Commit f9a2c5a6 authored by William A. Rowe Jr's avatar William A. Rowe Jr
Browse files 

  New SSLLogLevelDebugDump [ None (default) | IO (not bytes) | Bytes ]
  configures the I/O Dump of SSL traffic, when LogLevel is set to Debug.
  The default is none as this is far greater debugging resolution than 
  the typical administrator is prepared to untangle.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@416265 13f79535-47bb-0310-9956-ffa450edef68
parent f82d0dec

modules/ssl/mod_ssl.c

+3 −0
Original line number Diff line number Diff line
@@ -145,6 +145,9 @@ static const command_rec ssl_config_cmds[] = { 
                "Use the server's cipher ordering preference")

    SSL_CMD_ALL(UserName, TAKE1,

                "Set user name to SSL variable value")

    SSL_CMD_SRV(LogLevelDebugDump, TAKE1,

                "Include I/O Dump when LogLevel is set to Debug "

                "([ None (default) | IO (not bytes) | Bytes ])")



    /*

     * Proxy configuration for remote SSL connections

modules/ssl/ssl_engine_config.c

+26 −0
Original line number Diff line number Diff line
@@ -169,6 +169,7 @@ static SSLSrvConfigRec *ssl_config_server_new(apr_pool_t *p) 
    sc->vhost_id_len           = 0;     /* set during module init */

    sc->session_cache_timeout  = UNSET;

    sc->cipher_server_pref     = UNSET;

    sc->ssl_log_level          = SSL_LOG_UNSET;



    modssl_ctx_init_proxy(sc, p);
@@ -257,6 +258,7 @@ void *ssl_config_server_merge(apr_pool_t *p, void *basev, void *addv) 
    cfgMergeBool(proxy_enabled);

    cfgMergeInt(session_cache_timeout);

    cfgMergeBool(cipher_server_pref);

    cfgMerge(ssl_log_level, SSL_LOG_UNSET);



    modssl_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
@@ -1094,6 +1096,30 @@ const char *ssl_cmd_SSLSessionCacheTimeout(cmd_parms *cmd, 
    return NULL;

}



const char *ssl_cmd_SSLLogLevelDebugDump(cmd_parms *cmd,

                                         void *dcfg,

                                         const char *arg)

{

    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);



    if (strcEQ(arg, "none") || strcEQ(arg, "off")) {

        sc->ssl_log_level = SSL_LOG_NONE;

    }

    else if (strcEQ(arg, "io") || strcEQ(arg, "i/o")) {

        sc->ssl_log_level = SSL_LOG_IO;

    }

    else if (strcEQ(arg, "bytes") || strcEQ(arg, "on")) {

        sc->ssl_log_level = SSL_LOG_BYTES;

    }

    else {

        return apr_pstrcat(cmd->temp_pool, cmd->cmd->name,

                           ": Invalid argument '", arg, "'",

                           NULL);

    }



    return NULL;

}



const char *ssl_cmd_SSLOptions(cmd_parms *cmd,

                               void *dcfg,

                               const char *arg)

modules/ssl/ssl_engine_io.c

+7 −2
Original line number Diff line number Diff line
@@ -1655,6 +1655,8 @@ static void ssl_io_input_add_filter(ssl_filter_ctx_t *filter_ctx, conn_rec *c, 
void ssl_io_filter_init(conn_rec *c, SSL *ssl)

{

    ssl_filter_ctx_t *filter_ctx;

    server_rec *s = c->base_server;

    SSLSrvConfigRec *sc = mySrvConfig(s);



    filter_ctx = apr_palloc(c->pool, sizeof(ssl_filter_ctx_t));
@@ -1673,7 +1675,8 @@ void ssl_io_filter_init(conn_rec *c, SSL *ssl) 
    apr_pool_cleanup_register(c->pool, (void*)filter_ctx,

                              ssl_io_filter_cleanup, apr_pool_cleanup_null);



    if (c->base_server->loglevel >= APLOG_DEBUG) {

    if ((s->loglevel >= APLOG_DEBUG)

         && (sc->ssl_log_level >= SSL_LOG_IO)) {

        BIO_set_callback(SSL_get_rbio(ssl), ssl_io_data_cb);

        BIO_set_callback_arg(SSL_get_rbio(ssl), (void *)ssl);

    }
@@ -1776,12 +1779,14 @@ long ssl_io_data_cb(BIO *bio, int cmd, 
    SSL *ssl;

    conn_rec *c;

    server_rec *s;

    SSLSrvConfigRec *sc;



    if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL)

        return rc;

    if ((c = (conn_rec *)SSL_get_app_data(ssl)) == NULL)

        return rc;

    s = c->base_server;

    sc = mySrvConfig(s);



    if (   cmd == (BIO_CB_WRITE|BIO_CB_RETURN)

        || cmd == (BIO_CB_READ |BIO_CB_RETURN) ) {
@@ -1793,7 +1798,7 @@ long ssl_io_data_cb(BIO *bio, int cmd, 
                    rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"),

                    bio, argp,

                    (argp != NULL ? "(BIO dump follows)" : "(Oops, no memory buffer?)"));

            if (argp != NULL)

            if ((argp != NULL) && (sc->ssl_log_level >= SSL_LOG_BYTES))

                ssl_io_data_dump(s, argp, rc);

        }

        else {

modules/ssl/ssl_private.h

+16 −2
Original line number Diff line number Diff line
@@ -140,6 +140,18 @@ ap_set_module_config(c->conn_config, &ssl_module, val) 
#define SSL_SESSION_CACHE_TIMEOUT  300

#endif



/**

 * Define the per-server SSLLogLevel constants which provide

 * finer-than-debug resolution to decide if logs are to be

 * assulted with tens of thousands of characters per request.

 */

typedef enum {

    SSL_LOG_UNSET  = UNSET,

    SSL_LOG_NONE   = 0,

    SSL_LOG_IO     = 6,

    SSL_LOG_BYTES  = 7

} ssl_log_level_e;



/**

 * Support for MM library

 */
@@ -449,6 +461,7 @@ struct SSLSrvConfigRec { 
    BOOL             cipher_server_pref;

    modssl_ctx_t    *server;

    modssl_ctx_t    *proxy;

    ssl_log_level_e  ssl_log_level;

};



/**
@@ -513,6 +526,7 @@ const char *ssl_cmd_SSLOptions(cmd_parms *, void *, const char *); 
const char  *ssl_cmd_SSLRequireSSL(cmd_parms *, void *);

const char  *ssl_cmd_SSLRequire(cmd_parms *, void *, const char *);

const char  *ssl_cmd_SSLUserName(cmd_parms *, void *, const char *);

const char  *ssl_cmd_SSLLogLevelDebugDump(cmd_parms *, void *, const char *);



const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);

const char  *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *);