annotate src/event/ngx_event_openssl.c @ 7612:1ce3f01a4355

SSL: reworked posted next events. Introduced in 9d2ad2fb4423 available bytes handling in SSL relied on connection read handler being overwritten to set the ready flag and the amount of available bytes. This approach is, however, does not work properly when connection read handler is changed, for example, when switching to a next pipelined request, and can result in unexpected connection timeouts, see here: http://mailman.nginx.org/pipermail/nginx-devel/2019-December/012825.html Fix is to introduce ngx_event_process_posted_next() instead, which will set ready and available regardless of how event handler is set.
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 24 Dec 2019 17:24:59 +0300
parents 9d2ad2fb4423
children f1720934c45b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
441
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
1
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
2 /*
444
42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents: 441
diff changeset
3 * Copyright (C) Igor Sysoev
4412
d620f497c50f Copyright updated.
Maxim Konovalov <maxim@nginx.com>
parents: 4400
diff changeset
4 * Copyright (C) Nginx, Inc.
441
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
5 */
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
6
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
7
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 #include <ngx_config.h>
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 #include <ngx_core.h>
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
10 #include <ngx_event.h>
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
11
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
12
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
13 #define NGX_SSL_PASSWORD_BUFFER_SIZE 4096
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
14
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
15
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
16 typedef struct {
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
17 ngx_uint_t engine; /* unsigned engine:1; */
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
18 } ngx_openssl_conf_t;
479
c52408583801 nginx-0.1.14-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 473
diff changeset
19
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
20
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
21 static X509 *ngx_ssl_load_certificate(ngx_pool_t *pool, char **err,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
22 ngx_str_t *cert, STACK_OF(X509) **chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
23 static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
24 ngx_str_t *key, ngx_array_t *passwords);
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
25 static int ngx_ssl_password_callback(char *buf, int size, int rwflag,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
26 void *userdata);
5222
23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules.
Piotr Sikora <piotr@cloudflare.com>
parents: 5081
diff changeset
27 static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
28 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
29 int ret);
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
30 static void ngx_ssl_passwords_cleanup(void *data);
7320
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
31 static int ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn,
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
32 ngx_ssl_session_t *sess);
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
33 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
34 static ngx_int_t ngx_ssl_try_early_data(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
35 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
36 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
37 static void ngx_ssl_handshake_log(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
38 #endif
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
39 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
40 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
41 static ssize_t ngx_ssl_recv_early(ngx_connection_t *c, u_char *buf,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
42 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
43 #endif
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
44 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
45 static void ngx_ssl_write_handler(ngx_event_t *wev);
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
46 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
47 static ssize_t ngx_ssl_write_early(ngx_connection_t *c, u_char *data,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
48 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
49 #endif
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
50 static void ngx_ssl_read_handler(ngx_event_t *rev);
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
51 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
52 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
53 ngx_err_t err, char *text);
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
54 static void ngx_ssl_clear_error(ngx_log_t *log);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
55
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
56 static ngx_int_t ngx_ssl_session_id_context(ngx_ssl_t *ssl,
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
57 ngx_str_t *sess_ctx, ngx_array_t *certificates);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
58 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
59 ngx_ssl_session_t *sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
60 static ngx_ssl_session_t *ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
6487
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
61 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
62 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
63 #endif
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
64 u_char *id, int len, int *copy);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
65 static void ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
66 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
67 ngx_slab_pool_t *shpool, ngx_uint_t n);
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
68 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
69 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
70
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
71 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
72 static int ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
73 unsigned char *name, unsigned char *iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
74 HMAC_CTX *hctx, int enc);
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
75 static void ngx_ssl_session_ticket_keys_cleanup(void *data);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
76 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
77
6725
9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6699
diff changeset
78 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
79 static ngx_int_t ngx_ssl_check_name(ngx_str_t *name, ASN1_STRING *str);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
80 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
81
6815
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
82 static time_t ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
83 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
84 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
85 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
86 ASN1_TIME *asn1time);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
87
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
88 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
89 static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
90 static void ngx_openssl_exit(ngx_cycle_t *cycle);
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
91
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
92
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
93 static ngx_command_t ngx_openssl_commands[] = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
94
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
95 { ngx_string("ssl_engine"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
96 NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
97 ngx_openssl_engine,
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
98 0,
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
99 0,
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
100 NULL },
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
101
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
102 ngx_null_command
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
103 };
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
104
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
105
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
106 static ngx_core_module_t ngx_openssl_module_ctx = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
107 ngx_string("openssl"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
108 ngx_openssl_create_conf,
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
109 NULL
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
110 };
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
111
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
112
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
113 ngx_module_t ngx_openssl_module = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
114 NGX_MODULE_V1,
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
115 &ngx_openssl_module_ctx, /* module context */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
116 ngx_openssl_commands, /* module directives */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
117 NGX_CORE_MODULE, /* module type */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
118 NULL, /* init master */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
119 NULL, /* init module */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
120 NULL, /* init process */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
121 NULL, /* init thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
122 NULL, /* exit thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
123 NULL, /* exit process */
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
124 ngx_openssl_exit, /* exit master */
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
125 NGX_MODULE_V1_PADDING
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
126 };
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
127
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
128
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
129 int ngx_ssl_connection_index;
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
130 int ngx_ssl_server_conf_index;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
131 int ngx_ssl_session_cache_index;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
132 int ngx_ssl_session_ticket_keys_index;
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
133 int ngx_ssl_certificate_index;
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
134 int ngx_ssl_next_certificate_index;
6812
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
135 int ngx_ssl_certificate_name_index;
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
136 int ngx_ssl_stapling_index;
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
137
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
138
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
139 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
140 ngx_ssl_init(ngx_log_t *log)
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
141 {
6488
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
142 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
143
6902
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
144 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) == 0) {
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
145 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed");
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
146 return NGX_ERROR;
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
147 }
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
148
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
149 /*
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
150 * OPENSSL_init_ssl() may leave errors in the error queue
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
151 * while returning success
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
152 */
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
153
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl().
Sergey Kandaurov <pluknet@nginx.com>
parents: 6854
diff changeset
154 ERR_clear_error();
6488
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
155
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
156 #else
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
157
968
1b60ecc8cdb7 OPENSSL_config()
Igor Sysoev <igor@sysoev.ru>
parents: 671
diff changeset
158 OPENSSL_config(NULL);
1b60ecc8cdb7 OPENSSL_config()
Igor Sysoev <igor@sysoev.ru>
parents: 671
diff changeset
159
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
160 SSL_library_init();
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
161 SSL_load_error_strings();
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
162
3464
7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents: 3457
diff changeset
163 OpenSSL_add_all_algorithms();
7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents: 3457
diff changeset
164
6488
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
165 #endif
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
166
4696
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
167 #ifndef SSL_OP_NO_COMPRESSION
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
168 {
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
169 /*
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
170 * Disable gzip compression in OpenSSL prior to 1.0.0 version,
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
171 * this saves about 522K per connection.
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
172 */
4867
90bbf2adb2c9 SSL: fixed compression workaround to remove all methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4696
diff changeset
173 int n;
4696
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
174 STACK_OF(SSL_COMP) *ssl_comp_methods;
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
175
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
176 ssl_comp_methods = SSL_COMP_get_compression_methods();
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
177 n = sk_SSL_COMP_num(ssl_comp_methods);
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
178
4867
90bbf2adb2c9 SSL: fixed compression workaround to remove all methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4696
diff changeset
179 while (n--) {
90bbf2adb2c9 SSL: fixed compression workaround to remove all methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4696
diff changeset
180 (void) sk_SSL_COMP_pop(ssl_comp_methods);
4696
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
181 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
182 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
183 #endif
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version.
Igor Sysoev <igor@sysoev.ru>
parents: 4651
diff changeset
184
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
185 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
186
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
187 if (ngx_ssl_connection_index == -1) {
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
188 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
189 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
190 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
191
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
192 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
193 NULL);
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
194 if (ngx_ssl_server_conf_index == -1) {
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
195 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
196 "SSL_CTX_get_ex_new_index() failed");
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
197 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
198 }
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
199
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
200 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
201 NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
202 if (ngx_ssl_session_cache_index == -1) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
203 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
204 "SSL_CTX_get_ex_new_index() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
205 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
206 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
207
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
208 ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
209 NULL, NULL);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
210 if (ngx_ssl_session_ticket_keys_index == -1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
211 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
212 "SSL_CTX_get_ex_new_index() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
213 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
214 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
215
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
216 ngx_ssl_certificate_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
217 NULL);
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
218 if (ngx_ssl_certificate_index == -1) {
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
219 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
220 "SSL_CTX_get_ex_new_index() failed");
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
221 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
222 }
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
223
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
224 ngx_ssl_next_certificate_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
225 NULL);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
226 if (ngx_ssl_next_certificate_index == -1) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
227 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
228 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
229 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
230
6812
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
231 ngx_ssl_certificate_name_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
232 NULL);
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
233
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
234 if (ngx_ssl_certificate_name_index == -1) {
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
235 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
236 return NGX_ERROR;
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
237 }
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
238
6545
a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6490
diff changeset
239 ngx_ssl_stapling_index = X509_get_ex_new_index(0, NULL, NULL, NULL, NULL);
a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6490
diff changeset
240
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
241 if (ngx_ssl_stapling_index == -1) {
6545
a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6490
diff changeset
242 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
243 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
244 }
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
245
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
246 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
247 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
248
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
249
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
250 ngx_int_t
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
251 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
252 {
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
253 ssl->ctx = SSL_CTX_new(SSLv23_method());
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
254
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
255 if (ssl->ctx == NULL) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
256 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
257 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
258 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
259
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
260 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
261 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
262 "SSL_CTX_set_ex_data() failed");
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
263 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
264 }
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
265
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
266 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, NULL) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
267 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
268 "SSL_CTX_set_ex_data() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
269 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
270 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
271
5487
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
272 ssl->buffer_size = NGX_SSL_BUFSIZE;
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
273
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
274 /* client side options */
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
275
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
276 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
277 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
278 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
279
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
280 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
281 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
282 #endif
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
283
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
284 /* server side options */
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
285
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
286 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
287 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
288 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
289
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
290 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
291 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
292 #endif
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
293
5378
a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.
Piotr Sikora <piotr@cloudflare.com>
parents: 5365
diff changeset
294 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
295 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
296 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
5378
a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.
Piotr Sikora <piotr@cloudflare.com>
parents: 5365
diff changeset
297 #endif
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
298
5778
45ed2f1f0a6a SSL: let it build against BoringSSL.
Piotr Sikora <piotr@cloudflare.com>
parents: 5777
diff changeset
299 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
300 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
5778
45ed2f1f0a6a SSL: let it build against BoringSSL.
Piotr Sikora <piotr@cloudflare.com>
parents: 5777
diff changeset
301 #endif
45ed2f1f0a6a SSL: let it build against BoringSSL.
Piotr Sikora <piotr@cloudflare.com>
parents: 5777
diff changeset
302
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
303 #ifdef SSL_OP_TLS_D5_BUG
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
304 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
305 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
306
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
307 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
308 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
309 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
310
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
311 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
312 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
5823
275e35d54626 SSL: guard use of all SSL options for bug workarounds.
Piotr Sikora <piotr@cloudflare.com>
parents: 5779
diff changeset
313 #endif
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
314
2044
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
315 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
316
7318
3443fe40bdc7 SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7317
diff changeset
317 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
6034
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
318 /* only in 0.9.8m+ */
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
319 SSL_CTX_clear_options(ssl->ctx,
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
320 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
321 #endif
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
322
4400
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
323 if (!(protocols & NGX_SSL_SSLv2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
324 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
325 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
326 if (!(protocols & NGX_SSL_SSLv3)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
327 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
328 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
329 if (!(protocols & NGX_SSL_TLSv1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
330 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
331 }
4400
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
332 #ifdef SSL_OP_NO_TLSv1_1
6034
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
333 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
4400
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
334 if (!(protocols & NGX_SSL_TLSv1_1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
335 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
336 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
337 #endif
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
338 #ifdef SSL_OP_NO_TLSv1_2
6034
3e847964ab55 SSL: clear protocol options.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5986
diff changeset
339 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
4400
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
340 if (!(protocols & NGX_SSL_TLSv1_2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
341 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
342 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4236
diff changeset
343 #endif
6981
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
344 #ifdef SSL_OP_NO_TLSv1_3
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
345 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
346 if (!(protocols & NGX_SSL_TLSv1_3)) {
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
347 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
348 }
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6902
diff changeset
349 #endif
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
350
7372
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7365
diff changeset
351 #ifdef SSL_CTX_set_min_proto_version
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7365
diff changeset
352 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7365
diff changeset
353 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7365
diff changeset
354 #endif
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7365
diff changeset
355
7332
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7320
diff changeset
356 #ifdef TLS1_3_VERSION
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7320
diff changeset
357 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7320
diff changeset
358 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7320
diff changeset
359 #endif
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7320
diff changeset
360
4185
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection.
Igor Sysoev <igor@sysoev.ru>
parents: 4064
diff changeset
361 #ifdef SSL_OP_NO_COMPRESSION
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection.
Igor Sysoev <igor@sysoev.ru>
parents: 4064
diff changeset
362 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection.
Igor Sysoev <igor@sysoev.ru>
parents: 4064
diff changeset
363 #endif
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection.
Igor Sysoev <igor@sysoev.ru>
parents: 4064
diff changeset
364
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
365 #ifdef SSL_OP_NO_ANTI_REPLAY
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
366 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_ANTI_REPLAY);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
367 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
368
7474
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7472
diff changeset
369 #ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7472
diff changeset
370 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_CLIENT_RENEGOTIATION);
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7472
diff changeset
371 #endif
3f1db95d758a SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7472
diff changeset
372
4186
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL
Igor Sysoev <igor@sysoev.ru>
parents: 4185
diff changeset
373 #ifdef SSL_MODE_RELEASE_BUFFERS
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL
Igor Sysoev <igor@sysoev.ru>
parents: 4185
diff changeset
374 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_RELEASE_BUFFERS);
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL
Igor Sysoev <igor@sysoev.ru>
parents: 4185
diff changeset
375 #endif
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL
Igor Sysoev <igor@sysoev.ru>
parents: 4185
diff changeset
376
6036
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6034
diff changeset
377 #ifdef SSL_MODE_NO_AUTO_CHAIN
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6034
diff changeset
378 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_NO_AUTO_CHAIN);
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6034
diff changeset
379 #endif
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6034
diff changeset
380
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
381 SSL_CTX_set_read_ahead(ssl->ctx, 1);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
382
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
383 SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
384
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
385 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
386 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
387
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
388
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
389 ngx_int_t
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
390 ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
391 ngx_array_t *keys, ngx_array_t *passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
392 {
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
393 ngx_str_t *cert, *key;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
394 ngx_uint_t i;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
395
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
396 cert = certs->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
397 key = keys->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
398
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
399 for (i = 0; i < certs->nelts; i++) {
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
400
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
401 if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
402 != NGX_OK)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
403 {
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
404 return NGX_ERROR;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
405 }
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
406 }
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
407
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
408 return NGX_OK;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
409 }
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
410
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
411
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6549
diff changeset
412 ngx_int_t
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
413 ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
414 ngx_str_t *key, ngx_array_t *passwords)
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
415 {
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
416 char *err;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
417 X509 *x509;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
418 EVP_PKEY *pkey;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
419 STACK_OF(X509) *chain;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
420
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
421 x509 = ngx_ssl_load_certificate(cf->pool, &err, cert, &chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
422 if (x509 == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
423 if (err != NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
424 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
425 "cannot load certificate \"%s\": %s",
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
426 cert->data, err);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
427 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
428
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
429 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
430 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
431
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
432 if (SSL_CTX_use_certificate(ssl->ctx, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
433 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
434 "SSL_CTX_use_certificate(\"%s\") failed", cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
435 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
436 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
437 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
438 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
439
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
440 if (X509_set_ex_data(x509, ngx_ssl_certificate_name_index, cert->data)
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
441 == 0)
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
442 {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
443 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
444 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
445 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
446 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
447 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
448
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
449 if (X509_set_ex_data(x509, ngx_ssl_next_certificate_index,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
450 SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index))
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
451 == 0)
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
452 {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
453 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
454 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
455 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
456 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
457 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
458
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
459 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
460 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
461 "SSL_CTX_set_ex_data() failed");
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
462 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
463 sk_X509_pop_free(chain, X509_free);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
464 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
465 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
466
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
467 /*
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
468 * Note that x509 is not freed here, but will be instead freed in
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
469 * ngx_ssl_cleanup_ctx(). This is because we need to preserve all
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
470 * certificates to be able to iterate all of them through exdata
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
471 * (ngx_ssl_certificate_index, ngx_ssl_next_certificate_index),
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
472 * while OpenSSL can free a certificate if it is replaced with another
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
473 * certificate of the same type.
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
474 */
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
475
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
476 #ifdef SSL_CTX_set0_chain
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
477
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
478 if (SSL_CTX_set0_chain(ssl->ctx, chain) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
479 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
480 "SSL_CTX_set0_chain(\"%s\") failed", cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
481 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
482 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
483 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
484
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
485 #else
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
486 {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
487 int n;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
488
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
489 /* SSL_CTX_set0_chain() is only available in OpenSSL 1.0.2+ */
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
490
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
491 n = sk_X509_num(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
492
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
493 while (n--) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
494 x509 = sk_X509_shift(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
495
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
496 if (SSL_CTX_add_extra_chain_cert(ssl->ctx, x509) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
497 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
498 "SSL_CTX_add_extra_chain_cert(\"%s\") failed",
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
499 cert->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
500 sk_X509_pop_free(chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
501 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
502 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
503 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
504
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
505 sk_X509_free(chain);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
506 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
507 #endif
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
508
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
509 pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
510 if (pkey == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
511 if (err != NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
512 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
513 "cannot load certificate key \"%s\": %s",
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
514 key->data, err);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
515 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
516
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
517 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
518 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
519
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
520 if (SSL_CTX_use_PrivateKey(ssl->ctx, pkey) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
521 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
522 "SSL_CTX_use_PrivateKey(\"%s\") failed", key->data);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
523 EVP_PKEY_free(pkey);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
524 return NGX_ERROR;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
525 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
526
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
527 EVP_PKEY_free(pkey);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
528
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
529 return NGX_OK;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
530 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
531
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
532
7461
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
533 ngx_int_t
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
534 ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
535 ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords)
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
536 {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
537 char *err;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
538 X509 *x509;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
539 EVP_PKEY *pkey;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
540 STACK_OF(X509) *chain;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
541
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
542 x509 = ngx_ssl_load_certificate(pool, &err, cert, &chain);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
543 if (x509 == NULL) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
544 if (err != NULL) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
545 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
546 "cannot load certificate \"%s\": %s",
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
547 cert->data, err);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
548 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
549
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
550 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
551 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
552
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
553 if (SSL_use_certificate(c->ssl->connection, x509) == 0) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
554 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
555 "SSL_use_certificate(\"%s\") failed", cert->data);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
556 X509_free(x509);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
557 sk_X509_pop_free(chain, X509_free);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
558 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
559 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
560
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
561 X509_free(x509);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
562
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
563 #ifdef SSL_set0_chain
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
564
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
565 /*
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
566 * SSL_set0_chain() is only available in OpenSSL 1.0.2+,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
567 * but this function is only called via certificate callback,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
568 * which is only available in OpenSSL 1.0.2+ as well
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
569 */
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
570
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
571 if (SSL_set0_chain(c->ssl->connection, chain) == 0) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
572 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
573 "SSL_set0_chain(\"%s\") failed", cert->data);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
574 sk_X509_pop_free(chain, X509_free);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
575 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
576 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
577
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
578 #endif
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
579
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
580 pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
581 if (pkey == NULL) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
582 if (err != NULL) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
583 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
584 "cannot load certificate key \"%s\": %s",
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
585 key->data, err);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
586 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
587
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
588 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
589 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
590
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
591 if (SSL_use_PrivateKey(c->ssl->connection, pkey) == 0) {
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
592 ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
593 "SSL_use_PrivateKey(\"%s\") failed", key->data);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
594 EVP_PKEY_free(pkey);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
595 return NGX_ERROR;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
596 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
597
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
598 EVP_PKEY_free(pkey);
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
599
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
600 return NGX_OK;
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
601 }
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
602
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
603
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
604 static X509 *
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
605 ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
606 STACK_OF(X509) **chain)
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
607 {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
608 BIO *bio;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
609 X509 *x509, *temp;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
610 u_long n;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
611
7477
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
612 if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
613
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
614 bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
615 cert->len - (sizeof("data:") - 1));
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
616 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
617 *err = "BIO_new_mem_buf() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
618 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
619 }
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
620
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
621 } else {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
622
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
623 if (ngx_get_full_name(pool, (ngx_str_t *) &ngx_cycle->conf_prefix, cert)
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
624 != NGX_OK)
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
625 {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
626 *err = NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
627 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
628 }
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
629
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
630 bio = BIO_new_file((char *) cert->data, "r");
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
631 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
632 *err = "BIO_new_file() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
633 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
634 }
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
635 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
636
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
637 /* certificate itself */
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
638
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
639 x509 = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
640 if (x509 == NULL) {
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
641 *err = "PEM_read_bio_X509_AUX() failed";
6812
a7ec59df0c4d OCSP stapling: added certificate name to warnings.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6780
diff changeset
642 BIO_free(bio);
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
643 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
644 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
645
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
646 /* rest of the chain */
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
647
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
648 *chain = sk_X509_new_null();
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
649 if (*chain == NULL) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
650 *err = "sk_X509_new_null() failed";
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
651 BIO_free(bio);
5384
cfbf1d1cc233 SSL: fixed possible memory and file descriptor leak on HUP signal.
Piotr Sikora <piotr@cloudflare.com>
parents: 5378
diff changeset
652 X509_free(x509);
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
653 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
654 }
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
655
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
656 for ( ;; ) {
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
657
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
658 temp = PEM_read_bio_X509(bio, NULL, NULL, NULL);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
659 if (temp == NULL) {
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
660 n = ERR_peek_last_error();
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
661
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
662 if (ERR_GET_LIB(n) == ERR_LIB_PEM
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
663 && ERR_GET_REASON(n) == PEM_R_NO_START_LINE)
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
664 {
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
665 /* end of file */
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
666 ERR_clear_error();
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
667 break;
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
668 }
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
669
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
670 /* some real error */
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
671
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
672 *err = "PEM_read_bio_X509() failed";
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
673 BIO_free(bio);
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
674 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
675 sk_X509_pop_free(*chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
676 return NULL;
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
677 }
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
678
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
679 if (sk_X509_push(*chain, temp) == 0) {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
680 *err = "sk_X509_push() failed";
6549
d3302eb87a0c SSL: support for per-certificate chains.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6548
diff changeset
681 BIO_free(bio);
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
682 X509_free(x509);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
683 sk_X509_pop_free(*chain, X509_free);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
684 return NULL;
6549
d3302eb87a0c SSL: support for per-certificate chains.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6548
diff changeset
685 }
4875
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
686 }
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
687
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
688 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4872
diff changeset
689
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
690 return x509;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
691 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
692
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
693
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
694 static EVP_PKEY *
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
695 ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
696 ngx_str_t *key, ngx_array_t *passwords)
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
697 {
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
698 BIO *bio;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
699 EVP_PKEY *pkey;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
700 ngx_str_t *pwd;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
701 ngx_uint_t tries;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
702 pem_password_cb *cb;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
703
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
704 if (ngx_strncmp(key->data, "engine:", sizeof("engine:") - 1) == 0) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
705
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
706 #ifndef OPENSSL_NO_ENGINE
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
707
7476
b6dc8a12c07a SSL: removed redundant "pkey" variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7474
diff changeset
708 u_char *p, *last;
b6dc8a12c07a SSL: removed redundant "pkey" variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7474
diff changeset
709 ENGINE *engine;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
710
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
711 p = key->data + sizeof("engine:") - 1;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
712 last = (u_char *) ngx_strchr(p, ':');
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
713
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
714 if (last == NULL) {
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
715 *err = "invalid syntax";
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
716 return NULL;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
717 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
718
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
719 *last = '\0';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
720
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
721 engine = ENGINE_by_id((char *) p);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
722
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
723 if (engine == NULL) {
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
724 *err = "ENGINE_by_id() failed";
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
725 return NULL;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
726 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
727
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
728 *last++ = ':';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
729
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
730 pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
731
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
732 if (pkey == NULL) {
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
733 *err = "ENGINE_load_private_key() failed";
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
734 ENGINE_free(engine);
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
735 return NULL;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
736 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
737
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
738 ENGINE_free(engine);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
739
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
740 return pkey;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
741
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
742 #else
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
743
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
744 *err = "loading \"engine:...\" certificate keys is not supported";
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
745 return NULL;
5934
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
746
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
747 #endif
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
748 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key().
Dmitrii Pichulin
parents: 5902
diff changeset
749
7477
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
750 if (ngx_strncmp(key->data, "data:", sizeof("data:") - 1) == 0) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
751
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
752 bio = BIO_new_mem_buf(key->data + sizeof("data:") - 1,
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
753 key->len - (sizeof("data:") - 1));
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
754 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
755 *err = "BIO_new_mem_buf() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
756 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
757 }
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
758
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
759 } else {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
760
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
761 if (ngx_get_full_name(pool, (ngx_str_t *) &ngx_cycle->conf_prefix, key)
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
762 != NGX_OK)
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
763 {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
764 *err = NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
765 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
766 }
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
767
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
768 bio = BIO_new_file((char *) key->data, "r");
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
769 if (bio == NULL) {
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
770 *err = "BIO_new_file() failed";
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
771 return NULL;
c74904a17021 SSL: support for parsing PEM certificates from memory.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7476
diff changeset
772 }
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
773 }
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
774
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
775 if (passwords) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
776 tries = passwords->nelts;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
777 pwd = passwords->elts;
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
778 cb = ngx_ssl_password_callback;
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
779
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
780 } else {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
781 tries = 1;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
782 pwd = NULL;
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
783 cb = NULL;
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
784 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
785
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
786 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
787
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
788 pkey = PEM_read_bio_PrivateKey(bio, NULL, cb, pwd);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
789 if (pkey != NULL) {
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
790 break;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
791 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
792
7463
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
793 if (tries-- > 1) {
5892
42520df85ebb SSL: simplified ssl_password_file error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 5882
diff changeset
794 ERR_clear_error();
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
795 (void) BIO_reset(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
796 pwd++;
5892
42520df85ebb SSL: simplified ssl_password_file error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 5882
diff changeset
797 continue;
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
798 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
799
7460
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
800 *err = "PEM_read_bio_PrivateKey() failed";
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
801 BIO_free(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
802 return NULL;
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
803 }
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
804
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
805 BIO_free(bio);
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
806
77436d9951a1 SSL: reworked ngx_ssl_certificate().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7459
diff changeset
807 return pkey;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
808 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
809
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
810
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
811 static int
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
812 ngx_ssl_password_callback(char *buf, int size, int rwflag, void *userdata)
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
813 {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
814 ngx_str_t *pwd = userdata;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
815
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
816 if (rwflag) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
817 ngx_log_error(NGX_LOG_ALERT, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
818 "ngx_ssl_password_callback() is called for encryption");
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
819 return 0;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
820 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
821
7463
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
822 if (pwd == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
823 return 0;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
824 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
825
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
826 if (pwd->len > (size_t) size) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
827 ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
828 "password is truncated to %d bytes", size);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
829 } else {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
830 size = pwd->len;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
831 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
832
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
833 ngx_memcpy(buf, pwd->data, size);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
834
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
835 return size;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
836 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
837
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
838
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
839 ngx_int_t
6591
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
840 ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
841 ngx_uint_t prefer_server_ciphers)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
842 {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
843 if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
844 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
845 "SSL_CTX_set_cipher_list(\"%V\") failed",
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
846 ciphers);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
847 return NGX_ERROR;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
848 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
849
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
850 if (prefer_server_ciphers) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
851 SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
852 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
853
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
854 #if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
855 /* a temporary 512-bit RSA key is required for export versions of MSIE */
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
856 SSL_CTX_set_tmp_rsa_callback(ssl->ctx, ngx_ssl_rsa512_key_callback);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
857 #endif
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
858
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
859 return NGX_OK;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
860 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
861
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
862
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6554
diff changeset
863 ngx_int_t
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
864 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
865 ngx_int_t depth)
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
866 {
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
867 STACK_OF(X509_NAME) *list;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
868
5222
23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules.
Piotr Sikora <piotr@cloudflare.com>
parents: 5081
diff changeset
869 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
870
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
871 SSL_CTX_set_verify_depth(ssl->ctx, depth);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
872
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
873 if (cert->len == 0) {
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
874 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
875 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
876
5330
314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5317
diff changeset
877 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
878 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
879 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
880
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
881 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
882 == 0)
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
883 {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
884 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
885 "SSL_CTX_load_verify_locations(\"%s\") failed",
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
886 cert->data);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
887 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
888 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
889
5365
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
890 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
891 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
892 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
893 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
894
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
895 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
896
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
897 list = SSL_load_client_CA_file((char *) cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
898
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
899 if (list == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
900 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
901 "SSL_load_client_CA_file(\"%s\") failed", cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
902 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
903 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
904
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
905 SSL_CTX_set_client_CA_list(ssl->ctx, list);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
906
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
907 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
908 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
909
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
910
2995
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
911 ngx_int_t
4872
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
912 ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
913 ngx_int_t depth)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
914 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
915 SSL_CTX_set_verify_depth(ssl->ctx, depth);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
916
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
917 if (cert->len == 0) {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
918 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
919 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
920
5330
314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5317
diff changeset
921 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
4872
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
922 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
923 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
924
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
925 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
926 == 0)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
927 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
928 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
929 "SSL_CTX_load_verify_locations(\"%s\") failed",
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
930 cert->data);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
931 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
932 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
933
5365
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
934 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
935 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
936 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
937 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
938
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
939 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5330
diff changeset
940
4872
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
941 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
942 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
943
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
944
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4868
diff changeset
945 ngx_int_t
2995
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
946 ngx_ssl_crl(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *crl)
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
947 {
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
948 X509_STORE *store;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
949 X509_LOOKUP *lookup;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
950
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
951 if (crl->len == 0) {
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
952 return NGX_OK;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
953 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
954
5330
314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5317
diff changeset
955 if (ngx_conf_full_name(cf->cycle, crl, 1) != NGX_OK) {
2995
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
956 return NGX_ERROR;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
957 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
958
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
959 store = SSL_CTX_get_cert_store(ssl->ctx);
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
960
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
961 if (store == NULL) {
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
962 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
963 "SSL_CTX_get_cert_store() failed");
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
964 return NGX_ERROR;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
965 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
966
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
967 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
968
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
969 if (lookup == NULL) {
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
970 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
971 "X509_STORE_add_lookup() failed");
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
972 return NGX_ERROR;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
973 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
974
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
975 if (X509_LOOKUP_load_file(lookup, (char *) crl->data, X509_FILETYPE_PEM)
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
976 == 0)
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
977 {
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
978 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
979 "X509_LOOKUP_load_file(\"%s\") failed", crl->data);
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
980 return NGX_ERROR;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
981 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
982
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
983 X509_STORE_set_flags(store,
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
984 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
985
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
986 return NGX_OK;
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
987 }
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
988
cc07d164f0dc ssl_crl
Igor Sysoev <igor@sysoev.ru>
parents: 2994
diff changeset
989
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
990 static int
5222
23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules.
Piotr Sikora <piotr@cloudflare.com>
parents: 5081
diff changeset
991 ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
992 {
1977
40c9cb8576bb get certificate info only for debug build
Igor Sysoev <igor@sysoev.ru>
parents: 1976
diff changeset
993 #if (NGX_DEBUG)
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
994 char *subject, *issuer;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
995 int err, depth;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
996 X509 *cert;
1976
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
997 X509_NAME *sname, *iname;
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
998 ngx_connection_t *c;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
999 ngx_ssl_conn_t *ssl_conn;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1000
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1001 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1002 SSL_get_ex_data_X509_STORE_CTX_idx());
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1003
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1004 c = ngx_ssl_get_connection(ssl_conn);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1005
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1006 cert = X509_STORE_CTX_get_current_cert(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1007 err = X509_STORE_CTX_get_error(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1008 depth = X509_STORE_CTX_get_error_depth(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1009
1976
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1010 sname = X509_get_subject_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1011 subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1012
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1013 iname = X509_get_issuer_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1014 issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1015
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
1016 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1017 "verify:%d, error:%d, depth:%d, "
5775
294d020bbcfe SSL: misplaced space in debug message.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5767
diff changeset
1018 "subject:\"%s\", issuer:\"%s\"",
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1019 ok, err, depth, subject, issuer);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1020
1976
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1021 if (sname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1022 OPENSSL_free(subject);
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1023 }
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1024
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1025 if (iname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1026 OPENSSL_free(issuer);
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1027 }
1977
40c9cb8576bb get certificate info only for debug build
Igor Sysoev <igor@sysoev.ru>
parents: 1976
diff changeset
1028 #endif
1976
c4d8867f0162 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1974
diff changeset
1029
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1030 return 1;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1031 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1032
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1033
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1034 static void
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1035 ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1036 {
5395
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1037 BIO *rbio, *wbio;
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1038 ngx_connection_t *c;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1039
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1040 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1041
6982
ac9b1df5b246 SSL: disabled renegotiation detection in client mode.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6981
diff changeset
1042 if ((where & SSL_CB_HANDSHAKE_START)
ac9b1df5b246 SSL: disabled renegotiation detection in client mode.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6981
diff changeset
1043 && SSL_is_server((ngx_ssl_conn_t *) ssl_conn))
ac9b1df5b246 SSL: disabled renegotiation detection in client mode.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6981
diff changeset
1044 {
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1045 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1046
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1047 if (c->ssl->handshaked) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1048 c->ssl->renegotiation = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1049 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL renegotiation");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1050 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1051 }
5395
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1052
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1053 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1054
5395
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1055 if ((where & SSL_CB_ACCEPT_LOOP) == SSL_CB_ACCEPT_LOOP) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1056 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1057
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1058 if (!c->ssl->handshake_buffer_set) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1059 /*
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1060 * By default OpenSSL uses 4k buffer during a handshake,
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1061 * which is too low for long certificate chains and might
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1062 * result in extra round-trips.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1063 *
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1064 * To adjust a buffer size we detect that buffering was added
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1065 * to write side of the connection by comparing rbio and wbio.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1066 * If they are different, we assume that it's due to buffering
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1067 * added to wbio, and set buffer size.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1068 */
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1069
7509
b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7484
diff changeset
1070 rbio = SSL_get_rbio(ssl_conn);
b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7484
diff changeset
1071 wbio = SSL_get_wbio(ssl_conn);
5395
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1072
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1073 if (rbio != wbio) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1074 (void) BIO_set_write_buffer_size(wbio, NGX_SSL_BUFSIZE);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1075 c->ssl->handshake_buffer_set = 1;
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1076 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1077 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5384
diff changeset
1078 }
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1079 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1080
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1081
3959
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents: 3851
diff changeset
1082 RSA *
5223
71d85de7b53b Style: replace SSL *ssl with ngx_ssl_conn_t *ssl_conn.
Piotr Sikora <piotr@cloudflare.com>
parents: 5222
diff changeset
1083 ngx_ssl_rsa512_key_callback(ngx_ssl_conn_t *ssl_conn, int is_export,
71d85de7b53b Style: replace SSL *ssl with ngx_ssl_conn_t *ssl_conn.
Piotr Sikora <piotr@cloudflare.com>
parents: 5222
diff changeset
1084 int key_length)
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1085 {
3959
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents: 3851
diff changeset
1086 static RSA *key;
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents: 3851
diff changeset
1087
5754
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1088 if (key_length != 512) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1089 return NULL;
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1090 }
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1091
6489
c256dfdd469d SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6488
diff changeset
1092 #if (OPENSSL_VERSION_NUMBER < 0x10100003L && !defined OPENSSL_NO_DEPRECATED)
5755
8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5754
diff changeset
1093
5754
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1094 if (key == NULL) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches.
Piotr Sikora <piotr@cloudflare.com>
parents: 5747
diff changeset
1095 key = RSA_generate_key(512, RSA_F4, NULL, NULL);
559
c1f965ef9718 nginx-0.3.1-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 549
diff changeset
1096 }
c1f965ef9718 nginx-0.3.1-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 549
diff changeset
1097
5755
8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5754
diff changeset
1098 #endif
8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5754
diff changeset
1099
3959
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents: 3851
diff changeset
1100 return key;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1101 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1102
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1103
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1104 ngx_array_t *
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1105 ngx_ssl_read_password_file(ngx_conf_t *cf, ngx_str_t *file)
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1106 {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1107 u_char *p, *last, *end;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1108 size_t len;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1109 ssize_t n;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1110 ngx_fd_t fd;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1111 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1112 ngx_array_t *passwords;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1113 ngx_pool_cleanup_t *cln;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1114 u_char buf[NGX_SSL_PASSWORD_BUFFER_SIZE];
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1115
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1116 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1117 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1118 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1119
7454
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1120 passwords = ngx_array_create(cf->temp_pool, 4, sizeof(ngx_str_t));
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1121 if (passwords == NULL) {
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1122 return NULL;
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1123 }
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1124
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1125 cln = ngx_pool_cleanup_add(cf->temp_pool, 0);
7454
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7453
diff changeset
1126 if (cln == NULL) {
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1127 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1128 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1129
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1130 cln->handler = ngx_ssl_passwords_cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1131 cln->data = passwords;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1132
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1133 fd = ngx_open_file(file->data, NGX_FILE_RDONLY, NGX_FILE_OPEN, 0);
7086
Sergey Kandaurov <pluknet@nginx.com>
parents: 7074
diff changeset
1134
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1135 if (fd == NGX_INVALID_FILE) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1136 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1137 ngx_open_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1138 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1139 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1140
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1141 len = 0;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1142 last = buf;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1143
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1144 do {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1145 n = ngx_read_fd(fd, last, NGX_SSL_PASSWORD_BUFFER_SIZE - len);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1146
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1147 if (n == -1) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1148 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1149 ngx_read_fd_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1150 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1151 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1152 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1153
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1154 end = last + n;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1155
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1156 if (len && n == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1157 *end++ = LF;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1158 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1159
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1160 p = buf;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1161
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1162 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1163 last = ngx_strlchr(last, end, LF);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1164
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1165 if (last == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1166 break;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1167 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1168
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1169 len = last++ - p;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1170
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1171 if (len && p[len - 1] == CR) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1172 len--;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1173 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1174
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1175 if (len) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1176 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1177 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1178 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1179 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1180 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1181
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1182 pwd->len = len;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1183 pwd->data = ngx_pnalloc(cf->temp_pool, len);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1184
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1185 if (pwd->data == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1186 passwords->nelts--;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1187 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1188 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1189 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1190
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1191 ngx_memcpy(pwd->data, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1192 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1193
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1194 p = last;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1195 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1196
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1197 len = end - p;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1198
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1199 if (len == NGX_SSL_PASSWORD_BUFFER_SIZE) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1200 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1201 "too long line in \"%s\"", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1202 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1203 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1204 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1205
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1206 ngx_memmove(buf, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1207 last = buf + len;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1208
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1209 } while (n != 0);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1210
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1211 if (passwords->nelts == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1212 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1213 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1214 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1215 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1216 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1217
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1218 ngx_memzero(pwd, sizeof(ngx_str_t));
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1219 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1220
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1221 cleanup:
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1222
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1223 if (ngx_close_file(fd) == NGX_FILE_ERROR) {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1224 ngx_conf_log_error(NGX_LOG_ALERT, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1225 ngx_close_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1226 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1227
7395
9ca82f273967 Core: ngx_explicit_memzero().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7372
diff changeset
1228 ngx_explicit_memzero(buf, NGX_SSL_PASSWORD_BUFFER_SIZE);
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1229
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1230 return passwords;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1231 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1232
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1233
7463
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1234 ngx_array_t *
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1235 ngx_ssl_preserve_passwords(ngx_conf_t *cf, ngx_array_t *passwords)
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1236 {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1237 ngx_str_t *opwd, *pwd;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1238 ngx_uint_t i;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1239 ngx_array_t *pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1240 ngx_pool_cleanup_t *cln;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1241 static ngx_array_t empty_passwords;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1242
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1243 if (passwords == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1244
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1245 /*
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1246 * If there are no passwords, an empty array is used
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1247 * to make sure OpenSSL's default password callback
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1248 * won't block on reading from stdin.
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1249 */
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1250
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1251 return &empty_passwords;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1252 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1253
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1254 /*
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1255 * Passwords are normally allocated from the temporary pool
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1256 * and cleared after parsing configuration. To be used at
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1257 * runtime they have to be copied to the configuration pool.
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1258 */
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1259
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1260 pwds = ngx_array_create(cf->pool, passwords->nelts, sizeof(ngx_str_t));
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1261 if (pwds == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1262 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1263 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1264
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1265 cln = ngx_pool_cleanup_add(cf->pool, 0);
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1266 if (cln == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1267 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1268 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1269
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1270 cln->handler = ngx_ssl_passwords_cleanup;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1271 cln->data = pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1272
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1273 opwd = passwords->elts;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1274
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1275 for (i = 0; i < passwords->nelts; i++) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1276
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1277 pwd = ngx_array_push(pwds);
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1278 if (pwd == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1279 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1280 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1281
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1282 pwd->len = opwd[i].len;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1283 pwd->data = ngx_pnalloc(cf->pool, pwd->len);
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1284
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1285 if (pwd->data == NULL) {
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1286 pwds->nelts--;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1287 return NULL;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1288 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1289
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1290 ngx_memcpy(pwd->data, opwd[i].data, opwd[i].len);
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1291 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1292
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1293 return pwds;
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1294 }
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1295
180df83473a4 SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7461
diff changeset
1296
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1297 static void
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1298 ngx_ssl_passwords_cleanup(void *data)
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1299 {
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1300 ngx_array_t *passwords = data;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1301
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1302 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1303 ngx_uint_t i;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1304
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1305 pwd = passwords->elts;
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1306
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1307 for (i = 0; i < passwords->nelts; i++) {
7395
9ca82f273967 Core: ngx_explicit_memzero().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7372
diff changeset
1308 ngx_explicit_memzero(pwd[i].data, pwd[i].len);
5744
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1309 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1310 }
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1311
42114bf12da0 SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents: 5700
diff changeset
1312
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1313 ngx_int_t
2044
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1314 ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1315 {
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1316 DH *dh;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1317 BIO *bio;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1318
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1319 if (file->len == 0) {
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1320 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1321 }
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1322
5330
314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5317
diff changeset
1323 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
2044
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1324 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1325 }
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1326
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1327 bio = BIO_new_file((char *) file->data, "r");
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1328 if (bio == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1329 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1330 "BIO_new_file(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1331 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1332 }
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1333
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1334 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1335 if (dh == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1336 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1337 "PEM_read_bio_DHparams(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1338 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1339 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1340 }
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1341
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1342 SSL_CTX_set_tmp_dh(ssl->ctx, dh);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1343
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1344 DH_free(dh);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1345 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1346
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1347 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1348 }
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1349
4522
14411ee4d89f Whitespace fixes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4499
diff changeset
1350
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1351 ngx_int_t
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1352 ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name)
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1353 {
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1354 #ifndef OPENSSL_NO_ECDH
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1355
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1356 /*
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1357 * Elliptic-Curve Diffie-Hellman parameters are either "named curves"
4572
67653855682e Fixed spelling in multiline C comments.
Ruslan Ermilov <ru@nginx.com>
parents: 4522
diff changeset
1358 * from RFC 4492 section 5.1.1, or explicitly described curves over
6552
addd98357629 SSL: style.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6551
diff changeset
1359 * binary fields. OpenSSL only supports the "named curves", which provide
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1360 * maximum interoperability.
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1361 */
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1362
6983
3518287d995e SSL: compatibility with OpenSSL master branch.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6982
diff changeset
1363 #if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST)
6553
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1364
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1365 /*
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1366 * OpenSSL 1.0.2+ allows configuring a curve list instead of a single
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1367 * curve previously supported. By default an internal list is used,
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1368 * with prime256v1 being preferred by server in OpenSSL 1.0.2b+
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1369 * and X25519 in OpenSSL 1.1.0+.
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1370 *
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1371 * By default a curve preferred by the client will be used for
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1372 * key exchange. The SSL_OP_CIPHER_SERVER_PREFERENCE option can
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1373 * be used to prefer server curves instead, similar to what it
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1374 * does for ciphers.
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1375 */
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1376
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1377 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1378
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1379 #if SSL_CTRL_SET_ECDH_AUTO
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1380 /* not needed in OpenSSL 1.1.0+ */
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1381 SSL_CTX_set_ecdh_auto(ssl->ctx, 1);
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1382 #endif
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1383
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1384 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1385 return NGX_OK;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1386 }
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1387
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1388 if (SSL_CTX_set1_curves_list(ssl->ctx, (char *) name->data) == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1389 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1390 "SSL_CTX_set1_curves_list(\"%s\") failed", name->data);
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1391 return NGX_ERROR;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1392 }
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1393
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1394 #else
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1395
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1396 int nid;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1397 char *curve;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1398 EC_KEY *ecdh;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1399
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1400 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1401 curve = "prime256v1";
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1402
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1403 } else {
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1404 curve = (char *) name->data;
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1405 }
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1406
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1407 nid = OBJ_sn2nid(curve);
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1408 if (nid == 0) {
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1409 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1410 "OBJ_sn2nid(\"%s\") failed: unknown curve", curve);
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1411 return NGX_ERROR;
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1412 }
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1413
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1414 ecdh = EC_KEY_new_by_curve_name(nid);
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1415 if (ecdh == NULL) {
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1416 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6552
diff changeset
1417 "EC_KEY_new_by_curve_name(\"%s\") failed", curve);
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1418 return NGX_ERROR;
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1419 }
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1420
5003
82234f3f5ca2 SSL: speedup loading of configs with many ssl servers.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4877
diff changeset
1421 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
82234f3f5ca2 SSL: speedup loading of configs with many ssl servers.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4877
diff changeset
1422
3960
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1423 SSL_CTX_set_tmp_ecdh(ssl->ctx, ecdh);
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1424
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1425 EC_KEY_free(ecdh);
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1426 #endif
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1427 #endif
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1428
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1429 return NGX_OK;
0832a6997227 ECDHE support
Igor Sysoev <igor@sysoev.ru>
parents: 3959
diff changeset
1430 }
2044
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1431
4522
14411ee4d89f Whitespace fixes.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4499
diff changeset
1432
2044
f45cec1cd270 DH parameters, ssl_dhparam
Igor Sysoev <igor@sysoev.ru>
parents: 2032
diff changeset
1433 ngx_int_t
7333
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1434 ngx_ssl_early_data(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1435 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1436 if (!enable) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1437 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1438 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1439
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1440 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1441
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1442 /* BoringSSL */
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1443
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1444 SSL_CTX_set_early_data_enabled(ssl->ctx, 1);
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1445
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1446 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1447
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1448 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1449
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1450 SSL_CTX_set_max_early_data(ssl->ctx, NGX_SSL_BUFSIZE);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1451
7333
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1452 #else
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1453 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1454 "\"ssl_early_data\" is not supported on this platform, "
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1455 "ignored");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1456 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1457
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1458 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1459 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1460
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1461
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
1462 ngx_int_t
7320
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1463 ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1464 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1465 if (!enable) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1466 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1467 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1468
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1469 SSL_CTX_set_session_cache_mode(ssl->ctx,
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1470 SSL_SESS_CACHE_CLIENT
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1471 |SSL_SESS_CACHE_NO_INTERNAL);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1472
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1473 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_client_session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1474
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1475 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1476 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1477
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1478
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1479 static int
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1480 ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1481 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1482 ngx_connection_t *c;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1483
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1484 c = ngx_ssl_get_connection(ssl_conn);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1485
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1486 if (c->ssl->save_session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1487 c->ssl->session = sess;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1488
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1489 c->ssl->save_session(c);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1490
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1491 c->ssl->session = NULL;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1492 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1493
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1494 return 0;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1495 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1496
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1497
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1498 ngx_int_t
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1499 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1500 {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1501 ngx_ssl_connection_t *sc;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1502
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1503 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1504 if (sc == NULL) {
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1505 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1506 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1507
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
1508 sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
5487
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
1509 sc->buffer_size = ssl->buffer_size;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
1510
6261
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
1511 sc->session_ctx = ssl->ctx;
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
1512
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1513 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1514 if (SSL_CTX_get_max_early_data(ssl->ctx)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1515 sc->try_early_data = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1516 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1517 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1518
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1519 sc->connection = SSL_new(ssl->ctx);
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1520
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1521 if (sc->connection == NULL) {
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1522 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1523 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1524 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1525
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1526 if (SSL_set_fd(sc->connection, c->fd) == 0) {
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1527 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1528 return NGX_ERROR;
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1529 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
1530
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1531 if (flags & NGX_SSL_CLIENT) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1532 SSL_set_connect_state(sc->connection);
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1533
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1534 } else {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1535 SSL_set_accept_state(sc->connection);
7319
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7318
diff changeset
1536
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7318
diff changeset
1537 #ifdef SSL_OP_NO_RENEGOTIATION
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7318
diff changeset
1538 SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7318
diff changeset
1539 #endif
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1540 }
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1541
969
065b39794fff ngx_ssl_get_server_conf()
Igor Sysoev <igor@sysoev.ru>
parents: 968
diff changeset
1542 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1543 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1544 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1545 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
1546
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1547 c->ssl = sc;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1548
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1549 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1550 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1551
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1552
7320
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1553 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1554 ngx_ssl_get_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1555 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1556 #ifdef TLS1_3_VERSION
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1557 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1558 SSL_SESSION_up_ref(c->ssl->session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1559 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1560 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1561 #endif
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1562
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1563 return SSL_get1_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1564 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1565
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1566
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1567 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1568 ngx_ssl_get0_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1569 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1570 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1571 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1572 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1573
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1574 return SSL_get0_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1575 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1576
696df3ac27ac SSL: save sessions for upstream peers using a callback function.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7319
diff changeset
1577
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1578 ngx_int_t
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1579 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session)
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1580 {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1581 if (session) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1582 if (SSL_set_session(c->ssl->connection, session) == 0) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1583 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1584 return NGX_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1585 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1586 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1587
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1588 return NGX_OK;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1589 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1590
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1591
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1592 ngx_int_t
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1593 ngx_ssl_handshake(ngx_connection_t *c)
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1594 {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1595 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1596 ngx_err_t err;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1597
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1598 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1599 if (c->ssl->try_early_data) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1600 return ngx_ssl_try_early_data(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1601 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1602 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1603
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
1604 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
1605
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1606 n = SSL_do_handshake(c->ssl->connection);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1607
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1608 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1609
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1610 if (n == 1) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1611
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
1612 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1613 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1614 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1615
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
1616 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1617 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1618 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1619
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1620 #if (NGX_DEBUG)
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1621 ngx_ssl_handshake_log(c);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1622 #endif
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1623
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1624 c->ssl->handshaked = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1625
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1626 c->recv = ngx_ssl_recv;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1627 c->send = ngx_ssl_write;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1628 c->recv_chain = ngx_ssl_recv_chain;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1629 c->send_chain = ngx_ssl_send_chain;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1630
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1631 #ifndef SSL_OP_NO_RENEGOTIATION
6255
b40af2fd1c16 SSL: compatibility with OpenSSL master branch.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6036
diff changeset
1632 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5946
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.
Lukas Tribus <luky-37@hotmail.com>
parents: 5934
diff changeset
1633 #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.
Lukas Tribus <luky-37@hotmail.com>
parents: 5934
diff changeset
1634
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1635 /* initial handshake done, disable renegotiation (CVE-2009-3555) */
6995
eb5d119323d8 SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6983
diff changeset
1636 if (c->ssl->connection->s3 && SSL_is_server(c->ssl->connection)) {
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1637 c->ssl->connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1638 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
1639
5946
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.
Lukas Tribus <luky-37@hotmail.com>
parents: 5934
diff changeset
1640 #endif
6255
b40af2fd1c16 SSL: compatibility with OpenSSL master branch.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6036
diff changeset
1641 #endif
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
1642 #endif
5946
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.
Lukas Tribus <luky-37@hotmail.com>
parents: 5934
diff changeset
1643
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1644 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1645 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1646
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1647 sslerr = SSL_get_error(c->ssl->connection, n);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1648
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1649 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1650
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1651 if (sslerr == SSL_ERROR_WANT_READ) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1652 c->read->ready = 0;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1653 c->read->handler = ngx_ssl_handshake_handler;
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1654 c->write->handler = ngx_ssl_handshake_handler;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1655
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
1656 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1657 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1658 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1659
5024
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1660 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1661 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1662 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1663
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1664 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1665 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1666
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1667 if (sslerr == SSL_ERROR_WANT_WRITE) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1668 c->write->ready = 0;
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1669 c->read->handler = ngx_ssl_handshake_handler;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1670 c->write->handler = ngx_ssl_handshake_handler;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1671
5024
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1672 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1673 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1674 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5023
diff changeset
1675
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
1676 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1677 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1678 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1679
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1680 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1681 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1682
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1683 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1684
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1685 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1686 c->ssl->no_send_shutdown = 1;
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1687 c->read->eof = 1;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1688
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1689 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
5747
57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake".
Maxim Dounin <mdounin@mdounin.ru>
parents: 5744
diff changeset
1690 ngx_connection_error(c, err,
57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake".
Maxim Dounin <mdounin@mdounin.ru>
parents: 5744
diff changeset
1691 "peer closed connection in SSL handshake");
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1692
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1693 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1694 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1695
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1696 c->read->error = 1;
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1697
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1698 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1699
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1700 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1701 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1702
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1703
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1704 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1705
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1706 static ngx_int_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1707 ngx_ssl_try_early_data(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1708 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1709 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1710 u_char buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1711 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1712 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1713
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1714 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1715
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1716 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1717
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1718 n = SSL_read_early_data(c->ssl->connection, &buf, 1, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1719
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1720 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1721 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1722
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1723 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1724 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1725 return ngx_ssl_handshake(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1726 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1727
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1728 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1729
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1730 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1731 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1732 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1733
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1734 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1735 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1736 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1737
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1738 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1739 ngx_ssl_handshake_log(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1740 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1741
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1742 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1743
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1744 c->ssl->early_buf = buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1745 c->ssl->early_preread = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1746
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1747 c->ssl->handshaked = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1748 c->ssl->in_early = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1749
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1750 c->recv = ngx_ssl_recv;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1751 c->send = ngx_ssl_write;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1752 c->recv_chain = ngx_ssl_recv_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1753 c->send_chain = ngx_ssl_send_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1754
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1755 return NGX_OK;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1756 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1757
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1758 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1759
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1760 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1761
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1762 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1763
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1764 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1765 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1766 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1767 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1768
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1769 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1770 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1771 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1772
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1773 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1774 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1775 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1776
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1777 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1778 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1779
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1780 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1781 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1782 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1783 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1784
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1785 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1786 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1787 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1788
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1789 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1790 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1791 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1792
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1793 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1794 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1795
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1796 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1797
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1798 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1799 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1800 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1801
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1802 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1803 ngx_connection_error(c, err,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1804 "peer closed connection in SSL handshake");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1805
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1806 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1807 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1808
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1809 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1810
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1811 ngx_ssl_connection_error(c, sslerr, err, "SSL_read_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1812
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1813 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1814 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1815
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1816 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1817
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1818
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1819 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1820
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1821 static void
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1822 ngx_ssl_handshake_log(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1823 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1824 char buf[129], *s, *d;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1825 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1826 const
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1827 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1828 SSL_CIPHER *cipher;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1829
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1830 cipher = SSL_get_current_cipher(c->ssl->connection);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1831
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1832 if (cipher) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1833 SSL_CIPHER_description(cipher, &buf[1], 128);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1834
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1835 for (s = &buf[1], d = buf; *s; s++) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1836 if (*s == ' ' && *d == ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1837 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1838 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1839
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1840 if (*s == LF || *s == CR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1841 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1842 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1843
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1844 *++d = *s;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1845 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1846
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1847 if (*d != ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1848 d++;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1849 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1850
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1851 *d = '\0';
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1852
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1853 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1854 "SSL: %s, cipher: \"%s\"",
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1855 SSL_get_version(c->ssl->connection), &buf[1]);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1856
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1857 if (SSL_session_reused(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1858 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1859 "SSL reused session");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1860 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1861
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1862 } else {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1863 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1864 "SSL no shared ciphers");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1865 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1866 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1867
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1868 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1869
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1870
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1871 static void
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1872 ngx_ssl_handshake_handler(ngx_event_t *ev)
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1873 {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1874 ngx_connection_t *c;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1875
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1876 c = ev->data;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1877
549
e16a8d574da5 nginx-0.2.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 547
diff changeset
1878 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1879 "SSL handshake handler: %d", ev->write);
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1880
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1881 if (ev->timedout) {
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1882 c->ssl->handler(c);
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1883 return;
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1884 }
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
1885
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1886 if (ngx_ssl_handshake(c) == NGX_AGAIN) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1887 return;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1888 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1889
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1890 c->ssl->handler(c);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1891 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1892
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
1893
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1894 ssize_t
5882
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1895 ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl, off_t limit)
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1896 {
1154
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1897 u_char *last;
5882
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1898 ssize_t n, bytes, size;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1899 ngx_buf_t *b;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1900
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1901 bytes = 0;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1902
1154
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1903 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1904 last = b->last;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1905
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1906 for ( ;; ) {
5882
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1907 size = b->end - last;
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1908
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1909 if (limit) {
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1910 if (bytes >= limit) {
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1911 return bytes;
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1912 }
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1913
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1914 if (bytes + size > limit) {
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1915 size = (ssize_t) (limit - bytes);
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1916 }
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1917 }
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1918
ec81934727a1 Core: added limit to recv_chain().
Roman Arutyunyan <arut@nginx.com>
parents: 5834
diff changeset
1919 n = ngx_ssl_recv(c, last, size);
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1920
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1921 if (n > 0) {
1154
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1922 last += n;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1923 bytes += n;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1924
7582
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7560
diff changeset
1925 if (!c->read->ready) {
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7560
diff changeset
1926 return bytes;
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7560
diff changeset
1927 }
70749256af79 SSL: improved ngx_ssl_recv_chain() to stop if c->read->ready is 0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7560
diff changeset
1928
1154
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1929 if (last == b->end) {
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1930 cl = cl->next;
1154
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1931
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1932 if (cl == NULL) {
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1933 return bytes;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1934 }
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1935
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1936 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents: 1043
diff changeset
1937 last = b->last;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1938 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1939
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1940 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1941 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1942
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1943 if (bytes) {
2052
b4085596a7e6 fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents: 2049
diff changeset
1944
b4085596a7e6 fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents: 2049
diff changeset
1945 if (n == 0 || n == NGX_ERROR) {
b4085596a7e6 fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents: 2049
diff changeset
1946 c->read->ready = 1;
b4085596a7e6 fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents: 2049
diff changeset
1947 }
b4085596a7e6 fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents: 2049
diff changeset
1948
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1949 return bytes;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1950 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1951
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1952 return n;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1953 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1954 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1955
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1956
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1957 ssize_t
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1958 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1959 {
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1960 int n, bytes;
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1961
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1962 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1963 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1964 return ngx_ssl_recv_early(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1965 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1966 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
1967
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1968 if (c->ssl->last == NGX_ERROR) {
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
1969 c->read->error = 1;
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1970 return NGX_ERROR;
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1971 }
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1972
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1973 if (c->ssl->last == NGX_DONE) {
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
1974 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
1975 c->read->eof = 1;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1976 return 0;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1977 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1978
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1979 bytes = 0;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1980
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
1981 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
1982
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1983 /*
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1984 * SSL_read() may return data in parts, so try to read
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1985 * until SSL_read() would return no data
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1986 */
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1987
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1988 for ( ;; ) {
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1989
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
1990 n = SSL_read(c->ssl->connection, buf, size);
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1991
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
1992 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1993
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1994 if (n > 0) {
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1995 bytes += n;
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1996 }
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1997
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1998 c->ssl->last = ngx_ssl_handle_recv(c, n);
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
1999
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2000 if (c->ssl->last == NGX_OK) {
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2001
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2002 size -= n;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2003
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2004 if (size == 0) {
5450
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5425
diff changeset
2005 c->read->ready = 1;
7584
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2006
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2007 if (c->read->available >= 0) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2008 c->read->available -= bytes;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2009
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2010 /*
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2011 * there can be data buffered at SSL layer,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2012 * so we post an event to continue reading on the next
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2013 * iteration of the event loop
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2014 */
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2015
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2016 if (c->read->available < 0) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2017 c->read->available = 0;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2018 c->read->ready = 0;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2019
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2020 ngx_post_event(c->read, &ngx_posted_next_events);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2021 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2022
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2023 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2024 "SSL_read: avail:%d", c->read->available);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2025
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2026 } else {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2027
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2028 #if (NGX_HAVE_FIONREAD)
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2029
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2030 if (ngx_socket_nread(c->fd, &c->read->available) == -1) {
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2031 c->read->error = 1;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2032 ngx_connection_error(c, ngx_socket_errno,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2033 ngx_socket_nread_n " failed");
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2034 return NGX_ERROR;
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2035 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2036
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2037 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2038 "SSL_read: avail:%d", c->read->available);
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2039
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2040 #endif
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2041 }
9d2ad2fb4423 SSL: available bytes handling (ticket #1431).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7582
diff changeset
2042
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2043 return bytes;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2044 }
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2045
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2046 buf += n;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2047
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2048 continue;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2049 }
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2050
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2051 if (bytes) {
5450
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5425
diff changeset
2052 if (c->ssl->last != NGX_AGAIN) {
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5425
diff changeset
2053 c->read->ready = 1;
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5425
diff changeset
2054 }
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv().
Maxim Dounin <mdounin@mdounin.ru>
parents: 5425
diff changeset
2055
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2056 return bytes;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2057 }
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2058
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2059 switch (c->ssl->last) {
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2060
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2061 case NGX_DONE:
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2062 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2063 c->read->eof = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2064 return 0;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2065
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2066 case NGX_ERROR:
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2067 c->read->error = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2068
4499
778ef9c3fd2d Fixed spelling in single-line comments.
Ruslan Ermilov <ru@nginx.com>
parents: 4497
diff changeset
2069 /* fall through */
1426
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2070
adbafd129d06 do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents: 1421
diff changeset
2071 case NGX_AGAIN:
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2072 return c->ssl->last;
479
c52408583801 nginx-0.1.14-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 473
diff changeset
2073 }
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2074 }
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2075 }
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2076
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2077
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2078 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2079
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2080 static ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2081 ngx_ssl_recv_early(ngx_connection_t *c, u_char *buf, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2082 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2083 int n, bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2084 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2085
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2086 if (c->ssl->last == NGX_ERROR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2087 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2088 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2089 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2090
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2091 if (c->ssl->last == NGX_DONE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2092 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2093 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2094 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2095 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2096
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2097 bytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2098
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2099 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2100
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2101 if (c->ssl->early_preread) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2102
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2103 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2104 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2105 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2106 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2107 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2108
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2109 *buf = c->ssl->early_buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2110
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2111 c->ssl->early_preread = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2112
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2113 bytes = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2114 size -= 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2115 buf += 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2116 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2117
7431
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2118 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2119 return NGX_AGAIN;
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2120 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2121
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2122 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2123 * SSL_read_early_data() may return data in parts, so try to read
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2124 * until SSL_read_early_data() would return no data
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2125 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2126
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2127 for ( ;; ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2128
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2129 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2130
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2131 n = SSL_read_early_data(c->ssl->connection, buf, size, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2132
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2133 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2134 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2135
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2136 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2137
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2138 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2139
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2140 bytes += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2141 size -= readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2142
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2143 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2144 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2145 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2146 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2147
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2148 buf += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2149
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2150 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2151 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2152
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2153 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2154
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2155 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2156 c->ssl->in_early = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2157
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2158 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2159 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2160 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2161 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2162
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2163 return ngx_ssl_recv(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2164 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2165
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2166 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2167
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2168 c->ssl->last = ngx_ssl_handle_recv(c, 0);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2169
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2170 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2171 if (c->ssl->last != NGX_AGAIN) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2172 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2173 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2174
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2175 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2176 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2177
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2178 switch (c->ssl->last) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2179
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2180 case NGX_DONE:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2181 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2182 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2183 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2184
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2185 case NGX_ERROR:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2186 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2187
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2188 /* fall through */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2189
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2190 case NGX_AGAIN:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2191 return c->ssl->last;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2192 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2193 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2194 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2195
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2196 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2197
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2198
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2199 static ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2200 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2201 {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2202 int sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2203 ngx_err_t err;
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2204
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
2205 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
2206
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2207 if (c->ssl->renegotiation) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2208 /*
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2209 * disable renegotiation (CVE-2009-3555):
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2210 * OpenSSL (at least up to 0.9.8l) does not handle disabled
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2211 * renegotiation gracefully, so drop connection here
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2212 */
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2213
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2214 ngx_log_error(NGX_LOG_NOTICE, c->log, 0, "SSL renegotiation disabled");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2215
4236
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2216 while (ERR_peek_error()) {
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2217 ngx_ssl_error(NGX_LOG_DEBUG, c->log, 0,
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2218 "ignoring stale global SSL error");
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2219 }
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2220
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2221 ERR_clear_error();
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation.
Igor Sysoev <igor@sysoev.ru>
parents: 4228
diff changeset
2222
3300
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2223 c->ssl->no_wait_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2224 c->ssl->no_send_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2225
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2226 return NGX_ERROR;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2227 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents: 3283
diff changeset
2228
7356
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
2229 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7353
diff changeset
2230
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2231 if (n > 0) {
479
c52408583801 nginx-0.1.14-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 473
diff changeset
2232
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2233 if (c->ssl->saved_write_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2234
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2235 c->write->handler = c->ssl->saved_write_handler;
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2236 c->ssl->saved_write_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2237 c->write->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2238
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2239 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2240 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2241 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2242
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
2243 ngx_post_event(c->write, &ngx_posted_events);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2244 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2245
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2246 return NGX_OK;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2247 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2248
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2249 sslerr = SSL_get_error(c->ssl->connection, n);
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2250
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2251 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2252
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2253 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2254
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2255 if (sslerr == SSL_ERROR_WANT_READ) {
7353
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2256
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2257 if (c->ssl->saved_write_handler) {
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2258
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2259 c->write->handler = c->ssl->saved_write_handler;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2260 c->ssl->saved_write_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2261 c->write->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2262
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2263 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2264 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2265 }
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2266
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2267 ngx_post_event(c->write, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2268 }
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2269
455
295d97d70c69 nginx-0.1.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 452
diff changeset
2270 c->read->ready = 0;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2271 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2272 }
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2273
445
f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import
Igor Sysoev <igor@sysoev.ru>
parents: 444
diff changeset
2274 if (sslerr == SSL_ERROR_WANT_WRITE) {
539
371c1cee100d nginx-0.1.44-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 513
diff changeset
2275
7352
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2276 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2277 "SSL_read: want write");
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2278
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2279 c->write->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2280
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2281 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2282 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2283 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2284
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2285 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2286 * we do not set the timer because there is already the read event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2287 */
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2288
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2289 if (c->ssl->saved_write_handler == NULL) {
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2290 c->ssl->saved_write_handler = c->write->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2291 c->write->handler = ngx_ssl_write_handler;
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2292 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2293
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2294 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2295 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2296
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2297 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2298 c->ssl->no_send_shutdown = 1;
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2299
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2300 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2301 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2302 "peer shutdown SSL cleanly");
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2303 return NGX_DONE;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2304 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2305
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2306 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2307
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2308 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2309 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2310
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2311
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2312 static void
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2313 ngx_ssl_write_handler(ngx_event_t *wev)
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2314 {
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2315 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2316
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2317 c = wev->data;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2318
7352
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2319 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL write handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2320
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2321 c->read->handler(c->read);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2322 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2323
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2324
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2325 /*
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2326 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2327 * before the SSL_write() call to decrease a SSL overhead.
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2328 *
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2329 * Besides for protocols such as HTTP it is possible to always buffer
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2330 * the output to decrease a SSL overhead some more.
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2331 */
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2332
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2333 ngx_chain_t *
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2334 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2335 {
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2336 int n;
399
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 398
diff changeset
2337 ngx_uint_t flush;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2338 ssize_t send, size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2339 ngx_buf_t *buf;
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2340
2280
6453161bf53e always use buffer, if connection is buffered,
Igor Sysoev <igor@sysoev.ru>
parents: 2165
diff changeset
2341 if (!c->ssl->buffer) {
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2342
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2343 while (in) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2344 if (ngx_buf_special(in->buf)) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2345 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2346 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2347 }
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2348
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2349 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2350
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2351 if (n == NGX_ERROR) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2352 return NGX_CHAIN_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2353 }
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2354
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2355 if (n == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2356 return in;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2357 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2358
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2359 in->buf->pos += n;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2360
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2361 if (in->buf->pos == in->buf->last) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2362 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2363 }
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2364 }
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2365
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2366 return in;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2367 }
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2368
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2369
3962
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents: 3961
diff changeset
2370 /* the maximum limit size is the maximum int32_t value - the page size */
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents: 3961
diff changeset
2371
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents: 3961
diff changeset
2372 if (limit == 0 || limit > (off_t) (NGX_MAX_INT32_VALUE - ngx_pagesize)) {
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents: 3961
diff changeset
2373 limit = NGX_MAX_INT32_VALUE - ngx_pagesize;
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2374 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2375
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2376 buf = c->ssl->buf;
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2377
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2378 if (buf == NULL) {
5487
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
2379 buf = ngx_create_temp_buf(c->pool, c->ssl->buffer_size);
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2380 if (buf == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2381 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2382 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2383
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2384 c->ssl->buf = buf;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2385 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2386
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2387 if (buf->start == NULL) {
5487
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
2388 buf->start = ngx_palloc(c->pool, c->ssl->buffer_size);
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2389 if (buf->start == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2390 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2391 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2392
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2393 buf->pos = buf->start;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2394 buf->last = buf->start;
5487
a297b7ad6f94 SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5450
diff changeset
2395 buf->end = buf->start + c->ssl->buffer_size;
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2396 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2397
5023
70a35b7b63ea SSL: take into account data in the buffer while limiting output.
Valentin Bartenev <vbart@nginx.com>
parents: 5022
diff changeset
2398 send = buf->last - buf->pos;
5020
587dbe2edc5f SSL: preservation of flush flag for buffered data.
Valentin Bartenev <vbart@nginx.com>
parents: 5019
diff changeset
2399 flush = (in == NULL) ? 1 : buf->flush;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2400
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2401 for ( ;; ) {
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2402
3283
52b1624b93c2 fix segfault in SSL if limit_rate is used
Igor Sysoev <igor@sysoev.ru>
parents: 3159
diff changeset
2403 while (in && buf->last < buf->end && send < limit) {
583
4e296b7d25bf nginx-0.3.13-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 577
diff changeset
2404 if (in->buf->last_buf || in->buf->flush) {
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2405 flush = 1;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2406 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2407
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2408 if (ngx_buf_special(in->buf)) {
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2409 in = in->next;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2410 continue;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2411 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2412
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2413 size = in->buf->last - in->buf->pos;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2414
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2415 if (size > buf->end - buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2416 size = buf->end - buf->last;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2417 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2418
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2419 if (send + size > limit) {
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2420 size = (ssize_t) (limit - send);
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2421 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2422
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2423 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6480
f01ab2dbcfdc Fixed logging.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6474
diff changeset
2424 "SSL buf copy: %z", size);
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2425
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2426 ngx_memcpy(buf->last, in->buf->pos, size);
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2427
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2428 buf->last += size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2429 in->buf->pos += size;
3283
52b1624b93c2 fix segfault in SSL if limit_rate is used
Igor Sysoev <igor@sysoev.ru>
parents: 3159
diff changeset
2430 send += size;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2431
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2432 if (in->buf->pos == in->buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2433 in = in->next;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2434 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2435 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2436
5020
587dbe2edc5f SSL: preservation of flush flag for buffered data.
Valentin Bartenev <vbart@nginx.com>
parents: 5019
diff changeset
2437 if (!flush && send < limit && buf->last < buf->end) {
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2438 break;
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2439 }
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2440
5021
674f8739e443 SSL: calculation of buffer size moved closer to its usage.
Valentin Bartenev <vbart@nginx.com>
parents: 5020
diff changeset
2441 size = buf->last - buf->pos;
674f8739e443 SSL: calculation of buffer size moved closer to its usage.
Valentin Bartenev <vbart@nginx.com>
parents: 5020
diff changeset
2442
5022
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2443 if (size == 0) {
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2444 buf->flush = 0;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2445 c->buffered &= ~NGX_SSL_BUFFERED;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2446 return in;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2447 }
1d819608ad4a SSL: avoid calling SSL_write() with zero data size.
Valentin Bartenev <vbart@nginx.com>
parents: 5021
diff changeset
2448
398
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2449 n = ngx_ssl_write(c, buf->pos, size);
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2450
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2451 if (n == NGX_ERROR) {
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents: 397
diff changeset
2452 return NGX_CHAIN_ERROR;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2453 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2454
511
c12967aadd87 nginx-0.1.30-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 509
diff changeset
2455 if (n == NGX_AGAIN) {
5020
587dbe2edc5f SSL: preservation of flush flag for buffered data.
Valentin Bartenev <vbart@nginx.com>
parents: 5019
diff changeset
2456 break;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2457 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2458
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2459 buf->pos += n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2460
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2461 if (n < size) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2462 break;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2463 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2464
5019
69693a098655 SSL: resetting of flush flag after the data was written.
Valentin Bartenev <vbart@nginx.com>
parents: 5018
diff changeset
2465 flush = 0;
69693a098655 SSL: resetting of flush flag after the data was written.
Valentin Bartenev <vbart@nginx.com>
parents: 5018
diff changeset
2466
5018
0ea36741bb35 SSL: removed conditions that always hold true.
Valentin Bartenev <vbart@nginx.com>
parents: 5003
diff changeset
2467 buf->pos = buf->start;
0ea36741bb35 SSL: removed conditions that always hold true.
Valentin Bartenev <vbart@nginx.com>
parents: 5003
diff changeset
2468 buf->last = buf->start;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2469
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2470 if (in == NULL || send == limit) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2471 break;
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2472 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2473 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2474
5020
587dbe2edc5f SSL: preservation of flush flag for buffered data.
Valentin Bartenev <vbart@nginx.com>
parents: 5019
diff changeset
2475 buf->flush = flush;
587dbe2edc5f SSL: preservation of flush flag for buffered data.
Valentin Bartenev <vbart@nginx.com>
parents: 5019
diff changeset
2476
597
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2477 if (buf->pos < buf->last) {
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2478 c->buffered |= NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2479
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2480 } else {
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2481 c->buffered &= ~NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 591
diff changeset
2482 }
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2483
399
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 398
diff changeset
2484 return in;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2485 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2486
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2487
539
371c1cee100d nginx-0.1.44-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 513
diff changeset
2488 ssize_t
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2489 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2490 {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2491 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2492 ngx_err_t err;
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2493
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2494 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2495 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2496 return ngx_ssl_write_early(c, data, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2497 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2498 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2499
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
2500 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
2501
6480
f01ab2dbcfdc Fixed logging.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6474
diff changeset
2502 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2503
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2504 n = SSL_write(c->ssl->connection, data, size);
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2505
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2506 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2507
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2508 if (n > 0) {
539
371c1cee100d nginx-0.1.44-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 513
diff changeset
2509
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2510 if (c->ssl->saved_read_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2511
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2512 c->read->handler = c->ssl->saved_read_handler;
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2513 c->ssl->saved_read_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2514 c->read->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2515
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2516 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2517 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2518 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2519
563
9c2f3ed7a247 nginx-0.3.3-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 559
diff changeset
2520 ngx_post_event(c->read, &ngx_posted_events);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2521 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2522
5986
c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write().
Ruslan Ermilov <ru@nginx.com>
parents: 5946
diff changeset
2523 c->sent += n;
c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write().
Ruslan Ermilov <ru@nginx.com>
parents: 5946
diff changeset
2524
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2525 return n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2526 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2527
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2528 sslerr = SSL_get_error(c->ssl->connection, n);
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2529
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2530 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2531
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2532 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2533
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2534 if (sslerr == SSL_ERROR_WANT_WRITE) {
7353
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2535
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2536 if (c->ssl->saved_read_handler) {
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2537
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2538 c->read->handler = c->ssl->saved_read_handler;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2539 c->ssl->saved_read_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2540 c->read->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2541
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2542 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2543 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2544 }
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2545
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2546 ngx_post_event(c->read, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2547 }
87d2ea860f38 SSL: restore handlers after blocking.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7352
diff changeset
2548
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2549 c->write->ready = 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2550 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2551 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2552
445
f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import
Igor Sysoev <igor@sysoev.ru>
parents: 444
diff changeset
2553 if (sslerr == SSL_ERROR_WANT_READ) {
452
23fb87bddda1 nginx-0.1.1-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 445
diff changeset
2554
7352
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2555 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2556 "SSL_write: want read");
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2557
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2558 c->read->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2559
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2560 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2561 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2562 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2563
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2564 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2565 * we do not set the timer because there is already
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2566 * the write event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2567 */
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2568
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2569 if (c->ssl->saved_read_handler == NULL) {
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2570 c->ssl->saved_read_handler = c->read->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2571 c->read->handler = ngx_ssl_read_handler;
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2572 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2573
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2574 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2575 }
395
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents: 394
diff changeset
2576
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2577 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2578 c->ssl->no_send_shutdown = 1;
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
2579 c->write->error = 1;
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2580
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2581 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2582
397
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents: 396
diff changeset
2583 return NGX_ERROR;
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2584 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2585
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2586
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2587 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2588
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2589 ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2590 ngx_ssl_write_early(ngx_connection_t *c, u_char *data, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2591 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2592 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2593 size_t written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2594 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2595
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2596 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2597
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2598 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2599
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2600 written = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2601
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2602 n = SSL_write_early_data(c->ssl->connection, data, size, &written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2603
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2604 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2605 "SSL_write_early_data: %d, %uz", n, written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2606
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2607 if (n > 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2608
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2609 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2610
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2611 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2612 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2613 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2614
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2615 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2616 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2617 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2618
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2619 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2620 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2621
7431
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2622 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2623 c->ssl->write_blocked = 0;
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2624 ngx_post_event(c->read, &ngx_posted_events);
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2625 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2626
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2627 c->sent += written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2628
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2629 return written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2630 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2631
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2632 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2633
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2634 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2635
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2636 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2637
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2638 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2639
7431
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2640 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2641 "SSL_write_early_data: want write");
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2642
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2643 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2644
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2645 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2646 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2647 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2648
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2649 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2650 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2651 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2652
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2653 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2654 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2655
7431
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2656 /*
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2657 * OpenSSL 1.1.1a fails to handle SSL_read_early_data()
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2658 * if an SSL_write_early_data() call blocked on writing,
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2659 * see https://github.com/openssl/openssl/issues/7757
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2660 */
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2661
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2662 c->ssl->write_blocked = 1;
294162223c7c SSL: avoid reading on pending SSL_write_early_data().
Sergey Kandaurov <pluknet@nginx.com>
parents: 7395
diff changeset
2663
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2664 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2665 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2666 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2667
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2668 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2669
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2670 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2671 "SSL_write_early_data: want read");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2672
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2673 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2674
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2675 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2676 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2677 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2678
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2679 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2680 * we do not set the timer because there is already
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2681 * the write event timer
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2682 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2683
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2684 if (c->ssl->saved_read_handler == NULL) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2685 c->ssl->saved_read_handler = c->read->handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2686 c->read->handler = ngx_ssl_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2687 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2688
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2689 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2690 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2691
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2692 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2693 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2694 c->write->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2695
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2696 ngx_ssl_connection_error(c, sslerr, err, "SSL_write_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2697
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2698 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2699 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2700
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2701 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2702
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
2703
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2704 static void
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2705 ngx_ssl_read_handler(ngx_event_t *rev)
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2706 {
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2707 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2708
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2709 c = rev->data;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2710
7352
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2711 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL read handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7333
diff changeset
2712
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
2713 c->write->handler(c->write);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2714 }
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2715
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2716
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2717 void
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2718 ngx_ssl_free_buffer(ngx_connection_t *c)
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2719 {
1795
3a0132e2be2c fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents: 1779
diff changeset
2720 if (c->ssl->buf && c->ssl->buf->start) {
3a0132e2be2c fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents: 1779
diff changeset
2721 if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) {
3a0132e2be2c fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents: 1779
diff changeset
2722 c->ssl->buf->start = NULL;
3a0132e2be2c fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents: 1779
diff changeset
2723 }
1779
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2724 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2725 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2726
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents: 1778
diff changeset
2727
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2728 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
2729 ngx_ssl_shutdown(ngx_connection_t *c)
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2730 {
1754
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2731 int n, sslerr, mode;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2732 ngx_err_t err;
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2733
6407
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2734 if (SSL_in_init(c->ssl->connection)) {
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2735 /*
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2736 * OpenSSL 1.0.2f complains if SSL_shutdown() is called during
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2737 * an SSL handshake, while previous versions always return 0.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2738 * Avoid calling SSL_shutdown() if handshake wasn't completed.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2739 */
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2740
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2741 SSL_free(c->ssl->connection);
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2742 c->ssl = NULL;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2743
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2744 return NGX_OK;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2745 }
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6406
diff changeset
2746
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2747 if (c->timedout) {
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2748 mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
4064
5b776ad53c3c Proper SSL shutdown handling.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3992
diff changeset
2749 SSL_set_quiet_shutdown(c->ssl->connection, 1);
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2750
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2751 } else {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2752 mode = SSL_get_shutdown(c->ssl->connection);
473
8e8f3af115b5 nginx-0.1.11-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 469
diff changeset
2753
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2754 if (c->ssl->no_wait_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2755 mode |= SSL_RECEIVED_SHUTDOWN;
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2756 }
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2757
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2758 if (c->ssl->no_send_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2759 mode |= SSL_SENT_SHUTDOWN;
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2760 }
4064
5b776ad53c3c Proper SSL shutdown handling.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3992
diff changeset
2761
5b776ad53c3c Proper SSL shutdown handling.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3992
diff changeset
2762 if (c->ssl->no_wait_shutdown && c->ssl->no_send_shutdown) {
5b776ad53c3c Proper SSL shutdown handling.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3992
diff changeset
2763 SSL_set_quiet_shutdown(c->ssl->connection, 1);
5b776ad53c3c Proper SSL shutdown handling.
Maxim Dounin <mdounin@mdounin.ru>
parents: 3992
diff changeset
2764 }
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2765 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2766
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2767 SSL_set_shutdown(c->ssl->connection, mode);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2768
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
2769 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
2770
1754
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2771 n = SSL_shutdown(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2772
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2773 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2774
461
a88a3e4e158f nginx-0.1.5-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 455
diff changeset
2775 sslerr = 0;
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2776
6406
d194cad6dd3a SSL: fixed SSL_shutdown() comment.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6261
diff changeset
2777 /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors */
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2778
1865
4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755
Igor Sysoev <igor@sysoev.ru>
parents: 1861
diff changeset
2779 if (n != 1 && ERR_peek_error()) {
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2780 sslerr = SSL_get_error(c->ssl->connection, n);
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2781
396
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2782 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents: 395
diff changeset
2783 "SSL_get_error: %d", sslerr);
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2784 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2785
1865
4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755
Igor Sysoev <igor@sysoev.ru>
parents: 1861
diff changeset
2786 if (n == 1 || sslerr == 0 || sslerr == SSL_ERROR_ZERO_RETURN) {
1754
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2787 SSL_free(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2788 c->ssl = NULL;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2789
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2790 return NGX_OK;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2791 }
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2792
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2793 if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) {
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2794 c->read->handler = ngx_ssl_shutdown_handler;
589
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
2795 c->write->handler = ngx_ssl_shutdown_handler;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2796
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2797 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2798 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2799 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2800
2388
722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents: 2315
diff changeset
2801 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2802 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2803 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2804
1754
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents: 1743
diff changeset
2805 if (sslerr == SSL_ERROR_WANT_READ) {
589
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
2806 ngx_add_timer(c->read, 30000);
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
2807 }
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
2808
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2809 return NGX_AGAIN;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2810 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2811
591
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
2812 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
2813
8c0cdd81580e nginx-0.3.17-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 589
diff changeset
2814 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2815
543
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2816 SSL_free(c->ssl->connection);
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2817 c->ssl = NULL;
511a89da35ad nginx-0.2.0-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 541
diff changeset
2818
394
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2819 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2820 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2821
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents: 393
diff changeset
2822
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2823 static void
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2824 ngx_ssl_shutdown_handler(ngx_event_t *ev)
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2825 {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2826 ngx_connection_t *c;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2827 ngx_connection_handler_pt handler;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2828
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2829 c = ev->data;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2830 handler = c->ssl->handler;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2831
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2832 if (ev->timedout) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2833 c->timedout = 1;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2834 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2835
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
2836 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2837
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2838 if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2839 return;
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2840 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2841
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2842 handler(c);
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2843 }
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2844
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2845
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
2846 static void
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2847 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2848 char *text)
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2849 {
1876
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2850 int n;
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2851 ngx_uint_t level;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2852
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2853 level = NGX_LOG_CRIT;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2854
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2855 if (sslerr == SSL_ERROR_SYSCALL) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2856
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2857 if (err == NGX_ECONNRESET
7560
2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7509
diff changeset
2858 #if (NGX_WIN32)
2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7509
diff changeset
2859 || err == NGX_ECONNABORTED
2432a687e789 SSL: lowered log level for WSAECONNABORTED errors on Windows.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7509
diff changeset
2860 #endif
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2861 || err == NGX_EPIPE
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2862 || err == NGX_ENOTCONN
589
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
2863 || err == NGX_ETIMEDOUT
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2864 || err == NGX_ECONNREFUSED
1869
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents: 1868
diff changeset
2865 || err == NGX_ENETDOWN
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents: 1868
diff changeset
2866 || err == NGX_ENETUNREACH
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents: 1868
diff changeset
2867 || err == NGX_EHOSTDOWN
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2868 || err == NGX_EHOSTUNREACH)
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2869 {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2870 switch (c->log_error) {
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2871
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2872 case NGX_ERROR_IGNORE_ECONNRESET:
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2873 case NGX_ERROR_INFO:
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2874 level = NGX_LOG_INFO;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2875 break;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2876
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2877 case NGX_ERROR_ERR:
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2878 level = NGX_LOG_ERR;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2879 break;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2880
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2881 default:
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2882 break;
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2883 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2884 }
1876
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2885
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2886 } else if (sslerr == SSL_ERROR_SSL) {
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2887
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2888 n = ERR_GET_REASON(ERR_peek_error());
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2889
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2890 /* handshake failures */
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2891 if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */
7360
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2892 #ifdef SSL_R_NO_SUITABLE_KEY_SHARE
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2893 || n == SSL_R_NO_SUITABLE_KEY_SHARE /* 101 */
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2894 #endif
7361
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2895 #ifdef SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2896 || n == SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM /* 118 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2897 #endif
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2898 || n == SSL_R_BLOCK_CIPHER_PAD_IS_WRONG /* 129 */
3718
bfd84b583868 decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3516
diff changeset
2899 || n == SSL_R_DIGEST_CHECK_FAILED /* 149 */
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2900 || n == SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST /* 151 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2901 || n == SSL_R_EXCESSIVE_MESSAGE_SIZE /* 152 */
7311
778358452a81 SSL: logging level of "https proxy request" errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7291
diff changeset
2902 || n == SSL_R_HTTPS_PROXY_REQUEST /* 155 */
778358452a81 SSL: logging level of "https proxy request" errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7291
diff changeset
2903 || n == SSL_R_HTTP_REQUEST /* 156 */
3455
028f0892e0cd decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3357
diff changeset
2904 || n == SSL_R_LENGTH_MISMATCH /* 159 */
6652
1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6591
diff changeset
2905 #ifdef SSL_R_NO_CIPHERS_PASSED
2315
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2906 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */
6652
1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6591
diff changeset
2907 #endif
3455
028f0892e0cd decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3357
diff changeset
2908 || n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2909 || n == SSL_R_NO_COMPRESSION_SPECIFIED /* 187 */
2315
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2910 || n == SSL_R_NO_SHARED_CIPHER /* 193 */
3455
028f0892e0cd decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3357
diff changeset
2911 || n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */
7472
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2912 #ifdef SSL_R_CLIENTHELLO_TLSEXT
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2913 || n == SSL_R_CLIENTHELLO_TLSEXT /* 226 */
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2914 #endif
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2915 #ifdef SSL_R_PARSE_TLSEXT
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2916 || n == SSL_R_PARSE_TLSEXT /* 227 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2917 #endif
7472
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2918 #ifdef SSL_R_CALLBACK_FAILED
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2919 || n == SSL_R_CALLBACK_FAILED /* 234 */
d430babbe643 SSL: server name callback changed to return fatal errors.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7465
diff changeset
2920 #endif
2315
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2921 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2922 || n == SSL_R_UNEXPECTED_RECORD /* 245 */
3455
028f0892e0cd decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3357
diff changeset
2923 || n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */
3357
fc735aa50b8b decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents: 3300
diff changeset
2924 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */
7361
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2925 #ifdef SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2926 || n == SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS /* 253 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7360
diff changeset
2927 #endif
7317
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7311
diff changeset
2928 || n == SSL_R_UNSUPPORTED_PROTOCOL /* 258 */
7360
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2929 #ifdef SSL_R_NO_SHARED_GROUP
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2930 || n == SSL_R_NO_SHARED_GROUP /* 266 */
8f25a44d9add SSL: logging level of "no suitable key share".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7357
diff changeset
2931 #endif
2315
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2932 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2933 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */
4228
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2934 #ifdef SSL_R_RENEGOTIATE_EXT_TOO_LONG
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2935 || n == SSL_R_RENEGOTIATE_EXT_TOO_LONG /* 335 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2936 || n == SSL_R_RENEGOTIATION_ENCODING_ERR /* 336 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2937 || n == SSL_R_RENEGOTIATION_MISMATCH /* 337 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2938 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2939 #ifdef SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2940 || n == SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED /* 338 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2941 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2942 #ifdef SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2943 || n == SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING /* 345 */
5fef0313f2ff Decrease of log level of some SSL handshake errors.
Igor Sysoev <igor@sysoev.ru>
parents: 4186
diff changeset
2944 #endif
5902
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5892
diff changeset
2945 #ifdef SSL_R_INAPPROPRIATE_FALLBACK
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5892
diff changeset
2946 || n == SSL_R_INAPPROPRIATE_FALLBACK /* 373 */
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5892
diff changeset
2947 #endif
7461
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
2948 #ifdef SSL_R_CERT_CB_ERROR
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
2949 || n == SSL_R_CERT_CB_ERROR /* 377 */
a68799465b19 SSL: loading of connection-specific certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7460
diff changeset
2950 #endif
7317
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7311
diff changeset
2951 #ifdef SSL_R_VERSION_TOO_LOW
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7311
diff changeset
2952 || n == SSL_R_VERSION_TOO_LOW /* 396 */
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low".
Maxim Dounin <mdounin@mdounin.ru>
parents: 7311
diff changeset
2953 #endif
1877
a55876dff8f5 low SSL handshake close notify alert error level
Igor Sysoev <igor@sysoev.ru>
parents: 1876
diff changeset
2954 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
6486
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6485
diff changeset
2955 #ifdef SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE
2315
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2956 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2957 || n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC /* 1020 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2958 || n == SSL_R_TLSV1_ALERT_DECRYPTION_FAILED /* 1021 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2959 || n == SSL_R_TLSV1_ALERT_RECORD_OVERFLOW /* 1022 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2960 || n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE /* 1030 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2961 || n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE /* 1040 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2962 || n == SSL_R_SSLV3_ALERT_NO_CERTIFICATE /* 1041 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2963 || n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE /* 1042 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2964 || n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE /* 1043 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2965 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED /* 1044 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2966 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED /* 1045 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2967 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN /* 1046 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2968 || n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER /* 1047 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2969 || n == SSL_R_TLSV1_ALERT_UNKNOWN_CA /* 1048 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2970 || n == SSL_R_TLSV1_ALERT_ACCESS_DENIED /* 1049 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2971 || n == SSL_R_TLSV1_ALERT_DECODE_ERROR /* 1050 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2972 || n == SSL_R_TLSV1_ALERT_DECRYPT_ERROR /* 1051 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2973 || n == SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION /* 1060 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2974 || n == SSL_R_TLSV1_ALERT_PROTOCOL_VERSION /* 1070 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2975 || n == SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY /* 1071 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2976 || n == SSL_R_TLSV1_ALERT_INTERNAL_ERROR /* 1080 */
31fafd8e7436 low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 2280
diff changeset
2977 || n == SSL_R_TLSV1_ALERT_USER_CANCELLED /* 1090 */
6486
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6485
diff changeset
2978 || n == SSL_R_TLSV1_ALERT_NO_RENEGOTIATION /* 1100 */
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6485
diff changeset
2979 #endif
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6485
diff changeset
2980 )
1876
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2981 {
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2982 switch (c->log_error) {
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2983
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2984 case NGX_ERROR_IGNORE_ECONNRESET:
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2985 case NGX_ERROR_INFO:
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2986 level = NGX_LOG_INFO;
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2987 break;
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2988
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2989 case NGX_ERROR_ERR:
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2990 level = NGX_LOG_ERR;
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2991 break;
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2992
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2993 default:
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2994 break;
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2995 }
5d663752fd96 low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents: 1873
diff changeset
2996 }
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2997 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2998
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
2999 ngx_ssl_error(level, c->log, err, text);
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
3000 }
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
3001
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
3002
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3003 static void
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3004 ngx_ssl_clear_error(ngx_log_t *log)
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3005 {
1868
c2cd0720f292 pull all errors
Igor Sysoev <igor@sysoev.ru>
parents: 1865
diff changeset
3006 while (ERR_peek_error()) {
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3007 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error");
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3008 }
1868
c2cd0720f292 pull all errors
Igor Sysoev <igor@sysoev.ru>
parents: 1865
diff changeset
3009
c2cd0720f292 pull all errors
Igor Sysoev <igor@sysoev.ru>
parents: 1865
diff changeset
3010 ERR_clear_error();
1755
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3011 }
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3012
59e36c1c6296 cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents: 1754
diff changeset
3013
583
4e296b7d25bf nginx-0.3.13-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 577
diff changeset
3014 void ngx_cdecl
489
45a460f82aec nginx-0.1.19-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 479
diff changeset
3015 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
3016 {
4877
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3017 int flags;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3018 u_long n;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3019 va_list args;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3020 u_char *p, *last;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3021 u_char errstr[NGX_MAX_CONF_ERRSTR];
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 4875
diff changeset
3022 const char *data;
461
a88a3e4e158f nginx-0.1.5-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 455
diff changeset
3023
a88a3e4e158f nginx-0.1.5-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 455
diff changeset
3024 last = errstr + NGX_MAX_CONF_ERRSTR;
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3025
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3026 va_start(args, fmt);
2764
d4a717592877 use ngx_vslprintf(), ngx_slprintf()
Igor Sysoev <igor@sysoev.ru>
parents: 2720
diff changeset
3027 p = ngx_vslprintf(errstr, last - 1, fmt, args);
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3028 va_end(args);
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3029
7459
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3030 if (ERR_peek_error()) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3031 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3032
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3033 for ( ;; ) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3034
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3035 n = ERR_peek_error_line_data(NULL, NULL, &data, &flags);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3036
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3037 if (n == 0) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3038 break;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3039 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3040
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3041 /* ERR_error_string_n() requires at least one byte */
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3042
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3043 if (p >= last - 1) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3044 goto next;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3045 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3046
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3047 *p++ = ' ';
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3048
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3049 ERR_error_string_n(n, (char *) p, last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3050
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3051 while (p < last && *p) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3052 p++;
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3053 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3054
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3055 if (p < last && *data && (flags & ERR_TXT_STRING)) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3056 *p++ = ':';
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3057 p = ngx_cpystrn(p, (u_char *) data, last - p);
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3058 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3059
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3060 next:
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3061
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3062 (void) ERR_get_error();
1861
f00b30557c81 pull all errors
Igor Sysoev <igor@sysoev.ru>
parents: 1860
diff changeset
3063 }
f00b30557c81 pull all errors
Igor Sysoev <igor@sysoev.ru>
parents: 1860
diff changeset
3064
7459
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3065 if (p < last) {
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3066 *p++ = ')';
547
818fbd4750b9 nginx-0.2.2-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 543
diff changeset
3067 }
7459
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3068 }
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3069
982008fbc4ba SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().
Maxim Dounin <mdounin@mdounin.ru>
parents: 7455
diff changeset
3070 ngx_log_error(level, log, err, "%*s", p - errstr, errstr);
393
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3071 }
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
3072
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
3073
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3074 ngx_int_t
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3075 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3076 ngx_array_t *certificates, ssize_t builtin_session_cache,
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3077 ngx_shm_zone_t *shm_zone, time_t timeout)
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3078 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3079 long cache_mode;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3080
5424
767aa37f12de SSL: SSL_CTX_set_timeout() now always called.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5423
diff changeset
3081 SSL_CTX_set_timeout(ssl->ctx, (long) timeout);
767aa37f12de SSL: SSL_CTX_set_timeout() now always called.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5423
diff changeset
3082
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3083 if (ngx_ssl_session_id_context(ssl, sess_ctx, certificates) != NGX_OK) {
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3084 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3085 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3086
1778
14510c3cc6cb ssl_session_cache off
Igor Sysoev <igor@sysoev.ru>
parents: 1760
diff changeset
3087 if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
14510c3cc6cb ssl_session_cache off
Igor Sysoev <igor@sysoev.ru>
parents: 1760
diff changeset
3088 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
14510c3cc6cb ssl_session_cache off
Igor Sysoev <igor@sysoev.ru>
parents: 1760
diff changeset
3089 return NGX_OK;
14510c3cc6cb ssl_session_cache off
Igor Sysoev <igor@sysoev.ru>
parents: 1760
diff changeset
3090 }
14510c3cc6cb ssl_session_cache off
Igor Sysoev <igor@sysoev.ru>
parents: 1760
diff changeset
3091
2032
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3092 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3093
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3094 /*
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3095 * If the server explicitly says that it does not support
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3096 * session reuse (see SSL_SESS_CACHE_OFF above), then
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3097 * Outlook Express fails to upload a sent email to
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3098 * the Sent Items folder on the IMAP server via a separate IMAP
6552
addd98357629 SSL: style.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6551
diff changeset
3099 * connection in the background. Therefore we have a special
2032
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3100 * mode (SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_STORE)
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3101 * where the server pretends that it supports session reuse,
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3102 * but it does not actually store any session.
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3103 */
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3104
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3105 SSL_CTX_set_session_cache_mode(ssl->ctx,
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3106 SSL_SESS_CACHE_SERVER
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3107 |SSL_SESS_CACHE_NO_AUTO_CLEAR
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3108 |SSL_SESS_CACHE_NO_INTERNAL_STORE);
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3109
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3110 SSL_CTX_sess_set_cache_size(ssl->ctx, 1);
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3111
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3112 return NGX_OK;
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3113 }
12b3ad3353f9 ssl_session_cache none
Igor Sysoev <igor@sysoev.ru>
parents: 1977
diff changeset
3114
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3115 cache_mode = SSL_SESS_CACHE_SERVER;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3116
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3117 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3118 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3119 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3120
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3121 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3122
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3123 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3124
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3125 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3126 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3127 }
1015
32ebb6b13ff3 ssl_session_timeout was set only if builtin cache was used
Igor Sysoev <igor@sysoev.ru>
parents: 1014
diff changeset
3128 }
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3129
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3130 if (shm_zone) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3131 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3132 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3133 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3134
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3135 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3136 == 0)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3137 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3138 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3139 "SSL_CTX_set_ex_data() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3140 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3141 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3142 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3143
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3144 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3145 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3146
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3147
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3148 static ngx_int_t
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3149 ngx_ssl_session_id_context(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3150 ngx_array_t *certificates)
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3151 {
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3152 int n, i;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3153 X509 *cert;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3154 X509_NAME *name;
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3155 ngx_str_t *certs;
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3156 ngx_uint_t k;
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3157 EVP_MD_CTX *md;
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3158 unsigned int len;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3159 STACK_OF(X509_NAME) *list;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3160 u_char buf[EVP_MAX_MD_SIZE];
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3161
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3162 /*
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3163 * Session ID context is set based on the string provided,
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3164 * the server certificates, and the client CA list.
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3165 */
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3166
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3167 md = EVP_MD_CTX_create();
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3168 if (md == NULL) {
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3169 return NGX_ERROR;
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3170 }
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3171
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3172 if (EVP_DigestInit_ex(md, EVP_sha1(), NULL) == 0) {
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3173 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3174 "EVP_DigestInit_ex() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3175 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3176 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3177
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3178 if (EVP_DigestUpdate(md, sess_ctx->data, sess_ctx->len) == 0) {
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3179 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3180 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3181 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3182 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3183
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3184 for (cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3185 cert;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3186 cert = X509_get_ex_data(cert, ngx_ssl_next_certificate_index))
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3187 {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3188 if (X509_digest(cert, EVP_sha1(), buf, &len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3189 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3190 "X509_digest() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3191 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3192 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3193
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3194 if (EVP_DigestUpdate(md, buf, len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3195 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3196 "EVP_DigestUpdate() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3197 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
3198 }
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3199 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3200
7465
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3201 if (SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index) == NULL) {
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3202
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3203 /*
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3204 * If certificates are loaded dynamically, we use certificate
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3205 * names as specified in the configuration (with variables).
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3206 */
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3207
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3208 certs = certificates->elts;
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3209 for (k = 0; k < certificates->nelts; k++) {
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3210
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3211 if (EVP_DigestUpdate(md, certs[k].data, certs[k].len) == 0) {
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3212 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3213 "EVP_DigestUpdate() failed");
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3214 goto failed;
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3215 }
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3216 }
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3217 }
6708bec13757 SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7463
diff changeset
3218
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3219 list = SSL_CTX_get_client_CA_list(ssl->ctx);
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3220
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3221 if (list != NULL) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3222 n = sk_X509_NAME_num(list);
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3223
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3224 for (i = 0; i < n; i++) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3225 name = sk_X509_NAME_value(list, i);
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3226
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3227 if (X509_NAME_digest(name, EVP_sha1(), buf, &len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3228 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3229 "X509_NAME_digest() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3230 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3231 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3232
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3233 if (EVP_DigestUpdate(md, buf, len) == 0) {
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3234 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3235 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3236 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3237 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3238 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3239 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3240
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3241 if (EVP_DigestFinal_ex(md, buf, &len) == 0) {
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3242 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
7455
992bf7540a98 SSL: fixed EVP_DigestFinal_ex() error message.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7454
diff changeset
3243 "EVP_DigestFinal_ex() failed");
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3244 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3245 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3246
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3247 EVP_MD_CTX_destroy(md);
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3248
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3249 if (SSL_CTX_set_session_id_context(ssl->ctx, buf, len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3250 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3251 "SSL_CTX_set_session_id_context() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3252 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3253 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3254
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3255 return NGX_OK;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3256
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3257 failed:
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3258
6490
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6489
diff changeset
3259 EVP_MD_CTX_destroy(md);
5834
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3260
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3261 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3262 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3263
ca63fc5ed9b1 SSL: session id context now includes certificate hash.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5823
diff changeset
3264
3992
a1dd9dc754ab A new fix for the case when ssl_session_cache defined, but ssl is not
Igor Sysoev <igor@sysoev.ru>
parents: 3962
diff changeset
3265 ngx_int_t
993
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3266 ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data)
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3267 {
2611
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3268 size_t len;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3269 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3270 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3271
993
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3272 if (data) {
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3273 shm_zone->data = data;
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3274 return NGX_OK;
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3275 }
1b9a4d92173f pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents: 989
diff changeset
3276
5640
4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5634
diff changeset
3277 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5634
diff changeset
3278
2720
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3279 if (shm_zone->shm.exists) {
5640
4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528).
Maxim Dounin <mdounin@mdounin.ru>
parents: 5634
diff changeset
3280 shm_zone->data = shpool->data;
2720
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3281 return NGX_OK;
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3282 }
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3283
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3284 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3285 if (cache == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3286 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3287 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3288
2720
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3289 shpool->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3290 shm_zone->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2716
diff changeset
3291
1759
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3292 ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel,
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3293 ngx_ssl_session_rbtree_insert_value);
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3294
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3295 ngx_queue_init(&cache->expire_queue);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3296
2716
d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2710
diff changeset
3297 len = sizeof(" in SSL session shared cache \"\"") + shm_zone->shm.name.len;
2611
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3298
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3299 shpool->log_ctx = ngx_slab_alloc(shpool, len);
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3300 if (shpool->log_ctx == NULL) {
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3301 return NGX_ERROR;
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3302 }
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3303
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3304 ngx_sprintf(shpool->log_ctx, " in SSL session shared cache \"%V\"%Z",
2716
d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents: 2710
diff changeset
3305 &shm_zone->shm.name);
2611
2bce3f6416c6 improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents: 2536
diff changeset
3306
5634
5024d29354f1 Core: slab log_nomem flag.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5573
diff changeset
3307 shpool->log_nomem = 0;
5024d29354f1 Core: slab log_nomem flag.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5573
diff changeset
3308
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3309 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3310 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3311
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3312
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3313 /*
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3314 * The length of the session id is 16 bytes for SSLv2 sessions and
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3315 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3316 * It seems that the typical length of the external ASN1 representation
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3317 * of a session is 118 or 119 bytes for SSLv3/TSLv1.
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3318 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3319 * Thus on 32-bit platforms we allocate separately an rbtree node,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3320 * a session id, and an ASN1 representation, they take accordingly
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3321 * 64, 32, and 128 bytes.
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3322 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3323 * On 64-bit platforms we allocate separately an rbtree node + session_id,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3324 * and an ASN1 representation, they take accordingly 128 and 128 bytes.
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3325 *
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3326 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3327 * so they are outside the code locked by shared pool mutex
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3328 */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3329
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3330 static int
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3331 ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3332 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3333 int len;
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3334 u_char *p, *id, *cached_sess, *session_id;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3335 uint32_t hash;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3336 SSL_CTX *ssl_ctx;
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3337 unsigned int session_id_length;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3338 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3339 ngx_connection_t *c;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3340 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3341 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3342 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3343 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3344
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3345 len = i2d_SSL_SESSION(sess, NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3346
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3347 /* do not cache too big session */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3348
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3349 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3350 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3351 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3352
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3353 p = buf;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3354 i2d_SSL_SESSION(sess, &p);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3355
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3356 c = ngx_ssl_get_connection(ssl_conn);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3357
6261
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3358 ssl_ctx = c->ssl->session_ctx;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3359 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3360
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3361 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3362 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3363
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3364 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3365
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3366 /* drop one or two expired sessions */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3367 ngx_ssl_expire_sessions(cache, shpool, 1);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3368
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3369 cached_sess = ngx_slab_alloc_locked(shpool, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3370
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3371 if (cached_sess == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3372
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3373 /* drop the oldest non-expired session and try once more */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3374
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3375 ngx_ssl_expire_sessions(cache, shpool, 0);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3376
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3377 cached_sess = ngx_slab_alloc_locked(shpool, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3378
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3379 if (cached_sess == NULL) {
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3380 sess_id = NULL;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3381 goto failed;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3382 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3383 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3384
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3385 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
5081
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3386
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3387 if (sess_id == NULL) {
5081
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3388
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3389 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3390
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3391 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3392
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3393 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3394
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3395 if (sess_id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3396 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3397 }
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3398 }
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3399
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3400 session_id = (u_char *) SSL_SESSION_get_id(sess, &session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3401
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3402 #if (NGX_PTR_SIZE == 8)
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3403
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3404 id = sess_id->sess_id;
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3405
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3406 #else
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3407
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3408 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3409
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3410 if (id == NULL) {
5081
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3411
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3412 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3413
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3414 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3415
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3416 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3417
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3418 if (id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3419 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5024
diff changeset
3420 }
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3421 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3422
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3423 #endif
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3424
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3425 ngx_memcpy(cached_sess, buf, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3426
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3427 ngx_memcpy(id, session_id, session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3428
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3429 hash = ngx_crc32_short(session_id, session_id_length);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3430
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3431 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3432 "ssl new session: %08XD:%ud:%d",
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3433 hash, session_id_length, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3434
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3435 sess_id->node.key = hash;
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3436 sess_id->node.data = (u_char) session_id_length;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3437 sess_id->id = id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3438 sess_id->len = len;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3439 sess_id->session = cached_sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3440
1757
7ab8bd535eed use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents: 1756
diff changeset
3441 sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3442
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3443 ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3444
1759
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3445 ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3446
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3447 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3448
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3449 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3450
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3451 failed:
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3452
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3453 if (cached_sess) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3454 ngx_slab_free_locked(shpool, cached_sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3455 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3456
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3457 if (sess_id) {
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3458 ngx_slab_free_locked(shpool, sess_id);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3459 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3460
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3461 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3462
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3463 ngx_log_error(NGX_LOG_ALERT, c->log, 0,
5634
5024d29354f1 Core: slab log_nomem flag.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5573
diff changeset
3464 "could not allocate new session%s", shpool->log_ctx);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3465
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3466 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3467 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3468
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3469
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3470 static ngx_ssl_session_t *
6487
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3471 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3472 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3473 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3474 #endif
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3475 u_char *id, int len, int *copy)
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3476 {
7365
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len.
Ruslan Ermilov <ru@nginx.com>
parents: 7361
diff changeset
3477 size_t slen;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3478 uint32_t hash;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3479 ngx_int_t rc;
7509
b99cbafd51da SSL: removed OpenSSL 0.9.7 compatibility.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7484
diff changeset
3480 const u_char *p;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3481 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3482 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3483 ngx_rbtree_node_t *node, *sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3484 ngx_ssl_session_t *sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3485 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3486 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3487 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
3961
4048aa055411 fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents: 3960
diff changeset
3488 ngx_connection_t *c;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3489
6487
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3490 hash = ngx_crc32_short((u_char *) (uintptr_t) id, (size_t) len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3491 *copy = 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3492
3961
4048aa055411 fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents: 3960
diff changeset
3493 c = ngx_ssl_get_connection(ssl_conn);
4048aa055411 fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents: 3960
diff changeset
3494
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3495 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
3155
e720c4a68ee0 fix debug log message
Igor Sysoev <igor@sysoev.ru>
parents: 3154
diff changeset
3496 "ssl get session: %08XD:%d", hash, len);
6261
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3497
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3498 shm_zone = SSL_CTX_get_ex_data(c->ssl->session_ctx,
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3499 ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3500
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3501 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3502
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3503 sess = NULL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3504
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3505 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3506
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3507 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3508
1759
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3509 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3510 sentinel = cache->session_rbtree.sentinel;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3511
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3512 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3513
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3514 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3515 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3516 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3517 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3518
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3519 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3520 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3521 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3522 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3523
1013
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3524 /* hash == node->key */
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3525
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3526 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3527
6487
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3528 rc = ngx_memn2cmp((u_char *) (uintptr_t) id, sess_id->id,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6486
diff changeset
3529 (size_t) len, (size_t) node->data);
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3530
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3531 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3532
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3533 if (sess_id->expire > ngx_time()) {
7365
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len.
Ruslan Ermilov <ru@nginx.com>
parents: 7361
diff changeset
3534 slen = sess_id->len;
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len.
Ruslan Ermilov <ru@nginx.com>
parents: 7361
diff changeset
3535
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len.
Ruslan Ermilov <ru@nginx.com>
parents: 7361
diff changeset
3536 ngx_memcpy(buf, sess_id->session, slen);
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3537
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3538 ngx_shmtx_unlock(&shpool->mutex);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3539
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3540 p = buf;
7365
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len.
Ruslan Ermilov <ru@nginx.com>
parents: 7361
diff changeset
3541 sess = d2i_SSL_SESSION(NULL, &p, slen);
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3542
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3543 return sess;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3544 }
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3545
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3546 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3547
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3548 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3549
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3550 ngx_slab_free_locked(shpool, sess_id->session);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3551 #if (NGX_PTR_SIZE == 4)
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3552 ngx_slab_free_locked(shpool, sess_id->id);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3553 #endif
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3554 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3555
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3556 sess = NULL;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3557
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3558 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3559 }
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3560
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3561 node = (rc < 0) ? node->left : node->right;
1013
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3562 }
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3563
1013
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3564 done:
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3565
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3566 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3567
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3568 return sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3569 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3570
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3571
1924
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3572 void
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3573 ngx_ssl_remove_cached_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3574 {
6474
Ruslan Ermilov <ru@nginx.com>
parents: 6407
diff changeset
3575 SSL_CTX_remove_session(ssl, sess);
Ruslan Ermilov <ru@nginx.com>
parents: 6407
diff changeset
3576
Ruslan Ermilov <ru@nginx.com>
parents: 6407
diff changeset
3577 ngx_ssl_remove_session(ssl, sess);
1924
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3578 }
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3579
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3580
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3581 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3582 ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3583 {
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3584 u_char *id;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3585 uint32_t hash;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3586 ngx_int_t rc;
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3587 unsigned int len;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3588 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3589 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3590 ngx_rbtree_node_t *node, *sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3591 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3592 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3593
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3594 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3595
1924
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3596 if (shm_zone == NULL) {
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3597 return;
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3598 }
291689a7e5dc invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents: 1877
diff changeset
3599
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3600 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3601
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3602 id = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3603
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3604 hash = ngx_crc32_short(id, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3605
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3606 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
3607 "ssl remove session: %08XD:%ud", hash, len);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3608
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3609 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3610
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3611 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3612
1759
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3613 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents: 1758
diff changeset
3614 sentinel = cache->session_rbtree.sentinel;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3615
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3616 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3617
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3618 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3619 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3620 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3621 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3622
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3623 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3624 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3625 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3626 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3627
1013
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3628 /* hash == node->key */
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3629
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3630 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3631
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3632 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3633
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3634 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3635
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3636 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3637
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3638 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3639
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3640 ngx_slab_free_locked(shpool, sess_id->session);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3641 #if (NGX_PTR_SIZE == 4)
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3642 ngx_slab_free_locked(shpool, sess_id->id);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3643 #endif
4497
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3644 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3645
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3646 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3647 }
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3648
95ab6658654a Fix of rbtree lookup on hash collisions.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4414
diff changeset
3649 node = (rc < 0) ? node->left : node->right;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3650 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3651
1013
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3652 done:
7dd987e09701 stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents: 993
diff changeset
3653
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3654 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3655 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3656
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3657
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3658 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3659 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3660 ngx_slab_pool_t *shpool, ngx_uint_t n)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3661 {
1757
7ab8bd535eed use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents: 1756
diff changeset
3662 time_t now;
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3663 ngx_queue_t *q;
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3664 ngx_ssl_sess_id_t *sess_id;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3665
1757
7ab8bd535eed use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents: 1756
diff changeset
3666 now = ngx_time();
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3667
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3668 while (n < 3) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3669
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3670 if (ngx_queue_empty(&cache->expire_queue)) {
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3671 return;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3672 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3673
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3674 q = ngx_queue_last(&cache->expire_queue);
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3675
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3676 sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue);
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3677
1757
7ab8bd535eed use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents: 1756
diff changeset
3678 if (n++ != 0 && sess_id->expire > now) {
1439
36548ad85be1 style fix
Igor Sysoev <igor@sysoev.ru>
parents: 1426
diff changeset
3679 return;
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3680 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3681
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3682 ngx_queue_remove(q);
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3683
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3684 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3685 "expire session: %08Xi", sess_id->node.key);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3686
1760
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3687 ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
49429f5b2d94 use ngx_queue.h
Igor Sysoev <igor@sysoev.ru>
parents: 1759
diff changeset
3688
1014
5ffd76a9ccf3 optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents: 1013
diff changeset
3689 ngx_slab_free_locked(shpool, sess_id->session);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3690 #if (NGX_PTR_SIZE == 4)
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3691 ngx_slab_free_locked(shpool, sess_id->id);
1017
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents: 1015
diff changeset
3692 #endif
974
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3693 ngx_slab_free_locked(shpool, sess_id);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3694 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3695 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3696
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents: 969
diff changeset
3697
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3698 static void
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3699 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3700 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3701 {
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3702 ngx_rbtree_node_t **p;
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3703 ngx_ssl_sess_id_t *sess_id, *sess_id_temp;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3704
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3705 for ( ;; ) {
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3706
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3707 if (node->key < temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3708
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3709 p = &temp->left;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3710
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3711 } else if (node->key > temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3712
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3713 p = &temp->right;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3714
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3715 } else { /* node->key == temp->key */
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3716
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3717 sess_id = (ngx_ssl_sess_id_t *) node;
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3718 sess_id_temp = (ngx_ssl_sess_id_t *) temp;
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3719
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3720 p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3721 (size_t) node->data, (size_t) temp->data)
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3722 < 0) ? &temp->left : &temp->right;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3723 }
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3724
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3725 if (*p == sentinel) {
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3726 break;
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3727 }
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3728
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3729 temp = *p;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3730 }
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3731
1743
4fc402c3ec73 optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents: 1439
diff changeset
3732 *p = node;
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3733 node->parent = temp;
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3734 node->left = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3735 node->right = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3736 ngx_rbt_red(node);
1043
7073b87fa8e9 style fix: remove trailing spaces
Igor Sysoev <igor@sysoev.ru>
parents: 1029
diff changeset
3737 }
1027
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3738
ff07ccfaad50 fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents: 1025
diff changeset
3739
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3740 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3741
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3742 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3743 ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3744 {
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3745 u_char buf[80];
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3746 size_t size;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3747 ssize_t n;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3748 ngx_str_t *path;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3749 ngx_file_t file;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3750 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3751 ngx_array_t *keys;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3752 ngx_file_info_t fi;
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3753 ngx_pool_cleanup_t *cln;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3754 ngx_ssl_session_ticket_key_t *key;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3755
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3756 if (paths == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3757 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3758 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3759
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3760 keys = ngx_array_create(cf->pool, paths->nelts,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3761 sizeof(ngx_ssl_session_ticket_key_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3762 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3763 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3764 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3765
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3766 cln = ngx_pool_cleanup_add(cf->pool, 0);
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3767 if (cln == NULL) {
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3768 return NGX_ERROR;
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3769 }
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3770
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3771 cln->handler = ngx_ssl_session_ticket_keys_cleanup;
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3772 cln->data = keys;
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3773
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3774 path = paths->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3775 for (i = 0; i < paths->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3776
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3777 if (ngx_conf_full_name(cf->cycle, &path[i], 1) != NGX_OK) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3778 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3779 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3780
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3781 ngx_memzero(&file, sizeof(ngx_file_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3782 file.name = path[i];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3783 file.log = cf->log;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3784
7087
47b7ffc3339d Fixed calls to ngx_open_file() in certain places.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7086
diff changeset
3785 file.fd = ngx_open_file(file.name.data, NGX_FILE_RDONLY,
47b7ffc3339d Fixed calls to ngx_open_file() in certain places.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7086
diff changeset
3786 NGX_FILE_OPEN, 0);
7086
Sergey Kandaurov <pluknet@nginx.com>
parents: 7074
diff changeset
3787
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3788 if (file.fd == NGX_INVALID_FILE) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3789 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3790 ngx_open_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3791 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3792 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3793
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3794 if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3795 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3796 ngx_fd_info_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3797 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3798 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3799
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3800 size = ngx_file_size(&fi);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3801
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3802 if (size != 48 && size != 80) {
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3803 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3804 "\"%V\" must be 48 or 80 bytes", &file.name);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3805 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3806 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3807
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3808 n = ngx_read_file(&file, buf, size, 0);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3809
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3810 if (n == NGX_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3811 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3812 ngx_read_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3813 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3814 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3815
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3816 if ((size_t) n != size) {
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3817 ngx_conf_log_error(NGX_LOG_CRIT, cf, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3818 ngx_read_file_n " \"%V\" returned only "
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3819 "%z bytes instead of %uz", &file.name, n, size);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3820 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3821 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3822
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3823 key = ngx_array_push(keys);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3824 if (key == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3825 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3826 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3827
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3828 if (size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3829 key->size = 48;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3830 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3831 ngx_memcpy(key->aes_key, buf + 16, 16);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3832 ngx_memcpy(key->hmac_key, buf + 32, 16);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3833
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3834 } else {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3835 key->size = 80;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3836 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3837 ngx_memcpy(key->hmac_key, buf + 16, 32);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3838 ngx_memcpy(key->aes_key, buf + 48, 32);
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3839 }
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3840
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3841 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3842 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3843 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3844 }
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3845
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3846 ngx_explicit_memzero(&buf, 80);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3847 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3848
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3849 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_ticket_keys_index, keys)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3850 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3851 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3852 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3853 "SSL_CTX_set_ex_data() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3854 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3855 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3856
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3857 if (SSL_CTX_set_tlsext_ticket_key_cb(ssl->ctx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3858 ngx_ssl_session_ticket_key_callback)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3859 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3860 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3861 ngx_log_error(NGX_LOG_WARN, cf->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3862 "nginx was built with Session Tickets support, however, "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3863 "now it is linked dynamically to an OpenSSL library "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3864 "which has no tlsext support, therefore Session Tickets "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3865 "are not available");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3866 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3867
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3868 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3869
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3870 failed:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3871
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3872 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3873 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3874 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3875 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3876
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3877 ngx_explicit_memzero(&buf, 80);
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
3878
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3879 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3880 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3881
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3882
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3883 static int
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3884 ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3885 unsigned char *name, unsigned char *iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3886 HMAC_CTX *hctx, int enc)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3887 {
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3888 size_t size;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3889 SSL_CTX *ssl_ctx;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3890 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3891 ngx_array_t *keys;
6261
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3892 ngx_connection_t *c;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3893 ngx_ssl_session_ticket_key_t *key;
6686
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3894 const EVP_MD *digest;
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3895 const EVP_CIPHER *cipher;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3896 #if (NGX_DEBUG)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3897 u_char buf[32];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3898 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3899
6261
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3900 c = ngx_ssl_get_connection(ssl_conn);
97f102a13f33 SSL: preserve default server context in connection (ticket #235).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6259
diff changeset
3901 ssl_ctx = c->ssl->session_ctx;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3902
6686
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3903 #ifdef OPENSSL_NO_SHA256
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3904 digest = EVP_sha1();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3905 #else
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3906 digest = EVP_sha256();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3907 #endif
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6660
diff changeset
3908
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3909 keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_ticket_keys_index);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3910 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3911 return -1;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3912 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3913
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3914 key = keys->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3915
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3916 if (enc == 1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3917 /* encrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3918
5657
3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5640
diff changeset
3919 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3920 "ssl session ticket encrypt, key: \"%*s\" (%s session)",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3921 ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3922 SSL_session_reused(ssl_conn) ? "reused" : "new");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3923
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3924 if (key[0].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3925 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3926 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3927
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3928 } else {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3929 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3930 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3931 }
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3932
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3933 if (RAND_bytes(iv, EVP_CIPHER_iv_length(cipher)) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3934 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "RAND_bytes() failed");
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3935 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3936 }
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3937
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3938 if (EVP_EncryptInit_ex(ectx, cipher, NULL, key[0].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3939 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3940 "EVP_EncryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3941 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3942 }
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3943
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3944 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3945 if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3946 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3947 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3948 }
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3949 #else
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3950 HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL);
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3951 #endif
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3952
5760
4b668378ad8b Style: use ngx_memcpy() instead of memcpy().
Piotr Sikora <piotr@cloudflare.com>
parents: 5756
diff changeset
3953 ngx_memcpy(name, key[0].name, 16);
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3954
6660
3eb1a92a2f05 SSL: adopted session ticket handling for OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6659
diff changeset
3955 return 1;
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3956
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3957 } else {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3958 /* decrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3959
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3960 for (i = 0; i < keys->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3961 if (ngx_memcmp(name, key[i].name, 16) == 0) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3962 goto found;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3963 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3964 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3965
5657
3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5640
diff changeset
3966 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3967 "ssl session ticket decrypt, key: \"%*s\" not found",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3968 ngx_hex_dump(buf, name, 16) - buf, buf);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3969
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3970 return 0;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3971
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3972 found:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3973
5657
3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5640
diff changeset
3974 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3975 "ssl session ticket decrypt, key: \"%*s\"%s",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3976 ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3977 (i == 0) ? " (default)" : "");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
3978
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3979 if (key[i].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3980 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3981 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3982
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3983 } else {
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3984 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3985 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3986 }
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3987
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3988 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3989 if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3990 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3991 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3992 }
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3993 #else
6854
75e7d55214bd SSL: support AES256 encryption of tickets.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6842
diff changeset
3994 HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL);
6687
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3995 #endif
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3996
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3997 if (EVP_DecryptInit_ex(ectx, cipher, NULL, key[i].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3998 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
3999 "EVP_DecryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
4000 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6686
diff changeset
4001 }
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4002
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4003 return (i == 0) ? 1 : 2 /* renew */;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4004 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4005 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4006
7453
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4007
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4008 static void
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4009 ngx_ssl_session_ticket_keys_cleanup(void *data)
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4010 {
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4011 ngx_array_t *keys = data;
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4012
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4013 ngx_explicit_memzero(keys->elts,
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4014 keys->nelts * sizeof(ngx_ssl_session_ticket_key_t));
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4015 }
873150addfeb SSL: explicitly zero out session ticket keys.
Ruslan Ermilov <ru@nginx.com>
parents: 7431
diff changeset
4016
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4017 #else
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4018
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4019 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4020 ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4021 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4022 if (paths) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4023 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
7074
07a49cce21ca SSL: fixed typo in the error message.
Sergey Kandaurov <pluknet@nginx.com>
parents: 6995
diff changeset
4024 "\"ssl_session_ticket_key\" ignored, not supported");
5425
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4025 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4026
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4027 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4028 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4029
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4030 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4031
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents: 5424
diff changeset
4032
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
4033 void
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
4034 ngx_ssl_cleanup_ctx(void *data)
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
4035 {
589
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
4036 ngx_ssl_t *ssl = data;
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
4037
6548
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4038 X509 *cert, *next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4039
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4040 cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4041
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4042 while (cert) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4043 next = X509_get_ex_data(cert, ngx_ssl_next_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4044 X509_free(cert);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4045 cert = next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4046 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6545
diff changeset
4047
589
d4e858a5751a nginx-0.3.16-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 583
diff changeset
4048 SSL_CTX_free(ssl->ctx);
509
9b8c906f6e63 nginx-0.1.29-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 501
diff changeset
4049 }
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
4050
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
4051
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4052 ngx_int_t
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4053 ngx_ssl_check_host(ngx_connection_t *c, ngx_str_t *name)
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4054 {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4055 X509 *cert;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4056
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4057 cert = SSL_get_peer_certificate(c->ssl->connection);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4058 if (cert == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4059 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4060 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4061
6725
9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6699
diff changeset
4062 #ifdef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4063
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4064 /* X509_check_host() is only available in OpenSSL 1.0.2+ */
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4065
5669
cac82b9b3499 SSL: explicit handling of empty names.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5666
diff changeset
4066 if (name->len == 0) {
cac82b9b3499 SSL: explicit handling of empty names.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5666
diff changeset
4067 goto failed;
cac82b9b3499 SSL: explicit handling of empty names.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5666
diff changeset
4068 }
cac82b9b3499 SSL: explicit handling of empty names.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5666
diff changeset
4069
5767
abd460ece11e SSL: fix build with recent OpenSSL.
Piotr Sikora <piotr@cloudflare.com>
parents: 5760
diff changeset
4070 if (X509_check_host(cert, (char *) name->data, name->len, 0, NULL) != 1) {
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4071 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4072 "X509_check_host(): no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4073 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4074 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4075
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4076 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4077 "X509_check_host(): match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4078
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4079 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4080
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4081 #else
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4082 {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4083 int n, i;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4084 X509_NAME *sname;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4085 ASN1_STRING *str;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4086 X509_NAME_ENTRY *entry;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4087 GENERAL_NAME *altname;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4088 STACK_OF(GENERAL_NAME) *altnames;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4089
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4090 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4091 * As per RFC6125 and RFC2818, we check subjectAltName extension,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4092 * and if it's not present - commonName in Subject is checked.
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4093 */
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4094
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4095 altnames = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4096
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4097 if (altnames) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4098 n = sk_GENERAL_NAME_num(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4099
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4100 for (i = 0; i < n; i++) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4101 altname = sk_GENERAL_NAME_value(altnames, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4102
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4103 if (altname->type != GEN_DNS) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4104 continue;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4105 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4106
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4107 str = altname->d.dNSName;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4108
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4109 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4110 "SSL subjectAltName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4111 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4112
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4113 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4114 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4115 "SSL subjectAltName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4116 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4117 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4118 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4119 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4120
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4121 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4122 "SSL subjectAltName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4123
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4124 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4125 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4126 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4127
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4128 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4129 * If there is no subjectAltName extension, check commonName
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4130 * in Subject. While RFC2818 requires to only check "most specific"
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4131 * CN, both Apache and OpenSSL check all CNs, and so do we.
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4132 */
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4133
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4134 sname = X509_get_subject_name(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4135
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4136 if (sname == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4137 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4138 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4139
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4140 i = -1;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4141 for ( ;; ) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4142 i = X509_NAME_get_index_by_NID(sname, NID_commonName, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4143
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4144 if (i < 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4145 break;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4146 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4147
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4148 entry = X509_NAME_get_entry(sname, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4149 str = X509_NAME_ENTRY_get_data(entry);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4150
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4151 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4152 "SSL commonName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4153 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4154
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4155 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4156 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4157 "SSL commonName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4158 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4159 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4160 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4161
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4162 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4163 "SSL commonName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4164 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4165 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4166
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4167 failed:
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4168
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4169 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4170 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4171
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4172 found:
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4173
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4174 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4175 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4176 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4177
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4178
6725
9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6699
diff changeset
4179 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4180
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4181 static ngx_int_t
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4182 ngx_ssl_check_name(ngx_str_t *name, ASN1_STRING *pattern)
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4183 {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4184 u_char *s, *p, *end;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4185 size_t slen, plen;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4186
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4187 s = name->data;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4188 slen = name->len;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4189
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4190 p = ASN1_STRING_data(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4191 plen = ASN1_STRING_length(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4192
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4193 if (slen == plen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4194 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4195 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4196
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4197 if (plen > 2 && p[0] == '*' && p[1] == '.') {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4198 plen -= 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4199 p += 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4200
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4201 end = s + slen;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4202 s = ngx_strlchr(s, end, '.');
5666
a77c0839c993 SSL: added explicit check for ngx_strlchr() result.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5661
diff changeset
4203
a77c0839c993 SSL: added explicit check for ngx_strlchr() result.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5661
diff changeset
4204 if (s == NULL) {
a77c0839c993 SSL: added explicit check for ngx_strlchr() result.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5661
diff changeset
4205 return NGX_ERROR;
a77c0839c993 SSL: added explicit check for ngx_strlchr() result.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5661
diff changeset
4206 }
a77c0839c993 SSL: added explicit check for ngx_strlchr() result.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5661
diff changeset
4207
5661
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4208 slen = end - s;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4209
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4210 if (plen == slen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4211 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4212 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4213 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4214
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4215 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4216 }
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4217
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4218 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4219
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4220
060c2e692b96 Upstream: proxy_ssl_verify and friends.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5658
diff changeset
4221 ngx_int_t
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4222 ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4223 {
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4224 s->data = (u_char *) SSL_get_version(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4225 return NGX_OK;
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4226 }
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4227
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4228
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4229 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4230 ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4231 {
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4232 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4233 return NGX_OK;
611
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4234 }
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4235
3f8a2132b93d nginx-0.3.27-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 597
diff changeset
4236
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4237 ngx_int_t
6816
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4238 ngx_ssl_get_ciphers(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4239 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4240 #ifdef SSL_CTRL_GET_RAW_CIPHERLIST
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4241
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4242 int n, i, bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4243 size_t len;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4244 u_char *ciphers, *p;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4245 const SSL_CIPHER *cipher;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4246
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4247 bytes = SSL_get0_raw_cipherlist(c->ssl->connection, NULL);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4248 n = SSL_get0_raw_cipherlist(c->ssl->connection, &ciphers);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4249
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4250 if (n <= 0) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4251 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4252 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4253 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4254
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4255 len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4256 n /= bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4257
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4258 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4259 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4260
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4261 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4262 len += ngx_strlen(SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4263
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4264 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4265 len += sizeof("0x") - 1 + bytes * (sizeof("00") - 1);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4266 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4267
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4268 len += sizeof(":") - 1;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4269 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4270
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4271 s->data = ngx_pnalloc(pool, len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4272 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4273 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4274 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4275
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4276 p = s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4277
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4278 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4279 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4280
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4281 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4282 p = ngx_sprintf(p, "%s", SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4283
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4284 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4285 p = ngx_sprintf(p, "0x");
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4286 p = ngx_hex_dump(p, ciphers + i * bytes, bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4287 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4288
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4289 *p++ = ':';
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4290 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4291
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4292 p--;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4293
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4294 s->len = p - s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4295
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4296 #else
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4297
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4298 u_char buf[4096];
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4299
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4300 if (SSL_get_shared_ciphers(c->ssl->connection, (char *) buf, 4096)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4301 == NULL)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4302 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4303 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4304 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4305 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4306
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4307 s->len = ngx_strlen(buf);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4308 s->data = ngx_pnalloc(pool, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4309 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4310 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4311 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4312
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4313 ngx_memcpy(s->data, buf, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4314
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4315 #endif
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4316
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4317 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4318 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4319
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4320
ea93c7d8752a SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6815
diff changeset
4321 ngx_int_t
6817
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4322 ngx_ssl_get_curves(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4323 {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4324 #ifdef SSL_CTRL_GET_CURVES
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4325
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4326 int *curves, n, i, nid;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4327 u_char *p;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4328 size_t len;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4329
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4330 n = SSL_get1_curves(c->ssl->connection, NULL);
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4331
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4332 if (n <= 0) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4333 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4334 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4335 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4336
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4337 curves = ngx_palloc(pool, n * sizeof(int));
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4338
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4339 n = SSL_get1_curves(c->ssl->connection, curves);
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4340 len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4341
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4342 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4343 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4344
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4345 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4346 len += sizeof("0x0000") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4347
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4348 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4349 len += ngx_strlen(OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4350 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4351
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4352 len += sizeof(":") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4353 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4354
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4355 s->data = ngx_pnalloc(pool, len);
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4356 if (s->data == NULL) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4357 return NGX_ERROR;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4358 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4359
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4360 p = s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4361
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4362 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4363 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4364
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4365 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4366 p = ngx_sprintf(p, "0x%04xd", nid & 0xffff);
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4367
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4368 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4369 p = ngx_sprintf(p, "%s", OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4370 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4371
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4372 *p++ = ':';
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4373 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4374
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4375 p--;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4376
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4377 s->len = p - s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4378
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4379 #else
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4380
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4381 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4382
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4383 #endif
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4384
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4385 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4386 }
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4387
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4388
e75e854657ba SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6816
diff changeset
4389 ngx_int_t
3154
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4390 ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4391 {
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
4392 u_char *buf;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
4393 SSL_SESSION *sess;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
4394 unsigned int len;
3154
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4395
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4396 sess = SSL_get0_session(c->ssl->connection);
5537
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5531
diff changeset
4397 if (sess == NULL) {
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5531
diff changeset
4398 s->len = 0;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5531
diff changeset
4399 return NGX_OK;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5531
diff changeset
4400 }
3154
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4401
5756
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
4402 buf = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly.
Piotr Sikora <piotr@cloudflare.com>
parents: 5755
diff changeset
4403
3154
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4404 s->len = 2 * len;
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4405 s->data = ngx_pnalloc(pool, 2 * len);
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4406 if (s->data == NULL) {
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4407 return NGX_ERROR;
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4408 }
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4409
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4410 ngx_hex_dump(s->data, buf, len);
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4411
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4412 return NGX_OK;
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4413 }
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4414
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4415
823f72db46c0 $ssl_session_id
Igor Sysoev <igor@sysoev.ru>
parents: 3002
diff changeset
4416 ngx_int_t
5573
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4417 ngx_ssl_get_session_reused(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4418 {
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4419 if (SSL_session_reused(c->ssl->connection)) {
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4420 ngx_str_set(s, "r");
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4421
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4422 } else {
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4423 ngx_str_set(s, ".");
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4424 }
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4425
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4426 return NGX_OK;
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4427 }
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4428
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4429
7c05f6590753 SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5537
diff changeset
4430 ngx_int_t
7333
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4431 ngx_ssl_get_early_data(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4432 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4433 s->len = 0;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4434
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4435 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4436
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4437 /* BoringSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4438
7333
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4439 if (SSL_in_early_data(c->ssl->connection)) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4440 ngx_str_set(s, "1");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4441 }
7357
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4442
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4443 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4444
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4445 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4446
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4447 if (!SSL_is_init_finished(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4448 ngx_str_set(s, "1");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4449 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 7356
diff changeset
4450
7333
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4451 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4452
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4453 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4454 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4455
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4456
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7332
diff changeset
4457 ngx_int_t
5658
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4458 ngx_ssl_get_server_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4459 {
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4460 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4461
7092
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4462 size_t len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4463 const char *name;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4464
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4465 name = SSL_get_servername(c->ssl->connection, TLSEXT_NAMETYPE_host_name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4466
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4467 if (name) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4468 len = ngx_strlen(name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4469
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4470 s->len = len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4471 s->data = ngx_pnalloc(pool, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4472 if (s->data == NULL) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4473 return NGX_ERROR;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4474 }
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4475
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4476 ngx_memcpy(s->data, name, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name.
Maxim Dounin <mdounin@mdounin.ru>
parents: 7091
diff changeset
4477
5658
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4478 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4479 }
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4480
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4481 #endif
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4482
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4483 s->len = 0;
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4484 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4485 }
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4486
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4487
94ae92776441 SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents: 5657
diff changeset
4488 ngx_int_t
2123
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4489 ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2045
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4490 {
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4491 size_t len;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4492 BIO *bio;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4493 X509 *cert;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4494
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4495 s->len = 0;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4496
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4497 cert = SSL_get_peer_certificate(c->ssl->connection);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4498 if (cert == NULL) {
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4499 return NGX_OK;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4500 }
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4501
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4502 bio = BIO_new(BIO_s_mem());
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4503 if (bio == NULL) {
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4504 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4505 X509_free(cert);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4506 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4507 }
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4508
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4509 if (PEM_write_bio_X509(bio, cert) == 0) {
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4510 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed");
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4511 goto failed;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4512 }
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4513
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4514 len = BIO_pending(bio);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4515 s->len = len;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4516
2049
2a92804f4109 *) back out r2040
Igor Sysoev <igor@sysoev.ru>
parents: 2045
diff changeset
4517 s->data = ngx_pnalloc(pool, len);
2045
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4518 if (s->data == NULL) {
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4519 goto failed;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4520 }
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4521
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4522 BIO_read(bio, s->data, len);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4523
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4524 BIO_free(bio);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4525 X509_free(cert);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4526
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4527 return NGX_OK;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4528
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4529 failed:
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4530
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4531 BIO_free(bio);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4532 X509_free(cert);
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4533
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4534 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4535 }
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4536
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4537
2b11822b12d6 $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2044
diff changeset
4538 ngx_int_t
2123
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4539 ngx_ssl_get_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4540 {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4541 u_char *p;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4542 size_t len;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4543 ngx_uint_t i;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4544 ngx_str_t cert;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4545
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4546 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4547 return NGX_ERROR;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4548 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4549
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4550 if (cert.len == 0) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4551 s->len = 0;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4552 return NGX_OK;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4553 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4554
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4555 len = cert.len - 1;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4556
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4557 for (i = 0; i < cert.len - 1; i++) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4558 if (cert.data[i] == LF) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4559 len++;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4560 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4561 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4562
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4563 s->len = len;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4564 s->data = ngx_pnalloc(pool, len);
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4565 if (s->data == NULL) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4566 return NGX_ERROR;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4567 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4568
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4569 p = s->data;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4570
3002
bf0c7e58e016 fix memory corruption in $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents: 2997
diff changeset
4571 for (i = 0; i < cert.len - 1; i++) {
2123
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4572 *p++ = cert.data[i];
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4573 if (cert.data[i] == LF) {
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4574 *p++ = '\t';
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4575 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4576 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4577
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4578 return NGX_OK;
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4579 }
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4580
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4581
9697407e9ecb *) ssl_verify_client ask
Igor Sysoev <igor@sysoev.ru>
parents: 2052
diff changeset
4582 ngx_int_t
7091
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4583 ngx_ssl_get_escaped_certificate(ngx_connection_t *c, ngx_pool_t *pool,
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4584 ngx_str_t *s)
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4585 {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4586 ngx_str_t cert;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4587 uintptr_t n;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4588
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4589 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4590 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4591 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4592
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4593 if (cert.len == 0) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4594 s->len = 0;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4595 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4596 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4597
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4598 n = ngx_escape_uri(NULL, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4599
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4600 s->len = cert.len + n * 2;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4601 s->data = ngx_pnalloc(pool, s->len);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4602 if (s->data == NULL) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4603 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4604 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4605
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4606 ngx_escape_uri(s->data, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4607
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4608 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4609 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4610
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4611
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents: 7087
diff changeset
4612 ngx_int_t
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4613 ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4614 {
6780
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4615 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4616 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4617 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4618
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4619 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4620
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4621 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4622 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4623 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4624 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4625
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4626 name = X509_get_subject_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4627 if (name == NULL) {
7484
65074e13f171 SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn.
Nikolay Morozov <n.morozov@securitycode.ru>
parents: 7477
diff changeset
4628 X509_free(cert);
6780
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4629 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4630 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4631
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4632 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4633 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4634 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4635 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4636 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4637
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4638 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4639 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4640 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4641
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4642 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4643 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4644 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4645 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4646 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4647
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4648 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4649
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4650 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4651 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4652
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4653 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4654
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4655 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4656
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4657 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4658 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4659
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4660 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4661 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4662
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4663
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4664 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4665 ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4666 {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4667 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4668 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4669 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4670
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4671 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4672
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4673 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4674 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4675 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4676 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4677
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4678 name = X509_get_issuer_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4679 if (name == NULL) {
7484
65074e13f171 SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn.
Nikolay Morozov <n.morozov@securitycode.ru>
parents: 7477
diff changeset
4680 X509_free(cert);
6780
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4681 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4682 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4683
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4684 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4685 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4686 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4687 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4688 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4689
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4690 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4691 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4692 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4693
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4694 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4695 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4696 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4697 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4698 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4699
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4700 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4701
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4702 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4703 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4704
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4705 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4706
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4707 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4708
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4709 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4710 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4711
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4712 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4713 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4714
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4715
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4716 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4717 ngx_ssl_get_subject_dn_legacy(ngx_connection_t *c, ngx_pool_t *pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4718 ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4719 {
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4720 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4721 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4722 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4723 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4724
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4725 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4726
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4727 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4728 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4729 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4730 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4731
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4732 name = X509_get_subject_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4733 if (name == NULL) {
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4734 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4735 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4736 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4737
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4738 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4739
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4740 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4741
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4742 s->len = len;
2049
2a92804f4109 *) back out r2040
Igor Sysoev <igor@sysoev.ru>
parents: 2045
diff changeset
4743 s->data = ngx_pnalloc(pool, len);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4744 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4745 OPENSSL_free(p);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4746 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4747 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4748 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4749
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4750 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4751
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4752 OPENSSL_free(p);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4753 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4754
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4755 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4756 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4757
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4758
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4759 ngx_int_t
6780
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4760 ngx_ssl_get_issuer_dn_legacy(ngx_connection_t *c, ngx_pool_t *pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents: 6775
diff changeset
4761 ngx_str_t *s)
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4762 {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4763 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4764 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4765 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4766 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4767
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4768 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4769
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4770 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4771 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4772 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4773 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4774
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4775 name = X509_get_issuer_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4776 if (name == NULL) {
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4777 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4778 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4779 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4780
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4781 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4782
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4783 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4784
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4785 s->len = len;
2049
2a92804f4109 *) back out r2040
Igor Sysoev <igor@sysoev.ru>
parents: 2045
diff changeset
4786 s->data = ngx_pnalloc(pool, len);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4787 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4788 OPENSSL_free(p);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4789 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4790 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4791 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4792
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4793 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4794
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4795 OPENSSL_free(p);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4796 X509_free(cert);
647
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4797
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4798 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4799 }
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4800
95d7da23ea53 nginx-0.3.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 611
diff changeset
4801
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4802 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4803 ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4804 {
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4805 size_t len;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4806 X509 *cert;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4807 BIO *bio;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4808
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4809 s->len = 0;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4810
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4811 cert = SSL_get_peer_certificate(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4812 if (cert == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4813 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4814 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4815
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4816 bio = BIO_new(BIO_s_mem());
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4817 if (bio == NULL) {
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4818 X509_free(cert);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4819 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4820 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4821
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4822 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4823 len = BIO_pending(bio);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4824
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4825 s->len = len;
2049
2a92804f4109 *) back out r2040
Igor Sysoev <igor@sysoev.ru>
parents: 2045
diff changeset
4826 s->data = ngx_pnalloc(pool, len);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4827 if (s->data == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4828 BIO_free(bio);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4829 X509_free(cert);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4830 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4831 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4832
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4833 BIO_read(bio, s->data, len);
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4834 BIO_free(bio);
1974
f32cc6df6bd6 fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents: 1948
diff changeset
4835 X509_free(cert);
671
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4836
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4837 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4838 }
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4839
cec32b3753ac nginx-0.3.57-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 647
diff changeset
4840
2994
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4841 ngx_int_t
5700
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4842 ngx_ssl_get_fingerprint(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4843 {
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4844 X509 *cert;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4845 unsigned int len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4846 u_char buf[EVP_MAX_MD_SIZE];
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4847
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4848 s->len = 0;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4849
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4850 cert = SSL_get_peer_certificate(c->ssl->connection);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4851 if (cert == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4852 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4853 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4854
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4855 if (!X509_digest(cert, EVP_sha1(), buf, &len)) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4856 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4857 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4858 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4859
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4860 s->len = 2 * len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4861 s->data = ngx_pnalloc(pool, 2 * len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4862 if (s->data == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4863 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4864 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4865 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4866
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4867 ngx_hex_dump(s->data, buf, len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4868
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4869 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4870
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4871 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4872 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4873
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4874
5e892d40e5cc SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents: 5669
diff changeset
4875 ngx_int_t
2994
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4876 ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4877 {
6814
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4878 X509 *cert;
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4879 long rc;
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4880 const char *str;
2994
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4881
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4882 cert = SSL_get_peer_certificate(c->ssl->connection);
6814
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4883 if (cert == NULL) {
3516
dd1570b6f237 ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents: 3488
diff changeset
4884 ngx_str_set(s, "NONE");
6814
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4885 return NGX_OK;
2994
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4886 }
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4887
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4888 X509_free(cert);
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4889
6814
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4890 rc = SSL_get_verify_result(c->ssl->connection);
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4891
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4892 if (rc == X509_V_OK) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4893 ngx_str_set(s, "SUCCESS");
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4894 return NGX_OK;
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4895 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4896
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4897 str = X509_verify_cert_error_string(rc);
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4898
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4899 s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str));
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4900 if (s->data == NULL) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4901 return NGX_ERROR;
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4902 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4903
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4904 s->len = ngx_sprintf(s->data, "FAILED:%s", str) - s->data;
379139020d36 SSL: $ssl_client_verify extended with a failure reason.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6812
diff changeset
4905
2994
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4906 return NGX_OK;
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4907 }
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4908
f33c48457d0c *) $ssl_client_verify
Igor Sysoev <igor@sysoev.ru>
parents: 2912
diff changeset
4909
6815
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4910 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4911 ngx_ssl_get_client_v_start(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4912 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4913 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4914 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4915 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4916
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4917 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4918
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4919 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4920 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4921 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4922 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4923
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4924 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4925 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4926 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4927 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4928 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4929
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4930 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4931 ASN1_TIME_print(bio, X509_get0_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4932 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4933 ASN1_TIME_print(bio, X509_get_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4934 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4935
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4936 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4937
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4938 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4939 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4940 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4941 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4942 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4943 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4944 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4945
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4946 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4947 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4948 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4949
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4950 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4951 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4952
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4953
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4954 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4955 ngx_ssl_get_client_v_end(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4956 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4957 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4958 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4959 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4960
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4961 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4962
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4963 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4964 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4965 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4966 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4967
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4968 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4969 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4970 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4971 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4972 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4973
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4974 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4975 ASN1_TIME_print(bio, X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4976 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4977 ASN1_TIME_print(bio, X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4978 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4979
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4980 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4981
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4982 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4983 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4984 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4985 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4986 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4987 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4988 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4989
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4990 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4991 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4992 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4993
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4994 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4995 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4996
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4997
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4998 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
4999 ngx_ssl_get_client_v_remain(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5000 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5001 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5002 time_t now, end;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5003
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5004 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5005
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5006 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5007 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5008 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5009 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5010
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5011 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5012 end = ngx_ssl_parse_time(X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5013 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5014 end = ngx_ssl_parse_time(X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5015 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5016
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5017 if (end == (time_t) NGX_ERROR) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5018 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5019 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5020 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5021
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5022 now = ngx_time();
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5023
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5024 if (end < now + 86400) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5025 ngx_str_set(s, "0");
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5026 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5027 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5028 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5029
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5030 s->data = ngx_pnalloc(pool, NGX_TIME_T_LEN);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5031 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5032 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5033 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5034 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5035
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5036 s->len = ngx_sprintf(s->data, "%T", (end - now) / 86400) - s->data;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5037
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5038 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5039
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5040 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5041 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5042
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5043
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5044 static time_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5045 ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5046 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5047 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5048 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5049 ASN1_TIME *asn1time)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5050 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5051 BIO *bio;
6842
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6841
diff changeset
5052 char *value;
6815
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5053 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5054 time_t time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5055
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5056 /*
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5057 * OpenSSL doesn't provide a way to convert ASN1_TIME
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5058 * into time_t. To do this, we use ASN1_TIME_print(),
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5059 * which uses the "MMM DD HH:MM:SS YYYY [GMT]" format (e.g.,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5060 * "Feb 3 00:55:52 2015 GMT"), and parse the result.
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5061 */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5062
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5063 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5064 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5065 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5066 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5067
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5068 /* fake weekday prepended to match C asctime() format */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5069
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5070 BIO_write(bio, "Tue ", sizeof("Tue ") - 1);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5071 ASN1_TIME_print(bio, asn1time);
6842
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6841
diff changeset
5072 len = BIO_get_mem_data(bio, &value);
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6841
diff changeset
5073
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6841
diff changeset
5074 time = ngx_parse_http_time((u_char *) value, len);
6815
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5075
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5076 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5077
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5078 return time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5079 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5080
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6814
diff changeset
5081
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5082 static void *
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5083 ngx_openssl_create_conf(ngx_cycle_t *cycle)
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5084 {
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5085 ngx_openssl_conf_t *oscf;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
5086
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5087 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5088 if (oscf == NULL) {
2912
c7d57b539248 return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents: 2764
diff changeset
5089 return NULL;
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5090 }
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
5091
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5092 /*
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5093 * set by ngx_pcalloc():
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
5094 *
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5095 * oscf->engine = 0;
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
5096 */
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5097
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5098 return oscf;
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5099 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5100
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5101
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5102 static char *
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5103 ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5104 {
5777
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5105 #ifndef OPENSSL_NO_ENGINE
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5106
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5107 ngx_openssl_conf_t *oscf = conf;
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5108
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5109 ENGINE *engine;
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5110 ngx_str_t *value;
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5111
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5112 if (oscf->engine) {
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5113 return "is duplicate";
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5114 }
577
4d9ea73a627a nginx-0.3.10-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 571
diff changeset
5115
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5116 oscf->engine = 1;
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5117
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5118 value = cf->args->elts;
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5119
6552
addd98357629 SSL: style.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6551
diff changeset
5120 engine = ENGINE_by_id((char *) value[1].data);
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5121
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5122 if (engine == NULL) {
6699
9cf2dce316e5 Fixed log levels of configuration parsing errors.
Valentin Bartenev <vbart@nginx.com>
parents: 6687
diff changeset
5123 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5124 "ENGINE_by_id(\"%V\") failed", &value[1]);
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5125 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5126 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5127
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5128 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
6699
9cf2dce316e5 Fixed log levels of configuration parsing errors.
Valentin Bartenev <vbart@nginx.com>
parents: 6687
diff changeset
5129 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5130 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5131 &value[1]);
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5132
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5133 ENGINE_free(engine);
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5134
541
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5135 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5136 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5137
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5138 ENGINE_free(engine);
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5139
b09ee85d0ac8 nginx-0.1.45-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 539
diff changeset
5140 return NGX_CONF_OK;
5777
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5141
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5142 #else
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5143
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5144 return "is not supported";
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5145
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5146 #endif
2504
9e9a985d956a load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents: 2388
diff changeset
5147 }
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5148
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5149
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5150 static void
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5151 ngx_openssl_exit(ngx_cycle_t *cycle)
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5152 {
6488
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
5153 #if OPENSSL_VERSION_NUMBER < 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
5154
3464
7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents: 3457
diff changeset
5155 EVP_cleanup();
5777
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5156 #ifndef OPENSSL_NO_ENGINE
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5157 ENGINE_cleanup();
5777
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.
Piotr Sikora <piotr@cloudflare.com>
parents: 5775
diff changeset
5158 #endif
6488
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
5159
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 6487
diff changeset
5160 #endif
571
458b6c3fea65 nginx-0.3.7-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 563
diff changeset
5161 }