Mercurial > hg > nginx

annotate src/stream/ngx_stream_ssl_module.c @ 6693:3908156a51fa

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Stream: phases.
author Roman Arutyunyan <arut@nginx.com>
date Thu, 15 Sep 2016 14:55:54 +0300
parents 85e7bcb37d6b
children ea93c7d8752a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2 /*
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
3 * Copyright (C) Igor Sysoev
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
4 * Copyright (C) Nginx, Inc.
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
5 */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 #include <ngx_config.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 #include <ngx_core.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 #include <ngx_stream.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
14 ngx_pool_t *pool, ngx_str_t *s);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
15
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
16
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
6553
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6550
diff changeset
18 #define NGX_DEFAULT_ECDH_CURVE "auto"
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
21 static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
22 static ngx_int_t ngx_stream_ssl_init_connection(ngx_ssl_t *ssl,
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
23 ngx_connection_t *c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
24 static void ngx_stream_ssl_handshake_handler(ngx_connection_t *c);
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
25 static ngx_int_t ngx_stream_ssl_static_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
26 ngx_stream_variable_value_t *v, uintptr_t data);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
27 static ngx_int_t ngx_stream_ssl_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
28 ngx_stream_variable_value_t *v, uintptr_t data);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
29
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
30 static ngx_int_t ngx_stream_ssl_add_variables(ngx_conf_t *cf);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 static void *ngx_stream_ssl_create_conf(ngx_conf_t *cf);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 static char *ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33 void *child);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 static char *ngx_stream_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 void *conf);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 static char *ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 void *conf);
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
39 static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 static ngx_conf_bitmask_t ngx_stream_ssl_protocols[] = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 { ngx_string("SSLv2"), NGX_SSL_SSLv2 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44 { ngx_string("SSLv3"), NGX_SSL_SSLv3 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 { ngx_null_string, 0 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52 static ngx_command_t ngx_stream_ssl_commands[] = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54 { ngx_string("ssl_handshake_timeout"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56 ngx_conf_set_msec_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 offsetof(ngx_stream_ssl_conf_t, handshake_timeout),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 { ngx_string("ssl_certificate"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
63 ngx_conf_set_str_array_slot,
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 NGX_STREAM_SRV_CONF_OFFSET,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
65 offsetof(ngx_stream_ssl_conf_t, certificates),
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 { ngx_string("ssl_certificate_key"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
70 ngx_conf_set_str_array_slot,
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 NGX_STREAM_SRV_CONF_OFFSET,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
72 offsetof(ngx_stream_ssl_conf_t, certificate_keys),
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 { ngx_string("ssl_password_file"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ngx_stream_ssl_password_file,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 { ngx_string("ssl_dhparam"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 offsetof(ngx_stream_ssl_conf_t, dhparam),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 { ngx_string("ssl_ecdh_curve"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 offsetof(ngx_stream_ssl_conf_t, ecdh_curve),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 { ngx_string("ssl_protocols"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_1MORE,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 ngx_conf_set_bitmask_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 offsetof(ngx_stream_ssl_conf_t, protocols),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 &ngx_stream_ssl_protocols },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103 { ngx_string("ssl_ciphers"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 offsetof(ngx_stream_ssl_conf_t, ciphers),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 { ngx_string("ssl_prefer_server_ciphers"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112 ngx_conf_set_flag_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 offsetof(ngx_stream_ssl_conf_t, prefer_server_ciphers),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 { ngx_string("ssl_session_cache"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE12,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 ngx_stream_ssl_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 { ngx_string("ssl_session_tickets"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 ngx_conf_set_flag_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 offsetof(ngx_stream_ssl_conf_t, session_tickets),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 { ngx_string("ssl_session_ticket_key"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 ngx_conf_set_str_array_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 offsetof(ngx_stream_ssl_conf_t, session_ticket_keys),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 { ngx_string("ssl_session_timeout"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 ngx_conf_set_sec_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 offsetof(ngx_stream_ssl_conf_t, session_timeout),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 ngx_null_command
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 static ngx_stream_module_t ngx_stream_ssl_module_ctx = {
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
150 ngx_stream_ssl_add_variables, /* preconfiguration */
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
151 ngx_stream_ssl_init, /* postconfiguration */
6174
68c106e6fa0a Stream: added postconfiguration method to stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 6157
diff changeset
152
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 NULL, /* create main configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 NULL, /* init main configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 ngx_stream_ssl_create_conf, /* create server configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 ngx_stream_ssl_merge_conf /* merge server configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 ngx_module_t ngx_stream_ssl_module = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 NGX_MODULE_V1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 &ngx_stream_ssl_module_ctx, /* module context */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 ngx_stream_ssl_commands, /* module directives */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 NGX_STREAM_MODULE, /* module type */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 NULL, /* init master */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 NULL, /* init module */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 NULL, /* init process */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 NULL, /* init thread */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170 NULL, /* exit thread */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 NULL, /* exit process */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 NULL, /* exit master */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 NGX_MODULE_V1_PADDING
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
177 static ngx_stream_variable_t ngx_stream_ssl_vars[] = {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
178
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
179 { ngx_string("ssl_protocol"), NULL, ngx_stream_ssl_static_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
180 (uintptr_t) ngx_ssl_get_protocol, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
181
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
182 { ngx_string("ssl_cipher"), NULL, ngx_stream_ssl_static_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
183 (uintptr_t) ngx_ssl_get_cipher_name, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
184
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
185 { ngx_string("ssl_session_id"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
186 (uintptr_t) ngx_ssl_get_session_id, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
187
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
188 { ngx_string("ssl_session_reused"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
189 (uintptr_t) ngx_ssl_get_session_reused, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
190
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
191 { ngx_string("ssl_server_name"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
192 (uintptr_t) ngx_ssl_get_server_name, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
193
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
194 { ngx_null_string, NULL, NULL, 0, 0, 0 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
195 };
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
196
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
197
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 static ngx_str_t ngx_stream_ssl_sess_id_ctx = ngx_string("STREAM");
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
201 static ngx_int_t
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
202 ngx_stream_ssl_handler(ngx_stream_session_t *s)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
203 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
204 ngx_connection_t *c;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
205 ngx_stream_ssl_conf_t *sslcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
206
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
207 c = s->connection;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
208
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
209 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
210
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
211 if (s->ssl && c->ssl == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
212 c->log->action = "SSL handshaking";
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
213
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
214 if (sslcf->ssl.ctx == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
215 ngx_log_error(NGX_LOG_ERR, c->log, 0,
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
216 "no \"ssl_certificate\" is defined "
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
217 "in server listening on SSL port");
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
218 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
219 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
220
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
221 return ngx_stream_ssl_init_connection(&sslcf->ssl, c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
222 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
223
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
224 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
225 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
226
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
227
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
228 static ngx_int_t
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
229 ngx_stream_ssl_init_connection(ngx_ssl_t *ssl, ngx_connection_t *c)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
230 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
231 ngx_int_t rc;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
232 ngx_stream_session_t *s;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
233 ngx_stream_ssl_conf_t *sslcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
234
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
235 s = c->data;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
236
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
237 if (ngx_ssl_create_connection(ssl, c, 0) == NGX_ERROR) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
238 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
239 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
240
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
241 rc = ngx_ssl_handshake(c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
242
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
243 if (rc == NGX_ERROR) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
244 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
245 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
246
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
247 if (rc == NGX_AGAIN) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
248 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
249
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
250 ngx_add_timer(c->read, sslcf->handshake_timeout);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
251
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
252 c->ssl->handler = ngx_stream_ssl_handshake_handler;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
253
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
254 return NGX_AGAIN;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
255 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
256
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
257 /* rc == NGX_OK */
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
258
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
259 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
260 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
261
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
262
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
263 static void
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
264 ngx_stream_ssl_handshake_handler(ngx_connection_t *c)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
265 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
266 ngx_stream_session_t *s;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
267
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
268 s = c->data;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
269
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
270 if (!c->ssl->handshaked) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
271 ngx_stream_finalize_session(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
272 return;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
273 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
274
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
275 if (c->read->timer_set) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
276 ngx_del_timer(c->read);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
277 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
278
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
279 ngx_stream_core_run_phases(s);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
280 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
281
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
282
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
283 static ngx_int_t
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
284 ngx_stream_ssl_static_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
285 ngx_stream_variable_value_t *v, uintptr_t data)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
286 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
287 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
288
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
289 size_t len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
290 ngx_str_t str;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
291
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
292 if (s->connection->ssl) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
293
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
294 (void) handler(s->connection, NULL, &str);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
295
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
296 v->data = str.data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
297
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
298 for (len = 0; v->data[len]; len++) { /* void */ }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
299
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
300 v->len = len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
301 v->valid = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
302 v->no_cacheable = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
303 v->not_found = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
304
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
305 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
306 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
307
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
308 v->not_found = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
309
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
310 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
311 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
312
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
313
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
314 static ngx_int_t
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
315 ngx_stream_ssl_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
316 ngx_stream_variable_value_t *v, uintptr_t data)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
317 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
318 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
319
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
320 ngx_str_t str;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
321
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
322 if (s->connection->ssl) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
323
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
324 if (handler(s->connection, s->connection->pool, &str) != NGX_OK) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
325 return NGX_ERROR;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
326 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
327
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
328 v->len = str.len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
329 v->data = str.data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
330
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
331 if (v->len) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
332 v->valid = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
333 v->no_cacheable = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
334 v->not_found = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
335
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
336 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
337 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
338 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
339
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
340 v->not_found = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
341
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
342 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
343 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
344
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
345
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
346 static ngx_int_t
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
347 ngx_stream_ssl_add_variables(ngx_conf_t *cf)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
348 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
349 ngx_stream_variable_t *var, *v;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
350
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
351 for (v = ngx_stream_ssl_vars; v->name.len; v++) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
352 var = ngx_stream_add_variable(cf, &v->name, v->flags);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
353 if (var == NULL) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
354 return NGX_ERROR;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
355 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
356
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
357 var->get_handler = v->get_handler;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
358 var->data = v->data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
359 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
360
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
361 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
362 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
363
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
364
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 static void *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366 ngx_stream_ssl_create_conf(ngx_conf_t *cf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 ngx_stream_ssl_conf_t *scf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 scf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_ssl_conf_t));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371 if (scf == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 return NULL;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 /*
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 * set by ngx_pcalloc():
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 * scf->protocols = 0;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 * scf->dhparam = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 * scf->ecdh_curve = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 * scf->ciphers = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 * scf->shm_zone = NULL;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 scf->handshake_timeout = NGX_CONF_UNSET_MSEC;
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
386 scf->certificates = NGX_CONF_UNSET_PTR;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
387 scf->certificate_keys = NGX_CONF_UNSET_PTR;
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 scf->passwords = NGX_CONF_UNSET_PTR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 scf->prefer_server_ciphers = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 scf->builtin_session_cache = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 scf->session_timeout = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392 scf->session_tickets = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 scf->session_ticket_keys = NGX_CONF_UNSET_PTR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 return scf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402 ngx_stream_ssl_conf_t *prev = parent;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 ngx_stream_ssl_conf_t *conf = child;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 ngx_pool_cleanup_t *cln;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 ngx_conf_merge_msec_value(conf->handshake_timeout,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 prev->handshake_timeout, 60000);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 ngx_conf_merge_value(conf->session_timeout,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 prev->session_timeout, 300);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 ngx_conf_merge_value(conf->prefer_server_ciphers,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 prev->prefer_server_ciphers, 0);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
6157
b2899e7d0ef8 Disabled SSLv3 by default (ticket #653).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6115
diff changeset
417 (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
420 ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL);
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
421 ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys,
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
422 NULL);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, "");
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 NGX_DEFAULT_ECDH_CURVE);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434 conf->ssl.log = cf->log;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
436 if (conf->certificates == NULL) {
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
440 if (conf->certificate_keys == NULL
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
441 || conf->certificate_keys->nelts < conf->certificates->nelts)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
442 {
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 "no \"ssl_certificate_key\" is defined "
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 "for certificate \"%V\"",
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
446 ((ngx_str_t *) conf->certificates->elts)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
447 + conf->certificates->nelts - 1);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 if (ngx_ssl_create(&conf->ssl, conf->protocols, NULL) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 cln = ngx_pool_cleanup_add(cf->pool, 0);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456 if (cln == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 cln->handler = ngx_ssl_cleanup_ctx;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 cln->data = &conf->ssl;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
463 if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
464 conf->certificate_keys, conf->passwords)
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469
6591
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
470 if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
471 conf->prefer_server_ciphers)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
472 != NGX_OK)
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 ngx_conf_merge_value(conf->builtin_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 if (conf->shm_zone == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489 conf->shm_zone = prev->shm_zone;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493 conf->builtin_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494 conf->shm_zone, conf->session_timeout)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
496 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
497 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
500 ngx_conf_merge_value(conf->session_tickets,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
501 prev->session_tickets, 1);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
502
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
503 #ifdef SSL_OP_NO_TICKET
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
504 if (!conf->session_tickets) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
505 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
506 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
507 #endif
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
508
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
509 ngx_conf_merge_ptr_value(conf->session_ticket_keys,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
510 prev->session_ticket_keys, NULL);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
511
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
512 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
513 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
514 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
515 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
516 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
517
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
518 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
519 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
520
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
521
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
522 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
523 ngx_stream_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
524 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
525 ngx_stream_ssl_conf_t *scf = conf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
526
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
527 ngx_str_t *value;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
528
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
529 if (scf->passwords != NGX_CONF_UNSET_PTR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
530 return "is duplicate";
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
531 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
532
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
533 value = cf->args->elts;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
534
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
535 scf->passwords = ngx_ssl_read_password_file(cf, &value[1]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
536
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
537 if (scf->passwords == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
538 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
539 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
540
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
541 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
542 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
543
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
544
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
545 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
546 ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
547 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
548 ngx_stream_ssl_conf_t *scf = conf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
549
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
550 size_t len;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
551 ngx_str_t *value, name, size;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
552 ngx_int_t n;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
553 ngx_uint_t i, j;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
554
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
555 value = cf->args->elts;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
556
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
557 for (i = 1; i < cf->args->nelts; i++) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
558
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
559 if (ngx_strcmp(value[i].data, "off") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
560 scf->builtin_session_cache = NGX_SSL_NO_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
561 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
562 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
563
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
564 if (ngx_strcmp(value[i].data, "none") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
565 scf->builtin_session_cache = NGX_SSL_NONE_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
566 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
567 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
568
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
569 if (ngx_strcmp(value[i].data, "builtin") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
570 scf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
571 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
572 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
573
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
574 if (value[i].len > sizeof("builtin:") - 1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
575 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
576 == 0)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
577 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
578 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
579 value[i].len - (sizeof("builtin:") - 1));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
580
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
581 if (n == NGX_ERROR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
582 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
583 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
584
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
585 scf->builtin_session_cache = n;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
586
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
587 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
588 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
589
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
590 if (value[i].len > sizeof("shared:") - 1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
591 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
592 == 0)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
593 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
594 len = 0;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
595
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
596 for (j = sizeof("shared:") - 1; j < value[i].len; j++) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
597 if (value[i].data[j] == ':') {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
598 break;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
599 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
600
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
601 len++;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
602 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
603
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
604 if (len == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
605 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
606 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
607
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
608 name.len = len;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
609 name.data = value[i].data + sizeof("shared:") - 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
610
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
611 size.len = value[i].len - j - 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
612 size.data = name.data + len + 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
613
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
614 n = ngx_parse_size(&size);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
615
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
616 if (n == NGX_ERROR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
617 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
618 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
619
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
620 if (n < (ngx_int_t) (8 * ngx_pagesize)) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
621 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
622 "session cache \"%V\" is too small",
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
623 &value[i]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
624
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
625 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
626 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
627
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
628 scf->shm_zone = ngx_shared_memory_add(cf, &name, n,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
629 &ngx_stream_ssl_module);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
630 if (scf->shm_zone == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
631 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
632 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
633
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
634 scf->shm_zone->init = ngx_ssl_session_cache_init;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
635
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
636 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
637 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
638
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
639 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
640 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
641
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
642 if (scf->shm_zone && scf->builtin_session_cache == NGX_CONF_UNSET) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
643 scf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
644 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
645
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
646 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
647
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
648 invalid:
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
649
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
650 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
651 "invalid session cache \"%V\"", &value[i]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
652
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
653 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
654 }
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
655
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
656
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
657 static ngx_int_t
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
658 ngx_stream_ssl_init(ngx_conf_t *cf)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
659 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
660 ngx_stream_handler_pt *h;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
661 ngx_stream_core_main_conf_t *cmcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
662
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
663 cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
664
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
665 h = ngx_array_push(&cmcf->phases[NGX_STREAM_SSL_PHASE].handlers);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
666 if (h == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
667 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
668 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
669
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
670 *h = ngx_stream_ssl_handler;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
671
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
672 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
673 }