Mercurial > hg > nginx
annotate src/http/modules/ngx_http_ssl_module.c @ 5545:01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
| author | Piotr Sikora <piotr@cloudflare.com> |
|---|---|
| date | Tue, 28 Jan 2014 15:33:49 -0800 |
| parents | 8ed467553f6b |
| children | 7c05f6590753 |
| rev | line source |
|---|---|
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1 |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
2 /* |
|
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
5 */ |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
6 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #include <ngx_config.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 #include <ngx_core.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 #include <ngx_http.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
11 |
| 573 | 12 |
| 671 | 13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, |
| 14 ngx_pool_t *pool, ngx_str_t *s); | |
| 611 | 15 |
| 16 | |
| 3960 | 17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" |
| 18 #define NGX_DEFAULT_ECDH_CURVE "prime256v1" | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
19 |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
20 #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
21 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
22 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
23 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
24 static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
25 const unsigned char **out, unsigned char *outlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
26 const unsigned char *in, unsigned int inlen, void *arg); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
27 #endif |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
28 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
29 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
30 static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
31 const unsigned char **out, unsigned int *outlen, void *arg); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
32 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
33 |
| 671 | 34 static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 35 ngx_http_variable_value_t *v, uintptr_t data); |
| 671 | 36 static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r, |
| 647 | 37 ngx_http_variable_value_t *v, uintptr_t data); |
| 611 | 38 |
| 39 static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf); | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
40 static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
41 static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, |
| 501 | 42 void *parent, void *child); |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
43 |
| 2224 | 44 static char *ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, |
| 45 void *conf); | |
| 973 | 46 static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, |
| 47 void *conf); | |
| 48 | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
49 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
50 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
51 |
| 547 | 52 static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { |
| 53 { ngx_string("SSLv2"), NGX_SSL_SSLv2 }, | |
| 54 { ngx_string("SSLv3"), NGX_SSL_SSLv3 }, | |
| 55 { ngx_string("TLSv1"), NGX_SSL_TLSv1 }, | |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
56 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 }, |
|
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
57 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 }, |
| 547 | 58 { ngx_null_string, 0 } |
| 59 }; | |
| 60 | |
| 61 | |
| 2123 | 62 static ngx_conf_enum_t ngx_http_ssl_verify[] = { |
| 63 { ngx_string("off"), 0 }, | |
| 64 { ngx_string("on"), 1 }, | |
| 2994 | 65 { ngx_string("optional"), 2 }, |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
66 { ngx_string("optional_no_ca"), 3 }, |
| 2123 | 67 { ngx_null_string, 0 } |
| 68 }; | |
| 69 | |
| 70 | |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
71 static ngx_command_t ngx_http_ssl_commands[] = { |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
72 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
73 { ngx_string("ssl"), |
| 599 | 74 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
| 2224 | 75 ngx_http_ssl_enable, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
76 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
77 offsetof(ngx_http_ssl_srv_conf_t, enable), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
78 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
79 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
80 { ngx_string("ssl_certificate"), |
| 599 | 81 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
82 ngx_conf_set_str_slot, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
83 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
84 offsetof(ngx_http_ssl_srv_conf_t, certificate), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
85 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
86 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
87 { ngx_string("ssl_certificate_key"), |
| 599 | 88 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
89 ngx_conf_set_str_slot, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
90 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
91 offsetof(ngx_http_ssl_srv_conf_t, certificate_key), |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
92 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
93 |
| 2044 | 94 { ngx_string("ssl_dhparam"), |
| 95 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 96 ngx_conf_set_str_slot, | |
| 97 NGX_HTTP_SRV_CONF_OFFSET, | |
| 98 offsetof(ngx_http_ssl_srv_conf_t, dhparam), | |
| 99 NULL }, | |
| 100 | |
| 3960 | 101 { ngx_string("ssl_ecdh_curve"), |
| 102 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 103 ngx_conf_set_str_slot, | |
| 104 NGX_HTTP_SRV_CONF_OFFSET, | |
| 105 offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve), | |
| 106 NULL }, | |
| 107 | |
| 547 | 108 { ngx_string("ssl_protocols"), |
| 563 | 109 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE, |
| 547 | 110 ngx_conf_set_bitmask_slot, |
| 111 NGX_HTTP_SRV_CONF_OFFSET, | |
| 112 offsetof(ngx_http_ssl_srv_conf_t, protocols), | |
| 113 &ngx_http_ssl_protocols }, | |
| 114 | |
| 479 | 115 { ngx_string("ssl_ciphers"), |
| 563 | 116 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 479 | 117 ngx_conf_set_str_slot, |
| 118 NGX_HTTP_SRV_CONF_OFFSET, | |
| 119 offsetof(ngx_http_ssl_srv_conf_t, ciphers), | |
| 120 NULL }, | |
| 121 | |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
122 { ngx_string("ssl_buffer_size"), |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
123 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
124 ngx_conf_set_size_slot, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
125 NGX_HTTP_SRV_CONF_OFFSET, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
126 offsetof(ngx_http_ssl_srv_conf_t, buffer_size), |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
127 NULL }, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
128 |
| 647 | 129 { ngx_string("ssl_verify_client"), |
|
4273
e444e8f6538b
Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse.
Sergey Budnevitch <sb@waeme.net>
parents:
4234
diff
changeset
|
130 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 2123 | 131 ngx_conf_set_enum_slot, |
| 647 | 132 NGX_HTTP_SRV_CONF_OFFSET, |
| 133 offsetof(ngx_http_ssl_srv_conf_t, verify), | |
| 2123 | 134 &ngx_http_ssl_verify }, |
| 647 | 135 |
| 136 { ngx_string("ssl_verify_depth"), | |
|
5504
8ed467553f6b
SSL: fixed ssl_verify_depth to take only one argument.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5503
diff
changeset
|
137 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 647 | 138 ngx_conf_set_num_slot, |
| 139 NGX_HTTP_SRV_CONF_OFFSET, | |
| 140 offsetof(ngx_http_ssl_srv_conf_t, verify_depth), | |
| 141 NULL }, | |
| 142 | |
| 143 { ngx_string("ssl_client_certificate"), | |
| 144 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 145 ngx_conf_set_str_slot, | |
| 146 NGX_HTTP_SRV_CONF_OFFSET, | |
| 147 offsetof(ngx_http_ssl_srv_conf_t, client_certificate), | |
| 148 NULL }, | |
| 149 | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
150 { ngx_string("ssl_trusted_certificate"), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
151 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
152 ngx_conf_set_str_slot, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
153 NGX_HTTP_SRV_CONF_OFFSET, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
154 offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
155 NULL }, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
156 |
| 547 | 157 { ngx_string("ssl_prefer_server_ciphers"), |
| 158 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, | |
| 159 ngx_conf_set_flag_slot, | |
| 160 NGX_HTTP_SRV_CONF_OFFSET, | |
| 161 offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers), | |
| 162 NULL }, | |
| 163 | |
| 973 | 164 { ngx_string("ssl_session_cache"), |
| 165 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12, | |
| 166 ngx_http_ssl_session_cache, | |
| 167 NGX_HTTP_SRV_CONF_OFFSET, | |
| 168 0, | |
| 169 NULL }, | |
| 170 | |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
171 { ngx_string("ssl_session_tickets"), |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
172 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
173 ngx_conf_set_flag_slot, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
174 NGX_HTTP_SRV_CONF_OFFSET, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
175 offsetof(ngx_http_ssl_srv_conf_t, session_tickets), |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
176 NULL }, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
177 |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
178 { ngx_string("ssl_session_ticket_key"), |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
179 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
180 ngx_conf_set_str_array_slot, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
181 NGX_HTTP_SRV_CONF_OFFSET, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
182 offsetof(ngx_http_ssl_srv_conf_t, session_ticket_keys), |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
183 NULL }, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
184 |
| 573 | 185 { ngx_string("ssl_session_timeout"), |
| 186 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 187 ngx_conf_set_sec_slot, | |
| 188 NGX_HTTP_SRV_CONF_OFFSET, | |
| 189 offsetof(ngx_http_ssl_srv_conf_t, session_timeout), | |
| 190 NULL }, | |
| 191 | |
| 2995 | 192 { ngx_string("ssl_crl"), |
| 193 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 194 ngx_conf_set_str_slot, | |
| 195 NGX_HTTP_SRV_CONF_OFFSET, | |
| 196 offsetof(ngx_http_ssl_srv_conf_t, crl), | |
| 197 NULL }, | |
| 198 | |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
199 { ngx_string("ssl_stapling"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
200 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
201 ngx_conf_set_flag_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
202 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
203 offsetof(ngx_http_ssl_srv_conf_t, stapling), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
204 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
205 |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
206 { ngx_string("ssl_stapling_file"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
207 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
208 ngx_conf_set_str_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
209 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
210 offsetof(ngx_http_ssl_srv_conf_t, stapling_file), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
211 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
212 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
213 { ngx_string("ssl_stapling_responder"), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
214 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
215 ngx_conf_set_str_slot, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
216 NGX_HTTP_SRV_CONF_OFFSET, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
217 offsetof(ngx_http_ssl_srv_conf_t, stapling_responder), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
218 NULL }, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
219 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
220 { ngx_string("ssl_stapling_verify"), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
221 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
222 ngx_conf_set_flag_slot, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
223 NGX_HTTP_SRV_CONF_OFFSET, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
224 offsetof(ngx_http_ssl_srv_conf_t, stapling_verify), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
225 NULL }, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
226 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
227 ngx_null_command |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
228 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
229 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
230 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
231 static ngx_http_module_t ngx_http_ssl_module_ctx = { |
| 611 | 232 ngx_http_ssl_add_variables, /* preconfiguration */ |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
233 ngx_http_ssl_init, /* postconfiguration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
234 |
| 541 | 235 NULL, /* create main configuration */ |
| 236 NULL, /* init main configuration */ | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
237 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
238 ngx_http_ssl_create_srv_conf, /* create server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
239 ngx_http_ssl_merge_srv_conf, /* merge server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
240 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
241 NULL, /* create location configuration */ |
| 485 | 242 NULL /* merge location configuration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
243 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
244 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
245 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
246 ngx_module_t ngx_http_ssl_module = { |
| 509 | 247 NGX_MODULE_V1, |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
248 &ngx_http_ssl_module_ctx, /* module context */ |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
249 ngx_http_ssl_commands, /* module directives */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
250 NGX_HTTP_MODULE, /* module type */ |
| 541 | 251 NULL, /* init master */ |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
252 NULL, /* init module */ |
| 541 | 253 NULL, /* init process */ |
| 254 NULL, /* init thread */ | |
| 255 NULL, /* exit thread */ | |
| 256 NULL, /* exit process */ | |
| 257 NULL, /* exit master */ | |
| 258 NGX_MODULE_V1_PADDING | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
259 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
260 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
261 |
| 611 | 262 static ngx_http_variable_t ngx_http_ssl_vars[] = { |
| 263 | |
| 671 | 264 { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 265 (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 266 |
| 671 | 267 { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 268 (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 269 |
| 3154 | 270 { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable, |
| 271 (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 272 | |
| 2045 | 273 { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable, |
| 274 (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 275 | |
| 2123 | 276 { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable, |
| 277 (uintptr_t) ngx_ssl_get_raw_certificate, | |
| 278 NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 279 | |
| 671 | 280 { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 281 (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 282 |
| 671 | 283 { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 284 (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 671 | 285 |
| 286 { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable, | |
| 1565 | 287 (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 288 |
| 2994 | 289 { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable, |
| 290 (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 291 | |
| 637 | 292 { ngx_null_string, NULL, NULL, 0, 0, 0 } |
| 611 | 293 }; |
| 294 | |
| 295 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
296 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP"); |
| 973 | 297 |
| 298 | |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
299 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
300 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
301 static int |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
302 ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
303 unsigned char *outlen, const unsigned char *in, unsigned int inlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
304 void *arg) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
305 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
306 unsigned int srvlen; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
307 unsigned char *srv; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
308 #if (NGX_DEBUG) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
309 unsigned int i; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
310 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
311 #if (NGX_HTTP_SPDY) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
312 ngx_http_connection_t *hc; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
313 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
314 #if (NGX_HTTP_SPDY || NGX_DEBUG) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
315 ngx_connection_t *c; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
316 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
317 c = ngx_ssl_get_connection(ssl_conn); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
318 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
319 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
320 #if (NGX_DEBUG) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
321 for (i = 0; i < inlen; i += in[i] + 1) { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
322 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
323 "SSL ALPN supported by client: %*s", in[i], &in[i + 1]); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
324 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
325 #endif |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
326 |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
327 #if (NGX_HTTP_SPDY) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
328 hc = c->data; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
329 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
330 if (hc->addr_conf->spdy) { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
331 srv = (unsigned char *) NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
332 srvlen = sizeof(NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
333 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
334 } else |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
335 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
336 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
337 srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
338 srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
339 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
340 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
341 if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
342 in, inlen) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
343 != OPENSSL_NPN_NEGOTIATED) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
344 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
345 return SSL_TLSEXT_ERR_NOACK; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
346 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
347 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
348 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
349 "SSL ALPN selected: %*s", *outlen, *out); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
350 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
351 return SSL_TLSEXT_ERR_OK; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
352 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
353 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
354 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
355 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
356 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
357 #ifdef TLSEXT_TYPE_next_proto_neg |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
358 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
359 static int |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
360 ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
361 const unsigned char **out, unsigned int *outlen, void *arg) |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
362 { |
|
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
363 #if (NGX_HTTP_SPDY || NGX_DEBUG) |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
364 ngx_connection_t *c; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
365 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
366 c = ngx_ssl_get_connection(ssl_conn); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
367 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL NPN advertised"); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
368 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
369 |
|
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
370 #if (NGX_HTTP_SPDY) |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
371 { |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
372 ngx_http_connection_t *hc; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
373 |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
374 hc = c->data; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
375 |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
376 if (hc->addr_conf->spdy) { |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
377 *out = (unsigned char *) NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
378 *outlen = sizeof(NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
379 |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
380 return SSL_TLSEXT_ERR_OK; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
381 } |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
382 } |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
383 #endif |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
384 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
385 *out = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
386 *outlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
387 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
388 return SSL_TLSEXT_ERR_OK; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
389 } |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
390 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
391 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
392 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
393 |
| 973 | 394 static ngx_int_t |
| 671 | 395 ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 396 ngx_http_variable_value_t *v, uintptr_t data) |
| 397 { | |
| 671 | 398 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 611 | 399 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
400 size_t len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
401 ngx_str_t s; |
| 611 | 402 |
| 403 if (r->connection->ssl) { | |
| 404 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
405 (void) handler(r->connection, NULL, &s); |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
406 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
407 v->data = s.data; |
| 611 | 408 |
| 671 | 409 for (len = 0; v->data[len]; len++) { /* void */ } |
| 611 | 410 |
| 411 v->len = len; | |
| 412 v->valid = 1; | |
| 1565 | 413 v->no_cacheable = 0; |
| 611 | 414 v->not_found = 0; |
| 415 | |
| 416 return NGX_OK; | |
| 417 } | |
| 418 | |
| 419 v->not_found = 1; | |
| 420 | |
| 421 return NGX_OK; | |
| 422 } | |
| 423 | |
| 424 | |
| 425 static ngx_int_t | |
| 671 | 426 ngx_http_ssl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, |
| 647 | 427 uintptr_t data) |
| 428 { | |
| 671 | 429 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 647 | 430 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
431 ngx_str_t s; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
432 |
| 647 | 433 if (r->connection->ssl) { |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
434 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
435 if (handler(r->connection, r->pool, &s) != NGX_OK) { |
| 647 | 436 return NGX_ERROR; |
| 437 } | |
| 438 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
439 v->len = s.len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
440 v->data = s.data; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
441 |
| 647 | 442 if (v->len) { |
| 443 v->valid = 1; | |
| 1565 | 444 v->no_cacheable = 0; |
| 647 | 445 v->not_found = 0; |
| 446 | |
| 447 return NGX_OK; | |
| 448 } | |
| 449 } | |
| 450 | |
| 451 v->not_found = 1; | |
| 452 | |
| 453 return NGX_OK; | |
| 454 } | |
| 455 | |
| 456 | |
| 457 static ngx_int_t | |
| 611 | 458 ngx_http_ssl_add_variables(ngx_conf_t *cf) |
| 459 { | |
| 460 ngx_http_variable_t *var, *v; | |
| 461 | |
| 462 for (v = ngx_http_ssl_vars; v->name.len; v++) { | |
| 463 var = ngx_http_add_variable(cf, &v->name, v->flags); | |
| 464 if (var == NULL) { | |
| 465 return NGX_ERROR; | |
| 466 } | |
| 467 | |
| 637 | 468 var->get_handler = v->get_handler; |
| 611 | 469 var->data = v->data; |
| 470 } | |
| 471 | |
| 472 return NGX_OK; | |
| 473 } | |
| 474 | |
| 475 | |
| 501 | 476 static void * |
| 477 ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
478 { |
| 971 | 479 ngx_http_ssl_srv_conf_t *sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
480 |
| 971 | 481 sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)); |
| 482 if (sscf == NULL) { | |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
483 return NULL; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
484 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
485 |
| 479 | 486 /* |
| 487 * set by ngx_pcalloc(): | |
| 488 * | |
| 971 | 489 * sscf->protocols = 0; |
| 2044 | 490 * sscf->certificate = { 0, NULL }; |
| 491 * sscf->certificate_key = { 0, NULL }; | |
| 492 * sscf->dhparam = { 0, NULL }; | |
| 3960 | 493 * sscf->ecdh_curve = { 0, NULL }; |
| 2044 | 494 * sscf->client_certificate = { 0, NULL }; |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
495 * sscf->trusted_certificate = { 0, NULL }; |
| 2995 | 496 * sscf->crl = { 0, NULL }; |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3209
diff
changeset
|
497 * sscf->ciphers = { 0, NULL }; |
| 973 | 498 * sscf->shm_zone = NULL; |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
499 * sscf->stapling_file = { 0, NULL }; |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
500 * sscf->stapling_responder = { 0, NULL }; |
| 479 | 501 */ |
| 502 | |
| 971 | 503 sscf->enable = NGX_CONF_UNSET; |
| 2123 | 504 sscf->prefer_server_ciphers = NGX_CONF_UNSET; |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
505 sscf->buffer_size = NGX_CONF_UNSET_SIZE; |
| 2710 | 506 sscf->verify = NGX_CONF_UNSET_UINT; |
| 507 sscf->verify_depth = NGX_CONF_UNSET_UINT; | |
| 973 | 508 sscf->builtin_session_cache = NGX_CONF_UNSET; |
| 509 sscf->session_timeout = NGX_CONF_UNSET; | |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
510 sscf->session_tickets = NGX_CONF_UNSET; |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
511 sscf->session_ticket_keys = NGX_CONF_UNSET_PTR; |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
512 sscf->stapling = NGX_CONF_UNSET; |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
513 sscf->stapling_verify = NGX_CONF_UNSET; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
514 |
| 971 | 515 return sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
516 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
517 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
518 |
| 501 | 519 static char * |
| 520 ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
521 { |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
522 ngx_http_ssl_srv_conf_t *prev = parent; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
523 ngx_http_ssl_srv_conf_t *conf = child; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
524 |
| 563 | 525 ngx_pool_cleanup_t *cln; |
| 526 | |
|
4234
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
527 if (conf->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
528 if (prev->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
529 conf->enable = 0; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
530 |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
531 } else { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
532 conf->enable = prev->enable; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
533 conf->file = prev->file; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
534 conf->line = prev->line; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
535 } |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
536 } |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
537 |
| 573 | 538 ngx_conf_merge_value(conf->session_timeout, |
| 539 prev->session_timeout, 300); | |
| 540 | |
| 547 | 541 ngx_conf_merge_value(conf->prefer_server_ciphers, |
| 542 prev->prefer_server_ciphers, 0); | |
| 543 | |
| 544 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, | |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
545 (NGX_CONF_BITMASK_SET|NGX_SSL_SSLv3|NGX_SSL_TLSv1 |
|
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
546 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); |
| 547 | 547 |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
548 ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
549 NGX_SSL_BUFSIZE); |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
550 |
| 2123 | 551 ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); |
| 552 ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); | |
| 647 | 553 |
| 2224 | 554 ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); |
| 555 ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
556 |
| 2044 | 557 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); |
| 558 | |
| 647 | 559 ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate, |
| 560 ""); | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
561 ngx_conf_merge_str_value(conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
562 prev->trusted_certificate, ""); |
| 2995 | 563 ngx_conf_merge_str_value(conf->crl, prev->crl, ""); |
| 647 | 564 |
| 3960 | 565 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve, |
| 566 NGX_DEFAULT_ECDH_CURVE); | |
| 567 | |
| 2124 | 568 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS); |
| 479 | 569 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
570 ngx_conf_merge_value(conf->stapling, prev->stapling, 0); |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
571 ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0); |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
572 ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, ""); |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
573 ngx_conf_merge_str_value(conf->stapling_responder, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
574 prev->stapling_responder, ""); |
| 479 | 575 |
| 547 | 576 conf->ssl.log = cf->log; |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
577 |
| 2224 | 578 if (conf->enable) { |
| 579 | |
| 580 if (conf->certificate.len == 0) { | |
| 581 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 582 "no \"ssl_certificate\" is defined for " | |
| 583 "the \"ssl\" directive in %s:%ui", | |
| 584 conf->file, conf->line); | |
| 585 return NGX_CONF_ERROR; | |
| 586 } | |
| 587 | |
| 588 if (conf->certificate_key.len == 0) { | |
| 589 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 590 "no \"ssl_certificate_key\" is defined for " | |
| 591 "the \"ssl\" directive in %s:%ui", | |
| 592 conf->file, conf->line); | |
| 593 return NGX_CONF_ERROR; | |
| 594 } | |
| 595 | |
| 596 } else { | |
| 597 | |
| 598 if (conf->certificate.len == 0) { | |
| 599 return NGX_CONF_OK; | |
| 600 } | |
| 601 | |
| 602 if (conf->certificate_key.len == 0) { | |
| 603 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, | |
| 604 "no \"ssl_certificate_key\" is defined " | |
| 605 "for certificate \"%V\"", &conf->certificate); | |
| 606 return NGX_CONF_ERROR; | |
| 607 } | |
| 608 } | |
| 609 | |
| 969 | 610 if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
611 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
612 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
613 |
| 1219 | 614 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME |
| 615 | |
| 616 if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, | |
| 617 ngx_http_ssl_servername) | |
| 618 == 0) | |
| 619 { | |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
620 ngx_log_error(NGX_LOG_WARN, cf->log, 0, |
| 3209 | 621 "nginx was built with SNI support, however, now it is linked " |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
622 "dynamically to an OpenSSL library which has no tlsext support, " |
|
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
623 "therefore SNI is not available"); |
| 1219 | 624 } |
| 625 | |
| 626 #endif | |
| 627 | |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
628 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
629 SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
630 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
631 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
632 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
633 SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
634 ngx_http_ssl_npn_advertised, NULL); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
635 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
636 |
| 563 | 637 cln = ngx_pool_cleanup_add(cf->pool, 0); |
| 638 if (cln == NULL) { | |
| 509 | 639 return NGX_CONF_ERROR; |
| 640 } | |
| 641 | |
| 563 | 642 cln->handler = ngx_ssl_cleanup_ctx; |
| 643 cln->data = &conf->ssl; | |
| 644 | |
| 645 if (ngx_ssl_certificate(cf, &conf->ssl, &conf->certificate, | |
| 970 | 646 &conf->certificate_key) |
| 647 != NGX_OK) | |
| 529 | 648 { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
649 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
650 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
651 |
| 547 | 652 if (SSL_CTX_set_cipher_list(conf->ssl.ctx, |
| 563 | 653 (const char *) conf->ciphers.data) |
| 654 == 0) | |
| 529 | 655 { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
656 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0, |
| 547 | 657 "SSL_CTX_set_cipher_list(\"%V\") failed", |
| 658 &conf->ciphers); | |
|
5387
0fbcfab0bfd7
SSL: stop loading configs with invalid "ssl_ciphers" values.
Piotr Sikora <piotr@cloudflare.com>
parents:
5121
diff
changeset
|
659 return NGX_CONF_ERROR; |
| 547 | 660 } |
| 661 | |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
662 conf->ssl.buffer_size = conf->buffer_size; |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
663 |
| 647 | 664 if (conf->verify) { |
| 2123 | 665 |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
666 if (conf->client_certificate.len == 0 && conf->verify != 3) { |
| 2123 | 667 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
| 668 "no ssl_client_certificate for ssl_client_verify"); | |
| 669 return NGX_CONF_ERROR; | |
| 670 } | |
| 671 | |
| 671 | 672 if (ngx_ssl_client_certificate(cf, &conf->ssl, |
| 970 | 673 &conf->client_certificate, |
| 674 conf->verify_depth) | |
| 671 | 675 != NGX_OK) |
| 676 { | |
| 677 return NGX_CONF_ERROR; | |
| 647 | 678 } |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
679 } |
| 2995 | 680 |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
681 if (ngx_ssl_trusted_certificate(cf, &conf->ssl, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
682 &conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
683 conf->verify_depth) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
684 != NGX_OK) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
685 { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
686 return NGX_CONF_ERROR; |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
687 } |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
688 |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
689 if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
690 return NGX_CONF_ERROR; |
| 647 | 691 } |
| 692 | |
| 547 | 693 if (conf->prefer_server_ciphers) { |
| 694 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); | |
| 695 } | |
| 696 | |
| 697 /* a temporary 512-bit RSA key is required for export versions of MSIE */ | |
|
3959
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3938
diff
changeset
|
698 SSL_CTX_set_tmp_rsa_callback(conf->ssl.ctx, ngx_ssl_rsa512_key_callback); |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
699 |
| 2044 | 700 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) { |
| 701 return NGX_CONF_ERROR; | |
| 702 } | |
| 703 | |
| 3960 | 704 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) { |
| 705 return NGX_CONF_ERROR; | |
| 706 } | |
| 707 | |
| 973 | 708 ngx_conf_merge_value(conf->builtin_session_cache, |
| 2032 | 709 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE); |
| 973 | 710 |
| 711 if (conf->shm_zone == NULL) { | |
| 712 conf->shm_zone = prev->shm_zone; | |
| 713 } | |
| 714 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
715 if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
716 conf->builtin_session_cache, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
717 conf->shm_zone, conf->session_timeout) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
718 != NGX_OK) |
| 973 | 719 { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
720 return NGX_CONF_ERROR; |
| 973 | 721 } |
| 573 | 722 |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
723 ngx_conf_merge_value(conf->session_tickets, prev->session_tickets, 1); |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
724 |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
725 #ifdef SSL_OP_NO_TICKET |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
726 if (!conf->session_tickets) { |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
727 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET); |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
728 } |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
729 #endif |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
730 |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
731 ngx_conf_merge_ptr_value(conf->session_ticket_keys, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
732 prev->session_ticket_keys, NULL); |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
733 |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
734 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys) |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
735 != NGX_OK) |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
736 { |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
737 return NGX_CONF_ERROR; |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
738 } |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
739 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
740 if (conf->stapling) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
741 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
742 if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
743 &conf->stapling_responder, conf->stapling_verify) |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
744 != NGX_OK) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
745 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
746 return NGX_CONF_ERROR; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
747 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
748 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
749 } |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
750 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
751 return NGX_CONF_OK; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
752 } |
| 563 | 753 |
| 754 | |
| 973 | 755 static char * |
| 2224 | 756 ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 757 { | |
| 758 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 759 | |
| 760 char *rv; | |
| 761 | |
| 762 rv = ngx_conf_set_flag_slot(cf, cmd, conf); | |
| 763 | |
| 764 if (rv != NGX_CONF_OK) { | |
| 765 return rv; | |
| 766 } | |
| 767 | |
| 768 sscf->file = cf->conf_file->file.name.data; | |
| 769 sscf->line = cf->conf_file->line; | |
| 770 | |
| 771 return NGX_CONF_OK; | |
| 772 } | |
| 773 | |
| 774 | |
| 775 static char * | |
| 973 | 776 ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 777 { | |
| 778 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 779 | |
| 780 size_t len; | |
| 781 ngx_str_t *value, name, size; | |
| 782 ngx_int_t n; | |
| 783 ngx_uint_t i, j; | |
| 784 | |
| 785 value = cf->args->elts; | |
| 786 | |
| 787 for (i = 1; i < cf->args->nelts; i++) { | |
| 788 | |
| 1778 | 789 if (ngx_strcmp(value[i].data, "off") == 0) { |
| 790 sscf->builtin_session_cache = NGX_SSL_NO_SCACHE; | |
| 791 continue; | |
| 792 } | |
| 793 | |
| 2032 | 794 if (ngx_strcmp(value[i].data, "none") == 0) { |
| 795 sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE; | |
| 796 continue; | |
| 797 } | |
| 798 | |
| 973 | 799 if (ngx_strcmp(value[i].data, "builtin") == 0) { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
800 sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE; |
| 973 | 801 continue; |
| 802 } | |
| 803 | |
| 804 if (value[i].len > sizeof("builtin:") - 1 | |
| 805 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1) | |
| 806 == 0) | |
| 807 { | |
| 808 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1, | |
| 809 value[i].len - (sizeof("builtin:") - 1)); | |
| 810 | |
| 811 if (n == NGX_ERROR) { | |
| 812 goto invalid; | |
| 813 } | |
| 814 | |
| 815 sscf->builtin_session_cache = n; | |
| 816 | |
| 817 continue; | |
| 818 } | |
| 819 | |
| 820 if (value[i].len > sizeof("shared:") - 1 | |
| 821 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1) | |
| 822 == 0) | |
| 823 { | |
| 824 len = 0; | |
| 825 | |
| 826 for (j = sizeof("shared:") - 1; j < value[i].len; j++) { | |
| 827 if (value[i].data[j] == ':') { | |
| 828 break; | |
| 829 } | |
| 830 | |
| 831 len++; | |
| 832 } | |
| 833 | |
| 834 if (len == 0) { | |
| 835 goto invalid; | |
| 836 } | |
| 837 | |
| 838 name.len = len; | |
| 839 name.data = value[i].data + sizeof("shared:") - 1; | |
| 840 | |
| 841 size.len = value[i].len - j - 1; | |
| 842 size.data = name.data + len + 1; | |
| 843 | |
| 844 n = ngx_parse_size(&size); | |
| 845 | |
| 846 if (n == NGX_ERROR) { | |
| 847 goto invalid; | |
| 848 } | |
| 849 | |
| 850 if (n < (ngx_int_t) (8 * ngx_pagesize)) { | |
| 851 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
852 "session cache \"%V\" is too small", |
| 973 | 853 &value[i]); |
| 854 | |
| 855 return NGX_CONF_ERROR; | |
| 856 } | |
| 857 | |
| 858 sscf->shm_zone = ngx_shared_memory_add(cf, &name, n, | |
| 859 &ngx_http_ssl_module); | |
| 860 if (sscf->shm_zone == NULL) { | |
| 861 return NGX_CONF_ERROR; | |
| 862 } | |
| 863 | |
|
4153
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
864 sscf->shm_zone->init = ngx_ssl_session_cache_init; |
|
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
865 |
| 973 | 866 continue; |
| 867 } | |
| 868 | |
| 869 goto invalid; | |
| 870 } | |
| 871 | |
| 872 if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) { | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
873 sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE; |
| 973 | 874 } |
| 875 | |
| 876 return NGX_CONF_OK; | |
| 877 | |
| 878 invalid: | |
| 879 | |
| 880 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 881 "invalid session cache \"%V\"", &value[i]); | |
| 882 | |
| 883 return NGX_CONF_ERROR; | |
| 884 } | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
885 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
886 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
887 static ngx_int_t |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
888 ngx_http_ssl_init(ngx_conf_t *cf) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
889 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
890 ngx_uint_t s; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
891 ngx_http_ssl_srv_conf_t *sscf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
892 ngx_http_core_loc_conf_t *clcf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
893 ngx_http_core_srv_conf_t **cscfp; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
894 ngx_http_core_main_conf_t *cmcf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
895 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
896 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
897 cscfp = cmcf->servers.elts; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
898 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
899 for (s = 0; s < cmcf->servers.nelts; s++) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
900 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
901 sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
902 |
|
4887
4b4f4cea6dfb
OCSP stapling: properly check if there is ssl.ctx.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4884
diff
changeset
|
903 if (sscf->ssl.ctx == NULL || !sscf->stapling) { |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
904 continue; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
905 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
906 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
907 clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
908 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
909 if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
910 clcf->resolver_timeout) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
911 != NGX_OK) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
912 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
913 return NGX_ERROR; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
914 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
915 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
916 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
917 return NGX_OK; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
918 } |