annotate src/event/ngx_event_openssl.c @ 294:27d9d1f26b38 NGINX_0_5_17

nginx 0.5.17 *) Change: now nginx always returns the 405 status for the TRACE method. *) Feature: now nginx supports the "include" directive inside the "types" block. *) Bugfix: the $document_root variable usage in the "root" and "alias" directives is disabled: this caused recursive stack overflow. *) Bugfix: in the HTTPS protocol in the "proxy_pass" directive. *) Bugfix: in some cases non-cachable variables (such as $uri variable) returned old cached value.
author Igor Sysoev <http://sysoev.ru>
date Mon, 02 Apr 2007 00:00:00 +0400
parents c5c2b2883984
children 9b7db0df50f0
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
2 /*
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
3 * Copyright (C) Igor Sysoev
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
4 */
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
5
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
6
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
7 #include <ngx_config.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
8 #include <ngx_core.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
9 #include <ngx_event.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
10
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
11
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
12 typedef struct {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
13 ngx_str_t engine;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
14 } ngx_openssl_conf_t;
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
15
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
16
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
17 static int ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
18 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
19 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
20 static void ngx_ssl_write_handler(ngx_event_t *wev);
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
21 static void ngx_ssl_read_handler(ngx_event_t *rev);
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
22 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
23 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
24 ngx_err_t err, char *text);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
25
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
26 static ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
27 void *data);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
28 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
29 ngx_ssl_session_t *sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
30 static ngx_ssl_session_t *ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
31 u_char *id, int len, int *copy);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
32 static void ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
33 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
34 ngx_slab_pool_t *shpool, ngx_uint_t n);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
35 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
36 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
37
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
38 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
39 static char *ngx_openssl_init_conf(ngx_cycle_t *cycle, void *conf);
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
40 static void ngx_openssl_exit(ngx_cycle_t *cycle);
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
41
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
42 #if !(NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
43 static char *ngx_openssl_noengine(ngx_conf_t *cf, ngx_command_t *cmd,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
44 void *conf);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
45 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
46
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
47
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
48 static ngx_command_t ngx_openssl_commands[] = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
49
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
50 { ngx_string("ssl_engine"),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
51 NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
52 #if (NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
53 ngx_conf_set_str_slot,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
54 #else
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
55 ngx_openssl_noengine,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
56 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
57 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
58 offsetof(ngx_openssl_conf_t, engine),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
59 NULL },
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
60
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
61 ngx_null_command
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
62 };
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
63
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
64
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
65 static ngx_core_module_t ngx_openssl_module_ctx = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
66 ngx_string("openssl"),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
67 ngx_openssl_create_conf,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
68 ngx_openssl_init_conf
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
69 };
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
70
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
71
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
72 ngx_module_t ngx_openssl_module = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
73 NGX_MODULE_V1,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
74 &ngx_openssl_module_ctx, /* module context */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
75 ngx_openssl_commands, /* module directives */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
76 NGX_CORE_MODULE, /* module type */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
77 NULL, /* init master */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
78 NULL, /* init module */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
79 NULL, /* init process */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
80 NULL, /* init thread */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
81 NULL, /* exit thread */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
82 NULL, /* exit process */
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
83 ngx_openssl_exit, /* exit master */
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
84 NGX_MODULE_V1_PADDING
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
85 };
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
86
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
87
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
88 static long ngx_ssl_protocols[] = {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
89 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
90 SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
91 SSL_OP_NO_SSLv2|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
92 SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
93 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
94 SSL_OP_NO_SSLv3,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
95 SSL_OP_NO_SSLv2,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
96 0,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
97 };
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
98
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
99
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
100 int ngx_ssl_connection_index;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
101 int ngx_ssl_server_conf_index;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
102 int ngx_ssl_session_cache_index;
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
103
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
104
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
105 ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
106 ngx_ssl_init(ngx_log_t *log)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
107 {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
108 #if OPENSSL_VERSION_NUMBER >= 0x00907000
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
109 OPENSSL_config(NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
110 #endif
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
111
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
112 SSL_library_init();
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
113 SSL_load_error_strings();
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
114
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
115 #if (NGX_SSL_ENGINE)
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
116 ENGINE_load_builtin_engines();
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
117 #endif
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
118
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
119 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
120
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
121 if (ngx_ssl_connection_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
122 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
123 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
124 }
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
125
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
126 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
127 NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
128 if (ngx_ssl_server_conf_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
129 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
130 "SSL_CTX_get_ex_new_index() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
131 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
132 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
133
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
134 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
135 NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
136 if (ngx_ssl_session_cache_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
137 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
138 "SSL_CTX_get_ex_new_index() failed");
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
139 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
140 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
141
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
142 return NGX_OK;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
143 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
144
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
145
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
146 ngx_int_t
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
147 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
148 {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
149 ssl->ctx = SSL_CTX_new(SSLv23_method());
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
150
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
151 if (ssl->ctx == NULL) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
152 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
153 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
154 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
155
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
156 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
157 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
158 "SSL_CTX_set_ex_data() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
159 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
160 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
161
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
162 /* client side options */
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
163
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
164 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
165 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
166 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
167
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
168 /* server side options */
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
169
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
170 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
171 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
172
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
173 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
174 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
175
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
176 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
177 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
178 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
179
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
180 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
181 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
182 #endif
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
183
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
184
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
185 if (ngx_ssl_protocols[protocols >> 1] != 0) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
186 SSL_CTX_set_options(ssl->ctx, ngx_ssl_protocols[protocols >> 1]);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
187 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
188
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
189 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
190
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
191 SSL_CTX_set_read_ahead(ssl->ctx, 1);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
192
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
193 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
194 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
195
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
196
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
197 ngx_int_t
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
198 ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
199 ngx_str_t *key)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
200 {
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
201 if (ngx_conf_full_name(cf->cycle, cert) == NGX_ERROR) {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
202 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
203 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
204
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
205 if (SSL_CTX_use_certificate_chain_file(ssl->ctx, (char *) cert->data)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
206 == 0)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
207 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
208 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
209 "SSL_CTX_use_certificate_chain_file(\"%s\") failed",
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
210 cert->data);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
211 return NGX_ERROR;
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
212 }
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
213
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
214 if (ngx_conf_full_name(cf->cycle, key) == NGX_ERROR) {
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
215 return NGX_ERROR;
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
216 }
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
217
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
218 if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data,
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
219 SSL_FILETYPE_PEM)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
220 == 0)
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
221 {
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
222 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
223 "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
224 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
225 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
226
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
227 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
228 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
229
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
230
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
231 ngx_int_t
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
232 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
233 ngx_int_t depth)
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
234 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
235 STACK_OF(X509_NAME) *list;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
236
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
237 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_http_ssl_verify_callback);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
238
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
239 SSL_CTX_set_verify_depth(ssl->ctx, depth);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
240
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
241 if (cert->len == 0) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
242 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
243 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
244
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
245 if (ngx_conf_full_name(cf->cycle, cert) == NGX_ERROR) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
246 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
247 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
248
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
249 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
250 == 0)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
251 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
252 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
253 "SSL_CTX_load_verify_locations(\"%s\") failed",
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
254 cert->data);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
255 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
256 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
257
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
258 list = SSL_load_client_CA_file((char *) cert->data);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
259
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
260 if (list == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
261 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
262 "SSL_load_client_CA_file(\"%s\") failed", cert->data);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
263 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
264 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
265
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
266 /*
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
267 * before 0.9.7h and 0.9.8 SSL_load_client_CA_file()
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
268 * always leaved an error in the error queue
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
269 */
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
270
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
271 ERR_clear_error();
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
272
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
273 SSL_CTX_set_client_CA_list(ssl->ctx, list);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
274
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
275 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
276 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
277
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
278
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
279 static int
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
280 ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
281 {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
282 char *subject, *issuer;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
283 int err, depth;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
284 X509 *cert;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
285 X509_NAME *name;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
286 ngx_connection_t *c;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
287 ngx_ssl_conn_t *ssl_conn;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
288
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
289 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
290 SSL_get_ex_data_X509_STORE_CTX_idx());
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
291
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
292 c = ngx_ssl_get_connection(ssl_conn);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
293
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
294 cert = X509_STORE_CTX_get_current_cert(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
295 err = X509_STORE_CTX_get_error(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
296 depth = X509_STORE_CTX_get_error_depth(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
297
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
298 name = X509_get_subject_name(cert);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
299 subject = name ? X509_NAME_oneline(name, NULL, 0) : "(none)";
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
300
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
301 name = X509_get_issuer_name(cert);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
302 issuer = name ? X509_NAME_oneline(name, NULL, 0) : "(none)";
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
303
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
304 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
305 "verify:%d, error:%d, depth:%d, "
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
306 "subject:\"%s\",issuer: \"%s\"",
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
307 ok, err, depth, subject, issuer);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
308
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
309 return 1;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
310 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
311
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
312
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
313 ngx_int_t
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
314 ngx_ssl_generate_rsa512_key(ngx_ssl_t *ssl)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
315 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
316 RSA *key;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
317
108
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
318 if (SSL_CTX_need_tmp_RSA(ssl->ctx) == 0) {
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
319 return NGX_OK;
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
320 }
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
321
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
322 key = RSA_generate_key(512, RSA_F4, NULL, NULL);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
323
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
324 if (key) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
325 SSL_CTX_set_tmp_rsa(ssl->ctx, key);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
326
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
327 RSA_free(key);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
328
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
329 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
330 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
331
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
332 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "RSA_generate_key(512) failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
333
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
334 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
335 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
336
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
337
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
338 ngx_int_t
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
339 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
340 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
341 ngx_ssl_connection_t *sc;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
342
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
343 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
344 if (sc == NULL) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
345 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
346 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
347
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
348 if (flags & NGX_SSL_BUFFER) {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
349 sc->buffer = 1;
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
350
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
351 sc->buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
352 if (sc->buf == NULL) {
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
353 return NGX_ERROR;
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
354 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
355 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
356
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
357 sc->connection = SSL_new(ssl->ctx);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
358
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
359 if (sc->connection == NULL) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
360 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
361 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
362 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
363
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
364 if (SSL_set_fd(sc->connection, c->fd) == 0) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
365 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
366 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
367 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
368
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
369 if (flags & NGX_SSL_CLIENT) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
370 SSL_set_connect_state(sc->connection);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
371
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
372 } else {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
373 SSL_set_accept_state(sc->connection);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
374 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
375
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
376 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
377 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
378 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
379 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
380
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
381 c->ssl = sc;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
382
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
383 return NGX_OK;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
384 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
385
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
386
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
387 ngx_int_t
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
388 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
389 {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
390 if (session) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
391 if (SSL_set_session(c->ssl->connection, session) == 0) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
392 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
393 return NGX_ERROR;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
394 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
395 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
396
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
397 return NGX_OK;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
398 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
399
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
400
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
401 ngx_int_t
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
402 ngx_ssl_handshake(ngx_connection_t *c)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
403 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
404 int n, sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
405 ngx_err_t err;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
406
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
407 n = SSL_do_handshake(c->ssl->connection);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
408
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
409 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
410
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
411 if (n == 1) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
412
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
413 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
414 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
415 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
416
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
417 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
418 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
419 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
420
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
421 #if (NGX_DEBUG)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
422 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
423 char buf[129], *s, *d;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
424 SSL_CIPHER *cipher;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
425
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
426 cipher = SSL_get_current_cipher(c->ssl->connection);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
427
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
428 if (cipher) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
429 SSL_CIPHER_description(cipher, &buf[1], 128);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
430
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
431 for (s = &buf[1], d = buf; *s; s++) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
432 if (*s == ' ' && *d == ' ') {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
433 continue;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
434 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
435
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
436 if (*s == LF || *s == CR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
437 continue;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
438 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
439
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
440 *++d = *s;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
441 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
442
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
443 if (*d != ' ') {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
444 d++;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
445 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
446
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
447 *d = '\0';
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
448
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
449 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
450 "SSL: %s, cipher: \"%s\"",
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
451 SSL_get_version(c->ssl->connection), &buf[1]);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
452
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
453 if (SSL_session_reused(c->ssl->connection)) {
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
454 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
455 "SSL reused session");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
456 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
457
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
458 } else {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
459 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
460 "SSL no shared ciphers");
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
461 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
462 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
463 #endif
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
464
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
465 c->ssl->handshaked = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
466
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
467 c->recv = ngx_ssl_recv;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
468 c->send = ngx_ssl_write;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
469 c->recv_chain = ngx_ssl_recv_chain;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
470 c->send_chain = ngx_ssl_send_chain;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
471
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
472 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
473 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
474
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
475 sslerr = SSL_get_error(c->ssl->connection, n);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
476
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
477 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
478
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
479 if (sslerr == SSL_ERROR_WANT_READ) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
480 c->read->ready = 0;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
481 c->read->handler = ngx_ssl_handshake_handler;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
482 c->write->handler = ngx_ssl_handshake_handler;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
483
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
484 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
485 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
486 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
487
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
488 return NGX_AGAIN;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
489 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
490
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
491 if (sslerr == SSL_ERROR_WANT_WRITE) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
492 c->write->ready = 0;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
493 c->read->handler = ngx_ssl_handshake_handler;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
494 c->write->handler = ngx_ssl_handshake_handler;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
495
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
496 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
497 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
498 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
499
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
500 return NGX_AGAIN;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
501 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
502
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
503 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
504
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
505 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
506 c->ssl->no_send_shutdown = 1;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
507 c->read->eof = 1;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
508
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
509 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
510 ngx_log_error(NGX_LOG_INFO, c->log, err,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
511 "peer closed connection in SSL handshake");
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
512
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
513 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
514 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
515
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
516 c->read->error = 1;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
517
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
518 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
519
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
520 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
521 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
522
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
523
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
524 static void
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
525 ngx_ssl_handshake_handler(ngx_event_t *ev)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
526 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
527 ngx_connection_t *c;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
528
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
529 c = ev->data;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
530
98
8bf57caa374a nginx 0.2.3
Igor Sysoev <http://sysoev.ru>
parents: 96
diff changeset
531 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
532 "SSL handshake handler: %d", ev->write);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
533
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
534 if (ev->timedout) {
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
535 c->ssl->handler(c);
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
536 return;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
537 }
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
538
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
539 if (ngx_ssl_handshake(c) == NGX_AGAIN) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
540 return;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
541 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
542
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
543 c->ssl->handler(c);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
544 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
545
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
546
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
547 ssize_t
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
548 ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
549 {
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
550 u_char *last;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
551 ssize_t n, bytes;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
552 ngx_buf_t *b;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
553
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
554 bytes = 0;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
555
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
556 b = cl->buf;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
557 last = b->last;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
558
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
559 for ( ;; ) {
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
560
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
561 n = ngx_ssl_recv(c, last, b->end - last);
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
562
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
563 if (n > 0) {
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
564 last += n;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
565 bytes += n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
566
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
567 if (last == b->end) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
568 cl = cl->next;
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
569
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
570 if (cl == NULL) {
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
571 return bytes;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
572 }
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
573
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
574 b = cl->buf;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
575 last = b->last;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
576 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
577
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
578 continue;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
579 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
580
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
581 if (bytes) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
582 return bytes;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
583 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
584
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
585 return n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
586 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
587 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
588
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
589
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
590 ssize_t
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
591 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
592 {
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
593 int n, bytes;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
594
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
595 if (c->ssl->last == NGX_ERROR) {
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
596 return NGX_ERROR;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
597 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
598
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
599 if (c->ssl->last == NGX_DONE) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
600 return 0;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
601 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
602
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
603 bytes = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
604
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
605 /*
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
606 * SSL_read() may return data in parts, so try to read
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
607 * until SSL_read() would return no data
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
608 */
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
609
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
610 for ( ;; ) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
611
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
612 n = SSL_read(c->ssl->connection, buf, size);
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
613
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
614 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
615
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
616 if (n > 0) {
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
617 bytes += n;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
618 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
619
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
620 c->ssl->last = ngx_ssl_handle_recv(c, n);
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
621
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
622 if (c->ssl->last != NGX_OK) {
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
623
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
624 if (bytes) {
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
625 return bytes;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
626 }
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
627
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
628 if (c->ssl->last == NGX_DONE) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
629 return 0;
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
630 }
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
631
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
632 return c->ssl->last;
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
633 }
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
634
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
635 size -= n;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
636
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
637 if (size == 0) {
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
638 return bytes;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
639 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
640
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
641 buf += n;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
642 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
643 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
644
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
645
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
646 static ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
647 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
648 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
649 int sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
650 ngx_err_t err;
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
651
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
652 if (n > 0) {
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
653
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
654 if (c->ssl->saved_write_handler) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
655
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
656 c->write->handler = c->ssl->saved_write_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
657 c->ssl->saved_write_handler = NULL;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
658 c->write->ready = 1;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
659
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
660 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
661 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
662 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
663
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
664 ngx_post_event(c->write, &ngx_posted_events);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
665 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
666
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
667 return NGX_OK;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
668 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
669
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
670 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
671
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
672 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
673
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
674 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
675
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
676 if (sslerr == SSL_ERROR_WANT_READ) {
4
4b2dafa26fe2 nginx 0.1.2
Igor Sysoev <http://sysoev.ru>
parents: 2
diff changeset
677 c->read->ready = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
678 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
679 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
680
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
681 if (sslerr == SSL_ERROR_WANT_WRITE) {
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
682
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
683 ngx_log_error(NGX_LOG_INFO, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
684 "peer started SSL renegotiation");
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
685
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
686 c->write->ready = 0;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
687
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
688 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
689 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
690 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
691
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
692 /*
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
693 * we do not set the timer because there is already the read event timer
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
694 */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
695
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
696 if (c->ssl->saved_write_handler == NULL) {
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
697 c->ssl->saved_write_handler = c->write->handler;
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
698 c->write->handler = ngx_ssl_write_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
699 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
700
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
701 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
702 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
703
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
704 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
705 c->ssl->no_send_shutdown = 1;
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
706 c->read->eof = 1;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
707
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
708 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
709 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
710 "peer shutdown SSL cleanly");
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
711 return NGX_DONE;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
712 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
713
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
714 c->read->error = 1;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
715 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
716
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
717 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
718 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
719
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
720
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
721 static void
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
722 ngx_ssl_write_handler(ngx_event_t *wev)
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
723 {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
724 ngx_connection_t *c;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
725
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
726 c = wev->data;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
727
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
728 c->read->handler(c->read);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
729 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
730
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
731
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
732 /*
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
733 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
734 * before the SSL_write() call to decrease a SSL overhead.
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
735 *
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
736 * Besides for protocols such as HTTP it is possible to always buffer
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
737 * the output to decrease a SSL overhead some more.
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
738 */
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
739
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
740 ngx_chain_t *
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
741 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
742 {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
743 int n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
744 ngx_uint_t flush;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
745 ssize_t send, size;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
746 ngx_buf_t *buf;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
747
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
748 if (!c->ssl->buffer
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
749 || (in && in->next == NULL && !(c->buffered & NGX_SSL_BUFFERED)))
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
750 {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
751
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
752 /*
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
753 * we avoid a buffer copy if
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
754 * we do not need to buffer the output
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
755 * or the incoming buf is a single and our buffer is empty
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
756 */
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
757
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
758 while (in) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
759 if (ngx_buf_special(in->buf)) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
760 in = in->next;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
761 continue;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
762 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
763
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
764 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
765
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
766 if (n == NGX_ERROR) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
767 return NGX_CHAIN_ERROR;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
768 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
769
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
770 if (n == NGX_AGAIN) {
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
771 c->buffered |= NGX_SSL_BUFFERED;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
772 return in;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
773 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
774
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
775 in->buf->pos += n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
776
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
777 if (in->buf->pos == in->buf->last) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
778 in = in->next;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
779 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
780 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
781
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
782 return in;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
783 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
784
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
785
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
786 /* the maximum limit size is the maximum uint32_t value - the page size */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
787
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
788 if (limit == 0 || limit > NGX_MAX_UINT32_VALUE - ngx_pagesize) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
789 limit = NGX_MAX_UINT32_VALUE - ngx_pagesize;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
790 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
791
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
792
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
793 buf = c->ssl->buf;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
794 send = 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
795 flush = (in == NULL) ? 1 : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
796
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
797 for ( ;; ) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
798
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
799 while (in && buf->last < buf->end) {
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
800 if (in->buf->last_buf || in->buf->flush) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
801 flush = 1;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
802 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
803
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
804 if (ngx_buf_special(in->buf)) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
805 in = in->next;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
806 continue;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
807 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
808
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
809 size = in->buf->last - in->buf->pos;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
810
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
811 if (size > buf->end - buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
812 size = buf->end - buf->last;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
813 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
814
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
815 if (send + size > limit) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
816 size = (ssize_t) (limit - send);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
817 flush = 1;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
818 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
819
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
820 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
821 "SSL buf copy: %d", size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
822
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
823 ngx_memcpy(buf->last, in->buf->pos, size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
824
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
825 buf->last += size;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
826
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
827 in->buf->pos += size;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
828
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
829 if (in->buf->pos == in->buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
830 in = in->next;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
831 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
832 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
833
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
834 size = buf->last - buf->pos;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
835
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
836 if (!flush && buf->last < buf->end && c->ssl->buffer) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
837 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
838 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
839
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
840 n = ngx_ssl_write(c, buf->pos, size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
841
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
842 if (n == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
843 return NGX_CHAIN_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
844 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
845
60
df7d3fff122b nginx 0.1.30
Igor Sysoev <http://sysoev.ru>
parents: 58
diff changeset
846 if (n == NGX_AGAIN) {
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
847 c->buffered |= NGX_SSL_BUFFERED;
60
df7d3fff122b nginx 0.1.30
Igor Sysoev <http://sysoev.ru>
parents: 58
diff changeset
848 return in;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
849 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
850
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
851 buf->pos += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
852 send += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
853 c->sent += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
854
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
855 if (n < size) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
856 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
857 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
858
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
859 if (buf->pos == buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
860 buf->pos = buf->start;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
861 buf->last = buf->start;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
862 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
863
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
864 if (in == NULL || send == limit) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
865 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
866 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
867 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
868
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
869 if (buf->pos < buf->last) {
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
870 c->buffered |= NGX_SSL_BUFFERED;
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
871
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
872 } else {
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
873 c->buffered &= ~NGX_SSL_BUFFERED;
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
874 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
875
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
876 return in;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
877 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
878
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
879
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
880 ssize_t
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
881 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
882 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
883 int n, sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
884 ngx_err_t err;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
885
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
886 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
887
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
888 n = SSL_write(c->ssl->connection, data, size);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
889
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
890 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
891
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
892 if (n > 0) {
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
893
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
894 if (c->ssl->saved_read_handler) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
895
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
896 c->read->handler = c->ssl->saved_read_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
897 c->ssl->saved_read_handler = NULL;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
898 c->read->ready = 1;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
899
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
900 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
901 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
902 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
903
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
904 ngx_post_event(c->read, &ngx_posted_events);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
905 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
906
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
907 return n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
908 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
909
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
910 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
911
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
912 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
913
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
914 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
915
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
916 if (sslerr == SSL_ERROR_WANT_WRITE) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
917 c->write->ready = 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
918 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
919 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
920
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
921 if (sslerr == SSL_ERROR_WANT_READ) {
2
cc9f381affaa nginx 0.1.1
Igor Sysoev <http://sysoev.ru>
parents: 0
diff changeset
922
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
923 ngx_log_error(NGX_LOG_INFO, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
924 "peer started SSL renegotiation");
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
925
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
926 c->read->ready = 0;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
927
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
928 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
929 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
930 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
931
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
932 /*
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
933 * we do not set the timer because there is already
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
934 * the write event timer
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
935 */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
936
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
937 if (c->ssl->saved_read_handler == NULL) {
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
938 c->ssl->saved_read_handler = c->read->handler;
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
939 c->read->handler = ngx_ssl_read_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
940 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
941
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
942 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
943 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
944
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
945 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
946 c->ssl->no_send_shutdown = 1;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
947 c->write->error = 1;
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
948
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
949 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
950
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
951 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
952 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
953
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
954
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
955 static void
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
956 ngx_ssl_read_handler(ngx_event_t *rev)
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
957 {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
958 ngx_connection_t *c;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
959
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
960 c = rev->data;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
961
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
962 c->write->handler(c->write);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
963 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
964
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
965
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
966 ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
967 ngx_ssl_shutdown(ngx_connection_t *c)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
968 {
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
969 int n, sslerr, mode;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
970 ngx_err_t err;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
971 ngx_uint_t again;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
972
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
973 if (c->timedout) {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
974 mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
975
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
976 } else {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
977 mode = SSL_get_shutdown(c->ssl->connection);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
978
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
979 if (c->ssl->no_wait_shutdown) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
980 mode |= SSL_RECEIVED_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
981 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
982
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
983 if (c->ssl->no_send_shutdown) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
984 mode |= SSL_SENT_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
985 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
986 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
987
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
988 SSL_set_shutdown(c->ssl->connection, mode);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
989
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
990 again = 0;
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
991 sslerr = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
992
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
993 for ( ;; ) {
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
994 n = SSL_shutdown(c->ssl->connection);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
995
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
996 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
997
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
998 if (n == 1 || (n == 0 && c->timedout)) {
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
999 SSL_free(c->ssl->connection);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1000 c->ssl = NULL;
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1001
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1002 return NGX_OK;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1003 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1004
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1005 if (n == 0) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1006 again = 1;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1007 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1008 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1009
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1010 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1011 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1012
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1013 if (!again) {
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1014 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1015
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1016 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1017 "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1018 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1019
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1020 if (again
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1021 || sslerr == SSL_ERROR_WANT_READ
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1022 || sslerr == SSL_ERROR_WANT_WRITE)
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1023 {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1024 c->read->handler = ngx_ssl_shutdown_handler;
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1025 c->write->handler = ngx_ssl_shutdown_handler;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1026
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1027 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1028 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1029 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1030
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1031 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1032 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1033 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1034
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1035 if (again || sslerr == SSL_ERROR_WANT_READ) {
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1036 ngx_add_timer(c->read, 30000);
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1037 }
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1038
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1039 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1040 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1041
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1042 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1043
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1044 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1045
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1046 SSL_free(c->ssl->connection);
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1047 c->ssl = NULL;
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1048
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1049 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1050 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1051
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1052
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1053 static void
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1054 ngx_ssl_shutdown_handler(ngx_event_t *ev)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1055 {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1056 ngx_connection_t *c;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1057 ngx_connection_handler_pt handler;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1058
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1059 c = ev->data;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1060 handler = c->ssl->handler;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1061
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1062 if (ev->timedout) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1063 c->timedout = 1;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1064 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1065
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1066 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1067
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1068 if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1069 return;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1070 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1071
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1072 handler(c);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1073 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1074
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1075
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1076 static void
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1077 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1078 char *text)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1079 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1080 ngx_uint_t level;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1081
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1082 level = NGX_LOG_CRIT;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1083
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1084 if (sslerr == SSL_ERROR_SYSCALL) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1085
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1086 if (err == NGX_ECONNRESET
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1087 || err == NGX_EPIPE
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1088 || err == NGX_ENOTCONN
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1089 #if !(NGX_CRIT_ETIMEDOUT)
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1090 || err == NGX_ETIMEDOUT
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1091 #endif
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1092 || err == NGX_ECONNREFUSED
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1093 || err == NGX_EHOSTUNREACH)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1094 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1095 switch (c->log_error) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1096
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1097 case NGX_ERROR_IGNORE_ECONNRESET:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1098 case NGX_ERROR_INFO:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1099 level = NGX_LOG_INFO;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1100 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1101
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1102 case NGX_ERROR_ERR:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1103 level = NGX_LOG_ERR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1104 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1105
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1106 default:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1107 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1108 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1109 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1110 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1111
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1112 ngx_ssl_error(level, c->log, err, text);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1113 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1114
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1115
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1116 void ngx_cdecl
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1117 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1118 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1119 u_long n;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1120 va_list args;
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1121 u_char errstr[NGX_MAX_CONF_ERRSTR], *p, *last;
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1122
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1123 last = errstr + NGX_MAX_CONF_ERRSTR;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1124
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1125 va_start(args, fmt);
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1126 p = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1127 va_end(args);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1128
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1129 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1130
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1131 while (p < last) {
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1133 n = ERR_get_error();
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1134
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1135 if (n == 0) {
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1136 break;
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1137 }
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1138
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1139 *p++ = ' ';
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1140
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1141 ERR_error_string_n(n, (char *) p, last - p);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1142
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1143 while (p < last && *p) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1144 p++;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1145 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1146 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1147
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1148 ngx_log_error(level, log, err, "%s)", errstr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1149 }
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1150
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1151
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1152 ngx_int_t
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1153 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1154 ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1155 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1156 long cache_mode;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1157
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1158 cache_mode = SSL_SESS_CACHE_SERVER;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1159
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1160 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1161 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1162 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1163
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1164 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1165
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1166 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1167
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1168 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1169
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1170 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1171 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1172 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1173 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1174
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1175 SSL_CTX_set_timeout(ssl->ctx, timeout);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1176
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1177 if (shm_zone) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1178 shm_zone->init = ngx_ssl_session_cache_init;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1179
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1180 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1181 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1182 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1183
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1184 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1185 == 0)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1186 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1187 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1188 "SSL_CTX_set_ex_data() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1189 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1190 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1191 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1192
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1193 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1194 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1195
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1196
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1197 static ngx_int_t
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1198 ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1199 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1200 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1201 ngx_rbtree_node_t *sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1202 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1203
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1204 if (data) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1205 shm_zone->data = data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1206 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1207 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1208
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1209 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1210
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1211 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1212 if (cache == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1213 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1214 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1215
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1216 cache->session_cache_head.prev = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1217 cache->session_cache_head.next = &cache->session_cache_tail;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1218
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1219 cache->session_cache_tail.prev = &cache->session_cache_head;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1220 cache->session_cache_tail.next = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1221
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1222 cache->session_rbtree = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1223 if (cache->session_rbtree == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1224 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1225 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1226
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1227 sentinel = ngx_slab_alloc(shpool, sizeof(ngx_rbtree_node_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1228 if (sentinel == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1229 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1230 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1231
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1232 ngx_rbtree_sentinel_init(sentinel);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1233
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1234 cache->session_rbtree->root = sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1235 cache->session_rbtree->sentinel = sentinel;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1236 cache->session_rbtree->insert = ngx_ssl_session_rbtree_insert_value;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1237
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1238 shm_zone->data = cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1239
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1240 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1241 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1242
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1243
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1244 /*
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1245 * The length of the session id is 16 bytes for SSLv2 sessions and
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1246 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1247 * It seems that the typical length of the external ASN1 representation
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1248 * of a session is 118 or 119 bytes for SSLv3/TSLv1.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1249 *
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1250 * Thus on 32-bit platforms we allocate separately an rbtree node,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1251 * a session id, and an ASN1 representation, they take accordingly
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1252 * 64, 32, and 128 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1253 *
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1254 * On 64-bit platforms we allocate separately an rbtree node + session_id,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1255 * and an ASN1 representation, they take accordingly 128 and 128 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1256 *
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1257 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1258 * so they are outside the code locked by shared pool mutex
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1259 */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1260
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1261 static int
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1262 ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1263 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1264 int len;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1265 u_char *p, *id, *cached_sess;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1266 uint32_t hash;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1267 SSL_CTX *ssl_ctx;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1268 ngx_time_t *tp;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1269 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1270 ngx_connection_t *c;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1271 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1272 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1273 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1274 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1275
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1276 len = i2d_SSL_SESSION(sess, NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1277
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1278 /* do not cache too big session */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1279
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1280 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1281 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1282 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1283
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1284 p = buf;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1285 i2d_SSL_SESSION(sess, &p);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1286
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1287 c = ngx_ssl_get_connection(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1288
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1289 ssl_ctx = SSL_get_SSL_CTX(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1290 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1291
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1292 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1293 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1294
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1295 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1296
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1297 /* drop one or two expired sessions */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1298 ngx_ssl_expire_sessions(cache, shpool, 1);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1299
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1300 cached_sess = ngx_slab_alloc_locked(shpool, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1301
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1302 if (cached_sess == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1303
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1304 /* drop the oldest non-expired session and try once more */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1305
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1306 ngx_ssl_expire_sessions(cache, shpool, 0);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1307
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1308 cached_sess = ngx_slab_alloc_locked(shpool, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1309
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1310 if (cached_sess == NULL) {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1311 sess_id = NULL;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1312 goto failed;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1313 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1314 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1315
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1316 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1317 if (sess_id == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1318 goto failed;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1319 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1320
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1321 #if (NGX_PTR_SIZE == 8)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1322
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1323 id = sess_id->sess_id;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1324
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1325 #else
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1326
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1327 id = ngx_slab_alloc_locked(shpool, sess->session_id_length);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1328 if (id == NULL) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1329 goto failed;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1330 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1331
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1332 #endif
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1333
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1334 ngx_memcpy(cached_sess, buf, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1335
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1336 ngx_memcpy(id, sess->session_id, sess->session_id_length);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1337
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1338 hash = ngx_crc32_short(sess->session_id, sess->session_id_length);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1339
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1340 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1341 "http ssl new session: %08XD:%d:%d",
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1342 hash, sess->session_id_length, len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1343
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1344 tp = ngx_timeofday();
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1345
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1346 sess_id->node.key = hash;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1347 sess_id->node.data = (u_char) sess->session_id_length;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1348 sess_id->id = id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1349 sess_id->len = len;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1350 sess_id->session = cached_sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1351
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1352 sess_id->expire = tp->sec + SSL_CTX_get_timeout(ssl_ctx);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1353
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1354 sess_id->next = cache->session_cache_head.next;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1355 sess_id->next->prev = sess_id;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1356 sess_id->prev = &cache->session_cache_head;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1357 cache->session_cache_head.next = sess_id;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1358
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1359 ngx_rbtree_insert(cache->session_rbtree, &sess_id->node);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1360
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1361 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1362
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1363 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1364
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1365 failed:
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1366
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1367 if (cached_sess) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1368 ngx_slab_free_locked(shpool, cached_sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1369 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1370
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1371 if (sess_id) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1372 ngx_slab_free_locked(shpool, sess_id);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1373 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1374
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1375 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1376
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1377 ngx_log_error(NGX_LOG_ALERT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1378 "could not add new SSL session to the session cache");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1379
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1380 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1381 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1382
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1383
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1384 static ngx_ssl_session_t *
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1385 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn, u_char *id, int len,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1386 int *copy)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1387 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1388 #if OPENSSL_VERSION_NUMBER >= 0x0090707fL
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1389 const
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1390 #endif
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1391 u_char *p;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1392 uint32_t hash;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1393 ngx_int_t rc;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1394 ngx_time_t *tp;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1395 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1396 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1397 ngx_connection_t *c;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1398 ngx_rbtree_node_t *node, *sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1399 ngx_ssl_session_t *sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1400 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1401 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1402 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1403
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1404 c = ngx_ssl_get_connection(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1405
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1406 hash = ngx_crc32_short(id, (size_t) len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1407 *copy = 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1408
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1409 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1410 "http ssl get session: %08XD:%d", hash, len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1411
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1412 shm_zone = SSL_CTX_get_ex_data(SSL_get_SSL_CTX(ssl_conn),
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1413 ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1414
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1415 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1416
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1417 if (cache->session_rbtree == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1418 return NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1419 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1420
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1421 sess = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1422
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1423 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1424
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1425 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1426
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1427 node = cache->session_rbtree->root;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1428 sentinel = cache->session_rbtree->sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1429
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1430 while (node != sentinel) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1431
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1432 if (hash < node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1433 node = node->left;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1434 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1435 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1436
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1437 if (hash > node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1438 node = node->right;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1439 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1440 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1441
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1442 /* hash == node->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1443
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1444 do {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1445 sess_id = (ngx_ssl_sess_id_t *) node;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1446
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1447 rc = ngx_memn2cmp(id, sess_id->id,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1448 (size_t) len, (size_t) node->data);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1449 if (rc == 0) {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1450
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1451 tp = ngx_timeofday();
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1452
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1453 if (sess_id->expire > tp->sec) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1454 ngx_memcpy(buf, sess_id->session, sess_id->len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1455
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1456 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1457
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1458 p = buf;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1459 sess = d2i_SSL_SESSION(NULL, &p, sess_id->len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1460
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1461 return sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1462 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1463
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1464 sess_id->next->prev = sess_id->prev;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1465 sess_id->prev->next = sess_id->next;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1466
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1467 ngx_rbtree_delete(cache->session_rbtree, node);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1468
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1469 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1470 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1471 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1472 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1473 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1474
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1475 sess = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1476
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1477 goto done;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1478 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1479
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1480 node = (rc < 0) ? node->left : node->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1481
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1482 } while (node != sentinel && hash == node->key);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1483
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1484 break;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1485 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1486
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1487 done:
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1488
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1489 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1490
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1491 return sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1492 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1493
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1494
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1495 static void
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1496 ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1497 {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1498 size_t len;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1499 u_char *id;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1500 uint32_t hash;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1501 ngx_int_t rc;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1502 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1503 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1504 ngx_rbtree_node_t *node, *sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1505 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1506 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1507
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1508 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1509
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1510 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1511
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1512 id = sess->session_id;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1513 len = (size_t) sess->session_id_length;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1514
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1515 hash = ngx_crc32_short(id, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1516
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1517 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1518 "http ssl remove session: %08XD:%uz", hash, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1519
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1520 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1521
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1522 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1523
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1524 node = cache->session_rbtree->root;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1525 sentinel = cache->session_rbtree->sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1526
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1527 while (node != sentinel) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1528
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1529 if (hash < node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1530 node = node->left;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1531 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1532 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1533
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1534 if (hash > node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1535 node = node->right;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1536 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1537 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1538
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1539 /* hash == node->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1540
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1541 do {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1542 sess_id = (ngx_ssl_sess_id_t *) node;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1543
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1544 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1545
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1546 if (rc == 0) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1547 sess_id->next->prev = sess_id->prev;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1548 sess_id->prev->next = sess_id->next;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1549
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1550 ngx_rbtree_delete(cache->session_rbtree, node);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1551
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1552 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1553 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1554 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1555 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1556 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1557
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1558 goto done;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1559 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1560
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1561 node = (rc < 0) ? node->left : node->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1562
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1563 } while (node != sentinel && hash == node->key);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1564
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1565 break;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1566 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1567
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1568 done:
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1569
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1570 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1571 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1572
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1573
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1574 static void
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1575 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1576 ngx_slab_pool_t *shpool, ngx_uint_t n)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1577 {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1578 ngx_time_t *tp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1579 ngx_ssl_sess_id_t *sess_id;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1580
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1581 tp = ngx_timeofday();
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1582
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1583 while (n < 3) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1584
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1585 sess_id = cache->session_cache_tail.prev;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1586
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1587 if (sess_id == &cache->session_cache_head) {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1588 return;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1589 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1590
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1591 if (n++ != 0 && sess_id->expire > tp->sec) {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1592 break;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1593 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1594
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1595 sess_id->next->prev = sess_id->prev;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1596 sess_id->prev->next = sess_id->next;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1597
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1598 ngx_rbtree_delete(cache->session_rbtree, &sess_id->node);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1599
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1600 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1601 "expire session: %08Xi", sess_id->node.key);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1602
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1603 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1604 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1605 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1606 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1607 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1608 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1609 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1610
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1611
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1612 static void
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1613 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1614 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1615 {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1616 ngx_ssl_sess_id_t *sess_id, *sess_id_temp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1617
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1618 for ( ;; ) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1619
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1620 if (node->key < temp->key) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1621
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1622 if (temp->left == sentinel) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1623 temp->left = node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1624 break;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1625 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1626
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1627 temp = temp->left;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1628
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1629 } else if (node->key > temp->key) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1630
276
c5c2b2883984 nginx 0.5.8
Igor Sysoev <http://sysoev.ru>
parents: 274
diff changeset
1631 if (temp->right == sentinel) {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1632 temp->right = node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1633 break;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1634 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1635
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1636 temp = temp->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1637
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1638 } else { /* node->key == temp->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1639
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1640 sess_id = (ngx_ssl_sess_id_t *) node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1641 sess_id_temp = (ngx_ssl_sess_id_t *) temp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1642
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1643 if (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1644 (size_t) node->data, (size_t) temp->data)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1645 < 0)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1646 {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1647 if (temp->left == sentinel) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1648 temp->left = node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1649 break;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1650 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1651
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1652 temp = temp->left;
276
c5c2b2883984 nginx 0.5.8
Igor Sysoev <http://sysoev.ru>
parents: 274
diff changeset
1653
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1654 } else {
276
c5c2b2883984 nginx 0.5.8
Igor Sysoev <http://sysoev.ru>
parents: 274
diff changeset
1655
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1656 if (temp->right == sentinel) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1657 temp->right = node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1658 break;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1659 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1660
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1661 temp = temp->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1662 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1663 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1664 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1665
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1666 node->parent = temp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1667 node->left = sentinel;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1668 node->right = sentinel;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1669 ngx_rbt_red(node);
276
c5c2b2883984 nginx 0.5.8
Igor Sysoev <http://sysoev.ru>
parents: 274
diff changeset
1670 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1671
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1672
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1673 void
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1674 ngx_ssl_cleanup_ctx(void *data)
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1675 {
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1676 ngx_ssl_t *ssl = data;
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1677
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1678 SSL_CTX_free(ssl->ctx);
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1679 }
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1680
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1681
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1682 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1683 ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1684 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1685 s->data = (u_char *) SSL_get_version(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1686 return NGX_OK;
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1687 }
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1688
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1689
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1690 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1691 ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1692 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1693 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1694 return NGX_OK;
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1695 }
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1696
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1697
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1698 ngx_int_t
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1699 ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1700 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1701 char *p;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1702 size_t len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1703 X509 *cert;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1704 X509_NAME *name;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1705
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1706 s->len = 0;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1707
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1708 cert = SSL_get_peer_certificate(c->ssl->connection);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1709 if (cert == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1710 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1711 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1712
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1713 name = X509_get_subject_name(cert);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1714 if (name == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1715 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1716 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1717
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1718 p = X509_NAME_oneline(name, NULL, 0);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1719
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1720 for (len = 0; p[len]; len++) { /* void */ }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1721
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1722 s->len = len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1723 s->data = ngx_palloc(pool, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1724 if (s->data == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1725 OPENSSL_free(p);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1726 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1727 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1728
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1729 ngx_memcpy(s->data, p, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1730
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1731 OPENSSL_free(p);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1732
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1733 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1734 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1735
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1736
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1737 ngx_int_t
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1738 ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1739 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1740 char *p;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1741 size_t len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1742 X509 *cert;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1743 X509_NAME *name;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1744
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1745 s->len = 0;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1746
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1747 cert = SSL_get_peer_certificate(c->ssl->connection);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1748 if (cert == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1749 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1750 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1751
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1752 name = X509_get_issuer_name(cert);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1753 if (name == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1754 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1755 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1756
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1757 p = X509_NAME_oneline(name, NULL, 0);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1758
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1759 for (len = 0; p[len]; len++) { /* void */ }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1760
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1761 s->len = len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1762 s->data = ngx_palloc(pool, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1763 if (s->data == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1764 OPENSSL_free(p);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1765 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1766 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1767
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1768 ngx_memcpy(s->data, p, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1769
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1770 OPENSSL_free(p);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1771
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1772 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1773 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1774
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1775
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1776 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1777 ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1778 {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1779 size_t len;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1780 X509 *cert;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1781 BIO *bio;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1782
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1783 s->len = 0;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1784
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1785 cert = SSL_get_peer_certificate(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1786 if (cert == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1787 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1788 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1789
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1790 bio = BIO_new(BIO_s_mem());
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1791 if (bio == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1792 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1793 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1794
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1795 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1796 len = BIO_pending(bio);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1797
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1798 s->len = len;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1799 s->data = ngx_palloc(pool, len);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1800 if (s->data == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1801 BIO_free(bio);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1802 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1803 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1804
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1805 BIO_read(bio, s->data, len);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1806 BIO_free(bio);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1807
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1808 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1809 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1810
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1811
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1812 static void *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1813 ngx_openssl_create_conf(ngx_cycle_t *cycle)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1814 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1815 ngx_openssl_conf_t *oscf;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1816
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1817 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1818 if (oscf == NULL) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1819 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1820 }
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1821
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1822 /*
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1823 * set by ngx_pcalloc():
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1824 *
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1825 * oscf->engine.len = 0;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1826 * oscf->engine.data = NULL;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1827 */
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1828
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1829 return oscf;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1830 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1831
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1832
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1833 static char *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1834 ngx_openssl_init_conf(ngx_cycle_t *cycle, void *conf)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1835 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1836 #if (NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1837 ngx_openssl_conf_t *oscf = conf;
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1838
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1839 ENGINE *engine;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1840
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1841 if (oscf->engine.len == 0) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1842 return NGX_CONF_OK;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1843 }
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1844
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1845 engine = ENGINE_by_id((const char *) oscf->engine.data);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1846
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1847 if (engine == NULL) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1848 ngx_ssl_error(NGX_LOG_WARN, cycle->log, 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1849 "ENGINE_by_id(\"%V\") failed", &oscf->engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1850 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1851 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1852
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1853 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1854 ngx_ssl_error(NGX_LOG_WARN, cycle->log, 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1855 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1856 &oscf->engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1857 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1858 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1859
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1860 ENGINE_free(engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1861
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1862 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1863
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1864 return NGX_CONF_OK;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1865 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1866
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1867
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1868 #if !(NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1869
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1870 static char *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1871 ngx_openssl_noengine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1872 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1873 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
1874 "\"ssl_engine\" directive is available only in "
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
1875 "OpenSSL 0.9.7 and higher,");
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1876
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1877 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1878 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1879
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1880 #endif
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1881
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1882
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1883 static void
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1884 ngx_openssl_exit(ngx_cycle_t *cycle)
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1885 {
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1886 #if (NGX_SSL_ENGINE)
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1887 ENGINE_cleanup();
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1888 #endif
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
1889 }