* Find a (name-based) SSL virtual host where either the ServerName * or one of the ServerAliases matches the supplied name (to be used * with ap_vhost_iterate_given_conn()) */
| 2336 | * with ap_vhost_iterate_given_conn()) |
| 2337 | */ |
| 2338 | static int ssl_find_vhost(void *servername, conn_rec *c, server_rec *s) |
| 2339 | { |
| 2340 | SSLSrvConfigRec *sc; |
| 2341 | SSL *ssl; |
| 2342 | BOOL found; |
| 2343 | SSLConnRec *sslcon; |
| 2344 | |
| 2345 | found = ssl_util_vhost_matches(servername, s); |
| 2346 | |
| 2347 | /* set SSL_CTX (if matched) */ |
| 2348 | sslcon = myConnConfig(c); |
| 2349 | if (found && (ssl = sslcon->ssl) && |
| 2350 | (sc = mySrvConfig(s))) { |
| 2351 | SSL_CTX *ctx = SSL_set_SSL_CTX(ssl, sc->server->ssl_ctx); |
| 2352 | |
| 2353 | /* |
| 2354 | * SSL_set_SSL_CTX() only deals with the server cert, |
| 2355 | * so we need to duplicate a few additional settings |
| 2356 | * from the ctx by hand |
| 2357 | */ |
| 2358 | SSL_set_options(ssl, SSL_CTX_get_options(ctx)); |
| 2359 | #if OPENSSL_VERSION_NUMBER >= 0x1010007fL \ |
| 2360 | && (!defined(LIBRESSL_VERSION_NUMBER) \ |
| 2361 | || LIBRESSL_VERSION_NUMBER >= 0x20800000L) |
| 2362 | /* |
| 2363 | * Don't switch the protocol if none is configured for this vhost, |
| 2364 | * the default in this case is still the base server's SSLProtocol. |
| 2365 | */ |
| 2366 | if (myConnCtxConfig(c, sc)->protocol_set) { |
| 2367 | SSL_set_min_proto_version(ssl, SSL_CTX_get_min_proto_version(ctx)); |
| 2368 | SSL_set_max_proto_version(ssl, SSL_CTX_get_max_proto_version(ctx)); |
| 2369 | } |
| 2370 | #endif |
| 2371 | if ((SSL_get_verify_mode(ssl) == SSL_VERIFY_NONE) || |
| 2372 | (SSL_num_renegotiations(ssl) == 0)) { |
| 2373 | /* |
| 2374 | * Only initialize the verification settings from the ctx |
| 2375 | * if they are not yet set, or if we're called when a new |
| 2376 | * SSL connection is set up (num_renegotiations == 0). |
| 2377 | * Otherwise, we would possibly reset a per-directory |
| 2378 | * configuration which was put into effect by ssl_hook_Access. |
| 2379 | */ |
| 2380 | SSL_set_verify(ssl, SSL_CTX_get_verify_mode(ctx), |
| 2381 | SSL_CTX_get_verify_callback(ctx)); |
| 2382 | } |
| 2383 | |
| 2384 | /* |
| 2385 | * Adjust the session id context. ssl_init_ssl_connection() |
| 2386 | * always picks the configuration of the first vhost when |
| 2387 | * calling SSL_new(), but we want to tie the session to the |
| 2388 | * vhost we have just switched to. Again, we have to make sure |
| 2389 | * that we're not overwriting a session id context which was |
| 2390 | * possibly set in ssl_hook_Access(), before triggering |
| 2391 | * a renegotiation. |
| 2392 | */ |
| 2393 | if (SSL_num_renegotiations(ssl) == 0) { |
| 2394 | unsigned char *sid_ctx = |
| 2395 | (unsigned char *)ap_md5_binary(c->pool, |
nothing calls this directly
no test coverage detected