nginx-quic: src/event/ngx_event

annotate src/event/ngx_event_openssl.c @ 7636:53a5cdbe500c quic

QUIC add_handshake_data callback, varint routines.

author	Sergey Kandaurov <pluknet@nginx.com>
date	Fri, 28 Feb 2020 13:09:51 +0300
parents	bd006bd520a9
children	4daf03d2bd0a

rev	line source
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	1
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	2 /*
444 42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright Igor Sysoev <igor@sysoev.ru> parents: 441 diff changeset	3 * Copyright (C) Igor Sysoev
4412 d620f497c50f Copyright updated. Maxim Konovalov <maxim@nginx.com> parents: 4400 diff changeset	4 * Copyright (C) Nginx, Inc.
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	5 */
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	6
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	7
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	8 #include <ngx_config.h>
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	9 #include <ngx_core.h>
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	10 #include <ngx_event.h>
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	11
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	12
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	13 #define NGX_SSL_PASSWORD_BUFFER_SIZE 4096
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	14
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	15
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	16 typedef struct {
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	17 ngx_uint_t engine; /* unsigned engine:1; */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	18 } ngx_openssl_conf_t;
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	19
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	20
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	21 static X509 ngx_ssl_load_certificate(ngx_pool_t pool, char **err,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	22 ngx_str_t cert, STACK_OF(X509) *chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	23 static EVP_PKEY ngx_ssl_load_certificate_key(ngx_pool_t pool, char **err,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	24 ngx_str_t key, ngx_array_t passwords);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	25 static int ngx_ssl_password_callback(char *buf, int size, int rwflag,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	26 void *userdata);
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	27 static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	28 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	29 int ret);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	30 static void ngx_ssl_passwords_cleanup(void *data);
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	31 static int ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn,
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	32 ngx_ssl_session_t *sess);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	33 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	34 static ngx_int_t ngx_ssl_try_early_data(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	35 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	36 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	37 static void ngx_ssl_handshake_log(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	38 #endif
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	39 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	40 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	41 static ssize_t ngx_ssl_recv_early(ngx_connection_t c, u_char buf,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	42 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	43 #endif
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	44 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	45 static void ngx_ssl_write_handler(ngx_event_t *wev);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	46 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	47 static ssize_t ngx_ssl_write_early(ngx_connection_t c, u_char data,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	48 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	49 #endif
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	50 static void ngx_ssl_read_handler(ngx_event_t *rev);
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	51 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	52 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	53 ngx_err_t err, char *text);
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	54 static void ngx_ssl_clear_error(ngx_log_t *log);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	55
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	56 static ngx_int_t ngx_ssl_session_id_context(ngx_ssl_t *ssl,
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	57 ngx_str_t sess_ctx, ngx_array_t certificates);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	58 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	59 ngx_ssl_session_t *sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	60 static ngx_ssl_session_t ngx_ssl_get_cached_session(ngx_ssl_conn_t ssl_conn,
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	61 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	62 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	63 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	64 u_char id, int len, int copy);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	65 static void ngx_ssl_remove_session(SSL_CTX ssl, ngx_ssl_session_t sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	66 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	67 ngx_slab_pool_t *shpool, ngx_uint_t n);
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	68 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	69 ngx_rbtree_node_t node, ngx_rbtree_node_t sentinel);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	70
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	71 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	72 static int ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	73 unsigned char name, unsigned char iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	74 HMAC_CTX *hctx, int enc);
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	75 static void ngx_ssl_session_ticket_keys_cleanup(void *data);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	76 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	77
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	78 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	79 static ngx_int_t ngx_ssl_check_name(ngx_str_t name, ASN1_STRING str);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	80 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	81
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	82 static time_t ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	83 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	84 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	85 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	86 ASN1_TIME *asn1time);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	87
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	88 static void ngx_openssl_create_conf(ngx_cycle_t cycle);
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	89 static char ngx_openssl_engine(ngx_conf_t cf, ngx_command_t cmd, void conf);
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	90 static void ngx_openssl_exit(ngx_cycle_t *cycle);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	91
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	92
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	93 #if NGX_OPENSSL_QUIC
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	94
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	95 static int
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	96 quic_set_encryption_secrets(ngx_ssl_conn_t *ssl_conn,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	97 enum ssl_encryption_level_t level, const uint8_t *read_secret,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	98 const uint8_t *write_secret, size_t secret_len)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	99 {
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	100 size_t rlen, wlen;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	101 uint8_t rsec, wsec;
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	102 const char *name;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	103 const EVP_MD *digest;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	104 const EVP_AEAD *aead;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	105 ngx_connection_t *c;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	106
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	107 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	108
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	109 ngx_ssl_handshake_log(c);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	110
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	111 #if (NGX_DEBUG)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	112 if (c->log->log_level & NGX_LOG_DEBUG_EVENT) {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	113 u_char buf[64];
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	114 size_t m;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	115
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	116 m = ngx_hex_dump(buf, (u_char *) read_secret, secret_len) - buf;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	117 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	118 "set_encryption_secrets: read %*s, len: %uz, level:%d",
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	119 m, buf, secret_len, (int) level);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	120
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	121 m = ngx_hex_dump(buf, (u_char *) write_secret, secret_len) - buf;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	122 ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	123 "set_encryption_secrets: write %*s, len: %uz, level:%d",
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	124 m, buf, secret_len, (int) level);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	125 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	126 #endif
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	127
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	128 name = SSL_get_cipher(ssl_conn);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	129
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	130 if (OPENSSL_strcasecmp(name, "TLS_AES_128_GCM_SHA256") == 0) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	131 aead = EVP_aead_aes_128_gcm();
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	132 digest = EVP_sha256();
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	133
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	134 } else if (OPENSSL_strcasecmp(name, "TLS_AES_256_GCM_SHA384") == 0) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	135 aead = EVP_aead_aes_256_gcm();
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	136 digest = EVP_sha384();
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	137
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	138 } else {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	139 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	140 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	141
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	142 size_t hkdfl_len;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	143 uint8_t hkdfl[20];
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	144 uint8_t *p;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	145 const char *label;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	146
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	147 ngx_str_t client_key, client_iv, *client_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	148 ngx_str_t server_key, server_iv, *server_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	149
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	150 switch (level) {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	151
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	152 case ssl_encryption_handshake:
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	153 rlen = &c->quic->client_hs.len;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	154 rsec = &c->quic->client_hs.data;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	155 wlen = &c->quic->server_hs.len;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	156 wsec = &c->quic->server_hs.data;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	157
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	158 client_key = &c->quic->client_hs_key;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	159 client_iv = &c->quic->client_hs_iv;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	160 client_hp = &c->quic->client_hs_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	161
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	162 server_key = &c->quic->server_hs_key;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	163 server_iv = &c->quic->server_hs_iv;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	164 server_hp = &c->quic->server_hs_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	165
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	166 break;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	167
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	168 case ssl_encryption_application:
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	169 rlen = &c->quic->client_ad.len;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	170 rsec = &c->quic->client_ad.data;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	171 wlen = &c->quic->server_ad.len;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	172 wsec = &c->quic->server_ad.data;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	173
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	174 client_key = &c->quic->client_ad_key;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	175 client_iv = &c->quic->client_ad_iv;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	176 client_hp = &c->quic->client_ad_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	177
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	178 server_key = &c->quic->server_ad_key;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	179 server_iv = &c->quic->server_ad_iv;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	180 server_hp = &c->quic->server_ad_hp;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	181
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	182 break;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	183
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	184 default:
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	185 return 0;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	186 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	187
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	188 rlen = wlen = secret_len;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	189
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	190 *rsec = ngx_pnalloc(c->pool, secret_len);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	191 if (*rsec == NULL) {
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	192 return 0;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	193 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	194
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	195 ngx_memcpy(*rsec, read_secret, secret_len);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	196
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	197 *wsec = ngx_pnalloc(c->pool, secret_len);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	198 if (*wsec == NULL) {
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	199 return 0;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	200 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	201
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	202 ngx_memcpy(*wsec, write_secret, secret_len);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	203
7635 bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	204 // client keys
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	205
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	206 client_key->len = EVP_AEAD_key_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	207 client_key->data = ngx_pnalloc(c->pool, client_key->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	208 if (client_key->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	209 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	210 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	211
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	212 label = "tls13 quic key";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	213 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	214 hkdfl[0] = client_key->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	215 hkdfl[1] = client_key->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	216 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	217 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	218 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	219
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	220 if (HKDF_expand(client_key->data, client_key->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	221 digest, rsec, rlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	222 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	223 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	224 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	225 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	226 "HKDF_expand(client_key) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	227 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	228 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	229
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	230
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	231 client_iv->len = EVP_AEAD_nonce_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	232 client_iv->data = ngx_pnalloc(c->pool, client_iv->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	233 if (client_iv->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	234 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	235 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	236
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	237 label = "tls13 quic iv";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	238 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	239 hkdfl[0] = client_iv->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	240 hkdfl[1] = client_iv->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	241 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	242 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	243 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	244
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	245 if (HKDF_expand(client_iv->data, client_iv->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	246 digest, rsec, rlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	247 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	248 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	249 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	250 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	251 "HKDF_expand(client_iv) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	252 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	253 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	254
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	255
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	256 client_hp->len = EVP_AEAD_key_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	257 client_hp->data = ngx_pnalloc(c->pool, client_hp->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	258 if (client_hp->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	259 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	260 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	261
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	262 label = "tls13 quic hp";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	263 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	264 hkdfl[0] = client_hp->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	265 hkdfl[1] = client_hp->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	266 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	267 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	268 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	269
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	270 if (HKDF_expand(client_hp->data, client_hp->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	271 digest, rsec, rlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	272 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	273 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	274 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	275 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	276 "HKDF_expand(client_hp) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	277 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	278 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	279
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	280
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	281 // server keys
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	282
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	283 server_key->len = EVP_AEAD_key_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	284 server_key->data = ngx_pnalloc(c->pool, server_key->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	285 if (server_key->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	286 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	287 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	288
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	289 label = "tls13 quic key";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	290 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	291 hkdfl[0] = server_key->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	292 hkdfl[1] = server_key->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	293 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	294 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	295 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	296
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	297 if (HKDF_expand(server_key->data, server_key->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	298 digest, wsec, wlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	299 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	300 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	301 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	302 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	303 "HKDF_expand(server_key) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	304 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	305 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	306
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	307
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	308 server_iv->len = EVP_AEAD_nonce_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	309 server_iv->data = ngx_pnalloc(c->pool, server_iv->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	310 if (server_iv->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	311 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	312 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	313
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	314 label = "tls13 quic iv";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	315 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	316 hkdfl[0] = server_iv->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	317 hkdfl[1] = server_iv->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	318 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	319 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	320 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	321
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	322 if (HKDF_expand(server_iv->data, server_iv->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	323 digest, wsec, wlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	324 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	325 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	326 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	327 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	328 "HKDF_expand(server_iv) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	329 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	330 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	331
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	332
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	333 server_hp->len = EVP_AEAD_key_length(aead);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	334 server_hp->data = ngx_pnalloc(c->pool, server_hp->len);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	335 if (server_hp->data == NULL) {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	336 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	337 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	338
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	339 label = "tls13 quic hp";
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	340 hkdfl_len = 2 + 1 + sizeof(label) - 1 + 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	341 hkdfl[0] = server_hp->len / 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	342 hkdfl[1] = server_hp->len % 256;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	343 hkdfl[2] = sizeof(label) - 1;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	344 p = ngx_cpymem(&hkdfl[3], label, sizeof(label) - 1);
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	345 *p = '\0';
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	346
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	347 if (HKDF_expand(server_hp->data, server_hp->len,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	348 digest, wsec, wlen,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	349 hkdfl, hkdfl_len)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	350 == 0)
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	351 {
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	352 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	353 "HKDF_expand(server_hp) failed");
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	354 return 0;
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	355 }
bd006bd520a9 QUIC set_encryption_secrets callback. Sergey Kandaurov <pluknet@nginx.com> parents: 7633 diff changeset	356
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	357 return 1;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	358 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	359
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	360
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	361 static int
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	362 quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	363 enum ssl_encryption_level_t level, const uint8_t *data, size_t len)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	364 {
7636 53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	365 u_char buf[512], p, cipher, clear, ad;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	366 size_t ad_len, clear_len;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	367 ngx_int_t m;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	368 ngx_str_t server_key, server_iv, *server_hp;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	369 ngx_connection_t *c;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	370 ngx_quic_connection_t *qc;
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	371
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	372 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
7636 53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	373 qc = c->quic;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	374
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	375 switch (level) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	376
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	377 case ssl_encryption_initial:
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	378 server_key = &qc->server_in_key;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	379 server_iv = &qc->server_in_iv;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	380 server_hp = &qc->server_in_hp;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	381 break;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	382
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	383 case ssl_encryption_handshake:
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	384 server_key = &qc->server_hs_key;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	385 server_iv = &qc->server_hs_iv;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	386 server_hp = &qc->server_hs_hp;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	387 break;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	388
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	389 default:
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	390 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	391 }
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	392
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	393 m = ngx_hex_dump(buf, (u_char *) data, ngx_min(len, 256)) - buf;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	394 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	395 "quic_add_handshake_data: %*s%s, len: %uz, level:%d",
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	396 m, buf, len < 512 ? "" : "...", len, (int) level);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	397
7636 53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	398 clear = ngx_alloc(4 + len + 5 /minimal ACK/, c->log);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	399 if (clear == 0) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	400 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	401 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	402
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	403 p = clear;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	404 ngx_quic_build_int(&p, 6); // crypto frame
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	405 ngx_quic_build_int(&p, 0);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	406 ngx_quic_build_int(&p, len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	407 p = ngx_cpymem(p, data, len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	408
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	409 ngx_quic_build_int(&p, 2); // ack frame
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	410 ngx_quic_build_int(&p, 0);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	411 ngx_quic_build_int(&p, 0);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	412 ngx_quic_build_int(&p, 0);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	413 ngx_quic_build_int(&p, 0);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	414
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	415 clear_len = p - clear;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	416 size_t cipher_len = clear_len + 16 /expansion/;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	417
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	418 ad = ngx_alloc(346 /max header/, c->log);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	419 if (ad == 0) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	420 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	421 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	422
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	423 p = ad;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	424 if (level == ssl_encryption_initial) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	425 *p++ = 0xc0; // initial, packet number len
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	426 } else if (level == ssl_encryption_handshake) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	427 *p++ = 0xe0; // handshake, packet number len
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	428 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	429 *p++ = 0xff;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	430 *p++ = 0x00;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	431 *p++ = 0x00;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	432 *p++ = 0x17;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	433 *p++ = qc->scid.len;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	434 p = ngx_cpymem(p, qc->scid.data, qc->scid.len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	435 *p++ = qc->dcid.len;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	436 p = ngx_cpymem(p, qc->dcid.data, qc->dcid.len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	437 ngx_quic_build_int(&p, 0); // token length
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	438 ngx_quic_build_int(&p, cipher_len); // length
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	439 u_char *pnp = p;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	440 *p++ = 0; // packet number 0
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	441
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	442 ad_len = p - ad;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	443
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	444 m = ngx_hex_dump(buf, (u_char *) ad, ad_len) - buf;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	445 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	446 "quic_add_handshake_data ad: %*s, len: %uz",
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	447 m, buf, ad_len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	448
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	449 EVP_AEAD_CTX *aead = EVP_AEAD_CTX_new(EVP_aead_aes_128_gcm(),
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	450 server_key->data,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	451 server_key->len,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	452 EVP_AEAD_DEFAULT_TAG_LENGTH);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	453
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	454 cipher = ngx_alloc(cipher_len, c->log);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	455 if (cipher == 0) {
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	456 return 0;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	457 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	458
7636 53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	459 size_t out_len;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	460
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	461 if (EVP_AEAD_CTX_seal(aead, cipher, &out_len, cipher_len,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	462 server_iv->data, server_iv->len,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	463 clear, clear_len, ad, ad_len)
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	464 != 1)
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	465 {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	466 EVP_AEAD_CTX_free(aead);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	467 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	468 "EVP_AEAD_CTX_seal() failed");
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	469 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	470 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	471
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	472 EVP_AEAD_CTX_free(aead);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	473
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	474 EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	475 u_char *sample = cipher + 3; // pnl=0
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	476 uint8_t mask[16];
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	477 int outlen;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	478
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	479 if (EVP_EncryptInit_ex(ctx, EVP_aes_128_ecb(), NULL, server_hp->data, NULL)
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	480 != 1)
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	481 {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	482 EVP_CIPHER_CTX_free(ctx);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	483 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	484 "EVP_EncryptInit_ex() failed");
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	485 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	486 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	487
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	488 if (!EVP_EncryptUpdate(ctx, mask, &outlen, sample, 16)) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	489 EVP_CIPHER_CTX_free(ctx);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	490 ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	491 "EVP_EncryptUpdate() failed");
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	492 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	493 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	494
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	495 EVP_CIPHER_CTX_free(ctx);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	496
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	497 // header protection, pnl = 0
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	498 ad[0] ^= mask[0] & 0x0f;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	499 *pnp ^= mask[1];
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	500
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	501 printf("cipher_len %ld out_len %ld ad_len %ld\n", cipher_len, out_len, ad_len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	502
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	503 u_char *packet = ngx_alloc(ad_len + out_len, c->log);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	504 if (packet == 0) {
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	505 return 0;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	506 }
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	507
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	508 p = ngx_cpymem(packet, ad, ad_len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	509 p = ngx_cpymem(p, cipher, out_len);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	510
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	511 m = ngx_hex_dump(buf, (u_char *) packet, p - packet) - buf;
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	512 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	513 "quic_add_handshake_data packet: %*s, len: %uz",
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	514 m, buf, p - packet);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	515
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	516 c->send(c, packet, p - packet);
53a5cdbe500c QUIC add_handshake_data callback, varint routines. Sergey Kandaurov <pluknet@nginx.com> parents: 7635 diff changeset	517
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	518 return 1;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	519 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	520
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	521
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	522 static int
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	523 quic_flush_flight(ngx_ssl_conn_t *ssl_conn)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	524 {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	525 printf("quic_flush_flight()\n");
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	526 return 1;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	527 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	528
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	529
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	530 static int
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	531 quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	532 uint8_t alert)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	533 {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	534 printf("quic_send_alert(), lvl=%d, alert=%d\n", level, alert);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	535 return 1;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	536 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	537
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	538
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	539 static SSL_QUIC_METHOD quic_method = {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	540 quic_set_encryption_secrets,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	541 quic_add_handshake_data,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	542 quic_flush_flight,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	543 quic_send_alert,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	544 };
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	545
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	546 #endif
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	547
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	548
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	549 static ngx_command_t ngx_openssl_commands[] = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	550
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	551 { ngx_string("ssl_engine"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	552 NGX_MAIN_CONF\|NGX_DIRECT_CONF\|NGX_CONF_TAKE1,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	553 ngx_openssl_engine,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	554 0,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	555 0,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	556 NULL },
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	557
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	558 ngx_null_command
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	559 };
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	560
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	561
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	562 static ngx_core_module_t ngx_openssl_module_ctx = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	563 ngx_string("openssl"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	564 ngx_openssl_create_conf,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	565 NULL
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	566 };
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	567
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	568
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	569 ngx_module_t ngx_openssl_module = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	570 NGX_MODULE_V1,
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	571 &ngx_openssl_module_ctx, /* module context */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	572 ngx_openssl_commands, /* module directives */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	573 NGX_CORE_MODULE, /* module type */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	574 NULL, /* init master */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	575 NULL, /* init module */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	576 NULL, /* init process */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	577 NULL, /* init thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	578 NULL, /* exit thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	579 NULL, /* exit process */
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	580 ngx_openssl_exit, /* exit master */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	581 NGX_MODULE_V1_PADDING
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	582 };
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	583
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	584
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	585 int ngx_ssl_connection_index;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	586 int ngx_ssl_server_conf_index;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	587 int ngx_ssl_session_cache_index;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	588 int ngx_ssl_session_ticket_keys_index;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	589 int ngx_ssl_certificate_index;
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	590 int ngx_ssl_next_certificate_index;
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	591 int ngx_ssl_certificate_name_index;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	592 int ngx_ssl_stapling_index;
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	593
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	594
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	595 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	596 ngx_ssl_init(ngx_log_t *log)
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	597 {
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	598 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	599
6902 5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	600 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) == 0) {
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	601 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed");
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	602 return NGX_ERROR;
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	603 }
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	604
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	605 /*
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	606 * OPENSSL_init_ssl() may leave errors in the error queue
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	607 * while returning success
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	608 */
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	609
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	610 ERR_clear_error();
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	611
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	612 #else
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	613
968 1b60ecc8cdb7 OPENSSL_config() Igor Sysoev <igor@sysoev.ru> parents: 671 diff changeset	614 OPENSSL_config(NULL);
1b60ecc8cdb7 OPENSSL_config() Igor Sysoev <igor@sysoev.ru> parents: 671 diff changeset	615
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	616 SSL_library_init();
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	617 SSL_load_error_strings();
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	618
3464 7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	619 OpenSSL_add_all_algorithms();
7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	620
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	621 #endif
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	622
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	623 #ifndef SSL_OP_NO_COMPRESSION
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	624 {
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	625 /*
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	626 * Disable gzip compression in OpenSSL prior to 1.0.0 version,
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	627 * this saves about 522K per connection.
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	628 */
4867 90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	629 int n;
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	630 STACK_OF(SSL_COMP) *ssl_comp_methods;
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	631
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	632 ssl_comp_methods = SSL_COMP_get_compression_methods();
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	633 n = sk_SSL_COMP_num(ssl_comp_methods);
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	634
4867 90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	635 while (n--) {
90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	636 (void) sk_SSL_COMP_pop(ssl_comp_methods);
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	637 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	638 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	639 #endif
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	640
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	641 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	642
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	643 if (ngx_ssl_connection_index == -1) {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	644 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	645 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	646 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	647
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	648 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	649 NULL);
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	650 if (ngx_ssl_server_conf_index == -1) {
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	651 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	652 "SSL_CTX_get_ex_new_index() failed");
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	653 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	654 }
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	655
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	656 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	657 NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	658 if (ngx_ssl_session_cache_index == -1) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	659 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	660 "SSL_CTX_get_ex_new_index() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	661 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	662 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	663
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	664 ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	665 NULL, NULL);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	666 if (ngx_ssl_session_ticket_keys_index == -1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	667 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	668 "SSL_CTX_get_ex_new_index() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	669 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	670 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	671
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	672 ngx_ssl_certificate_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	673 NULL);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	674 if (ngx_ssl_certificate_index == -1) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	675 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	676 "SSL_CTX_get_ex_new_index() failed");
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	677 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	678 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	679
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	680 ngx_ssl_next_certificate_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	681 NULL);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	682 if (ngx_ssl_next_certificate_index == -1) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	683 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	684 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	685 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	686
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	687 ngx_ssl_certificate_name_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	688 NULL);
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	689
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	690 if (ngx_ssl_certificate_name_index == -1) {
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	691 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	692 return NGX_ERROR;
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	693 }
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	694
6545 a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	695 ngx_ssl_stapling_index = X509_get_ex_new_index(0, NULL, NULL, NULL, NULL);
a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	696
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	697 if (ngx_ssl_stapling_index == -1) {
6545 a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	698 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	699 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	700 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	701
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	702 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	703 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	704
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	705
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	706 ngx_int_t
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	707 ngx_ssl_create(ngx_ssl_t ssl, ngx_uint_t protocols, void data)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	708 {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	709 ssl->ctx = SSL_CTX_new(SSLv23_method());
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	710
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	711 if (ssl->ctx == NULL) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	712 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	713 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	714 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	715
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	716 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	717 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	718 "SSL_CTX_set_ex_data() failed");
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	719 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	720 }
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	721
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	722 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, NULL) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	723 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	724 "SSL_CTX_set_ex_data() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	725 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	726 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	727
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	728 ssl->buffer_size = NGX_SSL_BUFSIZE;
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	729
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	730 /* client side options */
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	731
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	732 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	733 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	734 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	735
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	736 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	737 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	738 #endif
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	739
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	740 /* server side options */
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	741
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	742 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	743 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	744 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	745
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	746 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	747 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	748 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	749
5378 a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING. Piotr Sikora <piotr@cloudflare.com> parents: 5365 diff changeset	750 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	751 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	752 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
5378 a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING. Piotr Sikora <piotr@cloudflare.com> parents: 5365 diff changeset	753 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	754
5778 45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	755 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	756 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
5778 45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	757 #endif
45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	758
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	759 #ifdef SSL_OP_TLS_D5_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	760 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	761 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	762
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	763 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	764 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	765 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	766
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	767 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	768 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	769 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	770
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	771 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	772
7318 3443fe40bdc7 SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+. Maxim Dounin <mdounin@mdounin.ru> parents: 7317 diff changeset	773 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	774 /* only in 0.9.8m+ */
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	775 SSL_CTX_clear_options(ssl->ctx,
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	776 SSL_OP_NO_SSLv2\|SSL_OP_NO_SSLv3\|SSL_OP_NO_TLSv1);
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	777 #endif
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	778
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	779 if (!(protocols & NGX_SSL_SSLv2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	780 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	781 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	782 if (!(protocols & NGX_SSL_SSLv3)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	783 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	784 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	785 if (!(protocols & NGX_SSL_TLSv1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	786 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	787 }
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	788 #ifdef SSL_OP_NO_TLSv1_1
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	789 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	790 if (!(protocols & NGX_SSL_TLSv1_1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	791 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	792 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	793 #endif
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	794 #ifdef SSL_OP_NO_TLSv1_2
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	795 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	796 if (!(protocols & NGX_SSL_TLSv1_2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	797 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	798 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	799 #endif
6981 08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	800 #ifdef SSL_OP_NO_TLSv1_3
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	801 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	802 if (!(protocols & NGX_SSL_TLSv1_3)) {
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	803 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	804 }
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	805 #endif
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	806
7372 ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	807 #ifdef SSL_CTX_set_min_proto_version
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	808 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	809 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	810 #endif
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	811
7332 7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	812 #ifdef TLS1_3_VERSION
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	813 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	814 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	815 #endif
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	816
4185 6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	817 #ifdef SSL_OP_NO_COMPRESSION
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	818 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	819 #endif
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	820
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	821 #ifdef SSL_OP_NO_ANTI_REPLAY
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	822 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_ANTI_REPLAY);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	823 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	824
7474 3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option. Maxim Dounin <mdounin@mdounin.ru> parents: 7472 diff changeset	825 #ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option. Maxim Dounin <mdounin@mdounin.ru> parents: 7472 diff changeset	826 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_CLIENT_RENEGOTIATION);
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option. Maxim Dounin <mdounin@mdounin.ru> parents: 7472 diff changeset	827 #endif
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option. Maxim Dounin <mdounin@mdounin.ru> parents: 7472 diff changeset	828
4186 cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	829 #ifdef SSL_MODE_RELEASE_BUFFERS
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	830 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_RELEASE_BUFFERS);
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	831 #endif
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	832
6036 4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	833 #ifdef SSL_MODE_NO_AUTO_CHAIN
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	834 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_NO_AUTO_CHAIN);
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	835 #endif
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	836
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	837 SSL_CTX_set_read_ahead(ssl->ctx, 1);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	838
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	839 SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	840
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	841 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	842 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	843
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	844
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	845 ngx_int_t
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	846 ngx_ssl_certificates(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *certs,
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	847 ngx_array_t keys, ngx_array_t passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	848 {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	849 ngx_str_t cert, key;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	850 ngx_uint_t i;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	851
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	852 cert = certs->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	853 key = keys->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	854
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	855 for (i = 0; i < certs->nelts; i++) {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	856
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	857 if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	858 != NGX_OK)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	859 {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	860 return NGX_ERROR;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	861 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	862 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	863
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	864 return NGX_OK;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	865 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	866
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	867
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	868 ngx_int_t
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	869 ngx_ssl_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	870 ngx_str_t key, ngx_array_t passwords)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	871 {
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	872 char *err;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	873 X509 *x509;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	874 EVP_PKEY *pkey;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	875 STACK_OF(X509) *chain;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	876
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	877 x509 = ngx_ssl_load_certificate(cf->pool, &err, cert, &chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	878 if (x509 == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	879 if (err != NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	880 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	881 "cannot load certificate \"%s\": %s",
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	882 cert->data, err);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	883 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	884
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	885 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	886 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	887
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	888 if (SSL_CTX_use_certificate(ssl->ctx, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	889 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	890 "SSL_CTX_use_certificate(\"%s\") failed", cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	891 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	892 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	893 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	894 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	895
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	896 if (X509_set_ex_data(x509, ngx_ssl_certificate_name_index, cert->data)
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	897 == 0)
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	898 {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	899 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	900 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	901 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	902 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	903 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	904
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	905 if (X509_set_ex_data(x509, ngx_ssl_next_certificate_index,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	906 SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index))
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	907 == 0)
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	908 {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	909 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	910 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	911 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	912 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	913 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	914
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	915 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	916 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	917 "SSL_CTX_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	918 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	919 sk_X509_pop_free(chain, X509_free);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	920 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	921 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	922
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	923 /*
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	924 * Note that x509 is not freed here, but will be instead freed in
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	925 * ngx_ssl_cleanup_ctx(). This is because we need to preserve all
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	926 * certificates to be able to iterate all of them through exdata
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	927 * (ngx_ssl_certificate_index, ngx_ssl_next_certificate_index),
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	928 * while OpenSSL can free a certificate if it is replaced with another
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	929 * certificate of the same type.
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	930 */
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	931
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	932 #ifdef SSL_CTX_set0_chain
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	933
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	934 if (SSL_CTX_set0_chain(ssl->ctx, chain) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	935 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	936 "SSL_CTX_set0_chain(\"%s\") failed", cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	937 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	938 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	939 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	940
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	941 #else
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	942 {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	943 int n;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	944
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	945 /* SSL_CTX_set0_chain() is only available in OpenSSL 1.0.2+ */
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	946
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	947 n = sk_X509_num(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	948
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	949 while (n--) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	950 x509 = sk_X509_shift(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	951
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	952 if (SSL_CTX_add_extra_chain_cert(ssl->ctx, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	953 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	954 "SSL_CTX_add_extra_chain_cert(\"%s\") failed",
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	955 cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	956 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	957 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	958 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	959 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	960
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	961 sk_X509_free(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	962 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	963 #endif
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	964
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	965 pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	966 if (pkey == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	967 if (err != NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	968 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	969 "cannot load certificate key \"%s\": %s",
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	970 key->data, err);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	971 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	972
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	973 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	974 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	975
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	976 if (SSL_CTX_use_PrivateKey(ssl->ctx, pkey) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	977 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	978 "SSL_CTX_use_PrivateKey(\"%s\") failed", key->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	979 EVP_PKEY_free(pkey);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	980 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	981 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	982
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	983 EVP_PKEY_free(pkey);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	984
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	985 return NGX_OK;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	986 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	987
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	988
7461 a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	989 ngx_int_t
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	990 ngx_ssl_connection_certificate(ngx_connection_t c, ngx_pool_t pool,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	991 ngx_str_t cert, ngx_str_t key, ngx_array_t *passwords)
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	992 {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	993 char *err;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	994 X509 *x509;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	995 EVP_PKEY *pkey;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	996 STACK_OF(X509) *chain;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	997
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	998 x509 = ngx_ssl_load_certificate(pool, &err, cert, &chain);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	999 if (x509 == NULL) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1000 if (err != NULL) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1001 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1002 "cannot load certificate \"%s\": %s",
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1003 cert->data, err);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1004 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1005
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1006 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1007 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1008
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1009 if (SSL_use_certificate(c->ssl->connection, x509) == 0) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1010 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1011 "SSL_use_certificate(\"%s\") failed", cert->data);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1012 X509_free(x509);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1013 sk_X509_pop_free(chain, X509_free);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1014 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1015 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1016
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1017 X509_free(x509);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1018
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1019 #ifdef SSL_set0_chain
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1020
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1021 /*
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1022 * SSL_set0_chain() is only available in OpenSSL 1.0.2+,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1023 * but this function is only called via certificate callback,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1024 * which is only available in OpenSSL 1.0.2+ as well
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1025 */
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1026
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1027 if (SSL_set0_chain(c->ssl->connection, chain) == 0) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1028 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1029 "SSL_set0_chain(\"%s\") failed", cert->data);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1030 sk_X509_pop_free(chain, X509_free);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1031 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1032 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1033
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1034 #endif
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1035
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1036 pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1037 if (pkey == NULL) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1038 if (err != NULL) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1039 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1040 "cannot load certificate key \"%s\": %s",
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1041 key->data, err);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1042 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1043
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1044 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1045 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1046
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1047 if (SSL_use_PrivateKey(c->ssl->connection, pkey) == 0) {
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1048 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1049 "SSL_use_PrivateKey(\"%s\") failed", key->data);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1050 EVP_PKEY_free(pkey);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1051 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1052 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1053
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1054 EVP_PKEY_free(pkey);
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1055
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1056 return NGX_OK;
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1057 }
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1058
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	1059
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1060 static X509 *
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1061 ngx_ssl_load_certificate(ngx_pool_t pool, char err, ngx_str_t cert,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1062 STACK_OF(X509) **chain)
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1063 {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1064 BIO *bio;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1065 X509 x509, temp;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1066 u_long n;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1067
7477 c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1068 if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1069
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1070 bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1071 cert->len - (sizeof("data:") - 1));
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1072 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1073 *err = "BIO_new_mem_buf() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1074 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1075 }
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1076
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1077 } else {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1078
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1079 if (ngx_get_full_name(pool, (ngx_str_t *) &ngx_cycle->conf_prefix, cert)
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1080 != NGX_OK)
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1081 {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1082 *err = NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1083 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1084 }
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1085
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1086 bio = BIO_new_file((char *) cert->data, "r");
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1087 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1088 *err = "BIO_new_file() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1089 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1090 }
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1091 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1092
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1093 /* certificate itself */
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1094
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1095 x509 = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1096 if (x509 == NULL) {
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1097 *err = "PEM_read_bio_X509_AUX() failed";
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	1098 BIO_free(bio);
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1099 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1100 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1101
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1102 /* rest of the chain */
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1103
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1104 *chain = sk_X509_new_null();
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1105 if (*chain == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1106 *err = "sk_X509_new_null() failed";
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	1107 BIO_free(bio);
5384 cfbf1d1cc233 SSL: fixed possible memory and file descriptor leak on HUP signal. Piotr Sikora <piotr@cloudflare.com> parents: 5378 diff changeset	1108 X509_free(x509);
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1109 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1110 }
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1111
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1112 for ( ;; ) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1113
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1114 temp = PEM_read_bio_X509(bio, NULL, NULL, NULL);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1115 if (temp == NULL) {
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1116 n = ERR_peek_last_error();
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1117
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1118 if (ERR_GET_LIB(n) == ERR_LIB_PEM
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1119 && ERR_GET_REASON(n) == PEM_R_NO_START_LINE)
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1120 {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1121 /* end of file */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1122 ERR_clear_error();
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1123 break;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1124 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1125
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1126 /* some real error */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1127
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1128 *err = "PEM_read_bio_X509() failed";
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1129 BIO_free(bio);
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1130 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1131 sk_X509_pop_free(*chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1132 return NULL;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1133 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1134
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1135 if (sk_X509_push(*chain, temp) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1136 *err = "sk_X509_push() failed";
6549 d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	1137 BIO_free(bio);
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1138 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1139 sk_X509_pop_free(*chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1140 return NULL;
6549 d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	1141 }
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1142 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1143
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1144 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	1145
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1146 return x509;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1147 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1148
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1149
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1150 static EVP_PKEY *
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1151 ngx_ssl_load_certificate_key(ngx_pool_t pool, char *err,
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1152 ngx_str_t key, ngx_array_t passwords)
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1153 {
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1154 BIO *bio;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1155 EVP_PKEY *pkey;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1156 ngx_str_t *pwd;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1157 ngx_uint_t tries;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1158 pem_password_cb *cb;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1159
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1160 if (ngx_strncmp(key->data, "engine:", sizeof("engine:") - 1) == 0) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1161
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1162 #ifndef OPENSSL_NO_ENGINE
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1163
7476 b6dc8a12c07a SSL: removed redundant "pkey" variable. Maxim Dounin <mdounin@mdounin.ru> parents: 7474 diff changeset	1164 u_char p, last;
b6dc8a12c07a SSL: removed redundant "pkey" variable. Maxim Dounin <mdounin@mdounin.ru> parents: 7474 diff changeset	1165 ENGINE *engine;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1166
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1167 p = key->data + sizeof("engine:") - 1;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1168 last = (u_char *) ngx_strchr(p, ':');
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1169
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1170 if (last == NULL) {
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1171 *err = "invalid syntax";
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1172 return NULL;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1173 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1174
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1175 *last = '\0';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1176
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1177 engine = ENGINE_by_id((char *) p);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1178
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1179 if (engine == NULL) {
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1180 *err = "ENGINE_by_id() failed";
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1181 return NULL;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1182 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1183
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1184 *last++ = ':';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1185
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1186 pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1187
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1188 if (pkey == NULL) {
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1189 *err = "ENGINE_load_private_key() failed";
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1190 ENGINE_free(engine);
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1191 return NULL;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1192 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1193
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1194 ENGINE_free(engine);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1195
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1196 return pkey;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1197
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1198 #else
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1199
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1200 *err = "loading \"engine:...\" certificate keys is not supported";
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1201 return NULL;
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1202
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1203 #endif
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1204 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	1205
7477 c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1206 if (ngx_strncmp(key->data, "data:", sizeof("data:") - 1) == 0) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1207
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1208 bio = BIO_new_mem_buf(key->data + sizeof("data:") - 1,
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1209 key->len - (sizeof("data:") - 1));
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1210 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1211 *err = "BIO_new_mem_buf() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1212 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1213 }
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1214
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1215 } else {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1216
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1217 if (ngx_get_full_name(pool, (ngx_str_t *) &ngx_cycle->conf_prefix, key)
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1218 != NGX_OK)
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1219 {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1220 *err = NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1221 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1222 }
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1223
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1224 bio = BIO_new_file((char *) key->data, "r");
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1225 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1226 *err = "BIO_new_file() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1227 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory. Maxim Dounin <mdounin@mdounin.ru> parents: 7476 diff changeset	1228 }
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	1229 }
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	1230
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1231 if (passwords) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1232 tries = passwords->nelts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1233 pwd = passwords->elts;
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1234 cb = ngx_ssl_password_callback;
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1235
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1236 } else {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1237 tries = 1;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1238 pwd = NULL;
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1239 cb = NULL;
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1240 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1241
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1242 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1243
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1244 pkey = PEM_read_bio_PrivateKey(bio, NULL, cb, pwd);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1245 if (pkey != NULL) {
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1246 break;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1247 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1248
7463 180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1249 if (tries-- > 1) {
5892 42520df85ebb SSL: simplified ssl_password_file error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 5882 diff changeset	1250 ERR_clear_error();
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1251 (void) BIO_reset(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1252 pwd++;
5892 42520df85ebb SSL: simplified ssl_password_file error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 5882 diff changeset	1253 continue;
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1254 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1255
7460 77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1256 *err = "PEM_read_bio_PrivateKey() failed";
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1257 BIO_free(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1258 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1259 }
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1260
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1261 BIO_free(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1262
77436d9951a1 SSL: reworked ngx_ssl_certificate(). Maxim Dounin <mdounin@mdounin.ru> parents: 7459 diff changeset	1263 return pkey;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1264 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1265
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1266
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1267 static int
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1268 ngx_ssl_password_callback(char buf, int size, int rwflag, void userdata)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1269 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1270 ngx_str_t *pwd = userdata;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1271
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1272 if (rwflag) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1273 ngx_log_error(NGX_LOG_ALERT, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1274 "ngx_ssl_password_callback() is called for encryption");
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1275 return 0;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1276 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1277
7463 180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1278 if (pwd == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1279 return 0;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1280 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1281
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1282 if (pwd->len > (size_t) size) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1283 ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1284 "password is truncated to %d bytes", size);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1285 } else {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1286 size = pwd->len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1287 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1288
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1289 ngx_memcpy(buf, pwd->data, size);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1290
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1291 return size;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1292 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1293
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1294
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1295 ngx_int_t
6591 04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1296 ngx_ssl_ciphers(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *ciphers,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1297 ngx_uint_t prefer_server_ciphers)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1298 {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1299 if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1300 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1301 "SSL_CTX_set_cipher_list(\"%V\") failed",
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1302 ciphers);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1303 return NGX_ERROR;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1304 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1305
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1306 if (prefer_server_ciphers) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1307 SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1308 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1309
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1310 #if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1311 /* a temporary 512-bit RSA key is required for export versions of MSIE */
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1312 SSL_CTX_set_tmp_rsa_callback(ssl->ctx, ngx_ssl_rsa512_key_callback);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1313 #endif
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1314
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1315 return NGX_OK;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1316 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1317
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1318
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	1319 ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1320 ngx_ssl_client_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1321 ngx_int_t depth)
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1322 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1323 STACK_OF(X509_NAME) *list;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1324
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	1325 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1326
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1327 SSL_CTX_set_verify_depth(ssl->ctx, depth);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1328
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1329 if (cert->len == 0) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1330 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1331 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1332
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	1333 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1334 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1335 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1336
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1337 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1338 == 0)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1339 {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1340 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1341 "SSL_CTX_load_verify_locations(\"%s\") failed",
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1342 cert->data);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1343 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1344 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1345
5365 6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1346 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1347 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1348 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1349 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1350
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1351 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1352
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1353 list = SSL_load_client_CA_file((char *) cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1354
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1355 if (list == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1356 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1357 "SSL_load_client_CA_file(\"%s\") failed", cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1358 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1359 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1360
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1361 SSL_CTX_set_client_CA_list(ssl->ctx, list);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1362
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1363 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1364 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1365
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	1366
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1367 ngx_int_t
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1368 ngx_ssl_trusted_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1369 ngx_int_t depth)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1370 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1371 SSL_CTX_set_verify_depth(ssl->ctx, depth);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1372
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1373 if (cert->len == 0) {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1374 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1375 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1376
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	1377 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1378 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1379 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1380
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1381 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1382 == 0)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1383 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1384 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1385 "SSL_CTX_load_verify_locations(\"%s\") failed",
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1386 cert->data);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1387 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1388 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1389
5365 6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1390 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1391 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1392 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1393 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1394
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1395 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	1396
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1397 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1398 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1399
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1400
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	1401 ngx_int_t
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1402 ngx_ssl_crl(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *crl)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1403 {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1404 X509_STORE *store;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1405 X509_LOOKUP *lookup;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1406
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1407 if (crl->len == 0) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1408 return NGX_OK;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1409 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1410
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	1411 if (ngx_conf_full_name(cf->cycle, crl, 1) != NGX_OK) {
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1412 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1413 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1414
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1415 store = SSL_CTX_get_cert_store(ssl->ctx);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1416
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1417 if (store == NULL) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1418 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1419 "SSL_CTX_get_cert_store() failed");
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1420 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1421 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1422
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1423 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1424
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1425 if (lookup == NULL) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1426 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1427 "X509_STORE_add_lookup() failed");
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1428 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1429 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1430
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1431 if (X509_LOOKUP_load_file(lookup, (char *) crl->data, X509_FILETYPE_PEM)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1432 == 0)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1433 {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1434 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1435 "X509_LOOKUP_load_file(\"%s\") failed", crl->data);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1436 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1437 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1438
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1439 X509_STORE_set_flags(store,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1440 X509_V_FLAG_CRL_CHECK\|X509_V_FLAG_CRL_CHECK_ALL);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1441
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1442 return NGX_OK;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1443 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1444
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	1445
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1446 static int
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	1447 ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1448 {
1977 40c9cb8576bb get certificate info only for debug build Igor Sysoev <igor@sysoev.ru> parents: 1976 diff changeset	1449 #if (NGX_DEBUG)
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1450 char subject, issuer;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1451 int err, depth;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1452 X509 *cert;
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1453 X509_NAME sname, iname;
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1454 ngx_connection_t *c;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1455 ngx_ssl_conn_t *ssl_conn;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1456
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1457 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1458 SSL_get_ex_data_X509_STORE_CTX_idx());
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1459
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1460 c = ngx_ssl_get_connection(ssl_conn);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1461
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1462 cert = X509_STORE_CTX_get_current_cert(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1463 err = X509_STORE_CTX_get_error(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1464 depth = X509_STORE_CTX_get_error_depth(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1465
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1466 sname = X509_get_subject_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1467 subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1468
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1469 iname = X509_get_issuer_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1470 issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1471
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	1472 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1473 "verify:%d, error:%d, depth:%d, "
5775 294d020bbcfe SSL: misplaced space in debug message. Maxim Dounin <mdounin@mdounin.ru> parents: 5767 diff changeset	1474 "subject:\"%s\", issuer:\"%s\"",
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1475 ok, err, depth, subject, issuer);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1476
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1477 if (sname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1478 OPENSSL_free(subject);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1479 }
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1480
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1481 if (iname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1482 OPENSSL_free(issuer);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1483 }
1977 40c9cb8576bb get certificate info only for debug build Igor Sysoev <igor@sysoev.ru> parents: 1976 diff changeset	1484 #endif
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	1485
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1486 return 1;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1487 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1488
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1489
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1490 static void
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1491 ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1492 {
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1493 BIO rbio, wbio;
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1494 ngx_connection_t *c;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1495
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1496 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1497
6982 ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	1498 if ((where & SSL_CB_HANDSHAKE_START)
ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	1499 && SSL_is_server((ngx_ssl_conn_t *) ssl_conn))
ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	1500 {
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1501 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1502
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1503 if (c->ssl->handshaked) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1504 c->ssl->renegotiation = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1505 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL renegotiation");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1506 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1507 }
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1508
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1509 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1510
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1511 if ((where & SSL_CB_ACCEPT_LOOP) == SSL_CB_ACCEPT_LOOP) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1512 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1513
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1514 if (!c->ssl->handshake_buffer_set) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1515 /*
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1516 * By default OpenSSL uses 4k buffer during a handshake,
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1517 * which is too low for long certificate chains and might
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1518 * result in extra round-trips.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1519 *
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1520 * To adjust a buffer size we detect that buffering was added
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1521 * to write side of the connection by comparing rbio and wbio.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1522 * If they are different, we assume that it's due to buffering
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1523 * added to wbio, and set buffer size.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1524 */
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1525
7509 b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility. Sergey Kandaurov <pluknet@nginx.com> parents: 7484 diff changeset	1526 rbio = SSL_get_rbio(ssl_conn);
b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility. Sergey Kandaurov <pluknet@nginx.com> parents: 7484 diff changeset	1527 wbio = SSL_get_wbio(ssl_conn);
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1528
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1529 if (rbio != wbio) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1530 (void) BIO_set_write_buffer_size(wbio, NGX_SSL_BUFSIZE);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1531 c->ssl->handshake_buffer_set = 1;
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1532 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1533 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	1534 }
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1535 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1536
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1537
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	1538 RSA *
5223 71d85de7b53b Style: replace SSL ssl with ngx_ssl_conn_t ssl_conn. Piotr Sikora <piotr@cloudflare.com> parents: 5222 diff changeset	1539 ngx_ssl_rsa512_key_callback(ngx_ssl_conn_t *ssl_conn, int is_export,
71d85de7b53b Style: replace SSL ssl with ngx_ssl_conn_t ssl_conn. Piotr Sikora <piotr@cloudflare.com> parents: 5222 diff changeset	1540 int key_length)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1541 {
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	1542 static RSA *key;
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	1543
5754 c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1544 if (key_length != 512) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1545 return NULL;
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1546 }
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1547
6489 c256dfdd469d SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6488 diff changeset	1548 #if (OPENSSL_VERSION_NUMBER < 0x10100003L && !defined OPENSSL_NO_DEPRECATED)
5755 8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	1549
5754 c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1550 if (key == NULL) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	1551 key = RSA_generate_key(512, RSA_F4, NULL, NULL);
559 c1f965ef9718 nginx-0.3.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 549 diff changeset	1552 }
c1f965ef9718 nginx-0.3.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 549 diff changeset	1553
5755 8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	1554 #endif
8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	1555
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	1556 return key;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1557 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1558
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1559
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1560 ngx_array_t *
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1561 ngx_ssl_read_password_file(ngx_conf_t cf, ngx_str_t file)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1562 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1563 u_char p, last, *end;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1564 size_t len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1565 ssize_t n;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1566 ngx_fd_t fd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1567 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1568 ngx_array_t *passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1569 ngx_pool_cleanup_t *cln;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1570 u_char buf[NGX_SSL_PASSWORD_BUFFER_SIZE];
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1571
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1572 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1573 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1574 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1575
7454 e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1576 passwords = ngx_array_create(cf->temp_pool, 4, sizeof(ngx_str_t));
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1577 if (passwords == NULL) {
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1578 return NULL;
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1579 }
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1580
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1581 cln = ngx_pool_cleanup_add(cf->temp_pool, 0);
7454 e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	1582 if (cln == NULL) {
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1583 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1584 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1585
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1586 cln->handler = ngx_ssl_passwords_cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1587 cln->data = passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1588
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1589 fd = ngx_open_file(file->data, NGX_FILE_RDONLY, NGX_FILE_OPEN, 0);
7086 577628e6b6a6 Style. Sergey Kandaurov <pluknet@nginx.com> parents: 7074 diff changeset	1590
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1591 if (fd == NGX_INVALID_FILE) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1592 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1593 ngx_open_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1594 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1595 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1596
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1597 len = 0;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1598 last = buf;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1599
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1600 do {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1601 n = ngx_read_fd(fd, last, NGX_SSL_PASSWORD_BUFFER_SIZE - len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1602
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1603 if (n == -1) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1604 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1605 ngx_read_fd_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1606 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1607 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1608 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1609
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1610 end = last + n;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1611
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1612 if (len && n == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1613 *end++ = LF;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1614 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1615
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1616 p = buf;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1617
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1618 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1619 last = ngx_strlchr(last, end, LF);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1620
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1621 if (last == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1622 break;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1623 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1624
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1625 len = last++ - p;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1626
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1627 if (len && p[len - 1] == CR) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1628 len--;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1629 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1630
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1631 if (len) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1632 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1633 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1634 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1635 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1636 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1637
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1638 pwd->len = len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1639 pwd->data = ngx_pnalloc(cf->temp_pool, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1640
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1641 if (pwd->data == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1642 passwords->nelts--;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1643 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1644 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1645 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1646
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1647 ngx_memcpy(pwd->data, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1648 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1649
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1650 p = last;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1651 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1652
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1653 len = end - p;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1654
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1655 if (len == NGX_SSL_PASSWORD_BUFFER_SIZE) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1656 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1657 "too long line in \"%s\"", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1658 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1659 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1660 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1661
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1662 ngx_memmove(buf, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1663 last = buf + len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1664
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1665 } while (n != 0);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1666
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1667 if (passwords->nelts == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1668 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1669 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1670 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1671 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1672 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1673
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1674 ngx_memzero(pwd, sizeof(ngx_str_t));
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1675 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1676
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1677 cleanup:
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1678
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1679 if (ngx_close_file(fd) == NGX_FILE_ERROR) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1680 ngx_conf_log_error(NGX_LOG_ALERT, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1681 ngx_close_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1682 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1683
7395 9ca82f273967 Core: ngx_explicit_memzero(). Maxim Dounin <mdounin@mdounin.ru> parents: 7372 diff changeset	1684 ngx_explicit_memzero(buf, NGX_SSL_PASSWORD_BUFFER_SIZE);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1685
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1686 return passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1687 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1688
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1689
7463 180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1690 ngx_array_t *
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1691 ngx_ssl_preserve_passwords(ngx_conf_t cf, ngx_array_t passwords)
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1692 {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1693 ngx_str_t opwd, pwd;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1694 ngx_uint_t i;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1695 ngx_array_t *pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1696 ngx_pool_cleanup_t *cln;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1697 static ngx_array_t empty_passwords;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1698
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1699 if (passwords == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1700
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1701 /*
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1702 * If there are no passwords, an empty array is used
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1703 * to make sure OpenSSL's default password callback
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1704 * won't block on reading from stdin.
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1705 */
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1706
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1707 return &empty_passwords;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1708 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1709
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1710 /*
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1711 * Passwords are normally allocated from the temporary pool
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1712 * and cleared after parsing configuration. To be used at
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1713 * runtime they have to be copied to the configuration pool.
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1714 */
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1715
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1716 pwds = ngx_array_create(cf->pool, passwords->nelts, sizeof(ngx_str_t));
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1717 if (pwds == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1718 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1719 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1720
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1721 cln = ngx_pool_cleanup_add(cf->pool, 0);
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1722 if (cln == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1723 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1724 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1725
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1726 cln->handler = ngx_ssl_passwords_cleanup;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1727 cln->data = pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1728
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1729 opwd = passwords->elts;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1730
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1731 for (i = 0; i < passwords->nelts; i++) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1732
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1733 pwd = ngx_array_push(pwds);
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1734 if (pwd == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1735 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1736 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1737
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1738 pwd->len = opwd[i].len;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1739 pwd->data = ngx_pnalloc(cf->pool, pwd->len);
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1740
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1741 if (pwd->data == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1742 pwds->nelts--;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1743 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1744 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1745
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1746 ngx_memcpy(pwd->data, opwd[i].data, opwd[i].len);
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1747 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1748
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1749 return pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1750 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1751
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7461 diff changeset	1752
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1753 static void
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1754 ngx_ssl_passwords_cleanup(void *data)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1755 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1756 ngx_array_t *passwords = data;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1757
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1758 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1759 ngx_uint_t i;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1760
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1761 pwd = passwords->elts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1762
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1763 for (i = 0; i < passwords->nelts; i++) {
7395 9ca82f273967 Core: ngx_explicit_memzero(). Maxim Dounin <mdounin@mdounin.ru> parents: 7372 diff changeset	1764 ngx_explicit_memzero(pwd[i].data, pwd[i].len);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1765 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1766 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1767
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1768
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1769 ngx_int_t
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1770 ngx_ssl_dhparam(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *file)
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1771 {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1772 DH *dh;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1773 BIO *bio;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1774
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1775 if (file->len == 0) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1776 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1777 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1778
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	1779 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1780 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1781 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1782
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1783 bio = BIO_new_file((char *) file->data, "r");
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1784 if (bio == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1785 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1786 "BIO_new_file(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1787 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1788 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1789
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1790 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1791 if (dh == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1792 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1793 "PEM_read_bio_DHparams(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1794 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1795 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1796 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1797
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1798 SSL_CTX_set_tmp_dh(ssl->ctx, dh);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1799
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1800 DH_free(dh);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1801 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1802
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1803 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1804 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1805
4522 14411ee4d89f Whitespace fixes. Maxim Dounin <mdounin@mdounin.ru> parents: 4499 diff changeset	1806
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1807 ngx_int_t
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1808 ngx_ssl_ecdh_curve(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *name)
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1809 {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1810 #ifndef OPENSSL_NO_ECDH
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1811
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1812 /*
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1813 * Elliptic-Curve Diffie-Hellman parameters are either "named curves"
4572 67653855682e Fixed spelling in multiline C comments. Ruslan Ermilov <ru@nginx.com> parents: 4522 diff changeset	1814 * from RFC 4492 section 5.1.1, or explicitly described curves over
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	1815 * binary fields. OpenSSL only supports the "named curves", which provide
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1816 * maximum interoperability.
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1817 */
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1818
6983 3518287d995e SSL: compatibility with OpenSSL master branch. Sergey Kandaurov <pluknet@nginx.com> parents: 6982 diff changeset	1819 #if (defined SSL_CTX_set1_curves_list \|\| defined SSL_CTRL_SET_CURVES_LIST)
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1820
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1821 /*
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1822 * OpenSSL 1.0.2+ allows configuring a curve list instead of a single
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1823 * curve previously supported. By default an internal list is used,
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1824 * with prime256v1 being preferred by server in OpenSSL 1.0.2b+
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1825 * and X25519 in OpenSSL 1.1.0+.
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1826 *
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1827 * By default a curve preferred by the client will be used for
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1828 * key exchange. The SSL_OP_CIPHER_SERVER_PREFERENCE option can
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1829 * be used to prefer server curves instead, similar to what it
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1830 * does for ciphers.
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1831 */
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1832
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1833 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1834
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1835 #if SSL_CTRL_SET_ECDH_AUTO
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1836 /* not needed in OpenSSL 1.1.0+ */
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1837 SSL_CTX_set_ecdh_auto(ssl->ctx, 1);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1838 #endif
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1839
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1840 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1841 return NGX_OK;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1842 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1843
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1844 if (SSL_CTX_set1_curves_list(ssl->ctx, (char *) name->data) == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1845 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1846 "SSL_CTX_set1_curves_list(\"%s\") failed", name->data);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1847 return NGX_ERROR;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1848 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1849
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1850 #else
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1851
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1852 int nid;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1853 char *curve;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1854 EC_KEY *ecdh;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1855
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1856 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1857 curve = "prime256v1";
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1858
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1859 } else {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1860 curve = (char *) name->data;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1861 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1862
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1863 nid = OBJ_sn2nid(curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1864 if (nid == 0) {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1865 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1866 "OBJ_sn2nid(\"%s\") failed: unknown curve", curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1867 return NGX_ERROR;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1868 }
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1869
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1870 ecdh = EC_KEY_new_by_curve_name(nid);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1871 if (ecdh == NULL) {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1872 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1873 "EC_KEY_new_by_curve_name(\"%s\") failed", curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1874 return NGX_ERROR;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1875 }
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1876
5003 82234f3f5ca2 SSL: speedup loading of configs with many ssl servers. Maxim Dounin <mdounin@mdounin.ru> parents: 4877 diff changeset	1877 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
82234f3f5ca2 SSL: speedup loading of configs with many ssl servers. Maxim Dounin <mdounin@mdounin.ru> parents: 4877 diff changeset	1878
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1879 SSL_CTX_set_tmp_ecdh(ssl->ctx, ecdh);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1880
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1881 EC_KEY_free(ecdh);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1882 #endif
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1883 #endif
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1884
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1885 return NGX_OK;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1886 }
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1887
4522 14411ee4d89f Whitespace fixes. Maxim Dounin <mdounin@mdounin.ru> parents: 4499 diff changeset	1888
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1889 ngx_int_t
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1890 ngx_ssl_early_data(ngx_conf_t cf, ngx_ssl_t ssl, ngx_uint_t enable)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1891 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1892 if (!enable) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1893 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1894 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1895
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1896 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1897
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1898 /* BoringSSL */
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1899
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1900 SSL_CTX_set_early_data_enabled(ssl->ctx, 1);
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1901
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1902 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1903
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1904 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1905
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1906 SSL_CTX_set_max_early_data(ssl->ctx, NGX_SSL_BUFSIZE);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1907
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1908 #else
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1909 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1910 "\"ssl_early_data\" is not supported on this platform, "
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1911 "ignored");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1912 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1913
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1914 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1915 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1916
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1917
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1918 ngx_int_t
7633 5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1919 ngx_ssl_quic(ngx_conf_t cf, ngx_ssl_t ssl, ngx_uint_t enable)
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1920 {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1921 if (!enable) {
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1922 return NGX_OK;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1923 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1924
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1925 #if NGX_OPENSSL_QUIC
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1926
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1927 SSL_CTX_set_quic_method(ssl->ctx, &quic_method);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1928 printf("%s\n", __func__);
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1929 return NGX_OK;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1930
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1931 #else
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1932
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1933 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1934 "\"ssl_quic\" is not supported on this platform");
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1935 return NGX_ERROR;
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1936
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1937 #endif
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1938 }
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1939
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1940
5d91389e0fd3 Initial QUIC support in http. Sergey Kandaurov <pluknet@nginx.com> parents: 7617 diff changeset	1941 ngx_int_t
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1942 ngx_ssl_client_session_cache(ngx_conf_t cf, ngx_ssl_t ssl, ngx_uint_t enable)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1943 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1944 if (!enable) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1945 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1946 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1947
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1948 SSL_CTX_set_session_cache_mode(ssl->ctx,
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1949 SSL_SESS_CACHE_CLIENT
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1950 \|SSL_SESS_CACHE_NO_INTERNAL);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1951
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1952 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_client_session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1953
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1954 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1955 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1956
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1957
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1958 static int
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1959 ngx_ssl_new_client_session(ngx_ssl_conn_t ssl_conn, ngx_ssl_session_t sess)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1960 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1961 ngx_connection_t *c;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1962
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1963 c = ngx_ssl_get_connection(ssl_conn);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1964
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1965 if (c->ssl->save_session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1966 c->ssl->session = sess;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1967
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1968 c->ssl->save_session(c);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1969
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1970 c->ssl->session = NULL;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1971 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1972
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1973 return 0;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1974 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1975
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1976
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1977 ngx_int_t
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1978 ngx_ssl_create_connection(ngx_ssl_t ssl, ngx_connection_t c, ngx_uint_t flags)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1979 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1980 ngx_ssl_connection_t *sc;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1981
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1982 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1983 if (sc == NULL) {
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1984 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1985 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1986
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1987 sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	1988 sc->buffer_size = ssl->buffer_size;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	1989
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	1990 sc->session_ctx = ssl->ctx;
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	1991
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1992 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1993 if (SSL_CTX_get_max_early_data(ssl->ctx)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1994 sc->try_early_data = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1995 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1996 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1997
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1998 sc->connection = SSL_new(ssl->ctx);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1999
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2000 if (sc->connection == NULL) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2001 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2002 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2003 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2004
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2005 if (SSL_set_fd(sc->connection, c->fd) == 0) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2006 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2007 return NGX_ERROR;
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2008 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2009
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2010 if (flags & NGX_SSL_CLIENT) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2011 SSL_set_connect_state(sc->connection);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2012
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2013 } else {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2014 SSL_set_accept_state(sc->connection);
7319 dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	2015
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	2016 #ifdef SSL_OP_NO_RENEGOTIATION
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	2017 SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	2018 #endif
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2019 }
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2020
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	2021 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	2022 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	2023 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	2024 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	2025
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2026 c->ssl = sc;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2027
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2028 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2029 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2030
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2031
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2032 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2033 ngx_ssl_get_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2034 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2035 #ifdef TLS1_3_VERSION
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2036 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2037 SSL_SESSION_up_ref(c->ssl->session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2038 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2039 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2040 #endif
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2041
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2042 return SSL_get1_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2043 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2044
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2045
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2046 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2047 ngx_ssl_get0_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2048 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2049 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2050 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2051 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2052
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2053 return SSL_get0_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2054 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2055
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	2056
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2057 ngx_int_t
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2058 ngx_ssl_set_session(ngx_connection_t c, ngx_ssl_session_t session)
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2059 {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2060 if (session) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2061 if (SSL_set_session(c->ssl->connection, session) == 0) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2062 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2063 return NGX_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2064 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2065 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2066
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2067 return NGX_OK;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2068 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2069
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2070
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2071 ngx_int_t
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2072 ngx_ssl_handshake(ngx_connection_t *c)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2073 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2074 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2075 ngx_err_t err;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2076
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2077 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2078 if (c->ssl->try_early_data) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2079 return ngx_ssl_try_early_data(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2080 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2081 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2082
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2083 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2084
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2085 n = SSL_do_handshake(c->ssl->connection);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2086
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2087 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2088
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2089 if (n == 1) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2090
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2091 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2092 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2093 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2094
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2095 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2096 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2097 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2098
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2099 #if (NGX_DEBUG)
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2100 ngx_ssl_handshake_log(c);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2101 #endif
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2102
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2103 c->ssl->handshaked = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2104
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2105 c->recv = ngx_ssl_recv;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2106 c->send = ngx_ssl_write;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2107 c->recv_chain = ngx_ssl_recv_chain;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2108 c->send_chain = ngx_ssl_send_chain;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2109
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2110 #ifndef SSL_OP_NO_RENEGOTIATION
6255 b40af2fd1c16 SSL: compatibility with OpenSSL master branch. Maxim Dounin <mdounin@mdounin.ru> parents: 6036 diff changeset	2111 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	2112 #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	2113
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2114 /* initial handshake done, disable renegotiation (CVE-2009-3555) */
6995 eb5d119323d8 SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6983 diff changeset	2115 if (c->ssl->connection->s3 && SSL_is_server(c->ssl->connection)) {
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2116 c->ssl->connection->s3->flags \|= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2117 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2118
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	2119 #endif
6255 b40af2fd1c16 SSL: compatibility with OpenSSL master branch. Maxim Dounin <mdounin@mdounin.ru> parents: 6036 diff changeset	2120 #endif
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2121 #endif
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	2122
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2123 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2124 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2125
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2126 sslerr = SSL_get_error(c->ssl->connection, n);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2127
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2128 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2129
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2130 if (sslerr == SSL_ERROR_WANT_READ) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2131 c->read->ready = 0;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2132 c->read->handler = ngx_ssl_handshake_handler;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2133 c->write->handler = ngx_ssl_handshake_handler;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2134
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2135 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2136 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2137 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2138
5024 03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2139 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2140 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2141 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2142
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2143 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2144 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2145
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2146 if (sslerr == SSL_ERROR_WANT_WRITE) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2147 c->write->ready = 0;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2148 c->read->handler = ngx_ssl_handshake_handler;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2149 c->write->handler = ngx_ssl_handshake_handler;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2150
5024 03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2151 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2152 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2153 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	2154
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2155 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2156 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2157 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2158
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2159 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2160 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2161
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2162 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2163
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2164 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2165 c->ssl->no_send_shutdown = 1;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2166 c->read->eof = 1;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2167
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2168 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
5747 57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake". Maxim Dounin <mdounin@mdounin.ru> parents: 5744 diff changeset	2169 ngx_connection_error(c, err,
57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake". Maxim Dounin <mdounin@mdounin.ru> parents: 5744 diff changeset	2170 "peer closed connection in SSL handshake");
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2171
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2172 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2173 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2174
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2175 c->read->error = 1;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2176
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2177 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2178
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2179 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2180 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2181
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2182
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2183 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2184
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2185 static ngx_int_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2186 ngx_ssl_try_early_data(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2187 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2188 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2189 u_char buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2190 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2191 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2192
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2193 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2194
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2195 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2196
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2197 n = SSL_read_early_data(c->ssl->connection, &buf, 1, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2198
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2199 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2200 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2201
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2202 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2203 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2204 return ngx_ssl_handshake(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2205 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2206
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2207 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2208
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2209 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2210 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2211 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2212
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2213 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2214 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2215 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2216
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2217 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2218 ngx_ssl_handshake_log(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2219 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2220
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2221 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2222
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2223 c->ssl->early_buf = buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2224 c->ssl->early_preread = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2225
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2226 c->ssl->handshaked = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2227 c->ssl->in_early = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2228
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2229 c->recv = ngx_ssl_recv;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2230 c->send = ngx_ssl_write;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2231 c->recv_chain = ngx_ssl_recv_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2232 c->send_chain = ngx_ssl_send_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2233
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2234 return NGX_OK;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2235 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2236
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2237 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2238
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2239 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2240
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2241 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2242
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2243 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2244 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2245 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2246 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2247
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2248 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2249 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2250 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2251
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2252 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2253 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2254 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2255
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2256 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2257 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2258
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2259 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2260 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2261 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2262 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2263
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2264 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2265 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2266 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2267
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2268 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2269 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2270 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2271
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2272 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2273 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2274
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2275 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2276
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2277 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2278 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2279 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2280
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2281 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2282 ngx_connection_error(c, err,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2283 "peer closed connection in SSL handshake");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2284
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2285 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2286 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2287
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2288 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2289
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2290 ngx_ssl_connection_error(c, sslerr, err, "SSL_read_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2291
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2292 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2293 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2294
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2295 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2296
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2297
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2298 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2299
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2300 static void
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2301 ngx_ssl_handshake_log(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2302 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2303 char buf[129], s, d;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2304 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2305 const
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2306 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2307 SSL_CIPHER *cipher;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2308
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2309 cipher = SSL_get_current_cipher(c->ssl->connection);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2310
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2311 if (cipher) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2312 SSL_CIPHER_description(cipher, &buf[1], 128);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2313
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2314 for (s = &buf[1], d = buf; *s; s++) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2315 if (s == ' ' && d == ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2316 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2317 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2318
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2319 if (s == LF \|\| s == CR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2320 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2321 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2322
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2323 ++d = s;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2324 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2325
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2326 if (*d != ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2327 d++;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2328 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2329
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2330 *d = '\0';
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2331
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2332 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2333 "SSL: %s, cipher: \"%s\"",
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2334 SSL_get_version(c->ssl->connection), &buf[1]);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2335
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2336 if (SSL_session_reused(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2337 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2338 "SSL reused session");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2339 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2340
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2341 } else {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2342 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2343 "SSL no shared ciphers");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2344 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2345 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2346
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2347 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2348
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2349
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2350 static void
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2351 ngx_ssl_handshake_handler(ngx_event_t *ev)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2352 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2353 ngx_connection_t *c;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2354
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2355 c = ev->data;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2356
549 e16a8d574da5 nginx-0.2.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	2357 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2358 "SSL handshake handler: %d", ev->write);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2359
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2360 if (ev->timedout) {
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2361 c->ssl->handler(c);
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2362 return;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2363 }
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2364
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2365 if (ngx_ssl_handshake(c) == NGX_AGAIN) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2366 return;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2367 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2368
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2369 c->ssl->handler(c);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2370 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2371
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2372
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2373 ssize_t
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2374 ngx_ssl_recv_chain(ngx_connection_t c, ngx_chain_t cl, off_t limit)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2375 {
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2376 u_char *last;
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2377 ssize_t n, bytes, size;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2378 ngx_buf_t *b;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2379
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2380 bytes = 0;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2381
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2382 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2383 last = b->last;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2384
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2385 for ( ;; ) {
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2386 size = b->end - last;
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2387
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2388 if (limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2389 if (bytes >= limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2390 return bytes;
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2391 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2392
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2393 if (bytes + size > limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2394 size = (ssize_t) (limit - bytes);
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2395 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2396 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2397
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	2398 n = ngx_ssl_recv(c, last, size);
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2399
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2400 if (n > 0) {
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2401 last += n;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2402 bytes += n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2403
7582 70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0. Maxim Dounin <mdounin@mdounin.ru> parents: 7560 diff changeset	2404 if (!c->read->ready) {
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0. Maxim Dounin <mdounin@mdounin.ru> parents: 7560 diff changeset	2405 return bytes;
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0. Maxim Dounin <mdounin@mdounin.ru> parents: 7560 diff changeset	2406 }
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0. Maxim Dounin <mdounin@mdounin.ru> parents: 7560 diff changeset	2407
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2408 if (last == b->end) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2409 cl = cl->next;
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2410
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2411 if (cl == NULL) {
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2412 return bytes;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2413 }
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2414
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2415 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	2416 last = b->last;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2417 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2418
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2419 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2420 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2421
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2422 if (bytes) {
2052 b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	2423
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	2424 if (n == 0 \|\| n == NGX_ERROR) {
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	2425 c->read->ready = 1;
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	2426 }
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	2427
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2428 return bytes;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2429 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2430
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2431 return n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2432 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2433 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2434
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2435
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2436 ssize_t
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2437 ngx_ssl_recv(ngx_connection_t c, u_char buf, size_t size)
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2438 {
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2439 int n, bytes;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2440
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2441 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2442 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2443 return ngx_ssl_recv_early(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2444 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2445 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2446
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2447 if (c->ssl->last == NGX_ERROR) {
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2448 c->read->error = 1;
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2449 return NGX_ERROR;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2450 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2451
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2452 if (c->ssl->last == NGX_DONE) {
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2453 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2454 c->read->eof = 1;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2455 return 0;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2456 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2457
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2458 bytes = 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2459
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2460 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2461
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2462 /*
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2463 * SSL_read() may return data in parts, so try to read
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2464 * until SSL_read() would return no data
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2465 */
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2466
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2467 for ( ;; ) {
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2468
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2469 n = SSL_read(c->ssl->connection, buf, size);
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2470
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2471 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2472
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2473 if (n > 0) {
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2474 bytes += n;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2475 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2476
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2477 c->ssl->last = ngx_ssl_handle_recv(c, n);
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2478
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2479 if (c->ssl->last == NGX_OK) {
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2480
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2481 size -= n;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2482
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2483 if (size == 0) {
5450 9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	2484 c->read->ready = 1;
7584 9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2485
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2486 if (c->read->available >= 0) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2487 c->read->available -= bytes;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2488
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2489 /*
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2490 * there can be data buffered at SSL layer,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2491 * so we post an event to continue reading on the next
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2492 * iteration of the event loop
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2493 */
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2494
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2495 if (c->read->available < 0) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2496 c->read->available = 0;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2497 c->read->ready = 0;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2498
7617 f1720934c45b SSL: reworked posted next events again. Maxim Dounin <mdounin@mdounin.ru> parents: 7612 diff changeset	2499 if (c->read->posted) {
f1720934c45b SSL: reworked posted next events again. Maxim Dounin <mdounin@mdounin.ru> parents: 7612 diff changeset	2500 ngx_delete_posted_event(c->read);
f1720934c45b SSL: reworked posted next events again. Maxim Dounin <mdounin@mdounin.ru> parents: 7612 diff changeset	2501 }
f1720934c45b SSL: reworked posted next events again. Maxim Dounin <mdounin@mdounin.ru> parents: 7612 diff changeset	2502
7584 9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2503 ngx_post_event(c->read, &ngx_posted_next_events);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2504 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2505
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2506 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2507 "SSL_read: avail:%d", c->read->available);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2508
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2509 } else {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2510
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2511 #if (NGX_HAVE_FIONREAD)
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2512
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2513 if (ngx_socket_nread(c->fd, &c->read->available) == -1) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2514 c->read->error = 1;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2515 ngx_connection_error(c, ngx_socket_errno,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2516 ngx_socket_nread_n " failed");
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2517 return NGX_ERROR;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2518 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2519
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2520 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2521 "SSL_read: avail:%d", c->read->available);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2522
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2523 #endif
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2524 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431). Maxim Dounin <mdounin@mdounin.ru> parents: 7582 diff changeset	2525
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2526 return bytes;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2527 }
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2528
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2529 buf += n;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2530
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2531 continue;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2532 }
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2533
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2534 if (bytes) {
5450 9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	2535 if (c->ssl->last != NGX_AGAIN) {
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	2536 c->read->ready = 1;
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	2537 }
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	2538
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2539 return bytes;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2540 }
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2541
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2542 switch (c->ssl->last) {
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2543
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2544 case NGX_DONE:
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2545 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2546 c->read->eof = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2547 return 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2548
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2549 case NGX_ERROR:
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2550 c->read->error = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2551
4499 778ef9c3fd2d Fixed spelling in single-line comments. Ruslan Ermilov <ru@nginx.com> parents: 4497 diff changeset	2552 /* fall through */
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2553
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	2554 case NGX_AGAIN:
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2555 return c->ssl->last;
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	2556 }
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2557 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2558 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2559
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2560
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2561 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2562
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2563 static ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2564 ngx_ssl_recv_early(ngx_connection_t c, u_char buf, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2565 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2566 int n, bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2567 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2568
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2569 if (c->ssl->last == NGX_ERROR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2570 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2571 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2572 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2573
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2574 if (c->ssl->last == NGX_DONE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2575 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2576 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2577 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2578 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2579
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2580 bytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2581
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2582 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2583
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2584 if (c->ssl->early_preread) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2585
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2586 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2587 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2588 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2589 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2590 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2591
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2592 *buf = c->ssl->early_buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2593
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2594 c->ssl->early_preread = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2595
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2596 bytes = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2597 size -= 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2598 buf += 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2599 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2600
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2601 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2602 return NGX_AGAIN;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2603 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2604
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2605 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2606 * SSL_read_early_data() may return data in parts, so try to read
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2607 * until SSL_read_early_data() would return no data
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2608 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2609
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2610 for ( ;; ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2611
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2612 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2613
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2614 n = SSL_read_early_data(c->ssl->connection, buf, size, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2615
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2616 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2617 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2618
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2619 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2620
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2621 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2622
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2623 bytes += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2624 size -= readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2625
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2626 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2627 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2628 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2629 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2630
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2631 buf += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2632
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2633 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2634 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2635
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2636 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2637
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2638 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2639 c->ssl->in_early = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2640
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2641 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2642 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2643 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2644 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2645
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2646 return ngx_ssl_recv(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2647 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2648
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2649 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2650
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2651 c->ssl->last = ngx_ssl_handle_recv(c, 0);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2652
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2653 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2654 if (c->ssl->last != NGX_AGAIN) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2655 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2656 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2657
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2658 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2659 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2660
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2661 switch (c->ssl->last) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2662
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2663 case NGX_DONE:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2664 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2665 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2666 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2667
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2668 case NGX_ERROR:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2669 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2670
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2671 /* fall through */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2672
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2673 case NGX_AGAIN:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2674 return c->ssl->last;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2675 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2676 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2677 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2678
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2679 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2680
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2681
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2682 static ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2683 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2684 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2685 int sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2686 ngx_err_t err;
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2687
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2688 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2689
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2690 if (c->ssl->renegotiation) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2691 /*
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2692 * disable renegotiation (CVE-2009-3555):
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2693 * OpenSSL (at least up to 0.9.8l) does not handle disabled
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2694 * renegotiation gracefully, so drop connection here
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2695 */
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2696
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2697 ngx_log_error(NGX_LOG_NOTICE, c->log, 0, "SSL renegotiation disabled");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2698
4236 2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2699 while (ERR_peek_error()) {
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2700 ngx_ssl_error(NGX_LOG_DEBUG, c->log, 0,
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2701 "ignoring stale global SSL error");
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2702 }
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2703
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2704 ERR_clear_error();
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	2705
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2706 c->ssl->no_wait_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2707 c->ssl->no_send_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2708
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2709 return NGX_ERROR;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2710 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	2711
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2712 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	2713
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2714 if (n > 0) {
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	2715
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2716 if (c->ssl->saved_write_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2717
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2718 c->write->handler = c->ssl->saved_write_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2719 c->ssl->saved_write_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2720 c->write->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2721
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2722 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2723 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2724 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2725
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	2726 ngx_post_event(c->write, &ngx_posted_events);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2727 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2728
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2729 return NGX_OK;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2730 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2731
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2732 sslerr = SSL_get_error(c->ssl->connection, n);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2733
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2734 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2735
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2736 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2737
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2738 if (sslerr == SSL_ERROR_WANT_READ) {
7353 87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2739
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2740 if (c->ssl->saved_write_handler) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2741
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2742 c->write->handler = c->ssl->saved_write_handler;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2743 c->ssl->saved_write_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2744 c->write->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2745
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2746 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2747 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2748 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2749
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2750 ngx_post_event(c->write, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2751 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2752
455 295d97d70c69 nginx-0.1.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 452 diff changeset	2753 c->read->ready = 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2754 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2755 }
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2756
445 f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	2757 if (sslerr == SSL_ERROR_WANT_WRITE) {
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2758
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2759 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2760 "SSL_read: want write");
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2761
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2762 c->write->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2763
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2764 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2765 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2766 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2767
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2768 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2769 * we do not set the timer because there is already the read event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2770 */
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2771
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2772 if (c->ssl->saved_write_handler == NULL) {
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2773 c->ssl->saved_write_handler = c->write->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2774 c->write->handler = ngx_ssl_write_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2775 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2776
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2777 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2778 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2779
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2780 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2781 c->ssl->no_send_shutdown = 1;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2782
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2783 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2784 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2785 "peer shutdown SSL cleanly");
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2786 return NGX_DONE;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2787 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2788
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2789 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2790
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2791 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2792 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2793
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2794
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2795 static void
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2796 ngx_ssl_write_handler(ngx_event_t *wev)
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2797 {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2798 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2799
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2800 c = wev->data;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2801
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2802 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL write handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2803
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2804 c->read->handler(c->read);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2805 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2806
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2807
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2808 /*
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2809 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2810 * before the SSL_write() call to decrease a SSL overhead.
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2811 *
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2812 * Besides for protocols such as HTTP it is possible to always buffer
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2813 * the output to decrease a SSL overhead some more.
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2814 */
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2815
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2816 ngx_chain_t *
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2817 ngx_ssl_send_chain(ngx_connection_t c, ngx_chain_t in, off_t limit)
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2818 {
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2819 int n;
399 4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import Igor Sysoev <igor@sysoev.ru> parents: 398 diff changeset	2820 ngx_uint_t flush;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2821 ssize_t send, size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2822 ngx_buf_t *buf;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2823
2280 6453161bf53e always use buffer, if connection is buffered, Igor Sysoev <igor@sysoev.ru> parents: 2165 diff changeset	2824 if (!c->ssl->buffer) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2825
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2826 while (in) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2827 if (ngx_buf_special(in->buf)) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2828 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2829 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2830 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2831
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2832 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2833
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2834 if (n == NGX_ERROR) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2835 return NGX_CHAIN_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2836 }
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2837
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2838 if (n == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2839 return in;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2840 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2841
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2842 in->buf->pos += n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2843
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2844 if (in->buf->pos == in->buf->last) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2845 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2846 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2847 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2848
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2849 return in;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2850 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2851
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2852
3962 df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2853 /* the maximum limit size is the maximum int32_t value - the page size */
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2854
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2855 if (limit == 0 \|\| limit > (off_t) (NGX_MAX_INT32_VALUE - ngx_pagesize)) {
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2856 limit = NGX_MAX_INT32_VALUE - ngx_pagesize;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2857 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2858
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2859 buf = c->ssl->buf;
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2860
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2861 if (buf == NULL) {
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2862 buf = ngx_create_temp_buf(c->pool, c->ssl->buffer_size);
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2863 if (buf == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2864 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2865 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2866
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2867 c->ssl->buf = buf;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2868 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2869
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2870 if (buf->start == NULL) {
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2871 buf->start = ngx_palloc(c->pool, c->ssl->buffer_size);
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2872 if (buf->start == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2873 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2874 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2875
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2876 buf->pos = buf->start;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2877 buf->last = buf->start;
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2878 buf->end = buf->start + c->ssl->buffer_size;
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2879 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2880
5023 70a35b7b63ea SSL: take into account data in the buffer while limiting output. Valentin Bartenev <vbart@nginx.com> parents: 5022 diff changeset	2881 send = buf->last - buf->pos;
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2882 flush = (in == NULL) ? 1 : buf->flush;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2883
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2884 for ( ;; ) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2885
3283 52b1624b93c2 fix segfault in SSL if limit_rate is used Igor Sysoev <igor@sysoev.ru> parents: 3159 diff changeset	2886 while (in && buf->last < buf->end && send < limit) {
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2887 if (in->buf->last_buf \|\| in->buf->flush) {
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2888 flush = 1;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2889 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2890
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2891 if (ngx_buf_special(in->buf)) {
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2892 in = in->next;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2893 continue;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2894 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2895
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2896 size = in->buf->last - in->buf->pos;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2897
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2898 if (size > buf->end - buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2899 size = buf->end - buf->last;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2900 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2901
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2902 if (send + size > limit) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2903 size = (ssize_t) (limit - send);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2904 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2905
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2906 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6480 f01ab2dbcfdc Fixed logging. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	2907 "SSL buf copy: %z", size);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2908
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2909 ngx_memcpy(buf->last, in->buf->pos, size);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2910
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2911 buf->last += size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2912 in->buf->pos += size;
3283 52b1624b93c2 fix segfault in SSL if limit_rate is used Igor Sysoev <igor@sysoev.ru> parents: 3159 diff changeset	2913 send += size;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2914
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2915 if (in->buf->pos == in->buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2916 in = in->next;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2917 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2918 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2919
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2920 if (!flush && send < limit && buf->last < buf->end) {
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2921 break;
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2922 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2923
5021 674f8739e443 SSL: calculation of buffer size moved closer to its usage. Valentin Bartenev <vbart@nginx.com> parents: 5020 diff changeset	2924 size = buf->last - buf->pos;
674f8739e443 SSL: calculation of buffer size moved closer to its usage. Valentin Bartenev <vbart@nginx.com> parents: 5020 diff changeset	2925
5022 1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2926 if (size == 0) {
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2927 buf->flush = 0;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2928 c->buffered &= ~NGX_SSL_BUFFERED;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2929 return in;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2930 }
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2931
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2932 n = ngx_ssl_write(c, buf->pos, size);
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2933
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2934 if (n == NGX_ERROR) {
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2935 return NGX_CHAIN_ERROR;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2936 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2937
511 c12967aadd87 nginx-0.1.30-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 509 diff changeset	2938 if (n == NGX_AGAIN) {
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2939 break;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2940 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2941
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2942 buf->pos += n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2943
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2944 if (n < size) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2945 break;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2946 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2947
5019 69693a098655 SSL: resetting of flush flag after the data was written. Valentin Bartenev <vbart@nginx.com> parents: 5018 diff changeset	2948 flush = 0;
69693a098655 SSL: resetting of flush flag after the data was written. Valentin Bartenev <vbart@nginx.com> parents: 5018 diff changeset	2949
5018 0ea36741bb35 SSL: removed conditions that always hold true. Valentin Bartenev <vbart@nginx.com> parents: 5003 diff changeset	2950 buf->pos = buf->start;
0ea36741bb35 SSL: removed conditions that always hold true. Valentin Bartenev <vbart@nginx.com> parents: 5003 diff changeset	2951 buf->last = buf->start;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2952
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2953 if (in == NULL \|\| send == limit) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2954 break;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2955 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2956 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2957
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2958 buf->flush = flush;
587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2959
597 9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2960 if (buf->pos < buf->last) {
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2961 c->buffered \|= NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2962
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2963 } else {
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2964 c->buffered &= ~NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2965 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2966
399 4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import Igor Sysoev <igor@sysoev.ru> parents: 398 diff changeset	2967 return in;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2968 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2969
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2970
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2971 ssize_t
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2972 ngx_ssl_write(ngx_connection_t c, u_char data, size_t size)
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2973 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2974 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2975 ngx_err_t err;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2976
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2977 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2978 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2979 return ngx_ssl_write_early(c, data, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2980 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2981 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2982
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2983 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2984
6480 f01ab2dbcfdc Fixed logging. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	2985 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2986
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2987 n = SSL_write(c->ssl->connection, data, size);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2988
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2989 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2990
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2991 if (n > 0) {
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2992
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2993 if (c->ssl->saved_read_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2994
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2995 c->read->handler = c->ssl->saved_read_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2996 c->ssl->saved_read_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2997 c->read->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2998
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2999 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3000 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3001 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3002
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	3003 ngx_post_event(c->read, &ngx_posted_events);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3004 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3005
5986 c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write(). Ruslan Ermilov <ru@nginx.com> parents: 5946 diff changeset	3006 c->sent += n;
c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write(). Ruslan Ermilov <ru@nginx.com> parents: 5946 diff changeset	3007
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3008 return n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3009 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3010
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3011 sslerr = SSL_get_error(c->ssl->connection, n);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3012
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3013 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3014
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3015 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3016
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3017 if (sslerr == SSL_ERROR_WANT_WRITE) {
7353 87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3018
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3019 if (c->ssl->saved_read_handler) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3020
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3021 c->read->handler = c->ssl->saved_read_handler;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3022 c->ssl->saved_read_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3023 c->read->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3024
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3025 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3026 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3027 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3028
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3029 ngx_post_event(c->read, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3030 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	3031
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3032 c->write->ready = 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3033 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3034 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3035
445 f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	3036 if (sslerr == SSL_ERROR_WANT_READ) {
452 23fb87bddda1 nginx-0.1.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 445 diff changeset	3037
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	3038 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	3039 "SSL_write: want read");
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3040
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3041 c->read->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3042
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	3043 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3044 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3045 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3046
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3047 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3048 * we do not set the timer because there is already
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3049 * the write event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3050 */
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3051
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3052 if (c->ssl->saved_read_handler == NULL) {
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3053 c->ssl->saved_read_handler = c->read->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3054 c->read->handler = ngx_ssl_read_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3055 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3056
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3057 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3058 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	3059
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3060 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3061 c->ssl->no_send_shutdown = 1;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	3062 c->write->error = 1;
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3063
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3064 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3065
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	3066 return NGX_ERROR;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3067 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3068
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3069
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3070 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3071
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3072 ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3073 ngx_ssl_write_early(ngx_connection_t c, u_char data, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3074 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3075 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3076 size_t written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3077 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3078
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3079 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3080
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3081 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3082
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3083 written = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3084
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3085 n = SSL_write_early_data(c->ssl->connection, data, size, &written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3086
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3087 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3088 "SSL_write_early_data: %d, %uz", n, written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3089
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3090 if (n > 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3091
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3092 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3093
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3094 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3095 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3096 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3097
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3098 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3099 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3100 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3101
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3102 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3103 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3104
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3105 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3106 c->ssl->write_blocked = 0;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3107 ngx_post_event(c->read, &ngx_posted_events);
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3108 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3109
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3110 c->sent += written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3111
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3112 return written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3113 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3114
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3115 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3116
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3117 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3118
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3119 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3120
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3121 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3122
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3123 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3124 "SSL_write_early_data: want write");
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3125
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3126 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3127
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3128 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3129 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3130 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3131
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3132 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3133 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3134 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3135
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3136 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3137 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3138
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3139 /*
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3140 * OpenSSL 1.1.1a fails to handle SSL_read_early_data()
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3141 * if an SSL_write_early_data() call blocked on writing,
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3142 * see https://github.com/openssl/openssl/issues/7757
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3143 */
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3144
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3145 c->ssl->write_blocked = 1;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	3146
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3147 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3148 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3149 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3150
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3151 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3152
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3153 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3154 "SSL_write_early_data: want read");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3155
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3156 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3157
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3158 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3159 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3160 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3161
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3162 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3163 * we do not set the timer because there is already
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3164 * the write event timer
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3165 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3166
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3167 if (c->ssl->saved_read_handler == NULL) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3168 c->ssl->saved_read_handler = c->read->handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3169 c->read->handler = ngx_ssl_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3170 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3171
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3172 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3173 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3174
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3175 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3176 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3177 c->write->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3178
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3179 ngx_ssl_connection_error(c, sslerr, err, "SSL_write_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3180
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3181 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3182 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3183
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3184 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3185
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	3186
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	3187 static void
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	3188 ngx_ssl_read_handler(ngx_event_t *rev)
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3189 {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3190 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3191
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3192 c = rev->data;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3193
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	3194 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL read handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	3195
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3196 c->write->handler(c->write);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3197 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3198
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3199
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3200 void
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3201 ngx_ssl_free_buffer(ngx_connection_t *c)
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3202 {
1795 3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	3203 if (c->ssl->buf && c->ssl->buf->start) {
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	3204 if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) {
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	3205 c->ssl->buf->start = NULL;
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	3206 }
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3207 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3208 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3209
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	3210
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	3211 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	3212 ngx_ssl_shutdown(ngx_connection_t *c)
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3213 {
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3214 int n, sslerr, mode;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3215 ngx_err_t err;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3216
6407 062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3217 if (SSL_in_init(c->ssl->connection)) {
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3218 /*
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3219 * OpenSSL 1.0.2f complains if SSL_shutdown() is called during
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3220 * an SSL handshake, while previous versions always return 0.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3221 * Avoid calling SSL_shutdown() if handshake wasn't completed.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3222 */
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3223
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3224 SSL_free(c->ssl->connection);
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3225 c->ssl = NULL;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3226
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3227 return NGX_OK;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3228 }
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	3229
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3230 if (c->timedout) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3231 mode = SSL_RECEIVED_SHUTDOWN\|SSL_SENT_SHUTDOWN;
4064 5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	3232 SSL_set_quiet_shutdown(c->ssl->connection, 1);
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3233
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3234 } else {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3235 mode = SSL_get_shutdown(c->ssl->connection);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	3236
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3237 if (c->ssl->no_wait_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3238 mode \|= SSL_RECEIVED_SHUTDOWN;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3239 }
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3240
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3241 if (c->ssl->no_send_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3242 mode \|= SSL_SENT_SHUTDOWN;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3243 }
4064 5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	3244
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	3245 if (c->ssl->no_wait_shutdown && c->ssl->no_send_shutdown) {
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	3246 SSL_set_quiet_shutdown(c->ssl->connection, 1);
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	3247 }
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3248 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3249
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3250 SSL_set_shutdown(c->ssl->connection, mode);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3251
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3252 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3253
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3254 n = SSL_shutdown(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3255
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3256 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3257
461 a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	3258 sslerr = 0;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3259
6406 d194cad6dd3a SSL: fixed SSL_shutdown() comment. Maxim Dounin <mdounin@mdounin.ru> parents: 6261 diff changeset	3260 /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors */
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3261
1865 4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755 Igor Sysoev <igor@sysoev.ru> parents: 1861 diff changeset	3262 if (n != 1 && ERR_peek_error()) {
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3263 sslerr = SSL_get_error(c->ssl->connection, n);
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3264
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3265 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	3266 "SSL_get_error: %d", sslerr);
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3267 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3268
1865 4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755 Igor Sysoev <igor@sysoev.ru> parents: 1861 diff changeset	3269 if (n == 1 \|\| sslerr == 0 \|\| sslerr == SSL_ERROR_ZERO_RETURN) {
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3270 SSL_free(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3271 c->ssl = NULL;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3272
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3273 return NGX_OK;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3274 }
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3275
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3276 if (sslerr == SSL_ERROR_WANT_READ \|\| sslerr == SSL_ERROR_WANT_WRITE) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3277 c->read->handler = ngx_ssl_shutdown_handler;
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3278 c->write->handler = ngx_ssl_shutdown_handler;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3279
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	3280 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3281 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3282 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3283
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	3284 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3285 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3286 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3287
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	3288 if (sslerr == SSL_ERROR_WANT_READ) {
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3289 ngx_add_timer(c->read, 30000);
d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3290 }
d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3291
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3292 return NGX_AGAIN;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3293 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3294
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	3295 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	3296
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	3297 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3298
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3299 SSL_free(c->ssl->connection);
511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3300 c->ssl = NULL;
511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	3301
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3302 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3303 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3304
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	3305
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3306 static void
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3307 ngx_ssl_shutdown_handler(ngx_event_t *ev)
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3308 {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3309 ngx_connection_t *c;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3310 ngx_connection_handler_pt handler;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3311
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3312 c = ev->data;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3313 handler = c->ssl->handler;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3314
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3315 if (ev->timedout) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3316 c->timedout = 1;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3317 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3318
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3319 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3320
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3321 if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3322 return;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3323 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3324
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3325 handler(c);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3326 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3327
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3328
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3329 static void
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3330 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3331 char *text)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3332 {
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3333 int n;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3334 ngx_uint_t level;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3335
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3336 level = NGX_LOG_CRIT;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3337
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3338 if (sslerr == SSL_ERROR_SYSCALL) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3339
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3340 if (err == NGX_ECONNRESET
7560 2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows. Maxim Dounin <mdounin@mdounin.ru> parents: 7509 diff changeset	3341 #if (NGX_WIN32)
2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows. Maxim Dounin <mdounin@mdounin.ru> parents: 7509 diff changeset	3342 \|\| err == NGX_ECONNABORTED
2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows. Maxim Dounin <mdounin@mdounin.ru> parents: 7509 diff changeset	3343 #endif
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3344 \|\| err == NGX_EPIPE
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3345 \|\| err == NGX_ENOTCONN
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3346 \|\| err == NGX_ETIMEDOUT
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3347 \|\| err == NGX_ECONNREFUSED
1869 192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	3348 \|\| err == NGX_ENETDOWN
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	3349 \|\| err == NGX_ENETUNREACH
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	3350 \|\| err == NGX_EHOSTDOWN
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3351 \|\| err == NGX_EHOSTUNREACH)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3352 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3353 switch (c->log_error) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3354
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3355 case NGX_ERROR_IGNORE_ECONNRESET:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3356 case NGX_ERROR_INFO:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3357 level = NGX_LOG_INFO;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3358 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3359
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3360 case NGX_ERROR_ERR:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3361 level = NGX_LOG_ERR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3362 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3363
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3364 default:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3365 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3366 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3367 }
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3368
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3369 } else if (sslerr == SSL_ERROR_SSL) {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3370
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3371 n = ERR_GET_REASON(ERR_peek_error());
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3372
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3373 /* handshake failures */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3374 if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */
7360 8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3375 #ifdef SSL_R_NO_SUITABLE_KEY_SHARE
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3376 \|\| n == SSL_R_NO_SUITABLE_KEY_SHARE /* 101 */
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3377 #endif
7361 c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3378 #ifdef SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3379 \|\| n == SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM /* 118 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3380 #endif
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3381 \|\| n == SSL_R_BLOCK_CIPHER_PAD_IS_WRONG /* 129 */
3718 bfd84b583868 decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3516 diff changeset	3382 \|\| n == SSL_R_DIGEST_CHECK_FAILED /* 149 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3383 \|\| n == SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST /* 151 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3384 \|\| n == SSL_R_EXCESSIVE_MESSAGE_SIZE /* 152 */
7311 778358452a81 SSL: logging level of "https proxy request" errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7291 diff changeset	3385 \|\| n == SSL_R_HTTPS_PROXY_REQUEST /* 155 */
778358452a81 SSL: logging level of "https proxy request" errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7291 diff changeset	3386 \|\| n == SSL_R_HTTP_REQUEST /* 156 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	3387 \|\| n == SSL_R_LENGTH_MISMATCH /* 159 */
6652 1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6591 diff changeset	3388 #ifdef SSL_R_NO_CIPHERS_PASSED
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3389 \|\| n == SSL_R_NO_CIPHERS_PASSED /* 182 */
6652 1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6591 diff changeset	3390 #endif
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	3391 \|\| n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3392 \|\| n == SSL_R_NO_COMPRESSION_SPECIFIED /* 187 */
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3393 \|\| n == SSL_R_NO_SHARED_CIPHER /* 193 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	3394 \|\| n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */
7472 d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3395 #ifdef SSL_R_CLIENTHELLO_TLSEXT
d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3396 \|\| n == SSL_R_CLIENTHELLO_TLSEXT /* 226 */
d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3397 #endif
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3398 #ifdef SSL_R_PARSE_TLSEXT
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3399 \|\| n == SSL_R_PARSE_TLSEXT /* 227 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3400 #endif
7472 d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3401 #ifdef SSL_R_CALLBACK_FAILED
d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3402 \|\| n == SSL_R_CALLBACK_FAILED /* 234 */
d430babbe643 SSL: server name callback changed to return fatal errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	3403 #endif
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3404 \|\| n == SSL_R_UNEXPECTED_MESSAGE /* 244 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3405 \|\| n == SSL_R_UNEXPECTED_RECORD /* 245 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	3406 \|\| n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */
3357 fc735aa50b8b decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3300 diff changeset	3407 \|\| n == SSL_R_UNKNOWN_PROTOCOL /* 252 */
7361 c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3408 #ifdef SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3409 \|\| n == SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS /* 253 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	3410 #endif
7317 6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	3411 \|\| n == SSL_R_UNSUPPORTED_PROTOCOL /* 258 */
7360 8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3412 #ifdef SSL_R_NO_SHARED_GROUP
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3413 \|\| n == SSL_R_NO_SHARED_GROUP /* 266 */
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	3414 #endif
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3415 \|\| n == SSL_R_WRONG_VERSION_NUMBER /* 267 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3416 \|\| n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3417 #ifdef SSL_R_RENEGOTIATE_EXT_TOO_LONG
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3418 \|\| n == SSL_R_RENEGOTIATE_EXT_TOO_LONG /* 335 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3419 \|\| n == SSL_R_RENEGOTIATION_ENCODING_ERR /* 336 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3420 \|\| n == SSL_R_RENEGOTIATION_MISMATCH /* 337 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3421 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3422 #ifdef SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3423 \|\| n == SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED /* 338 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3424 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3425 #ifdef SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3426 \|\| n == SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING /* 345 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	3427 #endif
5902 b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	3428 #ifdef SSL_R_INAPPROPRIATE_FALLBACK
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	3429 \|\| n == SSL_R_INAPPROPRIATE_FALLBACK /* 373 */
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	3430 #endif
7461 a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	3431 #ifdef SSL_R_CERT_CB_ERROR
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	3432 \|\| n == SSL_R_CERT_CB_ERROR /* 377 */
a68799465b19 SSL: loading of connection-specific certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7460 diff changeset	3433 #endif
7317 6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	3434 #ifdef SSL_R_VERSION_TOO_LOW
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	3435 \|\| n == SSL_R_VERSION_TOO_LOW /* 396 */
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	3436 #endif
1877 a55876dff8f5 low SSL handshake close notify alert error level Igor Sysoev <igor@sysoev.ru> parents: 1876 diff changeset	3437 \|\| n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
6486 978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	3438 #ifdef SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3439 \|\| n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3440 \|\| n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC /* 1020 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3441 \|\| n == SSL_R_TLSV1_ALERT_DECRYPTION_FAILED /* 1021 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3442 \|\| n == SSL_R_TLSV1_ALERT_RECORD_OVERFLOW /* 1022 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3443 \|\| n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE /* 1030 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3444 \|\| n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE /* 1040 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3445 \|\| n == SSL_R_SSLV3_ALERT_NO_CERTIFICATE /* 1041 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3446 \|\| n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE /* 1042 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3447 \|\| n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE /* 1043 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3448 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED /* 1044 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3449 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED /* 1045 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3450 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN /* 1046 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3451 \|\| n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER /* 1047 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3452 \|\| n == SSL_R_TLSV1_ALERT_UNKNOWN_CA /* 1048 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3453 \|\| n == SSL_R_TLSV1_ALERT_ACCESS_DENIED /* 1049 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3454 \|\| n == SSL_R_TLSV1_ALERT_DECODE_ERROR /* 1050 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3455 \|\| n == SSL_R_TLSV1_ALERT_DECRYPT_ERROR /* 1051 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3456 \|\| n == SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION /* 1060 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3457 \|\| n == SSL_R_TLSV1_ALERT_PROTOCOL_VERSION /* 1070 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3458 \|\| n == SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY /* 1071 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3459 \|\| n == SSL_R_TLSV1_ALERT_INTERNAL_ERROR /* 1080 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	3460 \|\| n == SSL_R_TLSV1_ALERT_USER_CANCELLED /* 1090 */
6486 978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	3461 \|\| n == SSL_R_TLSV1_ALERT_NO_RENEGOTIATION /* 1100 */
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	3462 #endif
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	3463 )
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3464 {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3465 switch (c->log_error) {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3466
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3467 case NGX_ERROR_IGNORE_ECONNRESET:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3468 case NGX_ERROR_INFO:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3469 level = NGX_LOG_INFO;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3470 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3471
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3472 case NGX_ERROR_ERR:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3473 level = NGX_LOG_ERR;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3474 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3475
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3476 default:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3477 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3478 }
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	3479 }
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3480 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3481
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3482 ngx_ssl_error(level, c->log, err, text);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3483 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3484
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3485
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3486 static void
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3487 ngx_ssl_clear_error(ngx_log_t *log)
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3488 {
1868 c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	3489 while (ERR_peek_error()) {
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3490 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error");
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3491 }
1868 c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	3492
c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	3493 ERR_clear_error();
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3494 }
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3495
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	3496
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	3497 void ngx_cdecl
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	3498 ngx_ssl_error(ngx_uint_t level, ngx_log_t log, ngx_err_t err, char fmt, ...)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	3499 {
4877 f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3500 int flags;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3501 u_long n;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3502 va_list args;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3503 u_char p, last;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3504 u_char errstr[NGX_MAX_CONF_ERRSTR];
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	3505 const char *data;
461 a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	3506
a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	3507 last = errstr + NGX_MAX_CONF_ERRSTR;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	3508
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	3509 va_start(args, fmt);
2764 d4a717592877 use ngx_vslprintf(), ngx_slprintf() Igor Sysoev <igor@sysoev.ru> parents: 2720 diff changeset	3510 p = ngx_vslprintf(errstr, last - 1, fmt, args);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	3511 va_end(args);
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	3512
7459 982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3513 if (ERR_peek_error()) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3514 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3515
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3516 for ( ;; ) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3517
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3518 n = ERR_peek_error_line_data(NULL, NULL, &data, &flags);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3519
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3520 if (n == 0) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3521 break;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3522 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3523
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3524 /* ERR_error_string_n() requires at least one byte */
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3525
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3526 if (p >= last - 1) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3527 goto next;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3528 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3529
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3530 *p++ = ' ';
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3531
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3532 ERR_error_string_n(n, (char *) p, last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3533
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3534 while (p < last && *p) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3535 p++;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3536 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3537
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3538 if (p < last && *data && (flags & ERR_TXT_STRING)) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3539 *p++ = ':';
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3540 p = ngx_cpystrn(p, (u_char *) data, last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3541 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3542
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3543 next:
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3544
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3545 (void) ERR_get_error();
1861 f00b30557c81 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1860 diff changeset	3546 }
f00b30557c81 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1860 diff changeset	3547
7459 982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3548 if (p < last) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3549 *p++ = ')';
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	3550 }
7459 982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3551 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3552
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 7455 diff changeset	3553 ngx_log_error(level, log, err, "%*s", p - errstr, errstr);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	3554 }
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3555
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3556
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3557 ngx_int_t
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3558 ngx_ssl_session_cache(ngx_ssl_t ssl, ngx_str_t sess_ctx,
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3559 ngx_array_t *certificates, ssize_t builtin_session_cache,
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3560 ngx_shm_zone_t *shm_zone, time_t timeout)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3561 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3562 long cache_mode;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3563
5424 767aa37f12de SSL: SSL_CTX_set_timeout() now always called. Maxim Dounin <mdounin@mdounin.ru> parents: 5423 diff changeset	3564 SSL_CTX_set_timeout(ssl->ctx, (long) timeout);
767aa37f12de SSL: SSL_CTX_set_timeout() now always called. Maxim Dounin <mdounin@mdounin.ru> parents: 5423 diff changeset	3565
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3566 if (ngx_ssl_session_id_context(ssl, sess_ctx, certificates) != NGX_OK) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3567 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3568 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3569
1778 14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	3570 if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	3571 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	3572 return NGX_OK;
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	3573 }
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	3574
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3575 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3576
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3577 /*
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3578 * If the server explicitly says that it does not support
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3579 * session reuse (see SSL_SESS_CACHE_OFF above), then
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3580 * Outlook Express fails to upload a sent email to
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3581 * the Sent Items folder on the IMAP server via a separate IMAP
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	3582 * connection in the background. Therefore we have a special
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3583 * mode (SSL_SESS_CACHE_SERVER\|SSL_SESS_CACHE_NO_INTERNAL_STORE)
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3584 * where the server pretends that it supports session reuse,
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3585 * but it does not actually store any session.
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3586 */
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3587
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3588 SSL_CTX_set_session_cache_mode(ssl->ctx,
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3589 SSL_SESS_CACHE_SERVER
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3590 \|SSL_SESS_CACHE_NO_AUTO_CLEAR
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3591 \|SSL_SESS_CACHE_NO_INTERNAL_STORE);
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3592
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3593 SSL_CTX_sess_set_cache_size(ssl->ctx, 1);
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3594
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3595 return NGX_OK;
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3596 }
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	3597
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3598 cache_mode = SSL_SESS_CACHE_SERVER;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3599
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3600 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3601 cache_mode \|= SSL_SESS_CACHE_NO_INTERNAL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3602 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3603
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3604 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3605
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3606 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3607
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3608 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3609 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3610 }
1015 32ebb6b13ff3 ssl_session_timeout was set only if builtin cache was used Igor Sysoev <igor@sysoev.ru> parents: 1014 diff changeset	3611 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3612
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3613 if (shm_zone) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3614 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3615 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3616 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3617
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3618 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3619 == 0)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3620 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3621 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3622 "SSL_CTX_set_ex_data() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3623 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3624 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3625 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3626
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3627 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3628 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3629
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3630
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3631 static ngx_int_t
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3632 ngx_ssl_session_id_context(ngx_ssl_t ssl, ngx_str_t sess_ctx,
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3633 ngx_array_t *certificates)
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3634 {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3635 int n, i;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3636 X509 *cert;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3637 X509_NAME *name;
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3638 ngx_str_t *certs;
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3639 ngx_uint_t k;
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3640 EVP_MD_CTX *md;
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3641 unsigned int len;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3642 STACK_OF(X509_NAME) *list;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3643 u_char buf[EVP_MAX_MD_SIZE];
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3644
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3645 /*
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3646 * Session ID context is set based on the string provided,
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3647 * the server certificates, and the client CA list.
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3648 */
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3649
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3650 md = EVP_MD_CTX_create();
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3651 if (md == NULL) {
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3652 return NGX_ERROR;
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3653 }
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3654
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3655 if (EVP_DigestInit_ex(md, EVP_sha1(), NULL) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3656 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3657 "EVP_DigestInit_ex() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3658 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3659 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3660
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3661 if (EVP_DigestUpdate(md, sess_ctx->data, sess_ctx->len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3662 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3663 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3664 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3665 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3666
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3667 for (cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3668 cert;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3669 cert = X509_get_ex_data(cert, ngx_ssl_next_certificate_index))
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3670 {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3671 if (X509_digest(cert, EVP_sha1(), buf, &len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3672 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3673 "X509_digest() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3674 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3675 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3676
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3677 if (EVP_DigestUpdate(md, buf, len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3678 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3679 "EVP_DigestUpdate() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3680 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3681 }
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3682 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3683
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3684 if (SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index) == NULL) {
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3685
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3686 /*
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3687 * If certificates are loaded dynamically, we use certificate
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3688 * names as specified in the configuration (with variables).
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3689 */
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3690
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3691 certs = certificates->elts;
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3692 for (k = 0; k < certificates->nelts; k++) {
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3693
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3694 if (EVP_DigestUpdate(md, certs[k].data, certs[k].len) == 0) {
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3695 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3696 "EVP_DigestUpdate() failed");
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3697 goto failed;
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3698 }
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3699 }
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3700 }
6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	3701
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3702 list = SSL_CTX_get_client_CA_list(ssl->ctx);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3703
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3704 if (list != NULL) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3705 n = sk_X509_NAME_num(list);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3706
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3707 for (i = 0; i < n; i++) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3708 name = sk_X509_NAME_value(list, i);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3709
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3710 if (X509_NAME_digest(name, EVP_sha1(), buf, &len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3711 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3712 "X509_NAME_digest() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3713 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3714 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3715
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3716 if (EVP_DigestUpdate(md, buf, len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3717 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3718 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3719 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3720 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3721 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3722 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3723
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3724 if (EVP_DigestFinal_ex(md, buf, &len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3725 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
7455 992bf7540a98 SSL: fixed EVP_DigestFinal_ex() error message. Sergey Kandaurov <pluknet@nginx.com> parents: 7454 diff changeset	3726 "EVP_DigestFinal_ex() failed");
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3727 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3728 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3729
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3730 EVP_MD_CTX_destroy(md);
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3731
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3732 if (SSL_CTX_set_session_id_context(ssl->ctx, buf, len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3733 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3734 "SSL_CTX_set_session_id_context() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3735 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3736 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3737
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3738 return NGX_OK;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3739
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3740 failed:
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3741
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	3742 EVP_MD_CTX_destroy(md);
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3743
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3744 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3745 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3746
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	3747
3992 a1dd9dc754ab A new fix for the case when ssl_session_cache defined, but ssl is not Igor Sysoev <igor@sysoev.ru> parents: 3962 diff changeset	3748 ngx_int_t
993 1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3749 ngx_ssl_session_cache_init(ngx_shm_zone_t shm_zone, void data)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3750 {
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3751 size_t len;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3752 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3753 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3754
993 1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3755 if (data) {
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3756 shm_zone->data = data;
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3757 return NGX_OK;
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3758 }
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	3759
5640 4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	3760 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	3761
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3762 if (shm_zone->shm.exists) {
5640 4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	3763 shm_zone->data = shpool->data;
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3764 return NGX_OK;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3765 }
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3766
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3767 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3768 if (cache == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3769 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3770 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3771
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3772 shpool->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3773 shm_zone->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	3774
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3775 ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel,
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3776 ngx_ssl_session_rbtree_insert_value);
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3777
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3778 ngx_queue_init(&cache->expire_queue);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3779
2716 d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2710 diff changeset	3780 len = sizeof(" in SSL session shared cache \"\"") + shm_zone->shm.name.len;
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3781
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3782 shpool->log_ctx = ngx_slab_alloc(shpool, len);
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3783 if (shpool->log_ctx == NULL) {
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3784 return NGX_ERROR;
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3785 }
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3786
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3787 ngx_sprintf(shpool->log_ctx, " in SSL session shared cache \"%V\"%Z",
2716 d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2710 diff changeset	3788 &shm_zone->shm.name);
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	3789
5634 5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	3790 shpool->log_nomem = 0;
5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	3791
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3792 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3793 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3794
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3795
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3796 /*
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3797 * The length of the session id is 16 bytes for SSLv2 sessions and
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3798 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3799 * It seems that the typical length of the external ASN1 representation
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3800 * of a session is 118 or 119 bytes for SSLv3/TSLv1.
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3801 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3802 * Thus on 32-bit platforms we allocate separately an rbtree node,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3803 * a session id, and an ASN1 representation, they take accordingly
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3804 * 64, 32, and 128 bytes.
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3805 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3806 * On 64-bit platforms we allocate separately an rbtree node + session_id,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3807 * and an ASN1 representation, they take accordingly 128 and 128 bytes.
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3808 *
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3809 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3810 * so they are outside the code locked by shared pool mutex
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3811 */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3812
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3813 static int
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3814 ngx_ssl_new_session(ngx_ssl_conn_t ssl_conn, ngx_ssl_session_t sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3815 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3816 int len;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3817 u_char p, id, cached_sess, session_id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3818 uint32_t hash;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3819 SSL_CTX *ssl_ctx;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3820 unsigned int session_id_length;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3821 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3822 ngx_connection_t *c;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3823 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3824 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3825 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3826 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3827
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3828 len = i2d_SSL_SESSION(sess, NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3829
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3830 /* do not cache too big session */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3831
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3832 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3833 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3834 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3835
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3836 p = buf;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3837 i2d_SSL_SESSION(sess, &p);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3838
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3839 c = ngx_ssl_get_connection(ssl_conn);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3840
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3841 ssl_ctx = c->ssl->session_ctx;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3842 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3843
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3844 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3845 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3846
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3847 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3848
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3849 /* drop one or two expired sessions */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3850 ngx_ssl_expire_sessions(cache, shpool, 1);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3851
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3852 cached_sess = ngx_slab_alloc_locked(shpool, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3853
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3854 if (cached_sess == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3855
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3856 /* drop the oldest non-expired session and try once more */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3857
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3858 ngx_ssl_expire_sessions(cache, shpool, 0);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3859
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3860 cached_sess = ngx_slab_alloc_locked(shpool, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3861
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3862 if (cached_sess == NULL) {
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3863 sess_id = NULL;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3864 goto failed;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3865 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3866 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3867
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3868 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3869
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3870 if (sess_id == NULL) {
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3871
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3872 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3873
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3874 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3875
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3876 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3877
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3878 if (sess_id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3879 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3880 }
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3881 }
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3882
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3883 session_id = (u_char *) SSL_SESSION_get_id(sess, &session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3884
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3885 #if (NGX_PTR_SIZE == 8)
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3886
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3887 id = sess_id->sess_id;
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3888
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3889 #else
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3890
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3891 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3892
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3893 if (id == NULL) {
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3894
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3895 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3896
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3897 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3898
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3899 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3900
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3901 if (id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3902 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3903 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3904 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3905
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3906 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3907
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3908 ngx_memcpy(cached_sess, buf, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3909
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3910 ngx_memcpy(id, session_id, session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3911
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3912 hash = ngx_crc32_short(session_id, session_id_length);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3913
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3914 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3915 "ssl new session: %08XD:%ud:%d",
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3916 hash, session_id_length, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3917
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3918 sess_id->node.key = hash;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3919 sess_id->node.data = (u_char) session_id_length;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3920 sess_id->id = id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3921 sess_id->len = len;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3922 sess_id->session = cached_sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3923
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	3924 sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3925
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3926 ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3927
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3928 ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3929
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3930 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3931
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3932 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3933
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3934 failed:
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3935
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3936 if (cached_sess) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3937 ngx_slab_free_locked(shpool, cached_sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3938 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3939
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3940 if (sess_id) {
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3941 ngx_slab_free_locked(shpool, sess_id);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3942 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3943
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3944 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3945
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3946 ngx_log_error(NGX_LOG_ALERT, c->log, 0,
5634 5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	3947 "could not allocate new session%s", shpool->log_ctx);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3948
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3949 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3950 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3951
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3952
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3953 static ngx_ssl_session_t *
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3954 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3955 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3956 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3957 #endif
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3958 u_char id, int len, int copy)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3959 {
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3960 size_t slen;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3961 uint32_t hash;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3962 ngx_int_t rc;
7509 b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility. Sergey Kandaurov <pluknet@nginx.com> parents: 7484 diff changeset	3963 const u_char *p;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3964 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3965 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3966 ngx_rbtree_node_t node, sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3967 ngx_ssl_session_t *sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3968 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3969 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3970 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
3961 4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3971 ngx_connection_t *c;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3972
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3973 hash = ngx_crc32_short((u_char *) (uintptr_t) id, (size_t) len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3974 *copy = 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3975
3961 4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3976 c = ngx_ssl_get_connection(ssl_conn);
4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3977
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3978 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
3155 e720c4a68ee0 fix debug log message Igor Sysoev <igor@sysoev.ru> parents: 3154 diff changeset	3979 "ssl get session: %08XD:%d", hash, len);
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3980
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3981 shm_zone = SSL_CTX_get_ex_data(c->ssl->session_ctx,
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3982 ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3983
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3984 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3985
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3986 sess = NULL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3987
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3988 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3989
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3990 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3991
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3992 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3993 sentinel = cache->session_rbtree.sentinel;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3994
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3995 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3996
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3997 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3998 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3999 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4000 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4001
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4002 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4003 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4004 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4005 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4006
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4007 /* hash == node->key */
7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4008
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4009 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4010
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	4011 rc = ngx_memn2cmp((u_char *) (uintptr_t) id, sess_id->id,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	4012 (size_t) len, (size_t) node->data);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4013
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4014 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4015
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4016 if (sess_id->expire > ngx_time()) {
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	4017 slen = sess_id->len;
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	4018
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	4019 ngx_memcpy(buf, sess_id->session, slen);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4020
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4021 ngx_shmtx_unlock(&shpool->mutex);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4022
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4023 p = buf;
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	4024 sess = d2i_SSL_SESSION(NULL, &p, slen);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4025
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4026 return sess;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4027 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4028
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4029 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4030
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4031 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4032
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4033 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4034 #if (NGX_PTR_SIZE == 4)
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4035 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4036 #endif
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4037 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4038
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4039 sess = NULL;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4040
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4041 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4042 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4043
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4044 node = (rc < 0) ? node->left : node->right;
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4045 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4046
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4047 done:
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4048
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4049 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4050
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4051 return sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4052 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4053
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4054
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4055 void
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4056 ngx_ssl_remove_cached_session(SSL_CTX ssl, ngx_ssl_session_t sess)
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4057 {
6474 2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	4058 SSL_CTX_remove_session(ssl, sess);
2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	4059
2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	4060 ngx_ssl_remove_session(ssl, sess);
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4061 }
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4062
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4063
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4064 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4065 ngx_ssl_remove_session(SSL_CTX ssl, ngx_ssl_session_t sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4066 {
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4067 u_char *id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4068 uint32_t hash;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4069 ngx_int_t rc;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4070 unsigned int len;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4071 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4072 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4073 ngx_rbtree_node_t node, sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4074 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4075 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4076
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4077 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4078
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4079 if (shm_zone == NULL) {
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4080 return;
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4081 }
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	4082
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4083 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4084
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4085 id = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4086
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4087 hash = ngx_crc32_short(id, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4088
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4089 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4090 "ssl remove session: %08XD:%ud", hash, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4091
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4092 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4093
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4094 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4095
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	4096 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	4097 sentinel = cache->session_rbtree.sentinel;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4098
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4099 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4100
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4101 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4102 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4103 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4104 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4105
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4106 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4107 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4108 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4109 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4110
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4111 /* hash == node->key */
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4112
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4113 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4114
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4115 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4116
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4117 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4118
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4119 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4120
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4121 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4122
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4123 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4124 #if (NGX_PTR_SIZE == 4)
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4125 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4126 #endif
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4127 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4128
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4129 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4130 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4131
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	4132 node = (rc < 0) ? node->left : node->right;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4133 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4134
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4135 done:
7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	4136
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4137 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4138 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4139
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4140
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4141 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4142 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4143 ngx_slab_pool_t *shpool, ngx_uint_t n)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4144 {
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	4145 time_t now;
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4146 ngx_queue_t *q;
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	4147 ngx_ssl_sess_id_t *sess_id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4148
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	4149 now = ngx_time();
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4150
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4151 while (n < 3) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4152
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4153 if (ngx_queue_empty(&cache->expire_queue)) {
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4154 return;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4155 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4156
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4157 q = ngx_queue_last(&cache->expire_queue);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4158
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4159 sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4160
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	4161 if (n++ != 0 && sess_id->expire > now) {
1439 36548ad85be1 style fix Igor Sysoev <igor@sysoev.ru> parents: 1426 diff changeset	4162 return;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4163 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4164
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4165 ngx_queue_remove(q);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4166
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4167 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4168 "expire session: %08Xi", sess_id->node.key);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4169
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4170 ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	4171
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	4172 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4173 #if (NGX_PTR_SIZE == 4)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4174 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	4175 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4176 ngx_slab_free_locked(shpool, sess_id);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4177 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4178 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4179
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	4180
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4181 static void
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4182 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4183 ngx_rbtree_node_t node, ngx_rbtree_node_t sentinel)
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4184 {
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4185 ngx_rbtree_node_t **p;
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4186 ngx_ssl_sess_id_t sess_id, sess_id_temp;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4187
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4188 for ( ;; ) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4189
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4190 if (node->key < temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4191
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4192 p = &temp->left;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4193
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4194 } else if (node->key > temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4195
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4196 p = &temp->right;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4197
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4198 } else { /* node->key == temp->key */
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4199
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4200 sess_id = (ngx_ssl_sess_id_t *) node;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4201 sess_id_temp = (ngx_ssl_sess_id_t *) temp;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4202
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4203 p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4204 (size_t) node->data, (size_t) temp->data)
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4205 < 0) ? &temp->left : &temp->right;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4206 }
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4207
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4208 if (*p == sentinel) {
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4209 break;
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4210 }
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4211
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4212 temp = *p;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4213 }
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4214
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	4215 *p = node;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4216 node->parent = temp;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4217 node->left = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4218 node->right = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4219 ngx_rbt_red(node);
1043 7073b87fa8e9 style fix: remove trailing spaces Igor Sysoev <igor@sysoev.ru> parents: 1029 diff changeset	4220 }
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4221
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	4222
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4223 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4224
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4225 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4226 ngx_ssl_session_ticket_keys(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4227 {
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4228 u_char buf[80];
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4229 size_t size;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4230 ssize_t n;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4231 ngx_str_t *path;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4232 ngx_file_t file;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4233 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4234 ngx_array_t *keys;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4235 ngx_file_info_t fi;
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4236 ngx_pool_cleanup_t *cln;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4237 ngx_ssl_session_ticket_key_t *key;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4238
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4239 if (paths == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4240 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4241 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4242
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4243 keys = ngx_array_create(cf->pool, paths->nelts,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4244 sizeof(ngx_ssl_session_ticket_key_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4245 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4246 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4247 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4248
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4249 cln = ngx_pool_cleanup_add(cf->pool, 0);
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4250 if (cln == NULL) {
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4251 return NGX_ERROR;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4252 }
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4253
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4254 cln->handler = ngx_ssl_session_ticket_keys_cleanup;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4255 cln->data = keys;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4256
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4257 path = paths->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4258 for (i = 0; i < paths->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4259
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4260 if (ngx_conf_full_name(cf->cycle, &path[i], 1) != NGX_OK) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4261 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4262 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4263
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4264 ngx_memzero(&file, sizeof(ngx_file_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4265 file.name = path[i];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4266 file.log = cf->log;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4267
7087 47b7ffc3339d Fixed calls to ngx_open_file() in certain places. Sergey Kandaurov <pluknet@nginx.com> parents: 7086 diff changeset	4268 file.fd = ngx_open_file(file.name.data, NGX_FILE_RDONLY,
47b7ffc3339d Fixed calls to ngx_open_file() in certain places. Sergey Kandaurov <pluknet@nginx.com> parents: 7086 diff changeset	4269 NGX_FILE_OPEN, 0);
7086 577628e6b6a6 Style. Sergey Kandaurov <pluknet@nginx.com> parents: 7074 diff changeset	4270
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4271 if (file.fd == NGX_INVALID_FILE) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4272 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4273 ngx_open_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4274 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4275 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4276
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4277 if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4278 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4279 ngx_fd_info_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4280 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4281 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4282
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4283 size = ngx_file_size(&fi);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4284
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4285 if (size != 48 && size != 80) {
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4286 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4287 "\"%V\" must be 48 or 80 bytes", &file.name);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4288 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4289 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4290
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4291 n = ngx_read_file(&file, buf, size, 0);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4292
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4293 if (n == NGX_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4294 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4295 ngx_read_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4296 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4297 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4298
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4299 if ((size_t) n != size) {
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4300 ngx_conf_log_error(NGX_LOG_CRIT, cf, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4301 ngx_read_file_n " \"%V\" returned only "
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4302 "%z bytes instead of %uz", &file.name, n, size);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4303 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4304 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4305
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4306 key = ngx_array_push(keys);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4307 if (key == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4308 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4309 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4310
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4311 if (size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4312 key->size = 48;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4313 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4314 ngx_memcpy(key->aes_key, buf + 16, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4315 ngx_memcpy(key->hmac_key, buf + 32, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4316
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4317 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4318 key->size = 80;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4319 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4320 ngx_memcpy(key->hmac_key, buf + 16, 32);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4321 ngx_memcpy(key->aes_key, buf + 48, 32);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4322 }
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4323
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4324 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4325 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4326 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4327 }
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4328
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4329 ngx_explicit_memzero(&buf, 80);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4330 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4331
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4332 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_ticket_keys_index, keys)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4333 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4334 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4335 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4336 "SSL_CTX_set_ex_data() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4337 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4338 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4339
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4340 if (SSL_CTX_set_tlsext_ticket_key_cb(ssl->ctx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4341 ngx_ssl_session_ticket_key_callback)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4342 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4343 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4344 ngx_log_error(NGX_LOG_WARN, cf->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4345 "nginx was built with Session Tickets support, however, "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4346 "now it is linked dynamically to an OpenSSL library "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4347 "which has no tlsext support, therefore Session Tickets "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4348 "are not available");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4349 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4350
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4351 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4352
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4353 failed:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4354
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4355 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4356 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4357 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4358 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4359
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4360 ngx_explicit_memzero(&buf, 80);
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4361
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4362 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4363 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4364
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4365
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4366 static int
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4367 ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4368 unsigned char name, unsigned char iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4369 HMAC_CTX *hctx, int enc)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4370 {
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4371 size_t size;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4372 SSL_CTX *ssl_ctx;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4373 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4374 ngx_array_t *keys;
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	4375 ngx_connection_t *c;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4376 ngx_ssl_session_ticket_key_t *key;
6686 f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4377 const EVP_MD *digest;
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4378 const EVP_CIPHER *cipher;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4379 #if (NGX_DEBUG)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4380 u_char buf[32];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4381 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4382
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	4383 c = ngx_ssl_get_connection(ssl_conn);
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	4384 ssl_ctx = c->ssl->session_ctx;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4385
6686 f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4386 #ifdef OPENSSL_NO_SHA256
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4387 digest = EVP_sha1();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4388 #else
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4389 digest = EVP_sha256();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4390 #endif
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	4391
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4392 keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_ticket_keys_index);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4393 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4394 return -1;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4395 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4396
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4397 key = keys->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4398
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4399 if (enc == 1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4400 /* encrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4401
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	4402 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4403 "ssl session ticket encrypt, key: \"%*s\" (%s session)",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4404 ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4405 SSL_session_reused(ssl_conn) ? "reused" : "new");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4406
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4407 if (key[0].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4408 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4409 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4410
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4411 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4412 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4413 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4414 }
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4415
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4416 if (RAND_bytes(iv, EVP_CIPHER_iv_length(cipher)) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4417 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "RAND_bytes() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4418 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4419 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4420
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4421 if (EVP_EncryptInit_ex(ectx, cipher, NULL, key[0].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4422 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4423 "EVP_EncryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4424 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4425 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4426
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4427 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4428 if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4429 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4430 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4431 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4432 #else
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4433 HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL);
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4434 #endif
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4435
5760 4b668378ad8b Style: use ngx_memcpy() instead of memcpy(). Piotr Sikora <piotr@cloudflare.com> parents: 5756 diff changeset	4436 ngx_memcpy(name, key[0].name, 16);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4437
6660 3eb1a92a2f05 SSL: adopted session ticket handling for OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6659 diff changeset	4438 return 1;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4439
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4440 } else {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4441 /* decrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4442
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4443 for (i = 0; i < keys->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4444 if (ngx_memcmp(name, key[i].name, 16) == 0) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4445 goto found;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4446 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4447 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4448
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	4449 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4450 "ssl session ticket decrypt, key: \"%*s\" not found",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4451 ngx_hex_dump(buf, name, 16) - buf, buf);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4452
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4453 return 0;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4454
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4455 found:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4456
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	4457 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4458 "ssl session ticket decrypt, key: \"%*s\"%s",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4459 ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4460 (i == 0) ? " (default)" : "");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4461
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4462 if (key[i].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4463 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4464 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4465
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4466 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4467 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4468 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4469 }
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4470
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4471 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4472 if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4473 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4474 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4475 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4476 #else
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	4477 HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL);
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4478 #endif
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4479
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4480 if (EVP_DecryptInit_ex(ectx, cipher, NULL, key[i].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4481 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4482 "EVP_DecryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4483 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	4484 }
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4485
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4486 return (i == 0) ? 1 : 2 /* renew */;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4487 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4488 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4489
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4490
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4491 static void
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4492 ngx_ssl_session_ticket_keys_cleanup(void *data)
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4493 {
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4494 ngx_array_t *keys = data;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4495
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4496 ngx_explicit_memzero(keys->elts,
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4497 keys->nelts * sizeof(ngx_ssl_session_ticket_key_t));
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4498 }
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	4499
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4500 #else
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4501
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4502 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4503 ngx_ssl_session_ticket_keys(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4504 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4505 if (paths) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4506 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
7074 07a49cce21ca SSL: fixed typo in the error message. Sergey Kandaurov <pluknet@nginx.com> parents: 6995 diff changeset	4507 "\"ssl_session_ticket_key\" ignored, not supported");
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4508 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4509
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4510 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4511 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4512
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4513 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4514
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	4515
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	4516 void
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	4517 ngx_ssl_cleanup_ctx(void *data)
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	4518 {
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	4519 ngx_ssl_t *ssl = data;
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	4520
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4521 X509 cert, next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4522
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4523 cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4524
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4525 while (cert) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4526 next = X509_get_ex_data(cert, ngx_ssl_next_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4527 X509_free(cert);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4528 cert = next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4529 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	4530
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	4531 SSL_CTX_free(ssl->ctx);
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	4532 }
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4533
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4534
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4535 ngx_int_t
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4536 ngx_ssl_check_host(ngx_connection_t c, ngx_str_t name)
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4537 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4538 X509 *cert;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4539
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4540 cert = SSL_get_peer_certificate(c->ssl->connection);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4541 if (cert == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4542 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4543 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4544
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	4545 #ifdef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4546
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4547 /* X509_check_host() is only available in OpenSSL 1.0.2+ */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4548
5669 cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	4549 if (name->len == 0) {
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	4550 goto failed;
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	4551 }
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	4552
5767 abd460ece11e SSL: fix build with recent OpenSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5760 diff changeset	4553 if (X509_check_host(cert, (char *) name->data, name->len, 0, NULL) != 1) {
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4554 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4555 "X509_check_host(): no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4556 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4557 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4558
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4559 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4560 "X509_check_host(): match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4561
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4562 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4563
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4564 #else
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4565 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4566 int n, i;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4567 X509_NAME *sname;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4568 ASN1_STRING *str;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4569 X509_NAME_ENTRY *entry;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4570 GENERAL_NAME *altname;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4571 STACK_OF(GENERAL_NAME) *altnames;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4572
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4573 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4574 * As per RFC6125 and RFC2818, we check subjectAltName extension,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4575 * and if it's not present - commonName in Subject is checked.
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4576 */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4577
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4578 altnames = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4579
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4580 if (altnames) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4581 n = sk_GENERAL_NAME_num(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4582
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4583 for (i = 0; i < n; i++) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4584 altname = sk_GENERAL_NAME_value(altnames, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4585
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4586 if (altname->type != GEN_DNS) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4587 continue;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4588 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4589
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4590 str = altname->d.dNSName;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4591
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4592 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4593 "SSL subjectAltName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4594 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4595
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4596 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4597 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4598 "SSL subjectAltName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4599 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4600 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4601 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4602 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4603
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4604 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4605 "SSL subjectAltName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4606
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4607 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4608 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4609 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4610
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4611 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4612 * If there is no subjectAltName extension, check commonName
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4613 * in Subject. While RFC2818 requires to only check "most specific"
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4614 * CN, both Apache and OpenSSL check all CNs, and so do we.
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4615 */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4616
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4617 sname = X509_get_subject_name(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4618
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4619 if (sname == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4620 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4621 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4622
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4623 i = -1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4624 for ( ;; ) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4625 i = X509_NAME_get_index_by_NID(sname, NID_commonName, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4626
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4627 if (i < 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4628 break;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4629 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4630
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4631 entry = X509_NAME_get_entry(sname, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4632 str = X509_NAME_ENTRY_get_data(entry);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4633
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4634 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4635 "SSL commonName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4636 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4637
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4638 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4639 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4640 "SSL commonName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4641 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4642 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4643 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4644
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4645 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4646 "SSL commonName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4647 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4648 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4649
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4650 failed:
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4651
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4652 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4653 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4654
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4655 found:
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4656
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4657 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4658 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4659 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4660
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4661
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	4662 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4663
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4664 static ngx_int_t
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4665 ngx_ssl_check_name(ngx_str_t name, ASN1_STRING pattern)
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4666 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4667 u_char s, p, *end;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4668 size_t slen, plen;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4669
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4670 s = name->data;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4671 slen = name->len;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4672
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4673 p = ASN1_STRING_data(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4674 plen = ASN1_STRING_length(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4675
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4676 if (slen == plen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4677 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4678 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4679
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4680 if (plen > 2 && p[0] == '*' && p[1] == '.') {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4681 plen -= 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4682 p += 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4683
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4684 end = s + slen;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4685 s = ngx_strlchr(s, end, '.');
5666 a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	4686
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	4687 if (s == NULL) {
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	4688 return NGX_ERROR;
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	4689 }
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	4690
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4691 slen = end - s;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4692
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4693 if (plen == slen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4694 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4695 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4696 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4697
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4698 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4699 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4700
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4701 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4702
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4703
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	4704 ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4705 ngx_ssl_get_protocol(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4706 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4707 s->data = (u_char *) SSL_get_version(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4708 return NGX_OK;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4709 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4710
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4711
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4712 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4713 ngx_ssl_get_cipher_name(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4714 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4715 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4716 return NGX_OK;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4717 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4718
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	4719
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4720 ngx_int_t
6816 ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4721 ngx_ssl_get_ciphers(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4722 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4723 #ifdef SSL_CTRL_GET_RAW_CIPHERLIST
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4724
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4725 int n, i, bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4726 size_t len;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4727 u_char ciphers, p;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4728 const SSL_CIPHER *cipher;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4729
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4730 bytes = SSL_get0_raw_cipherlist(c->ssl->connection, NULL);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4731 n = SSL_get0_raw_cipherlist(c->ssl->connection, &ciphers);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4732
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4733 if (n <= 0) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4734 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4735 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4736 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4737
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4738 len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4739 n /= bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4740
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4741 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4742 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4743
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4744 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4745 len += ngx_strlen(SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4746
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4747 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4748 len += sizeof("0x") - 1 + bytes * (sizeof("00") - 1);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4749 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4750
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4751 len += sizeof(":") - 1;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4752 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4753
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4754 s->data = ngx_pnalloc(pool, len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4755 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4756 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4757 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4758
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4759 p = s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4760
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4761 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4762 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4763
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4764 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4765 p = ngx_sprintf(p, "%s", SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4766
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4767 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4768 p = ngx_sprintf(p, "0x");
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4769 p = ngx_hex_dump(p, ciphers + i * bytes, bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4770 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4771
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4772 *p++ = ':';
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4773 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4774
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4775 p--;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4776
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4777 s->len = p - s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4778
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4779 #else
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4780
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4781 u_char buf[4096];
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4782
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4783 if (SSL_get_shared_ciphers(c->ssl->connection, (char *) buf, 4096)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4784 == NULL)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4785 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4786 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4787 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4788 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4789
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4790 s->len = ngx_strlen(buf);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4791 s->data = ngx_pnalloc(pool, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4792 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4793 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4794 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4795
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4796 ngx_memcpy(s->data, buf, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4797
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4798 #endif
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4799
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4800 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4801 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4802
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4803
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4804 ngx_int_t
6817 e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4805 ngx_ssl_get_curves(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4806 {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4807 #ifdef SSL_CTRL_GET_CURVES
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4808
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4809 int *curves, n, i, nid;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4810 u_char *p;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4811 size_t len;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4812
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4813 n = SSL_get1_curves(c->ssl->connection, NULL);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4814
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4815 if (n <= 0) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4816 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4817 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4818 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4819
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4820 curves = ngx_palloc(pool, n * sizeof(int));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4821
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4822 n = SSL_get1_curves(c->ssl->connection, curves);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4823 len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4824
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4825 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4826 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4827
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4828 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4829 len += sizeof("0x0000") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4830
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4831 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4832 len += ngx_strlen(OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4833 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4834
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4835 len += sizeof(":") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4836 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4837
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4838 s->data = ngx_pnalloc(pool, len);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4839 if (s->data == NULL) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4840 return NGX_ERROR;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4841 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4842
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4843 p = s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4844
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4845 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4846 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4847
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4848 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4849 p = ngx_sprintf(p, "0x%04xd", nid & 0xffff);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4850
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4851 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4852 p = ngx_sprintf(p, "%s", OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4853 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4854
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4855 *p++ = ':';
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4856 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4857
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4858 p--;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4859
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4860 s->len = p - s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4861
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4862 #else
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4863
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4864 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4865
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4866 #endif
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4867
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4868 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4869 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4870
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4871
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4872 ngx_int_t
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4873 ngx_ssl_get_session_id(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4874 {
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4875 u_char *buf;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4876 SSL_SESSION *sess;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4877 unsigned int len;
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4878
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4879 sess = SSL_get0_session(c->ssl->connection);
5537 49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4880 if (sess == NULL) {
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4881 s->len = 0;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4882 return NGX_OK;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4883 }
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4884
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4885 buf = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4886
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4887 s->len = 2 * len;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4888 s->data = ngx_pnalloc(pool, 2 * len);
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4889 if (s->data == NULL) {
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4890 return NGX_ERROR;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4891 }
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4892
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4893 ngx_hex_dump(s->data, buf, len);
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4894
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4895 return NGX_OK;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4896 }
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4897
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4898
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4899 ngx_int_t
5573 7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4900 ngx_ssl_get_session_reused(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4901 {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4902 if (SSL_session_reused(c->ssl->connection)) {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4903 ngx_str_set(s, "r");
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4904
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4905 } else {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4906 ngx_str_set(s, ".");
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4907 }
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4908
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4909 return NGX_OK;
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4910 }
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4911
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4912
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4913 ngx_int_t
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4914 ngx_ssl_get_early_data(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4915 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4916 s->len = 0;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4917
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4918 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4919
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4920 /* BoringSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4921
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4922 if (SSL_in_early_data(c->ssl->connection)) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4923 ngx_str_set(s, "1");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4924 }
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4925
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4926 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4927
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4928 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4929
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4930 if (!SSL_is_init_finished(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4931 ngx_str_set(s, "1");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4932 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4933
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4934 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4935
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4936 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4937 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4938
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4939
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4940 ngx_int_t
5658 94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4941 ngx_ssl_get_server_name(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4942 {
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4943 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4944
7092 2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4945 size_t len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4946 const char *name;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4947
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4948 name = SSL_get_servername(c->ssl->connection, TLSEXT_NAMETYPE_host_name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4949
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4950 if (name) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4951 len = ngx_strlen(name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4952
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4953 s->len = len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4954 s->data = ngx_pnalloc(pool, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4955 if (s->data == NULL) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4956 return NGX_ERROR;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4957 }
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4958
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4959 ngx_memcpy(s->data, name, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4960
5658 94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4961 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4962 }
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4963
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4964 #endif
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4965
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4966 s->len = 0;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4967 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4968 }
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4969
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4970
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4971 ngx_int_t
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4972 ngx_ssl_get_raw_certificate(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2045 2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4973 {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4974 size_t len;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4975 BIO *bio;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4976 X509 *cert;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4977
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4978 s->len = 0;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4979
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4980 cert = SSL_get_peer_certificate(c->ssl->connection);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4981 if (cert == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4982 return NGX_OK;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4983 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4984
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4985 bio = BIO_new(BIO_s_mem());
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4986 if (bio == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4987 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4988 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4989 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4990 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4991
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4992 if (PEM_write_bio_X509(bio, cert) == 0) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4993 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed");
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4994 goto failed;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4995 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4996
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4997 len = BIO_pending(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4998 s->len = len;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4999
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	5000 s->data = ngx_pnalloc(pool, len);
2045 2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5001 if (s->data == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5002 goto failed;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5003 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5004
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5005 BIO_read(bio, s->data, len);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5006
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5007 BIO_free(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5008 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5009
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5010 return NGX_OK;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5011
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5012 failed:
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5013
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5014 BIO_free(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5015 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5016
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5017 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5018 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5019
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5020
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	5021 ngx_int_t
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5022 ngx_ssl_get_certificate(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5023 {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5024 u_char *p;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5025 size_t len;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5026 ngx_uint_t i;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5027 ngx_str_t cert;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5028
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5029 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5030 return NGX_ERROR;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5031 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5032
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5033 if (cert.len == 0) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5034 s->len = 0;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5035 return NGX_OK;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5036 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5037
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5038 len = cert.len - 1;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5039
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5040 for (i = 0; i < cert.len - 1; i++) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5041 if (cert.data[i] == LF) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5042 len++;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5043 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5044 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5045
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5046 s->len = len;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5047 s->data = ngx_pnalloc(pool, len);
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5048 if (s->data == NULL) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5049 return NGX_ERROR;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5050 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5051
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5052 p = s->data;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5053
3002 bf0c7e58e016 fix memory corruption in $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2997 diff changeset	5054 for (i = 0; i < cert.len - 1; i++) {
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5055 *p++ = cert.data[i];
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5056 if (cert.data[i] == LF) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5057 *p++ = '\t';
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5058 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5059 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5060
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5061 return NGX_OK;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5062 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5063
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5064
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	5065 ngx_int_t
7091 82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5066 ngx_ssl_get_escaped_certificate(ngx_connection_t c, ngx_pool_t pool,
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5067 ngx_str_t *s)
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5068 {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5069 ngx_str_t cert;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5070 uintptr_t n;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5071
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5072 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5073 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5074 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5075
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5076 if (cert.len == 0) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5077 s->len = 0;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5078 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5079 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5080
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5081 n = ngx_escape_uri(NULL, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5082
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5083 s->len = cert.len + n * 2;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5084 s->data = ngx_pnalloc(pool, s->len);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5085 if (s->data == NULL) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5086 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5087 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5088
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5089 ngx_escape_uri(s->data, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5090
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5091 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5092 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5093
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5094
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	5095 ngx_int_t
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5096 ngx_ssl_get_subject_dn(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5097 {
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5098 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5099 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5100 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5101
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5102 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5103
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5104 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5105 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5106 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5107 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5108
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5109 name = X509_get_subject_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5110 if (name == NULL) {
7484 65074e13f171 SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn. Nikolay Morozov <n.morozov@securitycode.ru> parents: 7477 diff changeset	5111 X509_free(cert);
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5112 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5113 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5114
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5115 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5116 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5117 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5118 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5119 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5120
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5121 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5122 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5123 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5124
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5125 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5126 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5127 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5128 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5129 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5130
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5131 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5132
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5133 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5134 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5135
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5136 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5137
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5138 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5139
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5140 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5141 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5142
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5143 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5144 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5145
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5146
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5147 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5148 ngx_ssl_get_issuer_dn(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5149 {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5150 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5151 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5152 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5153
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5154 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5155
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5156 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5157 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5158 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5159 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5160
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5161 name = X509_get_issuer_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5162 if (name == NULL) {
7484 65074e13f171 SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn. Nikolay Morozov <n.morozov@securitycode.ru> parents: 7477 diff changeset	5163 X509_free(cert);
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5164 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5165 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5166
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5167 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5168 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5169 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5170 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5171 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5172
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5173 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5174 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5175 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5176
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5177 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5178 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5179 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5180 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5181 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5182
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5183 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5184
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5185 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5186 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5187
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5188 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5189
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5190 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5191
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5192 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5193 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5194
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5195 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5196 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5197
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5198
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5199 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5200 ngx_ssl_get_subject_dn_legacy(ngx_connection_t c, ngx_pool_t pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5201 ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5202 {
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5203 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5204 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5205 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5206 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5207
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5208 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5209
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5210 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5211 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5212 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5213 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5214
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5215 name = X509_get_subject_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5216 if (name == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5217 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5218 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5219 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5220
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5221 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5222
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5223 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5224
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5225 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	5226 s->data = ngx_pnalloc(pool, len);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5227 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5228 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5229 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5230 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5231 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5232
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5233 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5234
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5235 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5236 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5237
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5238 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5239 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5240
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5241
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5242 ngx_int_t
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5243 ngx_ssl_get_issuer_dn_legacy(ngx_connection_t c, ngx_pool_t pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	5244 ngx_str_t *s)
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5245 {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5246 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5247 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5248 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5249 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5250
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5251 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5252
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5253 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5254 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5255 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5256 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5257
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5258 name = X509_get_issuer_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5259 if (name == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5260 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5261 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5262 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5263
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5264 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5265
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5266 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5267
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5268 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	5269 s->data = ngx_pnalloc(pool, len);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5270 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5271 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5272 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5273 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5274 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5275
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5276 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5277
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5278 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5279 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5280
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5281 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5282 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5283
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	5284
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5285 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5286 ngx_ssl_get_serial_number(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5287 {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5288 size_t len;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5289 X509 *cert;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5290 BIO *bio;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5291
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5292 s->len = 0;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5293
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5294 cert = SSL_get_peer_certificate(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5295 if (cert == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5296 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5297 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5298
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5299 bio = BIO_new(BIO_s_mem());
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5300 if (bio == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5301 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5302 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5303 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5304
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5305 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5306 len = BIO_pending(bio);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5307
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5308 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	5309 s->data = ngx_pnalloc(pool, len);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5310 if (s->data == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5311 BIO_free(bio);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5312 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5313 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5314 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5315
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5316 BIO_read(bio, s->data, len);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5317 BIO_free(bio);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	5318 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5319
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5320 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5321 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5322
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	5323
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5324 ngx_int_t
5700 5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5325 ngx_ssl_get_fingerprint(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5326 {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5327 X509 *cert;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5328 unsigned int len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5329 u_char buf[EVP_MAX_MD_SIZE];
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5330
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5331 s->len = 0;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5332
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5333 cert = SSL_get_peer_certificate(c->ssl->connection);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5334 if (cert == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5335 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5336 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5337
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5338 if (!X509_digest(cert, EVP_sha1(), buf, &len)) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5339 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5340 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5341 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5342
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5343 s->len = 2 * len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5344 s->data = ngx_pnalloc(pool, 2 * len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5345 if (s->data == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5346 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5347 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5348 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5349
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5350 ngx_hex_dump(s->data, buf, len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5351
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5352 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5353
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5354 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5355 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5356
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5357
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	5358 ngx_int_t
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5359 ngx_ssl_get_client_verify(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5360 {
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5361 X509 *cert;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5362 long rc;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5363 const char *str;
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5364
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5365 cert = SSL_get_peer_certificate(c->ssl->connection);
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5366 if (cert == NULL) {
3516 dd1570b6f237 ngx_str_set() and ngx_str_null() Igor Sysoev <igor@sysoev.ru> parents: 3488 diff changeset	5367 ngx_str_set(s, "NONE");
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5368 return NGX_OK;
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5369 }
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5370
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5371 X509_free(cert);
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5372
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5373 rc = SSL_get_verify_result(c->ssl->connection);
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5374
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5375 if (rc == X509_V_OK) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5376 ngx_str_set(s, "SUCCESS");
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5377 return NGX_OK;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5378 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5379
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5380 str = X509_verify_cert_error_string(rc);
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5381
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5382 s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str));
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5383 if (s->data == NULL) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5384 return NGX_ERROR;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5385 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5386
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5387 s->len = ngx_sprintf(s->data, "FAILED:%s", str) - s->data;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	5388
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5389 return NGX_OK;
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5390 }
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5391
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	5392
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5393 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5394 ngx_ssl_get_client_v_start(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5395 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5396 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5397 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5398 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5399
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5400 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5401
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5402 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5403 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5404 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5405 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5406
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5407 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5408 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5409 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5410 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5411 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5412
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5413 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5414 ASN1_TIME_print(bio, X509_get0_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5415 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5416 ASN1_TIME_print(bio, X509_get_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5417 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5418
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5419 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5420
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5421 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5422 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5423 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5424 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5425 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5426 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5427 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5428
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5429 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5430 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5431 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5432
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5433 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5434 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5435
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5436
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5437 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5438 ngx_ssl_get_client_v_end(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5439 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5440 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5441 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5442 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5443
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5444 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5445
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5446 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5447 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5448 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5449 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5450
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5451 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5452 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5453 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5454 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5455 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5456
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5457 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5458 ASN1_TIME_print(bio, X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5459 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5460 ASN1_TIME_print(bio, X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5461 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5462
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5463 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5464
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5465 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5466 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5467 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5468 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5469 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5470 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5471 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5472
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5473 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5474 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5475 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5476
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5477 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5478 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5479
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5480
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5481 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5482 ngx_ssl_get_client_v_remain(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5483 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5484 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5485 time_t now, end;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5486
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5487 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5488
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5489 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5490 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5491 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5492 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5493
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5494 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5495 end = ngx_ssl_parse_time(X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5496 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5497 end = ngx_ssl_parse_time(X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5498 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5499
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5500 if (end == (time_t) NGX_ERROR) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5501 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5502 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5503 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5504
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5505 now = ngx_time();
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5506
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5507 if (end < now + 86400) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5508 ngx_str_set(s, "0");
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5509 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5510 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5511 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5512
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5513 s->data = ngx_pnalloc(pool, NGX_TIME_T_LEN);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5514 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5515 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5516 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5517 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5518
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5519 s->len = ngx_sprintf(s->data, "%T", (end - now) / 86400) - s->data;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5520
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5521 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5522
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5523 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5524 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5525
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5526
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5527 static time_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5528 ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5529 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5530 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5531 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5532 ASN1_TIME *asn1time)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5533 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5534 BIO *bio;
6842 25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	5535 char *value;
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5536 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5537 time_t time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5538
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5539 /*
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5540 * OpenSSL doesn't provide a way to convert ASN1_TIME
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5541 * into time_t. To do this, we use ASN1_TIME_print(),
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5542 * which uses the "MMM DD HH:MM:SS YYYY [GMT]" format (e.g.,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5543 * "Feb 3 00:55:52 2015 GMT"), and parse the result.
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5544 */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5545
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5546 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5547 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5548 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5549 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5550
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5551 /* fake weekday prepended to match C asctime() format */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5552
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5553 BIO_write(bio, "Tue ", sizeof("Tue ") - 1);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5554 ASN1_TIME_print(bio, asn1time);
6842 25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	5555 len = BIO_get_mem_data(bio, &value);
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	5556
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	5557 time = ngx_parse_http_time((u_char *) value, len);
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5558
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5559 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5560
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5561 return time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5562 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5563
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	5564
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5565 static void *
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5566 ngx_openssl_create_conf(ngx_cycle_t *cycle)
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5567 {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5568 ngx_openssl_conf_t *oscf;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	5569
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5570 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5571 if (oscf == NULL) {
2912 c7d57b539248 return NULL instead of NGX_CONF_ERROR on a create conf failure Igor Sysoev <igor@sysoev.ru> parents: 2764 diff changeset	5572 return NULL;
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5573 }
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	5574
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5575 /*
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5576 * set by ngx_pcalloc():
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	5577 *
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5578 * oscf->engine = 0;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	5579 */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5580
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5581 return oscf;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5582 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5583
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5584
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5585 static char *
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5586 ngx_openssl_engine(ngx_conf_t cf, ngx_command_t cmd, void *conf)
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5587 {
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5588 #ifndef OPENSSL_NO_ENGINE
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5589
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5590 ngx_openssl_conf_t *oscf = conf;
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5591
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5592 ENGINE *engine;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5593 ngx_str_t *value;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5594
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5595 if (oscf->engine) {
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5596 return "is duplicate";
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5597 }
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	5598
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5599 oscf->engine = 1;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5600
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5601 value = cf->args->elts;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5602
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	5603 engine = ENGINE_by_id((char *) value[1].data);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5604
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5605 if (engine == NULL) {
6699 9cf2dce316e5 Fixed log levels of configuration parsing errors. Valentin Bartenev <vbart@nginx.com> parents: 6687 diff changeset	5606 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5607 "ENGINE_by_id(\"%V\") failed", &value[1]);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5608 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5609 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5610
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5611 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
6699 9cf2dce316e5 Fixed log levels of configuration parsing errors. Valentin Bartenev <vbart@nginx.com> parents: 6687 diff changeset	5612 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5613 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5614 &value[1]);
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5615
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5616 ENGINE_free(engine);
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5617
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5618 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5619 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5620
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5621 ENGINE_free(engine);
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5622
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	5623 return NGX_CONF_OK;
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5624
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5625 #else
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5626
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5627 return "is not supported";
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5628
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5629 #endif
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	5630 }
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5631
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5632
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5633 static void
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5634 ngx_openssl_exit(ngx_cycle_t *cycle)
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5635 {
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	5636 #if OPENSSL_VERSION_NUMBER < 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	5637
3464 7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	5638 EVP_cleanup();
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5639 #ifndef OPENSSL_NO_ENGINE
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5640 ENGINE_cleanup();
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	5641 #endif
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	5642
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	5643 #endif
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	5644 }

Mercurial > hg > nginx-quic

annotate src/event/ngx_event_openssl.c @ 7636:53a5cdbe500c quic