Mercurial > hg > nginx
annotate src/http/modules/ngx_http_ssl_module.c @ 5106:afee87b8190a
SSL: Next Protocol Negotiation extension support.
Not only this is useful for the upcoming SPDY support, but it can
also help to improve HTTPS performance by enabling TLS False Start
in Chrome/Chromium browsers [1]. So, we always enable NPN for HTTPS
if it is supported by OpenSSL.
[1] http://www.imperialviolet.org/2012/04/11/falsestart.html
| author | Valentin Bartenev <vbart@nginx.com> |
|---|---|
| date | Thu, 07 Mar 2013 18:21:28 +0000 |
| parents | 9ea42922a395 |
| children | c0f7b94e88ba |
| rev | line source |
|---|---|
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1 |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
2 /* |
|
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
5 */ |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
6 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #include <ngx_config.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 #include <ngx_core.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 #include <ngx_http.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
11 |
| 573 | 12 |
| 671 | 13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, |
| 14 ngx_pool_t *pool, ngx_str_t *s); | |
| 611 | 15 |
| 16 | |
| 3960 | 17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" |
| 18 #define NGX_DEFAULT_ECDH_CURVE "prime256v1" | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
19 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
20 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
21 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
22 static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
23 const unsigned char **out, unsigned int *outlen, void *arg); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
24 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
25 |
| 671 | 26 static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 27 ngx_http_variable_value_t *v, uintptr_t data); |
| 671 | 28 static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r, |
| 647 | 29 ngx_http_variable_value_t *v, uintptr_t data); |
| 611 | 30 |
| 31 static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf); | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
32 static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
33 static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, |
| 501 | 34 void *parent, void *child); |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
35 |
| 2224 | 36 static char *ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, |
| 37 void *conf); | |
| 973 | 38 static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, |
| 39 void *conf); | |
| 40 | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
41 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
42 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
43 |
| 547 | 44 static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { |
| 45 { ngx_string("SSLv2"), NGX_SSL_SSLv2 }, | |
| 46 { ngx_string("SSLv3"), NGX_SSL_SSLv3 }, | |
| 47 { ngx_string("TLSv1"), NGX_SSL_TLSv1 }, | |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
48 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 }, |
|
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
49 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 }, |
| 547 | 50 { ngx_null_string, 0 } |
| 51 }; | |
| 52 | |
| 53 | |
| 2123 | 54 static ngx_conf_enum_t ngx_http_ssl_verify[] = { |
| 55 { ngx_string("off"), 0 }, | |
| 56 { ngx_string("on"), 1 }, | |
| 2994 | 57 { ngx_string("optional"), 2 }, |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
58 { ngx_string("optional_no_ca"), 3 }, |
| 2123 | 59 { ngx_null_string, 0 } |
| 60 }; | |
| 61 | |
| 62 | |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
63 static ngx_command_t ngx_http_ssl_commands[] = { |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
64 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
65 { ngx_string("ssl"), |
| 599 | 66 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
| 2224 | 67 ngx_http_ssl_enable, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
68 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
69 offsetof(ngx_http_ssl_srv_conf_t, enable), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
70 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
71 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
72 { ngx_string("ssl_certificate"), |
| 599 | 73 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
74 ngx_conf_set_str_slot, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
75 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
76 offsetof(ngx_http_ssl_srv_conf_t, certificate), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
77 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
78 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
79 { ngx_string("ssl_certificate_key"), |
| 599 | 80 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
81 ngx_conf_set_str_slot, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
82 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
83 offsetof(ngx_http_ssl_srv_conf_t, certificate_key), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
84 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
85 |
| 2044 | 86 { ngx_string("ssl_dhparam"), |
| 87 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 88 ngx_conf_set_str_slot, | |
| 89 NGX_HTTP_SRV_CONF_OFFSET, | |
| 90 offsetof(ngx_http_ssl_srv_conf_t, dhparam), | |
| 91 NULL }, | |
| 92 | |
| 3960 | 93 { ngx_string("ssl_ecdh_curve"), |
| 94 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 95 ngx_conf_set_str_slot, | |
| 96 NGX_HTTP_SRV_CONF_OFFSET, | |
| 97 offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve), | |
| 98 NULL }, | |
| 99 | |
| 547 | 100 { ngx_string("ssl_protocols"), |
| 563 | 101 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE, |
| 547 | 102 ngx_conf_set_bitmask_slot, |
| 103 NGX_HTTP_SRV_CONF_OFFSET, | |
| 104 offsetof(ngx_http_ssl_srv_conf_t, protocols), | |
| 105 &ngx_http_ssl_protocols }, | |
| 106 | |
| 479 | 107 { ngx_string("ssl_ciphers"), |
| 563 | 108 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 479 | 109 ngx_conf_set_str_slot, |
| 110 NGX_HTTP_SRV_CONF_OFFSET, | |
| 111 offsetof(ngx_http_ssl_srv_conf_t, ciphers), | |
| 112 NULL }, | |
| 113 | |
| 647 | 114 { ngx_string("ssl_verify_client"), |
|
4273
e444e8f6538b
Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse.
Sergey Budnevitch <sb@waeme.net>
parents:
4234
diff
changeset
|
115 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 2123 | 116 ngx_conf_set_enum_slot, |
| 647 | 117 NGX_HTTP_SRV_CONF_OFFSET, |
| 118 offsetof(ngx_http_ssl_srv_conf_t, verify), | |
| 2123 | 119 &ngx_http_ssl_verify }, |
| 647 | 120 |
| 121 { ngx_string("ssl_verify_depth"), | |
| 122 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE, | |
| 123 ngx_conf_set_num_slot, | |
| 124 NGX_HTTP_SRV_CONF_OFFSET, | |
| 125 offsetof(ngx_http_ssl_srv_conf_t, verify_depth), | |
| 126 NULL }, | |
| 127 | |
| 128 { ngx_string("ssl_client_certificate"), | |
| 129 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 130 ngx_conf_set_str_slot, | |
| 131 NGX_HTTP_SRV_CONF_OFFSET, | |
| 132 offsetof(ngx_http_ssl_srv_conf_t, client_certificate), | |
| 133 NULL }, | |
| 134 | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
135 { ngx_string("ssl_trusted_certificate"), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
136 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
137 ngx_conf_set_str_slot, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
138 NGX_HTTP_SRV_CONF_OFFSET, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
139 offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
140 NULL }, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
141 |
| 547 | 142 { ngx_string("ssl_prefer_server_ciphers"), |
| 143 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, | |
| 144 ngx_conf_set_flag_slot, | |
| 145 NGX_HTTP_SRV_CONF_OFFSET, | |
| 146 offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers), | |
| 147 NULL }, | |
| 148 | |
| 973 | 149 { ngx_string("ssl_session_cache"), |
| 150 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12, | |
| 151 ngx_http_ssl_session_cache, | |
| 152 NGX_HTTP_SRV_CONF_OFFSET, | |
| 153 0, | |
| 154 NULL }, | |
| 155 | |
| 573 | 156 { ngx_string("ssl_session_timeout"), |
| 157 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 158 ngx_conf_set_sec_slot, | |
| 159 NGX_HTTP_SRV_CONF_OFFSET, | |
| 160 offsetof(ngx_http_ssl_srv_conf_t, session_timeout), | |
| 161 NULL }, | |
| 162 | |
| 2995 | 163 { ngx_string("ssl_crl"), |
| 164 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 165 ngx_conf_set_str_slot, | |
| 166 NGX_HTTP_SRV_CONF_OFFSET, | |
| 167 offsetof(ngx_http_ssl_srv_conf_t, crl), | |
| 168 NULL }, | |
| 169 | |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
170 { ngx_string("ssl_stapling"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
171 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
172 ngx_conf_set_flag_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
173 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
174 offsetof(ngx_http_ssl_srv_conf_t, stapling), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
175 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
176 |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
177 { ngx_string("ssl_stapling_file"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
178 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
179 ngx_conf_set_str_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
180 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
181 offsetof(ngx_http_ssl_srv_conf_t, stapling_file), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
182 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
183 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
184 { ngx_string("ssl_stapling_responder"), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
185 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
186 ngx_conf_set_str_slot, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
187 NGX_HTTP_SRV_CONF_OFFSET, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
188 offsetof(ngx_http_ssl_srv_conf_t, stapling_responder), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
189 NULL }, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
190 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
191 { ngx_string("ssl_stapling_verify"), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
192 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
193 ngx_conf_set_flag_slot, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
194 NGX_HTTP_SRV_CONF_OFFSET, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
195 offsetof(ngx_http_ssl_srv_conf_t, stapling_verify), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
196 NULL }, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
197 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
198 ngx_null_command |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
199 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
200 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
201 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
202 static ngx_http_module_t ngx_http_ssl_module_ctx = { |
| 611 | 203 ngx_http_ssl_add_variables, /* preconfiguration */ |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
204 ngx_http_ssl_init, /* postconfiguration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
205 |
| 541 | 206 NULL, /* create main configuration */ |
| 207 NULL, /* init main configuration */ | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
208 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
209 ngx_http_ssl_create_srv_conf, /* create server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
210 ngx_http_ssl_merge_srv_conf, /* merge server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
211 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
212 NULL, /* create location configuration */ |
| 485 | 213 NULL /* merge location configuration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
214 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
215 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
216 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
217 ngx_module_t ngx_http_ssl_module = { |
| 509 | 218 NGX_MODULE_V1, |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
219 &ngx_http_ssl_module_ctx, /* module context */ |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
220 ngx_http_ssl_commands, /* module directives */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
221 NGX_HTTP_MODULE, /* module type */ |
| 541 | 222 NULL, /* init master */ |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
223 NULL, /* init module */ |
| 541 | 224 NULL, /* init process */ |
| 225 NULL, /* init thread */ | |
| 226 NULL, /* exit thread */ | |
| 227 NULL, /* exit process */ | |
| 228 NULL, /* exit master */ | |
| 229 NGX_MODULE_V1_PADDING | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
230 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
231 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
232 |
| 611 | 233 static ngx_http_variable_t ngx_http_ssl_vars[] = { |
| 234 | |
| 671 | 235 { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 236 (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 237 |
| 671 | 238 { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 239 (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 240 |
| 3154 | 241 { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable, |
| 242 (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 243 | |
| 2045 | 244 { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable, |
| 245 (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 246 | |
| 2123 | 247 { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable, |
| 248 (uintptr_t) ngx_ssl_get_raw_certificate, | |
| 249 NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 250 | |
| 671 | 251 { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 252 (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 253 |
| 671 | 254 { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 255 (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 671 | 256 |
| 257 { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable, | |
| 1565 | 258 (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 259 |
| 2994 | 260 { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable, |
| 261 (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 262 | |
| 637 | 263 { ngx_null_string, NULL, NULL, 0, 0, 0 } |
| 611 | 264 }; |
| 265 | |
| 266 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
267 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP"); |
| 973 | 268 |
| 269 | |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
270 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
271 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
272 #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
273 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
274 static int |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
275 ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
276 const unsigned char **out, unsigned int *outlen, void *arg) |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
277 { |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
278 #if (NGX_DEBUG) |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
279 ngx_connection_t *c; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
280 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
281 c = ngx_ssl_get_connection(ssl_conn); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
282 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL NPN advertised"); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
283 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
284 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
285 *out = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
286 *outlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
287 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
288 return SSL_TLSEXT_ERR_OK; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
289 } |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
290 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
291 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
292 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
293 |
| 973 | 294 static ngx_int_t |
| 671 | 295 ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 296 ngx_http_variable_value_t *v, uintptr_t data) |
| 297 { | |
| 671 | 298 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 611 | 299 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
300 size_t len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
301 ngx_str_t s; |
| 611 | 302 |
| 303 if (r->connection->ssl) { | |
| 304 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
305 (void) handler(r->connection, NULL, &s); |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
306 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
307 v->data = s.data; |
| 611 | 308 |
| 671 | 309 for (len = 0; v->data[len]; len++) { /* void */ } |
| 611 | 310 |
| 311 v->len = len; | |
| 312 v->valid = 1; | |
| 1565 | 313 v->no_cacheable = 0; |
| 611 | 314 v->not_found = 0; |
| 315 | |
| 316 return NGX_OK; | |
| 317 } | |
| 318 | |
| 319 v->not_found = 1; | |
| 320 | |
| 321 return NGX_OK; | |
| 322 } | |
| 323 | |
| 324 | |
| 325 static ngx_int_t | |
| 671 | 326 ngx_http_ssl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, |
| 647 | 327 uintptr_t data) |
| 328 { | |
| 671 | 329 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 647 | 330 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
331 ngx_str_t s; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
332 |
| 647 | 333 if (r->connection->ssl) { |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
334 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
335 if (handler(r->connection, r->pool, &s) != NGX_OK) { |
| 647 | 336 return NGX_ERROR; |
| 337 } | |
| 338 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
339 v->len = s.len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
340 v->data = s.data; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
341 |
| 647 | 342 if (v->len) { |
| 343 v->valid = 1; | |
| 1565 | 344 v->no_cacheable = 0; |
| 647 | 345 v->not_found = 0; |
| 346 | |
| 347 return NGX_OK; | |
| 348 } | |
| 349 } | |
| 350 | |
| 351 v->not_found = 1; | |
| 352 | |
| 353 return NGX_OK; | |
| 354 } | |
| 355 | |
| 356 | |
| 357 static ngx_int_t | |
| 611 | 358 ngx_http_ssl_add_variables(ngx_conf_t *cf) |
| 359 { | |
| 360 ngx_http_variable_t *var, *v; | |
| 361 | |
| 362 for (v = ngx_http_ssl_vars; v->name.len; v++) { | |
| 363 var = ngx_http_add_variable(cf, &v->name, v->flags); | |
| 364 if (var == NULL) { | |
| 365 return NGX_ERROR; | |
| 366 } | |
| 367 | |
| 637 | 368 var->get_handler = v->get_handler; |
| 611 | 369 var->data = v->data; |
| 370 } | |
| 371 | |
| 372 return NGX_OK; | |
| 373 } | |
| 374 | |
| 375 | |
| 501 | 376 static void * |
| 377 ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
378 { |
| 971 | 379 ngx_http_ssl_srv_conf_t *sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
380 |
| 971 | 381 sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)); |
| 382 if (sscf == NULL) { | |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
383 return NULL; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
384 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
385 |
| 479 | 386 /* |
| 387 * set by ngx_pcalloc(): | |
| 388 * | |
| 971 | 389 * sscf->protocols = 0; |
| 2044 | 390 * sscf->certificate = { 0, NULL }; |
| 391 * sscf->certificate_key = { 0, NULL }; | |
| 392 * sscf->dhparam = { 0, NULL }; | |
| 3960 | 393 * sscf->ecdh_curve = { 0, NULL }; |
| 2044 | 394 * sscf->client_certificate = { 0, NULL }; |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
395 * sscf->trusted_certificate = { 0, NULL }; |
| 2995 | 396 * sscf->crl = { 0, NULL }; |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3209
diff
changeset
|
397 * sscf->ciphers = { 0, NULL }; |
| 973 | 398 * sscf->shm_zone = NULL; |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
399 * sscf->stapling_file = { 0, NULL }; |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
400 * sscf->stapling_responder = { 0, NULL }; |
| 479 | 401 */ |
| 402 | |
| 971 | 403 sscf->enable = NGX_CONF_UNSET; |
| 2123 | 404 sscf->prefer_server_ciphers = NGX_CONF_UNSET; |
| 2710 | 405 sscf->verify = NGX_CONF_UNSET_UINT; |
| 406 sscf->verify_depth = NGX_CONF_UNSET_UINT; | |
| 973 | 407 sscf->builtin_session_cache = NGX_CONF_UNSET; |
| 408 sscf->session_timeout = NGX_CONF_UNSET; | |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
409 sscf->stapling = NGX_CONF_UNSET; |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
410 sscf->stapling_verify = NGX_CONF_UNSET; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
411 |
| 971 | 412 return sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
413 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
414 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
415 |
| 501 | 416 static char * |
| 417 ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
418 { |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
419 ngx_http_ssl_srv_conf_t *prev = parent; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
420 ngx_http_ssl_srv_conf_t *conf = child; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
421 |
| 563 | 422 ngx_pool_cleanup_t *cln; |
| 423 | |
|
4234
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
424 if (conf->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
425 if (prev->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
426 conf->enable = 0; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
427 |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
428 } else { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
429 conf->enable = prev->enable; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
430 conf->file = prev->file; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
431 conf->line = prev->line; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
432 } |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
433 } |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
434 |
| 573 | 435 ngx_conf_merge_value(conf->session_timeout, |
| 436 prev->session_timeout, 300); | |
| 437 | |
| 547 | 438 ngx_conf_merge_value(conf->prefer_server_ciphers, |
| 439 prev->prefer_server_ciphers, 0); | |
| 440 | |
| 441 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, | |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
442 (NGX_CONF_BITMASK_SET|NGX_SSL_SSLv3|NGX_SSL_TLSv1 |
|
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
443 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); |
| 547 | 444 |
| 2123 | 445 ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); |
| 446 ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); | |
| 647 | 447 |
| 2224 | 448 ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); |
| 449 ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
450 |
| 2044 | 451 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); |
| 452 | |
| 647 | 453 ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate, |
| 454 ""); | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
455 ngx_conf_merge_str_value(conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
456 prev->trusted_certificate, ""); |
| 2995 | 457 ngx_conf_merge_str_value(conf->crl, prev->crl, ""); |
| 647 | 458 |
| 3960 | 459 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve, |
| 460 NGX_DEFAULT_ECDH_CURVE); | |
| 461 | |
| 2124 | 462 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS); |
| 479 | 463 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
464 ngx_conf_merge_value(conf->stapling, prev->stapling, 0); |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
465 ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0); |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
466 ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, ""); |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
467 ngx_conf_merge_str_value(conf->stapling_responder, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
468 prev->stapling_responder, ""); |
| 479 | 469 |
| 547 | 470 conf->ssl.log = cf->log; |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
471 |
| 2224 | 472 if (conf->enable) { |
| 473 | |
| 474 if (conf->certificate.len == 0) { | |
| 475 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 476 "no \"ssl_certificate\" is defined for " | |
| 477 "the \"ssl\" directive in %s:%ui", | |
| 478 conf->file, conf->line); | |
| 479 return NGX_CONF_ERROR; | |
| 480 } | |
| 481 | |
| 482 if (conf->certificate_key.len == 0) { | |
| 483 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 484 "no \"ssl_certificate_key\" is defined for " | |
| 485 "the \"ssl\" directive in %s:%ui", | |
| 486 conf->file, conf->line); | |
| 487 return NGX_CONF_ERROR; | |
| 488 } | |
| 489 | |
| 490 } else { | |
| 491 | |
| 492 if (conf->certificate.len == 0) { | |
| 493 return NGX_CONF_OK; | |
| 494 } | |
| 495 | |
| 496 if (conf->certificate_key.len == 0) { | |
| 497 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 498 "no \"ssl_certificate_key\" is defined " | |
| 499 "for certificate \"%V\"", &conf->certificate); | |
| 500 return NGX_CONF_ERROR; | |
| 501 } | |
| 502 } | |
| 503 | |
| 969 | 504 if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
505 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
506 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
507 |
| 1219 | 508 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME |
| 509 | |
| 510 if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, | |
| 511 ngx_http_ssl_servername) | |
| 512 == 0) | |
| 513 { | |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
514 ngx_log_error(NGX_LOG_WARN, cf->log, 0, |
| 3209 | 515 "nginx was built with SNI support, however, now it is linked " |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
516 "dynamically to an OpenSSL library which has no tlsext support, " |
|
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
517 "therefore SNI is not available"); |
| 1219 | 518 } |
| 519 | |
| 520 #endif | |
| 521 | |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
522 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
523 SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
524 ngx_http_ssl_npn_advertised, NULL); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
525 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
526 |
| 563 | 527 cln = ngx_pool_cleanup_add(cf->pool, 0); |
| 528 if (cln == NULL) { | |
| 509 | 529 return NGX_CONF_ERROR; |
| 530 } | |
| 531 | |
| 563 | 532 cln->handler = ngx_ssl_cleanup_ctx; |
| 533 cln->data = &conf->ssl; | |
| 534 | |
| 535 if (ngx_ssl_certificate(cf, &conf->ssl, &conf->certificate, | |
| 970 | 536 &conf->certificate_key) |
| 537 != NGX_OK) | |
| 529 | 538 { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
539 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
540 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
541 |
| 547 | 542 if (SSL_CTX_set_cipher_list(conf->ssl.ctx, |
| 563 | 543 (const char *) conf->ciphers.data) |
| 544 == 0) | |
| 529 | 545 { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
546 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0, |
| 547 | 547 "SSL_CTX_set_cipher_list(\"%V\") failed", |
| 548 &conf->ciphers); | |
| 549 } | |
| 550 | |
| 647 | 551 if (conf->verify) { |
| 2123 | 552 |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
553 if (conf->client_certificate.len == 0 && conf->verify != 3) { |
| 2123 | 554 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
| 555 "no ssl_client_certificate for ssl_client_verify"); | |
| 556 return NGX_CONF_ERROR; | |
| 557 } | |
| 558 | |
| 671 | 559 if (ngx_ssl_client_certificate(cf, &conf->ssl, |
| 970 | 560 &conf->client_certificate, |
| 561 conf->verify_depth) | |
| 671 | 562 != NGX_OK) |
| 563 { | |
| 564 return NGX_CONF_ERROR; | |
| 647 | 565 } |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
566 } |
| 2995 | 567 |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
568 if (ngx_ssl_trusted_certificate(cf, &conf->ssl, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
569 &conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
570 conf->verify_depth) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
571 != NGX_OK) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
572 { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
573 return NGX_CONF_ERROR; |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
574 } |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
575 |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
576 if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
577 return NGX_CONF_ERROR; |
| 647 | 578 } |
| 579 | |
| 547 | 580 if (conf->prefer_server_ciphers) { |
| 581 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); | |
| 582 } | |
| 583 | |
| 584 /* a temporary 512-bit RSA key is required for export versions of MSIE */ | |
|
3959
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3938
diff
changeset
|
585 SSL_CTX_set_tmp_rsa_callback(conf->ssl.ctx, ngx_ssl_rsa512_key_callback); |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
586 |
| 2044 | 587 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) { |
| 588 return NGX_CONF_ERROR; | |
| 589 } | |
| 590 | |
| 3960 | 591 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) { |
| 592 return NGX_CONF_ERROR; | |
| 593 } | |
| 594 | |
| 973 | 595 ngx_conf_merge_value(conf->builtin_session_cache, |
| 2032 | 596 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE); |
| 973 | 597 |
| 598 if (conf->shm_zone == NULL) { | |
| 599 conf->shm_zone = prev->shm_zone; | |
| 600 } | |
| 601 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
602 if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
603 conf->builtin_session_cache, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
604 conf->shm_zone, conf->session_timeout) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
605 != NGX_OK) |
| 973 | 606 { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
607 return NGX_CONF_ERROR; |
| 973 | 608 } |
| 573 | 609 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
610 if (conf->stapling) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
611 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
612 if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
613 &conf->stapling_responder, conf->stapling_verify) |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
614 != NGX_OK) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
615 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
616 return NGX_CONF_ERROR; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
617 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
618 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
619 } |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
620 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
621 return NGX_CONF_OK; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
622 } |
| 563 | 623 |
| 624 | |
| 973 | 625 static char * |
| 2224 | 626 ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 627 { | |
| 628 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 629 | |
| 630 char *rv; | |
| 631 | |
| 632 rv = ngx_conf_set_flag_slot(cf, cmd, conf); | |
| 633 | |
| 634 if (rv != NGX_CONF_OK) { | |
| 635 return rv; | |
| 636 } | |
| 637 | |
| 638 sscf->file = cf->conf_file->file.name.data; | |
| 639 sscf->line = cf->conf_file->line; | |
| 640 | |
| 641 return NGX_CONF_OK; | |
| 642 } | |
| 643 | |
| 644 | |
| 645 static char * | |
| 973 | 646 ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 647 { | |
| 648 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 649 | |
| 650 size_t len; | |
| 651 ngx_str_t *value, name, size; | |
| 652 ngx_int_t n; | |
| 653 ngx_uint_t i, j; | |
| 654 | |
| 655 value = cf->args->elts; | |
| 656 | |
| 657 for (i = 1; i < cf->args->nelts; i++) { | |
| 658 | |
| 1778 | 659 if (ngx_strcmp(value[i].data, "off") == 0) { |
| 660 sscf->builtin_session_cache = NGX_SSL_NO_SCACHE; | |
| 661 continue; | |
| 662 } | |
| 663 | |
| 2032 | 664 if (ngx_strcmp(value[i].data, "none") == 0) { |
| 665 sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE; | |
| 666 continue; | |
| 667 } | |
| 668 | |
| 973 | 669 if (ngx_strcmp(value[i].data, "builtin") == 0) { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
670 sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE; |
| 973 | 671 continue; |
| 672 } | |
| 673 | |
| 674 if (value[i].len > sizeof("builtin:") - 1 | |
| 675 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1) | |
| 676 == 0) | |
| 677 { | |
| 678 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1, | |
| 679 value[i].len - (sizeof("builtin:") - 1)); | |
| 680 | |
| 681 if (n == NGX_ERROR) { | |
| 682 goto invalid; | |
| 683 } | |
| 684 | |
| 685 sscf->builtin_session_cache = n; | |
| 686 | |
| 687 continue; | |
| 688 } | |
| 689 | |
| 690 if (value[i].len > sizeof("shared:") - 1 | |
| 691 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1) | |
| 692 == 0) | |
| 693 { | |
| 694 len = 0; | |
| 695 | |
| 696 for (j = sizeof("shared:") - 1; j < value[i].len; j++) { | |
| 697 if (value[i].data[j] == ':') { | |
| 698 break; | |
| 699 } | |
| 700 | |
| 701 len++; | |
| 702 } | |
| 703 | |
| 704 if (len == 0) { | |
| 705 goto invalid; | |
| 706 } | |
| 707 | |
| 708 name.len = len; | |
| 709 name.data = value[i].data + sizeof("shared:") - 1; | |
| 710 | |
| 711 size.len = value[i].len - j - 1; | |
| 712 size.data = name.data + len + 1; | |
| 713 | |
| 714 n = ngx_parse_size(&size); | |
| 715 | |
| 716 if (n == NGX_ERROR) { | |
| 717 goto invalid; | |
| 718 } | |
| 719 | |
| 720 if (n < (ngx_int_t) (8 * ngx_pagesize)) { | |
| 721 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
722 "session cache \"%V\" is too small", |
| 973 | 723 &value[i]); |
| 724 | |
| 725 return NGX_CONF_ERROR; | |
| 726 } | |
| 727 | |
| 728 sscf->shm_zone = ngx_shared_memory_add(cf, &name, n, | |
| 729 &ngx_http_ssl_module); | |
| 730 if (sscf->shm_zone == NULL) { | |
| 731 return NGX_CONF_ERROR; | |
| 732 } | |
| 733 | |
|
4153
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
734 sscf->shm_zone->init = ngx_ssl_session_cache_init; |
|
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
735 |
| 973 | 736 continue; |
| 737 } | |
| 738 | |
| 739 goto invalid; | |
| 740 } | |
| 741 | |
| 742 if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) { | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
743 sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE; |
| 973 | 744 } |
| 745 | |
| 746 return NGX_CONF_OK; | |
| 747 | |
| 748 invalid: | |
| 749 | |
| 750 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 751 "invalid session cache \"%V\"", &value[i]); | |
| 752 | |
| 753 return NGX_CONF_ERROR; | |
| 754 } | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
755 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
756 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
757 static ngx_int_t |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
758 ngx_http_ssl_init(ngx_conf_t *cf) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
759 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
760 ngx_uint_t s; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
761 ngx_http_ssl_srv_conf_t *sscf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
762 ngx_http_core_loc_conf_t *clcf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
763 ngx_http_core_srv_conf_t **cscfp; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
764 ngx_http_core_main_conf_t *cmcf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
765 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
766 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
767 cscfp = cmcf->servers.elts; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
768 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
769 for (s = 0; s < cmcf->servers.nelts; s++) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
770 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
771 sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
772 |
|
4887
4b4f4cea6dfb
OCSP stapling: properly check if there is ssl.ctx.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4884
diff
changeset
|
773 if (sscf->ssl.ctx == NULL || !sscf->stapling) { |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
774 continue; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
775 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
776 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
777 clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
778 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
779 if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
780 clcf->resolver_timeout) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
781 != NGX_OK) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
782 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
783 return NGX_ERROR; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
784 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
785 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
786 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
787 return NGX_OK; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
788 } |