nginx: src/http/modules/ngx_http_ssl

annotate src/http/modules/ngx_http_ssl_module.c @ 9035:3be953161026 quic

Merged with the default branch.

author	Sergey Kandaurov <pluknet@nginx.com>
date	Thu, 20 Oct 2022 16:41:36 +0400
parents	3d0fc72d409e e32b48848add
children	7da4791e0264

rev	line source
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	1
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2 /*
444 42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright Igor Sysoev <igor@sysoev.ru> parents: 441 diff changeset	3 * Copyright (C) Igor Sysoev
4412 d620f497c50f Copyright updated. Maxim Konovalov <maxim@nginx.com> parents: 4400 diff changeset	4 * Copyright (C) Nginx, Inc.
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	5 */
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	6
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	7
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	8 #include <ngx_config.h>
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	9 #include <ngx_core.h>
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	10 #include <ngx_http.h>
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	11
573 58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	12
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	13 typedef ngx_int_t (ngx_ssl_variable_handler_pt)(ngx_connection_t c,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	14 ngx_pool_t pool, ngx_str_t s);
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	15
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	16
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6550 diff changeset	18 #define NGX_DEFAULT_ECDH_CURVE "auto"
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	19
7937 db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	20 #define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9"
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	21
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	22
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	23 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	24 static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	25 const unsigned char *out, unsigned char outlen,
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	26 const unsigned char in, unsigned int inlen, void arg);
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	27 #endif
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	28
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	29 static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r,
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	30 ngx_http_variable_value_t *v, uintptr_t data);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	31 static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r,
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	32 ngx_http_variable_value_t *v, uintptr_t data);
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	33
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	34 static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf);
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	35 static void ngx_http_ssl_create_srv_conf(ngx_conf_t cf);
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	36 static char ngx_http_ssl_merge_srv_conf(ngx_conf_t cf,
501 d4ea69372b94 nginx-0.1.25-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 485 diff changeset	37 void parent, void child);
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	38
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	39 static ngx_int_t ngx_http_ssl_compile_certificates(ngx_conf_t *cf,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	40 ngx_http_ssl_srv_conf_t *conf);
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	41
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	42 static char ngx_http_ssl_enable(ngx_conf_t cf, ngx_command_t *cmd,
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	43 void *conf);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	44 static char ngx_http_ssl_password_file(ngx_conf_t cf, ngx_command_t *cmd,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	45 void *conf);
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	46 static char ngx_http_ssl_session_cache(ngx_conf_t cf, ngx_command_t *cmd,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	47 void *conf);
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	48 static char ngx_http_ssl_ocsp_cache(ngx_conf_t cf, ngx_command_t *cmd,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	49 void *conf);
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	50
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	51 static char ngx_http_ssl_conf_command_check(ngx_conf_t cf, void *post,
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	52 void *data);
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	53
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	54 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	55
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	56
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	57 static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	58 { ngx_string("SSLv2"), NGX_SSL_SSLv2 },
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	59 { ngx_string("SSLv3"), NGX_SSL_SSLv3 },
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	60 { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4273 diff changeset	61 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4273 diff changeset	62 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
6981 08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6817 diff changeset	63 { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 },
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	64 { ngx_null_string, 0 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	65 };
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	66
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	67
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	68 static ngx_conf_enum_t ngx_http_ssl_verify[] = {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	69 { ngx_string("off"), 0 },
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	70 { ngx_string("on"), 1 },
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	71 { ngx_string("optional"), 2 },
4884 e406c997470a SSL: the "ssl_verify_client" directive parameter "optional_no_ca". Maxim Dounin <mdounin@mdounin.ru> parents: 4879 diff changeset	72 { ngx_string("optional_no_ca"), 3 },
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	73 { ngx_null_string, 0 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	74 };
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	75
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	76
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	77 static ngx_conf_enum_t ngx_http_ssl_ocsp[] = {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	78 { ngx_string("off"), 0 },
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	79 { ngx_string("on"), 1 },
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	80 { ngx_string("leaf"), 2 },
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	81 { ngx_null_string, 0 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	82 };
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	83
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	84
7270 46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	85 static ngx_conf_deprecated_t ngx_http_ssl_deprecated = {
46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	86 ngx_conf_deprecated, "ssl", "listen ... ssl"
46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	87 };
46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	88
46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	89
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	90 static ngx_conf_post_t ngx_http_ssl_conf_command_post =
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	91 { ngx_http_ssl_conf_command_check };
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	92
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	93
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	94 static ngx_command_t ngx_http_ssl_commands[] = {
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	95
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: 392 diff changeset	96 { ngx_string("ssl"),
599 869b6444d234 nginx-0.3.21-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 573 diff changeset	97 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	98 ngx_http_ssl_enable,
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	99 NGX_HTTP_SRV_CONF_OFFSET,
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	100 offsetof(ngx_http_ssl_srv_conf_t, enable),
7270 46c0c7ef4913 SSL: deprecated the "ssl" directive. Ruslan Ermilov <ru@nginx.com> parents: 7269 diff changeset	101 &ngx_http_ssl_deprecated },
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	102
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	103 { ngx_string("ssl_certificate"),
599 869b6444d234 nginx-0.3.21-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 573 diff changeset	104 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	105 ngx_conf_set_str_array_slot,
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	106 NGX_HTTP_SRV_CONF_OFFSET,
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	107 offsetof(ngx_http_ssl_srv_conf_t, certificates),
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	108 NULL },
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	109
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	110 { ngx_string("ssl_certificate_key"),
599 869b6444d234 nginx-0.3.21-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 573 diff changeset	111 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	112 ngx_conf_set_str_array_slot,
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	113 NGX_HTTP_SRV_CONF_OFFSET,
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	114 offsetof(ngx_http_ssl_srv_conf_t, certificate_keys),
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	115 NULL },
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	116
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	117 { ngx_string("ssl_password_file"),
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	118 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	119 ngx_http_ssl_password_file,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	120 NGX_HTTP_SRV_CONF_OFFSET,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	121 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	122 NULL },
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	123
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	124 { ngx_string("ssl_dhparam"),
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	125 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	126 ngx_conf_set_str_slot,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	127 NGX_HTTP_SRV_CONF_OFFSET,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	128 offsetof(ngx_http_ssl_srv_conf_t, dhparam),
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	129 NULL },
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	130
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	131 { ngx_string("ssl_ecdh_curve"),
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	132 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	133 ngx_conf_set_str_slot,
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	134 NGX_HTTP_SRV_CONF_OFFSET,
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	135 offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve),
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	136 NULL },
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	137
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	138 { ngx_string("ssl_protocols"),
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	139 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_1MORE,
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	140 ngx_conf_set_bitmask_slot,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	141 NGX_HTTP_SRV_CONF_OFFSET,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	142 offsetof(ngx_http_ssl_srv_conf_t, protocols),
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	143 &ngx_http_ssl_protocols },
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	144
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	145 { ngx_string("ssl_ciphers"),
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	146 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	147 ngx_conf_set_str_slot,
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	148 NGX_HTTP_SRV_CONF_OFFSET,
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	149 offsetof(ngx_http_ssl_srv_conf_t, ciphers),
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	150 NULL },
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	151
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	152 { ngx_string("ssl_buffer_size"),
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	153 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	154 ngx_conf_set_size_slot,
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	155 NGX_HTTP_SRV_CONF_OFFSET,
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	156 offsetof(ngx_http_ssl_srv_conf_t, buffer_size),
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	157 NULL },
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	158
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	159 { ngx_string("ssl_verify_client"),
4273 e444e8f6538b Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse. Sergey Budnevitch <sb@waeme.net> parents: 4234 diff changeset	160 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	161 ngx_conf_set_enum_slot,
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	162 NGX_HTTP_SRV_CONF_OFFSET,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	163 offsetof(ngx_http_ssl_srv_conf_t, verify),
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	164 &ngx_http_ssl_verify },
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	165
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	166 { ngx_string("ssl_verify_depth"),
5504 8ed467553f6b SSL: fixed ssl_verify_depth to take only one argument. Maxim Dounin <mdounin@mdounin.ru> parents: 5503 diff changeset	167 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	168 ngx_conf_set_num_slot,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	169 NGX_HTTP_SRV_CONF_OFFSET,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	170 offsetof(ngx_http_ssl_srv_conf_t, verify_depth),
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	171 NULL },
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	172
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	173 { ngx_string("ssl_client_certificate"),
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	174 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	175 ngx_conf_set_str_slot,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	176 NGX_HTTP_SRV_CONF_OFFSET,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	177 offsetof(ngx_http_ssl_srv_conf_t, client_certificate),
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	178 NULL },
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	179
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	180 { ngx_string("ssl_trusted_certificate"),
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	181 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	182 ngx_conf_set_str_slot,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	183 NGX_HTTP_SRV_CONF_OFFSET,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	184 offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate),
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	185 NULL },
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	186
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	187 { ngx_string("ssl_prefer_server_ciphers"),
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	188 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	189 ngx_conf_set_flag_slot,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	190 NGX_HTTP_SRV_CONF_OFFSET,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	191 offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers),
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	192 NULL },
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	193
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	194 { ngx_string("ssl_session_cache"),
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	195 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE12,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	196 ngx_http_ssl_session_cache,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	197 NGX_HTTP_SRV_CONF_OFFSET,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	198 0,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	199 NULL },
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	200
5503 d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	201 { ngx_string("ssl_session_tickets"),
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	202 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	203 ngx_conf_set_flag_slot,
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	204 NGX_HTTP_SRV_CONF_OFFSET,
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	205 offsetof(ngx_http_ssl_srv_conf_t, session_tickets),
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	206 NULL },
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	207
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	208 { ngx_string("ssl_session_ticket_key"),
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	209 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	210 ngx_conf_set_str_array_slot,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	211 NGX_HTTP_SRV_CONF_OFFSET,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	212 offsetof(ngx_http_ssl_srv_conf_t, session_ticket_keys),
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	213 NULL },
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	214
573 58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	215 { ngx_string("ssl_session_timeout"),
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	216 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	217 ngx_conf_set_sec_slot,
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	218 NGX_HTTP_SRV_CONF_OFFSET,
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	219 offsetof(ngx_http_ssl_srv_conf_t, session_timeout),
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	220 NULL },
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	221
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	222 { ngx_string("ssl_crl"),
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	223 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	224 ngx_conf_set_str_slot,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	225 NGX_HTTP_SRV_CONF_OFFSET,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	226 offsetof(ngx_http_ssl_srv_conf_t, crl),
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	227 NULL },
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	228
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	229 { ngx_string("ssl_ocsp"),
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	230 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	231 ngx_conf_set_enum_slot,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	232 NGX_HTTP_SRV_CONF_OFFSET,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	233 offsetof(ngx_http_ssl_srv_conf_t, ocsp),
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	234 &ngx_http_ssl_ocsp },
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	235
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	236 { ngx_string("ssl_ocsp_responder"),
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	237 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	238 ngx_conf_set_str_slot,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	239 NGX_HTTP_SRV_CONF_OFFSET,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	240 offsetof(ngx_http_ssl_srv_conf_t, ocsp_responder),
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	241 NULL },
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	242
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	243 { ngx_string("ssl_ocsp_cache"),
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	244 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	245 ngx_http_ssl_ocsp_cache,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	246 NGX_HTTP_SRV_CONF_OFFSET,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	247 0,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	248 NULL },
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	249
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	250 { ngx_string("ssl_stapling"),
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	251 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	252 ngx_conf_set_flag_slot,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	253 NGX_HTTP_SRV_CONF_OFFSET,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	254 offsetof(ngx_http_ssl_srv_conf_t, stapling),
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	255 NULL },
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	256
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	257 { ngx_string("ssl_stapling_file"),
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	258 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	259 ngx_conf_set_str_slot,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	260 NGX_HTTP_SRV_CONF_OFFSET,
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	261 offsetof(ngx_http_ssl_srv_conf_t, stapling_file),
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	262 NULL },
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	263
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	264 { ngx_string("ssl_stapling_responder"),
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	265 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE1,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	266 ngx_conf_set_str_slot,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	267 NGX_HTTP_SRV_CONF_OFFSET,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	268 offsetof(ngx_http_ssl_srv_conf_t, stapling_responder),
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	269 NULL },
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	270
4879 4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	271 { ngx_string("ssl_stapling_verify"),
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	272 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	273 ngx_conf_set_flag_slot,
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	274 NGX_HTTP_SRV_CONF_OFFSET,
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	275 offsetof(ngx_http_ssl_srv_conf_t, stapling_verify),
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	276 NULL },
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	277
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	278 { ngx_string("ssl_early_data"),
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	279 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	280 ngx_conf_set_flag_slot,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	281 NGX_HTTP_SRV_CONF_OFFSET,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	282 offsetof(ngx_http_ssl_srv_conf_t, early_data),
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	283 NULL },
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	284
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	285 { ngx_string("ssl_conf_command"),
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	286 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_TAKE2,
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	287 ngx_conf_set_keyval_slot,
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	288 NGX_HTTP_SRV_CONF_OFFSET,
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	289 offsetof(ngx_http_ssl_srv_conf_t, conf_commands),
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	290 &ngx_http_ssl_conf_command_post },
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	291
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	292 { ngx_string("ssl_reject_handshake"),
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	293 NGX_HTTP_MAIN_CONF\|NGX_HTTP_SRV_CONF\|NGX_CONF_FLAG,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	294 ngx_conf_set_flag_slot,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	295 NGX_HTTP_SRV_CONF_OFFSET,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	296 offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	297 NULL },
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	298
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	299 ngx_null_command
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	300 };
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	301
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	302
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	303 static ngx_http_module_t ngx_http_ssl_module_ctx = {
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	304 ngx_http_ssl_add_variables, /* preconfiguration */
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	305 ngx_http_ssl_init, /* postconfiguration */
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	306
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	307 NULL, /* create main configuration */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	308 NULL, /* init main configuration */
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	309
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	310 ngx_http_ssl_create_srv_conf, /* create server configuration */
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	311 ngx_http_ssl_merge_srv_conf, /* merge server configuration */
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	312
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	313 NULL, /* create location configuration */
485 4ebe09b07e30 nginx-0.1.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	314 NULL /* merge location configuration */
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	315 };
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	316
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	317
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	318 ngx_module_t ngx_http_ssl_module = {
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 507 diff changeset	319 NGX_MODULE_V1,
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	320 &ngx_http_ssl_module_ctx, /* module context */
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	321 ngx_http_ssl_commands, /* module directives */
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	322 NGX_HTTP_MODULE, /* module type */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	323 NULL, /* init master */
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: 392 diff changeset	324 NULL, /* init module */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	325 NULL, /* init process */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	326 NULL, /* init thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	327 NULL, /* exit thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	328 NULL, /* exit process */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	329 NULL, /* exit master */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 529 diff changeset	330 NGX_MODULE_V1_PADDING
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	331 };
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	332
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	333
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	334 static ngx_http_variable_t ngx_http_ssl_vars[] = {
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	335
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	336 { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable,
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	337 (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 },
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	338
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	339 { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable,
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	340 (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 },
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	341
6816 ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	342 { ngx_string("ssl_ciphers"), NULL, ngx_http_ssl_variable,
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	343 (uintptr_t) ngx_ssl_get_ciphers, NGX_HTTP_VAR_CHANGEABLE, 0 },
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	344
7973 3443c02ca1d1 SSL: $ssl_curve (ticket #2135). Sergey Kandaurov <pluknet@nginx.com> parents: 7937 diff changeset	345 { ngx_string("ssl_curve"), NULL, ngx_http_ssl_variable,
3443c02ca1d1 SSL: $ssl_curve (ticket #2135). Sergey Kandaurov <pluknet@nginx.com> parents: 7937 diff changeset	346 (uintptr_t) ngx_ssl_get_curve, NGX_HTTP_VAR_CHANGEABLE, 0 },
3443c02ca1d1 SSL: $ssl_curve (ticket #2135). Sergey Kandaurov <pluknet@nginx.com> parents: 7937 diff changeset	347
6817 e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	348 { ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable,
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	349 (uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 },
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	350
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3140 diff changeset	351 { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable,
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3140 diff changeset	352 (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 },
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3140 diff changeset	353
5573 7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5545 diff changeset	354 { ngx_string("ssl_session_reused"), NULL, ngx_http_ssl_variable,
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5545 diff changeset	355 (uintptr_t) ngx_ssl_get_session_reused, NGX_HTTP_VAR_CHANGEABLE, 0 },
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5545 diff changeset	356
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	357 { ngx_string("ssl_early_data"), NULL, ngx_http_ssl_variable,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	358 (uintptr_t) ngx_ssl_get_early_data,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	359 NGX_HTTP_VAR_CHANGEABLE\|NGX_HTTP_VAR_NOCACHEABLE, 0 },
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	360
5658 94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	361 { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable,
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	362 (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 },
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	363
7935 eb6c77e6d55d SSL: added $ssl_alpn_protocol variable. Vladimir Homutov <vl@nginx.com> parents: 7934 diff changeset	364 { ngx_string("ssl_alpn_protocol"), NULL, ngx_http_ssl_variable,
eb6c77e6d55d SSL: added $ssl_alpn_protocol variable. Vladimir Homutov <vl@nginx.com> parents: 7934 diff changeset	365 (uintptr_t) ngx_ssl_get_alpn_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 },
eb6c77e6d55d SSL: added $ssl_alpn_protocol variable. Vladimir Homutov <vl@nginx.com> parents: 7934 diff changeset	366
2045 2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	367 { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable,
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	368 (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 },
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	369
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	370 { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable,
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	371 (uintptr_t) ngx_ssl_get_raw_certificate,
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	372 NGX_HTTP_VAR_CHANGEABLE, 0 },
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	373
7091 82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7077 diff changeset	374 { ngx_string("ssl_client_escaped_cert"), NULL, ngx_http_ssl_variable,
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7077 diff changeset	375 (uintptr_t) ngx_ssl_get_escaped_certificate,
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7077 diff changeset	376 NGX_HTTP_VAR_CHANGEABLE, 0 },
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7077 diff changeset	377
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	378 { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable,
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	379 (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 },
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	380
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	381 { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable,
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	382 (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 },
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	383
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	384 { ngx_string("ssl_client_s_dn_legacy"), NULL, ngx_http_ssl_variable,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	385 (uintptr_t) ngx_ssl_get_subject_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 },
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	386
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	387 { ngx_string("ssl_client_i_dn_legacy"), NULL, ngx_http_ssl_variable,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	388 (uintptr_t) ngx_ssl_get_issuer_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 },
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6591 diff changeset	389
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	390 { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable,
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	391 (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 },
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	392
5700 5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5658 diff changeset	393 { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable,
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5658 diff changeset	394 (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 },
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5658 diff changeset	395
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	396 { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	397 (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 },
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	398
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	399 { ngx_string("ssl_client_v_start"), NULL, ngx_http_ssl_variable,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	400 (uintptr_t) ngx_ssl_get_client_v_start, NGX_HTTP_VAR_CHANGEABLE, 0 },
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	401
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	402 { ngx_string("ssl_client_v_end"), NULL, ngx_http_ssl_variable,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	403 (uintptr_t) ngx_ssl_get_client_v_end, NGX_HTTP_VAR_CHANGEABLE, 0 },
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	404
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	405 { ngx_string("ssl_client_v_remain"), NULL, ngx_http_ssl_variable,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	406 (uintptr_t) ngx_ssl_get_client_v_remain, NGX_HTTP_VAR_CHANGEABLE, 0 },
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	407
7077 2a288909abc6 Variables: macros for null variables. Ruslan Ermilov <ru@nginx.com> parents: 6981 diff changeset	408 ngx_http_null_variable
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	409 };
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	410
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	411
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	412 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP");
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	413
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	414
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	415 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	416
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	417 static int
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	418 ngx_http_ssl_alpn_select(ngx_ssl_conn_t ssl_conn, const unsigned char *out,
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	419 unsigned char outlen, const unsigned char in, unsigned int inlen,
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	420 void *arg)
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	421 {
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	422 unsigned int srvlen;
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	423 unsigned char *srv;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	424 #if (NGX_DEBUG)
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	425 unsigned int i;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	426 #endif
8921 33226ac61076 HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module. Roman Arutyunyan <arut@nginx.com> parents: 8918 diff changeset	427 #if (NGX_HTTP_V2 \|\| NGX_HTTP_V3)
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	428 ngx_http_connection_t *hc;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	429 #endif
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	430 #if (NGX_HTTP_V3 && NGX_HTTP_V3_HQ)
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	431 ngx_http_v3_srv_conf_t *h3scf;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	432 #endif
8921 33226ac61076 HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module. Roman Arutyunyan <arut@nginx.com> parents: 8918 diff changeset	433 #if (NGX_HTTP_V2 \|\| NGX_HTTP_V3 \|\| NGX_DEBUG)
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	434 ngx_connection_t *c;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	435
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	436 c = ngx_ssl_get_connection(ssl_conn);
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	437 #endif
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	438
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	439 #if (NGX_DEBUG)
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	440 for (i = 0; i < inlen; i += in[i] + 1) {
6474 2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6246 diff changeset	441 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
6478 3ef7bb882ad4 Fixed logging with variable field width. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	442 "SSL ALPN supported by client: %*s",
3ef7bb882ad4 Fixed logging with variable field width. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	443 (size_t) in[i], &in[i + 1]);
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	444 }
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	445 #endif
5106 afee87b8190a SSL: Next Protocol Negotiation extension support. Valentin Bartenev <vbart@nginx.com> parents: 5077 diff changeset	446
8921 33226ac61076 HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module. Roman Arutyunyan <arut@nginx.com> parents: 8918 diff changeset	447 #if (NGX_HTTP_V2 \|\| NGX_HTTP_V3)
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	448 hc = c->data;
8269 c9c3a73df6e8 Support for HTTP/3 ALPN. Roman Arutyunyan <arut@nginx.com> parents: 8232 diff changeset	449 #endif
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	450
8269 c9c3a73df6e8 Support for HTTP/3 ALPN. Roman Arutyunyan <arut@nginx.com> parents: 8232 diff changeset	451 #if (NGX_HTTP_V2)
6246 257b51c37c5a The HTTP/2 implementation (RFC 7240, 7241). Valentin Bartenev <vbart@nginx.com> parents: 6157 diff changeset	452 if (hc->addr_conf->http2) {
7937 db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	453 srv = (unsigned char *) NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTOS;
db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	454 srvlen = sizeof(NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTOS) - 1;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	455 } else
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	456 #endif
8921 33226ac61076 HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module. Roman Arutyunyan <arut@nginx.com> parents: 8918 diff changeset	457 #if (NGX_HTTP_V3)
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	458 if (hc->addr_conf->http3) {
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	459
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	460 #if (NGX_HTTP_V3_HQ)
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	461 h3scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v3_module);
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	462
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	463 if (h3scf->hq) {
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	464 srv = (unsigned char *) NGX_HTTP_V3_HQ_ALPN_PROTO;
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	465 srvlen = sizeof(NGX_HTTP_V3_HQ_ALPN_PROTO) - 1;
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	466 } else
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	467 #endif
be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	468 {
8918 606bf52888d2 HTTP/3: adjusted ALPN macro names to align with 61abb35bb8cf. Sergey Kandaurov <pluknet@nginx.com> parents: 8889 diff changeset	469 srv = (unsigned char *) NGX_HTTP_V3_ALPN_PROTO;
606bf52888d2 HTTP/3: adjusted ALPN macro names to align with 61abb35bb8cf. Sergey Kandaurov <pluknet@nginx.com> parents: 8889 diff changeset	470 srvlen = sizeof(NGX_HTTP_V3_ALPN_PROTO) - 1;
8626 e0947c952d43 QUIC: multiple versions support in ALPN. Sergey Kandaurov <pluknet@nginx.com> parents: 8618 diff changeset	471 }
e0947c952d43 QUIC: multiple versions support in ALPN. Sergey Kandaurov <pluknet@nginx.com> parents: 8618 diff changeset	472
8481 0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	473 } else
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	474 #endif
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	475 {
7937 db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	476 srv = (unsigned char *) NGX_HTTP_ALPN_PROTOS;
db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	477 srvlen = sizeof(NGX_HTTP_ALPN_PROTOS) - 1;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	478 }
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	479
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	480 if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen,
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	481 in, inlen)
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	482 != OPENSSL_NPN_NEGOTIATED)
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	483 {
7937 db6b630e6086 HTTP: connections with wrong ALPN protocols are now rejected. Vladimir Homutov <vl@nginx.com> parents: 7935 diff changeset	484 return SSL_TLSEXT_ERR_ALERT_FATAL;
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	485 }
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	486
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	487 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
6478 3ef7bb882ad4 Fixed logging with variable field width. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	488 "SSL ALPN selected: %s", (size_t) outlen, *out);
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	489
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	490 return SSL_TLSEXT_ERR_OK;
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	491 }
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	492
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	493 #endif
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	494
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	495
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	496 static ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	497 ngx_http_ssl_static_variable(ngx_http_request_t *r,
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	498 ngx_http_variable_value_t *v, uintptr_t data)
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	499 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	500 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	501
1310 33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	502 size_t len;
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	503 ngx_str_t s;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	504
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	505 if (r->connection->ssl) {
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	506
1310 33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	507 (void) handler(r->connection, NULL, &s);
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	508
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	509 v->data = s.data;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	510
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	511 for (len = 0; v->data[len]; len++) { /* void */ }
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	512
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	513 v->len = len;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	514 v->valid = 1;
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	515 v->no_cacheable = 0;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	516 v->not_found = 0;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	517
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	518 return NGX_OK;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	519 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	520
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	521 v->not_found = 1;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	522
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	523 return NGX_OK;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	524 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	525
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	526
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	527 static ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	528 ngx_http_ssl_variable(ngx_http_request_t r, ngx_http_variable_value_t v,
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	529 uintptr_t data)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	530 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	531 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	532
1310 33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	533 ngx_str_t s;
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	534
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	535 if (r->connection->ssl) {
1310 33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	536
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	537 if (handler(r->connection, r->pool, &s) != NGX_OK) {
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	538 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	539 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	540
1310 33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	541 v->len = s.len;
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	542 v->data = s.data;
33d6c994a0b2 Sun Studio on sparc uses different bit order Igor Sysoev <igor@sysoev.ru> parents: 1219 diff changeset	543
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	544 if (v->len) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	545 v->valid = 1;
1565 4c43e25d11ea fix English grammar Igor Sysoev <igor@sysoev.ru> parents: 1310 diff changeset	546 v->no_cacheable = 0;
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	547 v->not_found = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	548
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	549 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	550 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	551 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	552
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	553 v->not_found = 1;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	554
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	555 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	556 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	557
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	558
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	559 static ngx_int_t
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	560 ngx_http_ssl_add_variables(ngx_conf_t *cf)
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	561 {
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	562 ngx_http_variable_t var, v;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	563
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	564 for (v = ngx_http_ssl_vars; v->name.len; v++) {
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	565 var = ngx_http_add_variable(cf, &v->name, v->flags);
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	566 if (var == NULL) {
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	567 return NGX_ERROR;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	568 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	569
637 e60fe4cf1d4e nginx-0.3.40-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	570 var->get_handler = v->get_handler;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	571 var->data = v->data;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	572 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	573
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	574 return NGX_OK;
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	575 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	576
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 599 diff changeset	577
501 d4ea69372b94 nginx-0.1.25-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 485 diff changeset	578 static void *
d4ea69372b94 nginx-0.1.25-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 485 diff changeset	579 ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	580 {
971 948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	581 ngx_http_ssl_srv_conf_t *sscf;
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	582
971 948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	583 sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t));
948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	584 if (sscf == NULL) {
2912 c7d57b539248 return NULL instead of NGX_CONF_ERROR on a create conf failure Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	585 return NULL;
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	586 }
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	587
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	588 /*
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	589 * set by ngx_pcalloc():
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	590 *
971 948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	591 * sscf->protocols = 0;
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	592 * sscf->certificate_values = NULL;
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	593 * sscf->dhparam = { 0, NULL };
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	594 * sscf->ecdh_curve = { 0, NULL };
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	595 * sscf->client_certificate = { 0, NULL };
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	596 * sscf->trusted_certificate = { 0, NULL };
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	597 * sscf->crl = { 0, NULL };
3516 dd1570b6f237 ngx_str_set() and ngx_str_null() Igor Sysoev <igor@sysoev.ru> parents: 3209 diff changeset	598 * sscf->ciphers = { 0, NULL };
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	599 * sscf->shm_zone = NULL;
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	600 * sscf->ocsp_responder = { 0, NULL };
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	601 * sscf->stapling_file = { 0, NULL };
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	602 * sscf->stapling_responder = { 0, NULL };
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	603 */
c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	604
971 948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	605 sscf->enable = NGX_CONF_UNSET;
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	606 sscf->prefer_server_ciphers = NGX_CONF_UNSET;
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	607 sscf->early_data = NGX_CONF_UNSET;
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	608 sscf->reject_handshake = NGX_CONF_UNSET;
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	609 sscf->buffer_size = NGX_CONF_UNSET_SIZE;
2710 218ee852de73 fix building by MSVC8 Igor Sysoev <igor@sysoev.ru> parents: 2224 diff changeset	610 sscf->verify = NGX_CONF_UNSET_UINT;
218ee852de73 fix building by MSVC8 Igor Sysoev <igor@sysoev.ru> parents: 2224 diff changeset	611 sscf->verify_depth = NGX_CONF_UNSET_UINT;
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	612 sscf->certificates = NGX_CONF_UNSET_PTR;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	613 sscf->certificate_keys = NGX_CONF_UNSET_PTR;
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	614 sscf->passwords = NGX_CONF_UNSET_PTR;
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	615 sscf->conf_commands = NGX_CONF_UNSET_PTR;
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	616 sscf->builtin_session_cache = NGX_CONF_UNSET;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	617 sscf->session_timeout = NGX_CONF_UNSET;
5503 d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	618 sscf->session_tickets = NGX_CONF_UNSET;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	619 sscf->session_ticket_keys = NGX_CONF_UNSET_PTR;
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	620 sscf->ocsp = NGX_CONF_UNSET_UINT;
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	621 sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	622 sscf->stapling = NGX_CONF_UNSET;
4879 4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	623 sscf->stapling_verify = NGX_CONF_UNSET;
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	624
971 948acd940145 style fix: scf > sscf Igor Sysoev <igor@sysoev.ru> parents: 970 diff changeset	625 return sscf;
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	626 }
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	627
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	628
501 d4ea69372b94 nginx-0.1.25-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 485 diff changeset	629 static char *
d4ea69372b94 nginx-0.1.25-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 485 diff changeset	630 ngx_http_ssl_merge_srv_conf(ngx_conf_t cf, void parent, void *child)
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	631 {
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	632 ngx_http_ssl_srv_conf_t *prev = parent;
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	633 ngx_http_ssl_srv_conf_t *conf = child;
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	634
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	635 ngx_pool_cleanup_t *cln;
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	636
4234 d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	637 if (conf->enable == NGX_CONF_UNSET) {
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	638 if (prev->enable == NGX_CONF_UNSET) {
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	639 conf->enable = 0;
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	640
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	641 } else {
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	642 conf->enable = prev->enable;
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	643 conf->file = prev->file;
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	644 conf->line = prev->line;
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	645 }
d5462eab1440 Fixed segfault on configuration testing with ssl (ticket #37). Maxim Dounin <mdounin@mdounin.ru> parents: 4153 diff changeset	646 }
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	647
573 58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	648 ngx_conf_merge_value(conf->session_timeout,
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	649 prev->session_timeout, 300);
58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	650
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	651 ngx_conf_merge_value(conf->prefer_server_ciphers,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	652 prev->prefer_server_ciphers, 0);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	653
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	654 ngx_conf_merge_value(conf->early_data, prev->early_data, 0);
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	655 ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	656
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	657 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
6157 b2899e7d0ef8 Disabled SSLv3 by default (ticket #653). Maxim Dounin <mdounin@mdounin.ru> parents: 6035 diff changeset	658 (NGX_CONF_BITMASK_SET\|NGX_SSL_TLSv1
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4273 diff changeset	659 \|NGX_SSL_TLSv1_1\|NGX_SSL_TLSv1_2));
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	660
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	661 ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	662 NGX_SSL_BUFSIZE);
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	663
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	664 ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	665 ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	666
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	667 ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL);
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	668 ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys,
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	669 NULL);
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	670
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	671 ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	672
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	673 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, "");
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	674
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	675 ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	676 "");
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	677 ngx_conf_merge_str_value(conf->trusted_certificate,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	678 prev->trusted_certificate, "");
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	679 ngx_conf_merge_str_value(conf->crl, prev->crl, "");
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	680
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	681 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve,
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	682 NGX_DEFAULT_ECDH_CURVE);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	683
2124 e0b424b98f24 fix typo Igor Sysoev <igor@sysoev.ru> parents: 2123 diff changeset	684 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	685
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	686 ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	687
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	688 ngx_conf_merge_uint_value(conf->ocsp, prev->ocsp, 0);
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	689 ngx_conf_merge_str_value(conf->ocsp_responder, prev->ocsp_responder, "");
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	690 ngx_conf_merge_ptr_value(conf->ocsp_cache_zone,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	691 prev->ocsp_cache_zone, NULL);
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	692
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	693 ngx_conf_merge_value(conf->stapling, prev->stapling, 0);
4879 4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	694 ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0);
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	695 ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, "");
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	696 ngx_conf_merge_str_value(conf->stapling_responder,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	697 prev->stapling_responder, "");
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	698
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	699 conf->ssl.log = cf->log;
386 fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	700
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	701 if (conf->enable) {
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	702
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	703 if (conf->certificates) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	704 if (conf->certificate_keys == NULL) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	705 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	706 "no \"ssl_certificate_key\" is defined for "
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	707 "the \"ssl\" directive in %s:%ui",
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	708 conf->file, conf->line);
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	709 return NGX_CONF_ERROR;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	710 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	711
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	712 if (conf->certificate_keys->nelts < conf->certificates->nelts) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	713 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	714 "no \"ssl_certificate_key\" is defined "
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	715 "for certificate \"%V\" and "
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	716 "the \"ssl\" directive in %s:%ui",
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	717 ((ngx_str_t *) conf->certificates->elts)
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	718 + conf->certificates->nelts - 1,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	719 conf->file, conf->line);
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	720 return NGX_CONF_ERROR;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	721 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	722
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	723 } else if (!conf->reject_handshake) {
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	724 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	725 "no \"ssl_certificate\" is defined for "
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	726 "the \"ssl\" directive in %s:%ui",
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	727 conf->file, conf->line);
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	728 return NGX_CONF_ERROR;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	729 }
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	730
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	731 } else if (conf->certificates) {
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	732
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	733 if (conf->certificate_keys == NULL
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	734 \|\| conf->certificate_keys->nelts < conf->certificates->nelts)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	735 {
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	736 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	737 "no \"ssl_certificate_key\" is defined "
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	738 "for certificate \"%V\"",
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	739 ((ngx_str_t *) conf->certificates->elts)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6489 diff changeset	740 + conf->certificates->nelts - 1);
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	741 return NGX_CONF_ERROR;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	742 }
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	743
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	744 } else if (!conf->reject_handshake) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	745 return NGX_CONF_OK;
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	746 }
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	747
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 671 diff changeset	748 if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) {
386 fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	749 return NGX_CONF_ERROR;
fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	750 }
fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	751
7473 8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	752 cln = ngx_pool_cleanup_add(cf->pool, 0);
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	753 if (cln == NULL) {
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	754 ngx_ssl_cleanup_ctx(&conf->ssl);
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	755 return NGX_CONF_ERROR;
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	756 }
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	757
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	758 cln->handler = ngx_ssl_cleanup_ctx;
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	759 cln->data = &conf->ssl;
8981dbb12254 SSL: fixed potential leak on memory allocation errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7466 diff changeset	760
1219 86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	761 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	762
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	763 if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	764 ngx_http_ssl_servername)
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	765 == 0)
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	766 {
3140 ba9a8ba4207e ) issue warning instead of failure: this is too common case Igor Sysoev <igor@sysoev.ru>* parents: 2996 diff changeset	767 ngx_log_error(NGX_LOG_WARN, cf->log, 0,
3209 b82c623a607e fix typo Igor Sysoev <igor@sysoev.ru> parents: 3196 diff changeset	768 "nginx was built with SNI support, however, now it is linked "
3140 ba9a8ba4207e ) issue warning instead of failure: this is too common case Igor Sysoev <igor@sysoev.ru>* parents: 2996 diff changeset	769 "dynamically to an OpenSSL library which has no tlsext support, "
ba9a8ba4207e ) issue warning instead of failure: this is too common case Igor Sysoev <igor@sysoev.ru>* parents: 2996 diff changeset	770 "therefore SNI is not available");
1219 86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	771 }
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	772
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	773 #endif
86c5c9288acc SNI support Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	774
5545 01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	775 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	776 SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL);
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	777 #endif
01e2a5bcdd8f SSL: support ALPN (IETF's successor to NPN). Piotr Sikora <piotr@cloudflare.com> parents: 5504 diff changeset	778
7904 419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	779 if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	780 conf->prefer_server_ciphers)
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	781 != NGX_OK)
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	782 {
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	783 return NGX_CONF_ERROR;
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	784 }
419c066cb710 SSL: ciphers now set before loading certificates (ticket #2035). Maxim Dounin <mdounin@mdounin.ru> parents: 7787 diff changeset	785
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	786 if (ngx_http_ssl_compile_certificates(cf, conf) != NGX_OK) {
386 fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	787 return NGX_CONF_ERROR;
fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	788 }
fa72605e7089 nginx-0.0.7-2004-07-12-01:03:47 import Igor Sysoev <igor@sysoev.ru> parents: 385 diff changeset	789
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	790 if (conf->certificate_values) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	791
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	792 #ifdef SSL_R_CERT_CB_ERROR
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	793
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	794 /* install callback to lookup certificates */
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	795
7466 48c87377aabd SSL: fixed possible segfault with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7465 diff changeset	796 SSL_CTX_set_cert_cb(conf->ssl.ctx, ngx_http_ssl_certificate, conf);
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	797
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	798 #else
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	799 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	800 "variables in "
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	801 "\"ssl_certificate\" and \"ssl_certificate_key\" "
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	802 "directives are not supported on this platform");
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	803 return NGX_CONF_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	804 #endif
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	805
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	806 } else if (conf->certificates) {
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	807
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	808 /* configure certificates */
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	809
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	810 if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	811 conf->certificate_keys, conf->passwords)
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	812 != NGX_OK)
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	813 {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	814 return NGX_CONF_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	815 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	816 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	817
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	818 conf->ssl.buffer_size = conf->buffer_size;
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	819
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	820 if (conf->verify) {
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	821
4884 e406c997470a SSL: the "ssl_verify_client" directive parameter "optional_no_ca". Maxim Dounin <mdounin@mdounin.ru> parents: 4879 diff changeset	822 if (conf->client_certificate.len == 0 && conf->verify != 3) {
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	823 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
7567 ef7ee19776db SSL: fixed ssl_verify_client error message. Sergey Kandaurov <pluknet@nginx.com> parents: 7473 diff changeset	824 "no ssl_client_certificate for ssl_verify_client");
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	825 return NGX_CONF_ERROR;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	826 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	827
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	828 if (ngx_ssl_client_certificate(cf, &conf->ssl,
970 35f98a8e275f style fix Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	829 &conf->client_certificate,
35f98a8e275f style fix Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	830 conf->verify_depth)
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	831 != NGX_OK)
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	832 {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 669 diff changeset	833 return NGX_CONF_ERROR;
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	834 }
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	835 }
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	836
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	837 if (ngx_ssl_trusted_certificate(cf, &conf->ssl,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	838 &conf->trusted_certificate,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	839 conf->verify_depth)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	840 != NGX_OK)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	841 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	842 return NGX_CONF_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	843 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	844
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	845 if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4412 diff changeset	846 return NGX_CONF_ERROR;
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	847 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 637 diff changeset	848
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	849 if (conf->ocsp) {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	850
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	851 if (conf->verify == 3) {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	852 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	853 "\"ssl_ocsp\" is incompatible with "
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	854 "\"ssl_verify_client optional_no_ca\"");
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	855 return NGX_CONF_ERROR;
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	856 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	857
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	858 if (ngx_ssl_ocsp(cf, &conf->ssl, &conf->ocsp_responder, conf->ocsp,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	859 conf->ocsp_cache_zone)
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	860 != NGX_OK)
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	861 {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	862 return NGX_CONF_ERROR;
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	863 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	864 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	865
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	866 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	867 return NGX_CONF_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	868 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	869
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	870 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	871 return NGX_CONF_ERROR;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	872 }
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	873
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	874 ngx_conf_merge_value(conf->builtin_session_cache,
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	875 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE);
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	876
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	877 if (conf->shm_zone == NULL) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	878 conf->shm_zone = prev->shm_zone;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	879 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	880
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	881 if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx,
7465 6708bec13757 SSL: adjusted session id context with dynamic certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 7463 diff changeset	882 conf->certificates, conf->builtin_session_cache,
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	883 conf->shm_zone, conf->session_timeout)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	884 != NGX_OK)
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	885 {
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	886 return NGX_CONF_ERROR;
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	887 }
573 58475592100c nginx-0.3.8-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	888
5503 d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	889 ngx_conf_merge_value(conf->session_tickets, prev->session_tickets, 1);
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	890
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	891 #ifdef SSL_OP_NO_TICKET
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	892 if (!conf->session_tickets) {
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	893 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET);
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	894 }
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	895 #endif
d049b0ea00a3 SSL: ssl_session_tickets directive. Dirkjan Bussink <d.bussink@gmail.com> parents: 5487 diff changeset	896
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	897 ngx_conf_merge_ptr_value(conf->session_ticket_keys,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	898 prev->session_ticket_keys, NULL);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	899
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	900 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	901 != NGX_OK)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	902 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	903 return NGX_CONF_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	904 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5387 diff changeset	905
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	906 if (conf->stapling) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	907
4879 4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	908 if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file,
4a804fd04e6c OCSP stapling: ssl_stapling_verify directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	909 &conf->stapling_responder, conf->stapling_verify)
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	910 != NGX_OK)
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	911 {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	912 return NGX_CONF_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	913 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	914
4873 dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	915 }
dd74fd35ceb5 OCSP stapling: ssl_stapling_file support. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	916
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	917 if (ngx_ssl_early_data(cf, &conf->ssl, conf->early_data) != NGX_OK) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	918 return NGX_CONF_ERROR;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	919 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7270 diff changeset	920
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	921 if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	922 return NGX_CONF_ERROR;
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	923 }
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	924
383 c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	925 return NGX_CONF_OK;
c05876036128 nginx-0.0.7-2004-07-08-19:17:47 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	926 }
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	927
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	928
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	929 static ngx_int_t
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	930 ngx_http_ssl_compile_certificates(ngx_conf_t *cf,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	931 ngx_http_ssl_srv_conf_t *conf)
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	932 {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	933 ngx_str_t cert, key;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	934 ngx_uint_t i, nelts;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	935 ngx_http_complex_value_t *cv;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	936 ngx_http_compile_complex_value_t ccv;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	937
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	938 if (conf->certificates == NULL) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	939 return NGX_OK;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	940 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	941
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	942 cert = conf->certificates->elts;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	943 key = conf->certificate_keys->elts;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	944 nelts = conf->certificates->nelts;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	945
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	946 for (i = 0; i < nelts; i++) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	947
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	948 if (ngx_http_script_variables_count(&cert[i])) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	949 goto found;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	950 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	951
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	952 if (ngx_http_script_variables_count(&key[i])) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	953 goto found;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	954 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	955 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	956
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	957 return NGX_OK;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	958
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	959 found:
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	960
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	961 conf->certificate_values = ngx_array_create(cf->pool, nelts,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	962 sizeof(ngx_http_complex_value_t));
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	963 if (conf->certificate_values == NULL) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	964 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	965 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	966
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	967 conf->certificate_key_values = ngx_array_create(cf->pool, nelts,
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	968 sizeof(ngx_http_complex_value_t));
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	969 if (conf->certificate_key_values == NULL) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	970 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	971 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	972
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	973 for (i = 0; i < nelts; i++) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	974
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	975 cv = ngx_array_push(conf->certificate_values);
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	976 if (cv == NULL) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	977 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	978 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	979
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	980 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	981
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	982 ccv.cf = cf;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	983 ccv.value = &cert[i];
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	984 ccv.complex_value = cv;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	985 ccv.zero = 1;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	986
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	987 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	988 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	989 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	990
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	991 cv = ngx_array_push(conf->certificate_key_values);
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	992 if (cv == NULL) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	993 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	994 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	995
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	996 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	997
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	998 ccv.cf = cf;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	999 ccv.value = &key[i];
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1000 ccv.complex_value = cv;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1001 ccv.zero = 1;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1002
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1003 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1004 return NGX_ERROR;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1005 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1006 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1007
7463 180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7462 diff changeset	1008 conf->passwords = ngx_ssl_preserve_passwords(cf, conf->passwords);
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7462 diff changeset	1009 if (conf->passwords == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7462 diff changeset	1010 return NGX_ERROR;
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7462 diff changeset	1011 }
180df83473a4 SSL: passwords support for dynamic certificate loading. Maxim Dounin <mdounin@mdounin.ru> parents: 7462 diff changeset	1012
7462 be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1013 return NGX_OK;
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1014 }
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1015
be2af41d3620 SSL: variables support in ssl_certificate and ssl_certificate_key. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	1016
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1017 static char *
2224 109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1018 ngx_http_ssl_enable(ngx_conf_t cf, ngx_command_t cmd, void *conf)
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1019 {
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1020 ngx_http_ssl_srv_conf_t *sscf = conf;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1021
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1022 char *rv;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1023
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1024 rv = ngx_conf_set_flag_slot(cf, cmd, conf);
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1025
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1026 if (rv != NGX_CONF_OK) {
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1027 return rv;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1028 }
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1029
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1030 sscf->file = cf->conf_file->file.name.data;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1031 sscf->line = cf->conf_file->line;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1032
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1033 return NGX_CONF_OK;
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1034 }
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1035
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1036
109849282793 ) listen ssl Igor Sysoev <igor@sysoev.ru>* parents: 2124 diff changeset	1037 static char *
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1038 ngx_http_ssl_password_file(ngx_conf_t cf, ngx_command_t cmd, void *conf)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1039 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1040 ngx_http_ssl_srv_conf_t *sscf = conf;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1041
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1042 ngx_str_t *value;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1043
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1044 if (sscf->passwords != NGX_CONF_UNSET_PTR) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1045 return "is duplicate";
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1046 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1047
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1048 value = cf->args->elts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1049
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1050 sscf->passwords = ngx_ssl_read_password_file(cf, &value[1]);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1051
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1052 if (sscf->passwords == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1053 return NGX_CONF_ERROR;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1054 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1055
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1056 return NGX_CONF_OK;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1057 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1058
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1059
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1060 static char *
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1061 ngx_http_ssl_session_cache(ngx_conf_t cf, ngx_command_t cmd, void *conf)
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1062 {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1063 ngx_http_ssl_srv_conf_t *sscf = conf;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1064
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1065 size_t len;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1066 ngx_str_t *value, name, size;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1067 ngx_int_t n;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1068 ngx_uint_t i, j;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1069
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1070 value = cf->args->elts;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1071
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1072 for (i = 1; i < cf->args->nelts; i++) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1073
1778 14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1565 diff changeset	1074 if (ngx_strcmp(value[i].data, "off") == 0) {
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1565 diff changeset	1075 sscf->builtin_session_cache = NGX_SSL_NO_SCACHE;
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1565 diff changeset	1076 continue;
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1565 diff changeset	1077 }
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1565 diff changeset	1078
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1079 if (ngx_strcmp(value[i].data, "none") == 0) {
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1080 sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE;
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1081 continue;
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1082 }
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1083
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1084 if (ngx_strcmp(value[i].data, "builtin") == 0) {
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	1085 sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE;
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1086 continue;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1087 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1088
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1089 if (value[i].len > sizeof("builtin:") - 1
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1090 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1)
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1091 == 0)
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1092 {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1093 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1094 value[i].len - (sizeof("builtin:") - 1));
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1095
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1096 if (n == NGX_ERROR) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1097 goto invalid;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1098 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1099
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1100 sscf->builtin_session_cache = n;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1101
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1102 continue;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1103 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1104
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1105 if (value[i].len > sizeof("shared:") - 1
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1106 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1)
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1107 == 0)
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1108 {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1109 len = 0;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1110
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1111 for (j = sizeof("shared:") - 1; j < value[i].len; j++) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1112 if (value[i].data[j] == ':') {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1113 break;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1114 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1115
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1116 len++;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1117 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1118
8088 e32b48848add SSL: improved validation of ssl_session_cache and ssl_ocsp_cache. Sergey Kandaurov <pluknet@nginx.com> parents: 7973 diff changeset	1119 if (len == 0 \|\| j == value[i].len) {
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1120 goto invalid;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1121 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1122
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1123 name.len = len;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1124 name.data = value[i].data + sizeof("shared:") - 1;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1125
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1126 size.len = value[i].len - j - 1;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1127 size.data = name.data + len + 1;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1128
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1129 n = ngx_parse_size(&size);
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1130
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1131 if (n == NGX_ERROR) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1132 goto invalid;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1133 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1134
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1135 if (n < (ngx_int_t) (8 * ngx_pagesize)) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1136 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	1137 "session cache \"%V\" is too small",
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1138 &value[i]);
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1139
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1140 return NGX_CONF_ERROR;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1141 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1142
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1143 sscf->shm_zone = ngx_shared_memory_add(cf, &name, n,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1144 &ngx_http_ssl_module);
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1145 if (sscf->shm_zone == NULL) {
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1146 return NGX_CONF_ERROR;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1147 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1148
4153 7de74ed694c8 Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993). Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	1149 sscf->shm_zone->init = ngx_ssl_session_cache_init;
7de74ed694c8 Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993). Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	1150
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1151 continue;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1152 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1153
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1154 goto invalid;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1155 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1156
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1157 if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) {
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 973 diff changeset	1158 sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE;
973 e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1159 }
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1160
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1161 return NGX_CONF_OK;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1162
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1163 invalid:
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1164
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1165 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1166 "invalid session cache \"%V\"", &value[i]);
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1167
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1168 return NGX_CONF_ERROR;
e1ede83911ef ssl_session_cache Igor Sysoev <igor@sysoev.ru> parents: 971 diff changeset	1169 }
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1170
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1171
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1172 static char *
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1173 ngx_http_ssl_ocsp_cache(ngx_conf_t cf, ngx_command_t cmd, void *conf)
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1174 {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1175 ngx_http_ssl_srv_conf_t *sscf = conf;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1176
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1177 size_t len;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1178 ngx_int_t n;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1179 ngx_str_t *value, name, size;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1180 ngx_uint_t j;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1181
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1182 if (sscf->ocsp_cache_zone != NGX_CONF_UNSET_PTR) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1183 return "is duplicate";
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1184 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1185
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1186 value = cf->args->elts;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1187
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1188 if (ngx_strcmp(value[1].data, "off") == 0) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1189 sscf->ocsp_cache_zone = NULL;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1190 return NGX_CONF_OK;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1191 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1192
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1193 if (value[1].len <= sizeof("shared:") - 1
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1194 \|\| ngx_strncmp(value[1].data, "shared:", sizeof("shared:") - 1) != 0)
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1195 {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1196 goto invalid;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1197 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1198
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1199 len = 0;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1200
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1201 for (j = sizeof("shared:") - 1; j < value[1].len; j++) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1202 if (value[1].data[j] == ':') {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1203 break;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1204 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1205
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1206 len++;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1207 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1208
8088 e32b48848add SSL: improved validation of ssl_session_cache and ssl_ocsp_cache. Sergey Kandaurov <pluknet@nginx.com> parents: 7973 diff changeset	1209 if (len == 0 \|\| j == value[1].len) {
7654 b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1210 goto invalid;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1211 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1212
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1213 name.len = len;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1214 name.data = value[1].data + sizeof("shared:") - 1;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1215
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1216 size.len = value[1].len - j - 1;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1217 size.data = name.data + len + 1;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1218
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1219 n = ngx_parse_size(&size);
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1220
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1221 if (n == NGX_ERROR) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1222 goto invalid;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1223 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1224
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1225 if (n < (ngx_int_t) (8 * ngx_pagesize)) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1226 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1227 "OCSP cache \"%V\" is too small", &value[1]);
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1228
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1229 return NGX_CONF_ERROR;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1230 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1231
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1232 sscf->ocsp_cache_zone = ngx_shared_memory_add(cf, &name, n,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1233 &ngx_http_ssl_module_ctx);
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1234 if (sscf->ocsp_cache_zone == NULL) {
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1235 return NGX_CONF_ERROR;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1236 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1237
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1238 sscf->ocsp_cache_zone->init = ngx_ssl_ocsp_cache_init;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1239
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1240 return NGX_CONF_OK;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1241
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1242 invalid:
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1243
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1244 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1245 "invalid OCSP cache \"%V\"", &value[1]);
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1246
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1247 return NGX_CONF_ERROR;
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1248 }
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1249
b56f725dd4bb OCSP: certificate status cache. Roman Arutyunyan <arut@nginx.com> parents: 7653 diff changeset	1250
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1251 static char *
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1252 ngx_http_ssl_conf_command_check(ngx_conf_t cf, void post, void *data)
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1253 {
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1254 #ifndef SSL_CONF_FLAG_FILE
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1255 return "is not supported on this platform";
7787 7ce28b4cc57e SSL: fixed build by Sun C with old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 7732 diff changeset	1256 #else
7ce28b4cc57e SSL: fixed build by Sun C with old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 7732 diff changeset	1257 return NGX_CONF_OK;
7729 3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1258 #endif
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1259 }
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1260
3bff3f397c05 SSL: ssl_conf_command directive. Maxim Dounin <mdounin@mdounin.ru> parents: 7654 diff changeset	1261
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1262 static ngx_int_t
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1263 ngx_http_ssl_init(ngx_conf_t *cf)
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1264 {
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1265 ngx_uint_t a, p, s;
8481 0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1266 const char *name;
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1267 ngx_http_conf_addr_t *addr;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1268 ngx_http_conf_port_t *port;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1269 ngx_http_ssl_srv_conf_t *sscf;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1270 ngx_http_core_loc_conf_t *clcf;
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1271 ngx_http_core_srv_conf_t *cscfp, cscf;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1272 ngx_http_core_main_conf_t *cmcf;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1273
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1274 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1275 cscfp = cmcf->servers.elts;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1276
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1277 for (s = 0; s < cmcf->servers.nelts; s++) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1278
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1279 sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1280
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1281 if (sscf->ssl.ctx == NULL) {
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1282 continue;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1283 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1284
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1285 clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index];
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1286
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1287 if (sscf->stapling) {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1288 if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver,
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1289 clcf->resolver_timeout)
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1290 != NGX_OK)
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1291 {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1292 return NGX_ERROR;
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1293 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1294 }
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1295
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1296 if (sscf->ocsp) {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1297 if (ngx_ssl_ocsp_resolver(cf, &sscf->ssl, clcf->resolver,
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1298 clcf->resolver_timeout)
7653 8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1299 != NGX_OK)
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1300 {
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1301 return NGX_ERROR;
8409f9df6219 SSL: client certificate validation with OCSP (ticket #1534). Roman Arutyunyan <arut@nginx.com> parents: 7567 diff changeset	1302 }
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1303 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1304 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1305
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1306 if (cmcf->ports == NULL) {
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1307 return NGX_OK;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1308 }
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1309
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1310 port = cmcf->ports->elts;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1311 for (p = 0; p < cmcf->ports->nelts; p++) {
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1312
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1313 addr = port[p].addrs.elts;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1314 for (a = 0; a < port[p].addrs.nelts; a++) {
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1315
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	1316 if (!addr[a].opt.ssl && !addr[a].opt.http3) {
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1317 continue;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1318 }
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1319
8481 0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1320 if (addr[a].opt.http3) {
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1321 name = "http3";
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1322
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1323 } else {
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1324 name = "ssl";
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1325 }
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1326
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1327 cscf = addr[a].default_server;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1328 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1329
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1330 if (sscf->certificates) {
8869 e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1331
8922 be08b858086a HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro. Roman Arutyunyan <arut@nginx.com> parents: 8921 diff changeset	1332 if (addr[a].opt.http3 && !(sscf->protocols & NGX_SSL_TLSv1_3)) {
8869 e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1333 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1334 "\"ssl_protocols\" must enable TLSv1.3 for "
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1335 "the \"listen ... %s\" directive in %s:%ui",
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1336 name, cscf->file_name, cscf->line);
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1337 return NGX_ERROR;
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1338 }
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1339
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1340 continue;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1341 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1342
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1343 if (!sscf->reject_handshake) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1344 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1345 "no \"ssl_certificate\" is defined for "
8869 e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1346 "the \"listen ... %s\" directive in %s:%ui",
e5a17d6041bd Fixed mismerge of ssl_reject_handshake in 71b7453fb11f. Sergey Kandaurov <pluknet@nginx.com> parents: 8839 diff changeset	1347 name, cscf->file_name, cscf->line);
7732 59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1348 return NGX_ERROR;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1349 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1350
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1351 /*
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1352 * if no certificates are defined in the default server,
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1353 * check all non-default server blocks
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1354 */
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1355
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1356 cscfp = addr[a].servers.elts;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1357 for (s = 0; s < addr[a].servers.nelts; s++) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1358
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1359 cscf = cscfp[s];
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1360 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1361
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1362 if (sscf->certificates \|\| sscf->reject_handshake) {
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1363 continue;
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1364 }
59e1c73fe02b SSL: ssl_reject_handshake directive (ticket #195). Maxim Dounin <mdounin@mdounin.ru> parents: 7729 diff changeset	1365
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1366 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1367 "no \"ssl_certificate\" is defined for "
8481 0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1368 "the \"listen ... %s\" directive in %s:%ui",
0d2b2664b41c QUIC: added "quic" listen parameter. Roman Arutyunyan <arut@nginx.com> parents: 8411 diff changeset	1369 name, cscf->file_name, cscf->line);
7269 7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1370 return NGX_ERROR;
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1371 }
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1372 }
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1373 }
7f955d3b9a0d SSL: detect "listen ... ssl" without certificates (ticket #178). Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	1374
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1375 return NGX_OK;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4873 diff changeset	1376 }

Mercurial > hg > nginx

annotate src/http/modules/ngx_http_ssl_module.c @ 9035:3be953161026 quic