tls_core.h File Reference

Go to the source code of this file.

Classes
struct	tls_conf_conn_t

Macros
#define	TLS_CONN_ST_IS_ENABLED(cc)   (cc && cc->state >= TLS_CONN_ST_CLIENT_HELLO)

Enumerations
enum	tls_conn_state_t {   TLS_CONN_ST_INIT , TLS_CONN_ST_DISABLED , TLS_CONN_ST_CLIENT_HELLO , TLS_CONN_ST_HANDSHAKE ,   TLS_CONN_ST_TRAFFIC , TLS_CONN_ST_NOTIFIED , TLS_CONN_ST_DONE }

Functions
tls_conf_conn_t *	tls_conf_conn_get (conn_rec *c)
void	tls_conf_conn_set (conn_rec *c, tls_conf_conn_t *cc)
int	tls_conn_check_ssl (conn_rec *c)
apr_status_t	tls_core_init (apr_pool_t *p, apr_pool_t *ptemp, server_rec *base_server)
apr_status_t	tls_core_init_outgoing (apr_pool_t *p, apr_pool_t *ptemp, server_rec *base_server)
void	tls_core_conn_bind (conn_rec *c, ap_conf_vector_t *dir_conf)
void	tls_core_conn_disable (conn_rec *c)
int	tls_core_pre_conn_init (conn_rec *c)
apr_status_t	tls_core_conn_init (conn_rec *c)
apr_status_t	tls_core_conn_seen_client_hello (conn_rec *c)
apr_status_t	tls_core_conn_post_handshake (conn_rec *c)
int	tls_core_request_check (request_rec *r)
apr_status_t	tls_core_error (conn_rec *c, rustls_result rr, const char **perrstr)
int	tls_core_setup_outgoing (conn_rec *c)

Macro Definition Documentation

TLS_CONN_ST_IS_ENABLED

#define TLS_CONN_ST_IS_ENABLED

(

cc

)

(cc && cc->state >= TLS_CONN_ST_CLIENT_HELLO)

Definition at line 31 of file tls_core.h.

Enumeration Type Documentation

tls_conn_state_t

enum tls_conn_state_t

Enumerator
TLS_CONN_ST_INIT
TLS_CONN_ST_DISABLED
TLS_CONN_ST_CLIENT_HELLO
TLS_CONN_ST_HANDSHAKE
TLS_CONN_ST_TRAFFIC
TLS_CONN_ST_NOTIFIED
TLS_CONN_ST_DONE

Definition at line 21 of file tls_core.h.

Function Documentation

tls_conf_conn_get()

tls_conf_conn_t * tls_conf_conn_get

(

conn_rec *

c

)

Definition at line 45 of file tls_core.c.

tls_conf_conn_set()

void tls_conf_conn_set	(	conn_rec *	c,
		tls_conf_conn_t *	cc
	)

Definition at line 50 of file tls_core.c.

tls_conn_check_ssl()

int tls_conn_check_ssl

(

conn_rec *

c

)

< Module has handled this stage.

< Module declines to handle

Definition at line 55 of file tls_core.c.

tls_core_conn_bind()

void tls_core_conn_bind	(	conn_rec *	c,
		ap_conf_vector_t *	dir_conf
	)

Supply a directory configuration for the connection to work with. This maybe NULL. This can be called several times during the lifetime of a connection and must not change the current TLS state.

Parameters

c	the connection
dir_conf	optional directory configuration that applies

Definition at line 754 of file tls_core.c.

tls_core_conn_disable()

void tls_core_conn_disable

(

conn_rec *

c

)

Disable TLS on a new connection. Will do nothing on already initialized connections.

Parameters

c	a new connection

Definition at line 745 of file tls_core.c.

tls_core_conn_init()

apr_status_t tls_core_conn_init

(

conn_rec *

c

)

Initialize the module for a TLS enabled connection.

Parameters

c	a new connection

Definition at line 934 of file tls_core.c.

tls_core_conn_post_handshake()

apr_status_t tls_core_conn_post_handshake

(

conn_rec *

c

)

The TLS handshake for the connection has been successfully performed. This means that TLS related properties, such as TLS version and cipher, are known and the props in tls_conf_conn_t of the connection can be set.

Definition at line 1257 of file tls_core.c.

tls_core_conn_seen_client_hello()

apr_status_t tls_core_conn_seen_client_hello

(

conn_rec *

c

)

Called when the ClientHello has been received and values from it have been extracted into the tls_conf_conn_t of the connection.

Decides:

• which server_rec this connection is for (SNI)
• which application protocol to use (ALPN) This may be unsuccessful for several reasons. The SNI from the client may not be known or the selected server has not certificates available. etc. On success, a proper rustls_connection will have been created and set in the tls_conf_conn_t of the connection.

Definition at line 1186 of file tls_core.c.

tls_core_error()

apr_status_t tls_core_error	(	conn_rec *	c,
		rustls_result	rr,
		const char **	perrstr
	)

A Rustls error happened while processing the connection. Look up an error description, determine the apr_status_t to use for it and remember this as the last error at tls_conf_conn_t.

Definition at line 1384 of file tls_core.c.

tls_core_init()

apr_status_t tls_core_init	(	apr_pool_t *	p,
		apr_pool_t *	ptemp,
		server_rec *	base_server
	)

Initialize the module's global and server specific settings. This runs in Apache's "post-config" phase, meaning the configuration has been read and checked for syntactic and other easily verifiable errors and now it is time to load everything in and make it ready for traffic.

a memory pool staying with us the whole time until the server stops/reloads. <ptemp> a temporary pool as a scratch buffer that will be destroyed shortly after. <base_server> the server for the global configuration which links -> next to all contained virtual hosts configured.

Definition at line 665 of file tls_core.c.

tls_core_init_outgoing()

apr_status_t tls_core_init_outgoing	(	apr_pool_t *	p,
		apr_pool_t *	ptemp,
		server_rec *	base_server
	)

Initialize the module's outgoing connection settings. This runs in Apache's "post-config" phase after mod_proxy.

tls_core_pre_conn_init()

int tls_core_pre_conn_init

(

conn_rec *

c

)

Initialize the tls_conf_connt_t for the connection and decide if TLS is enabled or not.

Returns

OK if enabled, DECLINED otherwise

< Module has handled this stage.

< Module declines to handle

Definition at line 904 of file tls_core.c.

tls_core_request_check()

int tls_core_request_check

(

request_rec *

r

)

After a request has been read, but before processing is started, we check if everything looks good to us:

• was an SNI hostname provided by the client when we have vhosts to choose from? if not, we deny it.
• if the SNI hostname and request host are not the same, are they - from TLS point of view - 'compatible' enough? For example, if one server requires client certificates and the other not (or with different settings), such a request will also be denied. returns DECLINED if everything is ok, otherwise an HTTP response code to generate an error page for.

< Module declines to handle

Definition at line 1348 of file tls_core.c.

tls_core_setup_outgoing()

int tls_core_setup_outgoing

(

conn_rec *

c

)

Determine if we handle the TLS for an outgoing connection or not.

Parameters

c	the connection

Returns

OK if we handle the TLS, DECLINED otherwise.

< Module declines to handle

< Module has handled this stage.

< Module has handled this stage.

< Module has handled this stage.

Definition at line 1397 of file tls_core.c.