| 632 | |
| 633 | #ifdef HAVE_TLSEXT |
| 634 | static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, |
| 635 | apr_pool_t *p, |
| 636 | apr_pool_t *ptemp, |
| 637 | modssl_ctx_t *mctx) |
| 638 | { |
| 639 | apr_status_t rv; |
| 640 | |
| 641 | /* |
| 642 | * Configure TLS extensions support |
| 643 | */ |
| 644 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01893) |
| 645 | "Configuring TLS extension handling"); |
| 646 | |
| 647 | /* |
| 648 | * The Server Name Indication (SNI) provided by the ClientHello can be |
| 649 | * used to select the right (name-based-)vhost and its SSL configuration |
| 650 | * before the handshake takes place. |
| 651 | */ |
| 652 | if (!SSL_CTX_set_tlsext_servername_callback(mctx->ssl_ctx, |
| 653 | ssl_callback_ServerNameIndication) || |
| 654 | !SSL_CTX_set_tlsext_servername_arg(mctx->ssl_ctx, mctx)) { |
| 655 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01894) |
| 656 | "Unable to initialize TLS servername extension " |
| 657 | "callback (incompatible OpenSSL version?)"); |
| 658 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 659 | return ssl_die(s); |
| 660 | } |
| 661 | |
| 662 | #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) |
| 663 | /* |
| 664 | * The ClientHello callback also allows to retrieve the SNI, but since it |
| 665 | * runs at the earliest possible connection stage we can even set the TLS |
| 666 | * protocol version(s) according to the selected (name-based-)vhost, which |
| 667 | * is not possible at the SNI callback stage (due to OpenSSL internals). |
| 668 | */ |
| 669 | SSL_CTX_set_client_hello_cb(mctx->ssl_ctx, ssl_callback_ClientHello, NULL); |
| 670 | #endif |
| 671 | |
| 672 | #ifdef HAVE_OCSP_STAPLING |
| 673 | /* |
| 674 | * OCSP Stapling support, status_request extension |
| 675 | */ |
| 676 | if ((mctx->pkp == FALSE) && (mctx->stapling_enabled == TRUE)) { |
| 677 | if ((rv = modssl_init_stapling(s, p, ptemp, mctx)) != APR_SUCCESS) { |
| 678 | return rv; |
| 679 | } |
| 680 | } |
| 681 | #endif |
| 682 | |
| 683 | #ifdef HAVE_SRP |
| 684 | /* |
| 685 | * TLS-SRP support |
| 686 | */ |
| 687 | if (mctx->srp_vfile != NULL) { |
| 688 | int err; |
| 689 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02308) |
| 690 | "Using SRP verifier file [%s]", mctx->srp_vfile); |
| 691 |
no test coverage detected