconf, APLOGNO(02129) |
| "alloc_listener: failed to set up sockaddr for %s:%d", sl->addr, sl->port); |
| return HTTP_INTERNAL_SERVER_ERROR; |
| } |
| lr->next = ap_listeners; |
| ap_listeners = lr; |
| apr_pool_cleanup_register(s->process->pool, lr, nwssl_socket_cleanup, apr_pool_cleanup_null); |
| } |
| } else { |
| return HTTP_INTERNAL_SERVER_ERROR; |
| } |
| } |
| |
| for (slu = ap_seclistenersup; slu; slu = slu->next) { |
| /* Check the listener list for a matching upgradeable listener */ |
| found = 0; |
| for (lr = ap_listeners; lr; lr = lr->next) { |
| if (slu->port == lr->bind_addr->port) { |
| found = 1; |
| break; |
| } |
| } |
| if (!found) { |
| ap_log_perror(APLOG_MARK, APLOG_WARNING, 0, plog, APLOGNO(02130) |
| "No Listen directive found for upgradeable listener %s:%d", slu->addr, slu->port); |
| } |
| } |
| |
| build_cert_list(s->process->pool); |
| |
| return OK; |
| } |
| |
| static void *nwssl_config_server_create(apr_pool_t *p, server_rec *s) |
| { |
| NWSSLSrvConfigRec *new = apr_palloc(p, sizeof(NWSSLSrvConfigRec)); |
| new->sltable = apr_table_make(p, 5); |
| new->slutable = apr_table_make(p, 5); |
| return new; |
| } |
| |
| static void *nwssl_config_server_merge(apr_pool_t *p, void *basev, void *addv) |
| { |
| NWSSLSrvConfigRec *base = (NWSSLSrvConfigRec *)basev; |
| NWSSLSrvConfigRec *add = (NWSSLSrvConfigRec *)addv; |
| NWSSLSrvConfigRec *merged = (NWSSLSrvConfigRec *)apr_palloc(p, sizeof(NWSSLSrvConfigRec)); |
| return merged; |
| } |
| |
| static int compare_ipports(void *rec, const char *key, const char *value) |
| { |
| conn_rec *c = (conn_rec*)rec; |
| |
| if (value && |
| ((strcmp(value, "0.0.0.0") == 0) || (strcmp(value, c->local_ip) == 0))) |
| { |
| return 0; |
| } |
| return 1; |
| } |
| |
| static int isSecureConnEx (const server_rec *s, const conn_rec *c, const apr_table_t *t) |
| { |
| char port[8]; |
| |
| itoa((c->local_addr)->port, port, 10); |
| if (!apr_table_do(compare_ipports, (void*)c, t, port, NULL)) { |
| return 1; |
| } |
| |
| return 0; |
| } |
| |
| static int isSecureConn (const server_rec *s, const conn_rec *c) |
| { |
| NWSSLSrvConfigRec *sc = get_nwssl_cfg(s); |
| |
| return isSecureConnEx (s, c, sc->sltable); |
| } |
| |
| static int isSecureConnUpgradeable (const server_rec *s, const conn_rec *c) |
| { |
| NWSSLSrvConfigRec *sc = get_nwssl_cfg(s); |
| |
| return isSecureConnEx (s, c, sc->slutable); |
| } |
| |
| static int isSecure (const request_rec *r) |
| { |
| return isSecureConn (r->server, r->connection); |
| } |
| |
| static int isSecureUpgradeable (const request_rec *r) |
| { |
| return isSecureConnUpgradeable (r->server, r->connection); |
| } |
| |
| static int isSecureUpgraded (const request_rec *r) |
| { |
| secsocket_data *csd_data = (secsocket_data*)ap_get_module_config(r->connection->conn_config, &nwssl_module); |
| |
| return csd_data->is_secure; |
| } |
| |
| static int nwssl_hook_Fixup(request_rec *r) |
| { |
| if (!isSecure(r) && !isSecureUpgraded(r)) |
| return DECLINED; |
| |
| apr_table_setn(r->subprocess_env, "HTTPS", "on"); |
| |
| return DECLINED; |
| } |
| |
| static const char *nwssl_hook_http_scheme(const request_rec *r) |
| { |
| if (isSecure(r) && !isSecureUpgraded(r)) |
| return "https"; |
| |
| return NULL; |
| } |
| |
| static apr_port_t nwssl_hook_default_port(const request_rec *r) |
| { |
| if (isSecure(r)) |
| return DEFAULT_HTTPS_PORT; |
| |
| return 0; |
| } |
| |
| int ssl_proxy_enable(conn_rec *c) |
| { |
| apr_table_setn(c->notes, "nwconv-ssl", "Y"); |
| |
| return 1; |
| } |
| |
| int ssl_engine_disable(conn_rec *c) |
| { |
| return 1; |
| } |
| |
| static int ssl_is_https(conn_rec *c) |
| { |
| secsocket_data *csd_data = (secsocket_data*)ap_get_module_config(c->conn_config, &nwssl_module); |
| |
| return isSecureConn (c->base_server, c) || (csd_data && csd_data->is_secure); |
| } |
| |
| /* This function must remain safe to use for a non-SSL connection. */ |
| char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, char *var) |
| { |
| NWSSLSrvConfigRec *mc = get_nwssl_cfg(s); |
| const char *result; |
| BOOL resdup; |
| apr_time_exp_t tm; |
| |
| result = NULL; |
| resdup = TRUE; |
| |
| /* |
| * When no pool is given try to find one |
| */ |
| if (p == NULL) { |
| if (r != NULL) |
| p = r->pool; |
| else if (c != NULL) |
| p = c->pool; |
| else |
| p = mc->pPool; |
| } |
| |
| /* |
| * Request dependent stuff |
| */ |
| if (r != NULL) { |
| switch (var[0]) { |
| case 'H': |
| case 'h': |
| if (strcEQ(var, "HTTP_USER_AGENT")) |
| result = apr_table_get(r->headers_in, "User-Agent"); |
| else if (strcEQ(var, "HTTP_REFERER")) |
| result = apr_table_get(r->headers_in, "Referer"); |
| else if (strcEQ(var, "HTTP_COOKIE")) |
| result = apr_table_get(r->headers_in, "Cookie"); |
| else if (strcEQ(var, "HTTP_FORWARDED")) |
| result = apr_table_get(r->headers_in, "Forwarded"); |
| else if (strcEQ(var, "HTTP_HOST")) |
| result = apr_table_get(r->headers_in, "Host"); |
| else if (strcEQ(var, "HTTP_PROXY_CONNECTION")) |
| result = apr_table_get(r->headers_in, "Proxy-Connection"); |
| else if (strcEQ(var, "HTTP_ACCEPT")) |
| result = apr_table_get(r->headers_in, "Accept"); |
| else if (strcEQ(var, "HTTPS")) { |
| if (isSecure(r) || isSecureUpgraded(r)) |
| result = "on"; |
| else |
| result = "off"; |
| } |
| else if (strlen(var) > 5 && strcEQn(var, "HTTP:", 5)) |
| /* all other headers from which we are still not know about */ |
| result = apr_table_get(r->headers_in, var+5); |
| break; |
| |
| case 'R': |
| case 'r': |
| if (strcEQ(var, "REQUEST_METHOD")) |
| result = r->method; |
| else if (strcEQ(var, "REQUEST_SCHEME")) |
| result = ap_http_scheme(r); |
| else if (strcEQ(var, "REQUEST_URI")) |
| result = r->uri; |
| else if (strcEQ(var, "REQUEST_FILENAME")) |
| result = r->filename; |
| else if (strcEQ(var, "REMOTE_ADDR")) |
| result = r->useragent_ip; |
| else if (strcEQ(var, "REMOTE_HOST")) |
| result = ap_get_useragent_host(r, REMOTE_NAME, NULL); |
| else if (strcEQ(var, "REMOTE_IDENT")) |
| result = ap_get_remote_logname(r); |
| else if (strcEQ(var, "REMOTE_USER")) |
| result = r->user; |
| break; |
| |
| case 'S': |
| case 's': |
| if (strcEQn(var, "SSL", 3)) break; /* shortcut common case */ |
| |
| if (strcEQ(var, "SERVER_ADMIN")) |
| result = r->server->server_admin; |
| else if (strcEQ(var, "SERVER_NAME")) |
| result = ap_get_server_name_for_url(r); |
| else if (strcEQ(var, "SERVER_PORT")) |
| result = apr_psprintf(p, "%u", ap_get_server_port(r)); |
| else if (strcEQ(var, "SERVER_PROTOCOL")) |
| result = r->protocol; |
| else if (strcEQ(var, "SCRIPT_FILENAME")) |
| result = r->filename; |
| break; |
| |
| default: |
| if (strcEQ(var, "PATH_INFO")) |
| result = r->path_info; |
| else if (strcEQ(var, "QUERY_STRING")) |
| result = r->args; |
| else if (strcEQ(var, "IS_SUBREQ")) |
| result = (r->main != NULL ? "true" : "false"); |
| else if (strcEQ(var, "DOCUMENT_ROOT")) |
| result = ap_document_root(r); |
| else if (strcEQ(var, "AUTH_TYPE")) |
| result = r->ap_auth_type; |
| else if (strcEQ(var, "THE_REQUEST")) |
| result = r->the_request; |
| break; |
| } |
| } |
| |
| /* |
| * Connection stuff |
| */ |
| if (result == NULL && c != NULL) { |
| /* XXX-Can't get specific SSL info from NetWare */ |
| /* SSLConnRec *sslconn = myConnConfig(c); |
| if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) |
| && sslconn && sslconn->ssl) |
| result = ssl_var_lookup_ssl(p, c, var+4);*/ |
| |
| if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)) |
| result = NULL; |
| } |
| |
| /* |
| * Totally independent stuff |
| */ |
| if (result == NULL) { |
| if (strlen(var) > 12 && strcEQn(var, "SSL_VERSION_", 12)) |
| result = NULL; |
| /* XXX-Can't get specific SSL info from NetWare */ |
| /*result = ssl_var_lookup_ssl_version(p, var+12);*/ |
| else if (strcEQ(var, "SERVER_SOFTWARE")) |
| result = ap_get_server_banner(); |
| else if (strcEQ(var, "API_VERSION")) { |
| result = apr_itoa(p, MODULE_MAGIC_NUMBER_MAJOR); |
| resdup = FALSE; |
| } |
| else if (strcEQ(var, "TIME_YEAR")) { |
| apr_time_exp_lt(&tm, apr_time_now()); |
| result = apr_psprintf(p, "%02d%02d", |
| (tm.tm_year / 100) + 19, tm.tm_year % 100); |
| resdup = FALSE; |
| } |
| #define MKTIMESTR(format, tmfield) \ |
| apr_time_exp_lt(&tm, apr_time_now()); \ |
| result = apr_psprintf(p, format, tm.tmfield); \ |
| resdup = FALSE; |
| else if (strcEQ(var, "TIME_MON")) { |
| MKTIMESTR("%02d", tm_mon+1) |
| } |
| else if (strcEQ(var, "TIME_DAY")) { |
| MKTIMESTR("%02d", tm_mday) |
| } |
| else if (strcEQ(var, "TIME_HOUR")) { |
| MKTIMESTR("%02d", tm_hour) |
| } |
| else if (strcEQ(var, "TIME_MIN")) { |
| MKTIMESTR("%02d", tm_min) |
| } |
| else if (strcEQ(var, "TIME_SEC")) { |
| MKTIMESTR("%02d", tm_sec) |
| } |
| else if (strcEQ(var, "TIME_WDAY")) { |
| MKTIMESTR("%d", tm_wday) |
| } |
| else if (strcEQ(var, "TIME")) { |
| apr_time_exp_lt(&tm, apr_time_now()); |
| result = apr_psprintf(p, |
| "%02d%02d%02d%02d%02d%02d%02d", (tm.tm_year / 100) + 19, |
| (tm.tm_year % 100), tm.tm_mon+1, tm.tm_mday, |
| tm.tm_hour, tm.tm_min, tm.tm_sec); |
| resdup = FALSE; |
| } |
| /* all other env-variables from the parent Apache process */ |
| else if (strlen(var) > 4 && strcEQn(var, "ENV:", 4)) { |
| result = apr_table_get(r->notes, var+4); |
| if (result == NULL) |
| result = apr_table_get(r->subprocess_env, var+4); |
| if (result == NULL) |
| result = getenv(var+4); |
| } |
| } |
| |
| if (result != NULL && resdup) |
| result = apr_pstrdup(p, result); |
| if (result == NULL) |
| result = ""; |
| return (char *)result; |
| } |
| |
| #define SWITCH_STATUS_LINE "HTTP/1.1 101 Switching Protocols" |
| #define UPGRADE_HEADER "Upgrade: TLS/1.0, HTTP/1.1" |
| #define CONNECTION_HEADER "Connection: Upgrade" |
| |
| static apr_status_t ssl_io_filter_Upgrade(ap_filter_t *f, |
| apr_bucket_brigade *bb) |
| |
| { |
| const char *upgrade; |
| apr_bucket_brigade *upgradebb; |
| request_rec *r = f->r; |
| apr_socket_t *csd = NULL; |
| char *key; |
| int ret; |
| secsocket_data *csd_data; |
| apr_bucket *b; |
| apr_status_t rv; |
| |
| /* Just remove the filter, if it doesn't work the first time, it won't |
| * work at all for this request. |
| */ |
| ap_remove_output_filter(f); |
| |
| if (!r) { |
| /* |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02131) |
| "Unable to get upgradeable socket handle"); |
| */ |
| return ap_pass_brigade(f->next, bb); |
| } |
| |
| /* No need to ensure that this is a server with optional SSL, the filter |
| * is only inserted if that is true. |
| */ |
| |
| upgrade = apr_table_get(r->headers_in, "Upgrade"); |
| if (upgrade == NULL |
| || strcmp(ap_getword(r->pool, &upgrade, ','), "TLS/1.0")) { |
| /* "Upgrade: TLS/1.0, ..." header not found, don't do Upgrade */ |
| return ap_pass_brigade(f->next, bb); |
| } |
| |
| apr_table_unset(r->headers_out, "Upgrade"); |
| |
| csd_data = (secsocket_data*)ap_get_module_config(r->connection->conn_config, &nwssl_module); |
| csd = csd_data->csd; |
| |
| /* Send the interim 101 response. */ |
| upgradebb = apr_brigade_create(r->pool, f->c->bucket_alloc); |
| |
| ap_fputs(f->next, upgradebb, SWITCH_STATUS_LINE CRLF |
| UPGRADE_HEADER CRLF CONNECTION_HEADER CRLF CRLF); |
| |
| b = apr_bucket_flush_create(f->c->bucket_alloc); |
| APR_BRIGADE_INSERT_TAIL(upgradebb, b); |
| |
| rv = ap_pass_brigade(f->next, upgradebb); |
| if (rv) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02132) |
| "could not send interim 101 Upgrade response"); |
| return AP_FILTER_ERROR; |
| } |
| |
| key = get_port_key(r->connection); |
| |
| if (csd && key) { |
| int sockdes; |
| apr_os_sock_get(&sockdes, csd); |
| |
| |
| ret = SSLize_Socket(sockdes, key, r); |
| if (!ret) { |
| csd_data->is_secure = 1; |
| } |
| } |
| else { |
| ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02133) |
| "Upgradeable socket handle not found"); |
| return AP_FILTER_ERROR; |
| } |
| |
| ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server, APLOGNO(02134) |
| "Awaiting re-negotiation handshake"); |
| |
| /* Now that we have initialized the ssl connection which added the ssl_io_filter, |
| pass the brigade off to the connection based output filters so that the |
| request can complete encrypted */ |
| return ap_pass_brigade(f->c->output_filters, bb); |
| } |
| |
| static void ssl_hook_Insert_Filter(request_rec *r) |
| { |
| NWSSLSrvConfigRec *sc = get_nwssl_cfg(r->server); |
| |
| if (isSecureUpgradeable (r)) { |
| ap_add_output_filter("UPGRADE_FILTER", NULL, r, r->connection); |
| } |
| } |
| |
| static const command_rec nwssl_module_cmds[] = |
| { |
| AP_INIT_TAKE23("SecureListen", set_secure_listener, NULL, RSRC_CONF, |
| "specify an address and/or port with a key pair name.\n" |
| "Optional third parameter of MUTUAL configures the port for mutual authentication."), |
| AP_INIT_TAKE2("NWSSLUpgradeable", set_secure_upgradeable_listener, NULL, RSRC_CONF, |
| "specify an address and/or port with a key pair name, that can be upgraded to an SSL connection.\n" |
| "The address and/or port must have already be defined using a Listen directive."), |
| AP_INIT_ITERATE("NWSSLTrustedCerts", set_trusted_certs, NULL, RSRC_CONF, |
| "Adds trusted certificates that are used to create secure connections to proxied servers"), |
| {NULL} |
| }; |
| |
| static void register_hooks(apr_pool_t *p) |
| { |
| ap_register_output_filter ("UPGRADE_FILTER", ssl_io_filter_Upgrade, NULL, AP_FTYPE_PROTOCOL + 5); |
| |
| ap_hook_pre_config(nwssl_pre_config, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_pre_connection(nwssl_pre_connection, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_post_config(nwssl_post_config, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_fixups(nwssl_hook_Fixup, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_http_scheme(nwssl_hook_http_scheme, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_default_port(nwssl_hook_default_port, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_insert_filter(ssl_hook_Insert_Filter, NULL, NULL, APR_HOOK_MIDDLE); |
| |
| APR_REGISTER_OPTIONAL_FN(ssl_is_https); |
| APR_REGISTER_OPTIONAL_FN(ssl_var_lookup); |
| |
| APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); |
| APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); |
| } |
| |
| AP_DECLARE_MODULE(nwssl) = |
| { |
| STANDARD20_MODULE_STUFF, |
| NULL, /* dir config creater */ |
| NULL, /* dir merger --- default is to override */ |
| nwssl_config_server_create, /* server config */ |
| nwssl_config_server_merge, /* merge server config */ |
| nwssl_module_cmds, /* command apr_table_t */ |
| register_hooks |
| }; |
| |
