Mercurial > hg > nginx-quic
comparison src/http/ngx_http_upstream.c @ 5660:7022564a9e0e
Upstream: proxy_ssl_name and proxy_ssl_server_name directives.
These directives allow to switch on Server Name Indication (SNI) while
connecting to upstream servers.
By default, proxy_ssl_server_name is currently off (that is, no SNI) and
proxy_ssl_name is set to a host used in the proxy_pass directive.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Fri, 18 Apr 2014 20:13:28 +0400 |
parents | 345e4fd4bb64 |
children | 060c2e692b96 |
comparison
equal
deleted
inserted
replaced
5659:3fb6615bb87f | 5660:7022564a9e0e |
---|---|
154 | 154 |
155 #if (NGX_HTTP_SSL) | 155 #if (NGX_HTTP_SSL) |
156 static void ngx_http_upstream_ssl_init_connection(ngx_http_request_t *, | 156 static void ngx_http_upstream_ssl_init_connection(ngx_http_request_t *, |
157 ngx_http_upstream_t *u, ngx_connection_t *c); | 157 ngx_http_upstream_t *u, ngx_connection_t *c); |
158 static void ngx_http_upstream_ssl_handshake(ngx_connection_t *c); | 158 static void ngx_http_upstream_ssl_handshake(ngx_connection_t *c); |
159 static ngx_int_t ngx_http_upstream_ssl_name(ngx_http_request_t *r, | |
160 ngx_http_upstream_t *u, ngx_connection_t *c); | |
159 #endif | 161 #endif |
160 | 162 |
161 | 163 |
162 ngx_http_upstream_header_t ngx_http_upstream_headers_in[] = { | 164 ngx_http_upstream_header_t ngx_http_upstream_headers_in[] = { |
163 | 165 |
579 u->cleanup = &cln->handler; | 581 u->cleanup = &cln->handler; |
580 | 582 |
581 if (u->resolved == NULL) { | 583 if (u->resolved == NULL) { |
582 | 584 |
583 uscf = u->conf->upstream; | 585 uscf = u->conf->upstream; |
586 #if (NGX_HTTP_SSL) | |
587 u->ssl_name = uscf->host; | |
588 #endif | |
584 | 589 |
585 } else { | 590 } else { |
591 | |
592 #if (NGX_HTTP_SSL) | |
593 u->ssl_name = u->resolved->host; | |
594 #endif | |
586 | 595 |
587 if (u->resolved->sockaddr) { | 596 if (u->resolved->sockaddr) { |
588 | 597 |
589 if (ngx_http_upstream_create_round_robin_peer(r, u->resolved) | 598 if (ngx_http_upstream_create_round_robin_peer(r, u->resolved) |
590 != NGX_OK) | 599 != NGX_OK) |
1353 } | 1362 } |
1354 | 1363 |
1355 c->sendfile = 0; | 1364 c->sendfile = 0; |
1356 u->output.sendfile = 0; | 1365 u->output.sendfile = 0; |
1357 | 1366 |
1367 if (u->conf->ssl_server_name) { | |
1368 if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) { | |
1369 ngx_http_upstream_finalize_request(r, u, | |
1370 NGX_HTTP_INTERNAL_SERVER_ERROR); | |
1371 return; | |
1372 } | |
1373 } | |
1374 | |
1358 if (u->conf->ssl_session_reuse) { | 1375 if (u->conf->ssl_session_reuse) { |
1359 if (u->peer.set_session(&u->peer, u->peer.data) != NGX_OK) { | 1376 if (u->peer.set_session(&u->peer, u->peer.data) != NGX_OK) { |
1360 ngx_http_upstream_finalize_request(r, u, | 1377 ngx_http_upstream_finalize_request(r, u, |
1361 NGX_HTTP_INTERNAL_SERVER_ERROR); | 1378 NGX_HTTP_INTERNAL_SERVER_ERROR); |
1362 return; | 1379 return; |
1405 c = r->connection; | 1422 c = r->connection; |
1406 | 1423 |
1407 ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR); | 1424 ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR); |
1408 | 1425 |
1409 ngx_http_run_posted_requests(c); | 1426 ngx_http_run_posted_requests(c); |
1427 } | |
1428 | |
1429 | |
1430 static ngx_int_t | |
1431 ngx_http_upstream_ssl_name(ngx_http_request_t *r, ngx_http_upstream_t *u, | |
1432 ngx_connection_t *c) | |
1433 { | |
1434 u_char *p, *last; | |
1435 ngx_str_t name; | |
1436 | |
1437 if (u->conf->ssl_name) { | |
1438 if (ngx_http_complex_value(r, u->conf->ssl_name, &name) != NGX_OK) { | |
1439 return NGX_ERROR; | |
1440 } | |
1441 | |
1442 } else { | |
1443 name = u->ssl_name; | |
1444 } | |
1445 | |
1446 if (name.len == 0) { | |
1447 goto done; | |
1448 } | |
1449 | |
1450 /* | |
1451 * ssl name here may contain port, notably if derived from $proxy_host | |
1452 * or $http_host; we have to strip it | |
1453 */ | |
1454 | |
1455 p = name.data; | |
1456 last = name.data + name.len; | |
1457 | |
1458 if (*p == '[') { | |
1459 p = ngx_strlchr(p, last, ']'); | |
1460 | |
1461 if (p == NULL) { | |
1462 p = name.data; | |
1463 } | |
1464 } | |
1465 | |
1466 p = ngx_strlchr(p, last, ':'); | |
1467 | |
1468 if (p != NULL) { | |
1469 name.len = p - name.data; | |
1470 } | |
1471 | |
1472 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME | |
1473 | |
1474 /* as per RFC 6066, literal IPv4 and IPv6 addresses are not permitted */ | |
1475 | |
1476 if (name.len == 0 || *name.data == '[') { | |
1477 goto done; | |
1478 } | |
1479 | |
1480 if (ngx_inet_addr(name.data, name.len) != INADDR_NONE) { | |
1481 goto done; | |
1482 } | |
1483 | |
1484 /* | |
1485 * SSL_set_tlsext_host_name() needs a null-terminated string, | |
1486 * hence we explicitly null-terminate name here | |
1487 */ | |
1488 | |
1489 p = ngx_palloc(r->pool, name.len + 1); | |
1490 if (p == NULL) { | |
1491 return NGX_ERROR; | |
1492 } | |
1493 | |
1494 (void) ngx_cpystrn(p, name.data, name.len + 1); | |
1495 | |
1496 name.data = p; | |
1497 | |
1498 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, | |
1499 "upstream SSL server name: \"%s\"", name.data); | |
1500 | |
1501 if (SSL_set_tlsext_host_name(c->ssl->connection, name.data) == 0) { | |
1502 ngx_ssl_error(NGX_LOG_ERR, r->connection->log, 0, | |
1503 "SSL_set_tlsext_host_name(\"%s\") failed", name.data); | |
1504 return NGX_ERROR; | |
1505 } | |
1506 | |
1507 #endif | |
1508 | |
1509 done: | |
1510 | |
1511 u->ssl_name = name; | |
1512 | |
1513 return NGX_OK; | |
1410 } | 1514 } |
1411 | 1515 |
1412 #endif | 1516 #endif |
1413 | 1517 |
1414 | 1518 |