Mercurial > hg > nginx
annotate src/stream/ngx_stream_ssl_preread_module.c @ 7314:3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
The variable keeps the latest SSL protocol version supported by the client.
The variable has the same format as $ssl_protocol.
The version is read from the client_version field of ClientHello. If the
supported_versions extension is present in the ClientHello, then the version
is set to TLSv1.3.
| author | Roman Arutyunyan <arut@nginx.com> |
|---|---|
| date | Wed, 11 Jul 2018 17:56:51 +0300 |
| parents | 0f811890f2f0 |
| children | 6649d4433266 |
| rev | line source |
|---|---|
| 6695 | 1 |
| 2 /* | |
| 3 * Copyright (C) Nginx, Inc. | |
| 4 */ | |
| 5 | |
| 6 | |
| 7 #include <ngx_config.h> | |
| 8 #include <ngx_core.h> | |
| 9 #include <ngx_stream.h> | |
| 10 | |
| 11 | |
| 12 typedef struct { | |
| 13 ngx_flag_t enabled; | |
| 14 } ngx_stream_ssl_preread_srv_conf_t; | |
| 15 | |
| 16 | |
| 17 typedef struct { | |
| 18 size_t left; | |
| 19 size_t size; | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
20 size_t ext; |
| 6695 | 21 u_char *pos; |
| 22 u_char *dst; | |
| 23 u_char buf[4]; | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
24 u_char version[2]; |
| 6695 | 25 ngx_str_t host; |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
26 ngx_str_t alpn; |
| 6695 | 27 ngx_log_t *log; |
| 28 ngx_pool_t *pool; | |
| 29 ngx_uint_t state; | |
| 30 } ngx_stream_ssl_preread_ctx_t; | |
| 31 | |
| 32 | |
| 33 static ngx_int_t ngx_stream_ssl_preread_handler(ngx_stream_session_t *s); | |
| 34 static ngx_int_t ngx_stream_ssl_preread_parse_record( | |
| 35 ngx_stream_ssl_preread_ctx_t *ctx, u_char *pos, u_char *last); | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
36 static ngx_int_t ngx_stream_ssl_preread_protocol_variable( |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
37 ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data); |
| 6695 | 38 static ngx_int_t ngx_stream_ssl_preread_server_name_variable( |
| 39 ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data); | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
40 static ngx_int_t ngx_stream_ssl_preread_alpn_protocols_variable( |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
41 ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data); |
| 6695 | 42 static ngx_int_t ngx_stream_ssl_preread_add_variables(ngx_conf_t *cf); |
| 43 static void *ngx_stream_ssl_preread_create_srv_conf(ngx_conf_t *cf); | |
| 44 static char *ngx_stream_ssl_preread_merge_srv_conf(ngx_conf_t *cf, void *parent, | |
| 45 void *child); | |
| 46 static ngx_int_t ngx_stream_ssl_preread_init(ngx_conf_t *cf); | |
| 47 | |
| 48 | |
| 49 static ngx_command_t ngx_stream_ssl_preread_commands[] = { | |
| 50 | |
| 51 { ngx_string("ssl_preread"), | |
| 52 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG, | |
| 53 ngx_conf_set_flag_slot, | |
| 54 NGX_STREAM_SRV_CONF_OFFSET, | |
| 55 offsetof(ngx_stream_ssl_preread_srv_conf_t, enabled), | |
| 56 NULL }, | |
| 57 | |
| 58 ngx_null_command | |
| 59 }; | |
| 60 | |
| 61 | |
| 62 static ngx_stream_module_t ngx_stream_ssl_preread_module_ctx = { | |
| 63 ngx_stream_ssl_preread_add_variables, /* preconfiguration */ | |
| 64 ngx_stream_ssl_preread_init, /* postconfiguration */ | |
| 65 | |
| 66 NULL, /* create main configuration */ | |
| 67 NULL, /* init main configuration */ | |
| 68 | |
| 69 ngx_stream_ssl_preread_create_srv_conf, /* create server configuration */ | |
| 70 ngx_stream_ssl_preread_merge_srv_conf /* merge server configuration */ | |
| 71 }; | |
| 72 | |
| 73 | |
| 74 ngx_module_t ngx_stream_ssl_preread_module = { | |
| 75 NGX_MODULE_V1, | |
| 76 &ngx_stream_ssl_preread_module_ctx, /* module context */ | |
| 77 ngx_stream_ssl_preread_commands, /* module directives */ | |
| 78 NGX_STREAM_MODULE, /* module type */ | |
| 79 NULL, /* init master */ | |
| 80 NULL, /* init module */ | |
| 81 NULL, /* init process */ | |
| 82 NULL, /* init thread */ | |
| 83 NULL, /* exit thread */ | |
| 84 NULL, /* exit process */ | |
| 85 NULL, /* exit master */ | |
| 86 NGX_MODULE_V1_PADDING | |
| 87 }; | |
| 88 | |
| 89 | |
| 90 static ngx_stream_variable_t ngx_stream_ssl_preread_vars[] = { | |
| 91 | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
92 { ngx_string("ssl_preread_protocol"), NULL, |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
93 ngx_stream_ssl_preread_protocol_variable, 0, 0, 0 }, |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
94 |
| 6695 | 95 { ngx_string("ssl_preread_server_name"), NULL, |
| 96 ngx_stream_ssl_preread_server_name_variable, 0, 0, 0 }, | |
| 97 | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
98 { ngx_string("ssl_preread_alpn_protocols"), NULL, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
99 ngx_stream_ssl_preread_alpn_protocols_variable, 0, 0, 0 }, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
100 |
|
7077
2a288909abc6
Variables: macros for null variables.
Ruslan Ermilov <ru@nginx.com>
parents:
6849
diff
changeset
|
101 ngx_stream_null_variable |
| 6695 | 102 }; |
| 103 | |
| 104 | |
| 105 static ngx_int_t | |
| 106 ngx_stream_ssl_preread_handler(ngx_stream_session_t *s) | |
| 107 { | |
| 108 u_char *last, *p; | |
| 109 size_t len; | |
| 110 ngx_int_t rc; | |
| 111 ngx_connection_t *c; | |
| 112 ngx_stream_ssl_preread_ctx_t *ctx; | |
| 113 ngx_stream_ssl_preread_srv_conf_t *sscf; | |
| 114 | |
| 115 c = s->connection; | |
| 116 | |
| 117 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, c->log, 0, "ssl preread handler"); | |
| 118 | |
| 119 sscf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_preread_module); | |
| 120 | |
| 121 if (!sscf->enabled) { | |
| 122 return NGX_DECLINED; | |
| 123 } | |
| 124 | |
| 125 if (c->type != SOCK_STREAM) { | |
| 126 return NGX_DECLINED; | |
| 127 } | |
| 128 | |
| 129 if (c->buffer == NULL) { | |
| 130 return NGX_AGAIN; | |
| 131 } | |
| 132 | |
| 133 ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module); | |
| 134 if (ctx == NULL) { | |
| 135 ctx = ngx_pcalloc(c->pool, sizeof(ngx_stream_ssl_preread_ctx_t)); | |
| 136 if (ctx == NULL) { | |
| 137 return NGX_ERROR; | |
| 138 } | |
| 139 | |
| 140 ngx_stream_set_ctx(s, ctx, ngx_stream_ssl_preread_module); | |
| 141 | |
| 142 ctx->pool = c->pool; | |
| 143 ctx->log = c->log; | |
| 144 ctx->pos = c->buffer->pos; | |
| 145 } | |
| 146 | |
| 147 p = ctx->pos; | |
| 148 last = c->buffer->last; | |
| 149 | |
| 150 while (last - p >= 5) { | |
| 151 | |
| 152 if (p[0] != 0x16) { | |
|
6696
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
153 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
154 "ssl preread: not a handshake"); |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
155 ngx_stream_set_ctx(s, NULL, ngx_stream_ssl_preread_module); |
| 6695 | 156 return NGX_DECLINED; |
| 157 } | |
| 158 | |
|
6849
01adb18a5d23
Stream ssl_preread: relaxed SSL version check.
Roman Arutyunyan <arut@nginx.com>
parents:
6728
diff
changeset
|
159 if (p[1] != 3) { |
|
6696
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
160 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
161 "ssl preread: unsupported SSL version"); |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
162 ngx_stream_set_ctx(s, NULL, ngx_stream_ssl_preread_module); |
| 6695 | 163 return NGX_DECLINED; |
| 164 } | |
| 165 | |
| 166 len = (p[3] << 8) + p[4]; | |
| 167 | |
| 168 /* read the whole record before parsing */ | |
| 169 if ((size_t) (last - p) < len + 5) { | |
| 170 break; | |
| 171 } | |
| 172 | |
| 173 p += 5; | |
| 174 | |
| 175 rc = ngx_stream_ssl_preread_parse_record(ctx, p, p + len); | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
176 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
177 if (rc == NGX_DECLINED) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
178 ngx_stream_set_ctx(s, NULL, ngx_stream_ssl_preread_module); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
179 return NGX_DECLINED; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
180 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
181 |
| 6695 | 182 if (rc != NGX_AGAIN) { |
| 183 return rc; | |
| 184 } | |
| 185 | |
| 186 p += len; | |
| 187 } | |
| 188 | |
| 189 ctx->pos = p; | |
| 190 | |
| 191 return NGX_AGAIN; | |
| 192 } | |
| 193 | |
| 194 | |
| 195 static ngx_int_t | |
| 196 ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx, | |
| 197 u_char *pos, u_char *last) | |
| 198 { | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
199 size_t left, n, size, ext; |
| 6695 | 200 u_char *dst, *p; |
| 201 | |
| 202 enum { | |
| 203 sw_start = 0, | |
| 204 sw_header, /* handshake msg_type, length */ | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
205 sw_version, /* client_version */ |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
206 sw_random, /* random */ |
| 6695 | 207 sw_sid_len, /* session_id length */ |
| 208 sw_sid, /* session_id */ | |
| 209 sw_cs_len, /* cipher_suites length */ | |
| 210 sw_cs, /* cipher_suites */ | |
| 211 sw_cm_len, /* compression_methods length */ | |
| 212 sw_cm, /* compression_methods */ | |
| 213 sw_ext, /* extension */ | |
| 214 sw_ext_header, /* extension_type, extension_data length */ | |
| 215 sw_sni_len, /* SNI length */ | |
| 216 sw_sni_host_head, /* SNI name_type, host_name length */ | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
217 sw_sni_host, /* SNI host_name */ |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
218 sw_alpn_len, /* ALPN length */ |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
219 sw_alpn_proto_len, /* ALPN protocol_name length */ |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
220 sw_alpn_proto_data, /* ALPN protocol_name */ |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
221 sw_supver_len /* supported_versions length */ |
| 6695 | 222 } state; |
| 223 | |
| 224 ngx_log_debug2(NGX_LOG_DEBUG_STREAM, ctx->log, 0, | |
| 225 "ssl preread: state %ui left %z", ctx->state, ctx->left); | |
| 226 | |
| 227 state = ctx->state; | |
| 228 size = ctx->size; | |
| 229 left = ctx->left; | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
230 ext = ctx->ext; |
| 6695 | 231 dst = ctx->dst; |
| 232 p = ctx->buf; | |
| 233 | |
| 234 for ( ;; ) { | |
| 235 n = ngx_min((size_t) (last - pos), size); | |
| 236 | |
| 237 if (dst) { | |
| 238 dst = ngx_cpymem(dst, pos, n); | |
| 239 } | |
| 240 | |
| 241 pos += n; | |
| 242 size -= n; | |
| 243 left -= n; | |
| 244 | |
| 245 if (size != 0) { | |
| 246 break; | |
| 247 } | |
| 248 | |
| 249 switch (state) { | |
| 250 | |
| 251 case sw_start: | |
| 252 state = sw_header; | |
| 253 dst = p; | |
| 254 size = 4; | |
| 255 left = size; | |
| 256 break; | |
| 257 | |
| 258 case sw_header: | |
| 259 if (p[0] != 1) { | |
|
6696
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
260 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
e83540f825cd
Stream ssl_preread: removed internal macro.
Vladimir Homutov <vl@nginx.com>
parents:
6695
diff
changeset
|
261 "ssl preread: not a client hello"); |
| 6695 | 262 return NGX_DECLINED; |
| 263 } | |
| 264 | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
265 state = sw_version; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
266 dst = ctx->version; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
267 size = 2; |
| 6695 | 268 left = (p[1] << 16) + (p[2] << 8) + p[3]; |
| 269 break; | |
| 270 | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
271 case sw_version: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
272 state = sw_random; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
273 dst = NULL; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
274 size = 32; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
275 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
276 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
277 case sw_random: |
| 6695 | 278 state = sw_sid_len; |
| 279 dst = p; | |
| 280 size = 1; | |
| 281 break; | |
| 282 | |
| 283 case sw_sid_len: | |
| 284 state = sw_sid; | |
| 285 dst = NULL; | |
| 286 size = p[0]; | |
| 287 break; | |
| 288 | |
| 289 case sw_sid: | |
| 290 state = sw_cs_len; | |
| 291 dst = p; | |
| 292 size = 2; | |
| 293 break; | |
| 294 | |
| 295 case sw_cs_len: | |
| 296 state = sw_cs; | |
| 297 dst = NULL; | |
| 298 size = (p[0] << 8) + p[1]; | |
| 299 break; | |
| 300 | |
| 301 case sw_cs: | |
| 302 state = sw_cm_len; | |
| 303 dst = p; | |
| 304 size = 1; | |
| 305 break; | |
| 306 | |
| 307 case sw_cm_len: | |
| 308 state = sw_cm; | |
| 309 dst = NULL; | |
| 310 size = p[0]; | |
| 311 break; | |
| 312 | |
| 313 case sw_cm: | |
| 314 if (left == 0) { | |
| 315 /* no extensions */ | |
| 316 return NGX_OK; | |
| 317 } | |
| 318 | |
| 319 state = sw_ext; | |
| 320 dst = p; | |
| 321 size = 2; | |
| 322 break; | |
| 323 | |
| 324 case sw_ext: | |
| 325 if (left == 0) { | |
| 326 return NGX_OK; | |
| 327 } | |
| 328 | |
| 329 state = sw_ext_header; | |
| 330 dst = p; | |
| 331 size = 4; | |
| 332 break; | |
| 333 | |
| 334 case sw_ext_header: | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
335 if (p[0] == 0 && p[1] == 0 && ctx->host.data == NULL) { |
| 6695 | 336 /* SNI extension */ |
| 337 state = sw_sni_len; | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
338 dst = p; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
339 size = 2; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
340 break; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
341 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
342 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
343 if (p[0] == 0 && p[1] == 16 && ctx->alpn.data == NULL) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
344 /* ALPN extension */ |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
345 state = sw_alpn_len; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
346 dst = p; |
| 6695 | 347 size = 2; |
| 348 break; | |
| 349 } | |
| 350 | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
351 if (p[0] == 0 && p[1] == 43) { |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
352 /* supported_versions extension */ |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
353 state = sw_supver_len; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
354 dst = p; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
355 size = 1; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
356 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
357 } |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
358 |
| 6695 | 359 state = sw_ext; |
| 360 dst = NULL; | |
| 361 size = (p[2] << 8) + p[3]; | |
| 362 break; | |
| 363 | |
| 364 case sw_sni_len: | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
365 ext = (p[0] << 8) + p[1]; |
| 6695 | 366 state = sw_sni_host_head; |
| 367 dst = p; | |
| 368 size = 3; | |
| 369 break; | |
| 370 | |
| 371 case sw_sni_host_head: | |
| 372 if (p[0] != 0) { | |
| 373 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, | |
| 374 "ssl preread: SNI hostname type is not DNS"); | |
| 375 return NGX_DECLINED; | |
| 376 } | |
| 377 | |
| 378 size = (p[1] << 8) + p[2]; | |
| 379 | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
380 if (ext < 3 + size) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
381 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
382 "ssl preread: SNI format error"); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
383 return NGX_DECLINED; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
384 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
385 ext -= 3 + size; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
386 |
| 6695 | 387 ctx->host.data = ngx_pnalloc(ctx->pool, size); |
| 388 if (ctx->host.data == NULL) { | |
| 389 return NGX_ERROR; | |
| 390 } | |
| 391 | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
392 state = sw_sni_host; |
| 6695 | 393 dst = ctx->host.data; |
| 394 break; | |
| 395 | |
| 396 case sw_sni_host: | |
|
6728
8f75d9883730
Stream ssl_preread: fixed $ssl_preread_server_name variable.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6696
diff
changeset
|
397 ctx->host.len = (p[1] << 8) + p[2]; |
|
8f75d9883730
Stream ssl_preread: fixed $ssl_preread_server_name variable.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6696
diff
changeset
|
398 |
| 6695 | 399 ngx_log_debug1(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
| 400 "ssl preread: SNI hostname \"%V\"", &ctx->host); | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
401 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
402 state = sw_ext; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
403 dst = NULL; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
404 size = ext; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
405 break; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
406 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
407 case sw_alpn_len: |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
408 ext = (p[0] << 8) + p[1]; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
409 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
410 ctx->alpn.data = ngx_pnalloc(ctx->pool, ext); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
411 if (ctx->alpn.data == NULL) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
412 return NGX_ERROR; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
413 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
414 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
415 state = sw_alpn_proto_len; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
416 dst = p; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
417 size = 1; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
418 break; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
419 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
420 case sw_alpn_proto_len: |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
421 size = p[0]; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
422 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
423 if (size == 0) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
424 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
425 "ssl preread: ALPN empty protocol"); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
426 return NGX_DECLINED; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
427 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
428 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
429 if (ext < 1 + size) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
430 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
431 "ssl preread: ALPN format error"); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
432 return NGX_DECLINED; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
433 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
434 ext -= 1 + size; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
435 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
436 state = sw_alpn_proto_data; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
437 dst = ctx->alpn.data + ctx->alpn.len; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
438 break; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
439 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
440 case sw_alpn_proto_data: |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
441 ctx->alpn.len += p[0]; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
442 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
443 ngx_log_debug1(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
444 "ssl preread: ALPN protocols \"%V\"", &ctx->alpn); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
445 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
446 if (ext) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
447 ctx->alpn.data[ctx->alpn.len++] = ','; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
448 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
449 state = sw_alpn_proto_len; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
450 dst = p; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
451 size = 1; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
452 break; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
453 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
454 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
455 state = sw_ext; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
456 dst = NULL; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
457 size = 0; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
458 break; |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
459 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
460 case sw_supver_len: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
461 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
462 "ssl preread: supported_versions"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
463 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
464 /* set TLSv1.3 */ |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
465 ctx->version[0] = 3; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
466 ctx->version[1] = 4; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
467 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
468 state = sw_ext; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
469 dst = NULL; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
470 size = p[0]; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
471 break; |
| 6695 | 472 } |
| 473 | |
| 474 if (left < size) { | |
| 7228 | 475 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0, |
| 476 "ssl preread: failed to parse handshake"); | |
| 477 return NGX_DECLINED; | |
| 6695 | 478 } |
| 479 } | |
| 480 | |
| 481 ctx->state = state; | |
| 482 ctx->size = size; | |
| 483 ctx->left = left; | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
484 ctx->ext = ext; |
| 6695 | 485 ctx->dst = dst; |
| 486 | |
| 487 return NGX_AGAIN; | |
| 488 } | |
| 489 | |
| 490 | |
| 491 static ngx_int_t | |
|
7314
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
492 ngx_stream_ssl_preread_protocol_variable(ngx_stream_session_t *s, |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
493 ngx_variable_value_t *v, uintptr_t data) |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
494 { |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
495 ngx_str_t version; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
496 ngx_stream_ssl_preread_ctx_t *ctx; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
497 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
498 ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
499 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
500 if (ctx == NULL) { |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
501 v->not_found = 1; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
502 return NGX_OK; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
503 } |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
504 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
505 /* SSL_get_version() format */ |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
506 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
507 ngx_str_null(&version); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
508 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
509 switch (ctx->version[0]) { |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
510 case 2: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
511 ngx_str_set(&version, "SSLv2"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
512 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
513 case 3: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
514 switch (ctx->version[1]) { |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
515 case 0: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
516 ngx_str_set(&version, "SSLv3"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
517 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
518 case 1: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
519 ngx_str_set(&version, "TLSv1"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
520 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
521 case 2: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
522 ngx_str_set(&version, "TLSv1.1"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
523 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
524 case 3: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
525 ngx_str_set(&version, "TLSv1.2"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
526 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
527 case 4: |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
528 ngx_str_set(&version, "TLSv1.3"); |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
529 break; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
530 } |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
531 } |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
532 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
533 v->valid = 1; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
534 v->no_cacheable = 0; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
535 v->not_found = 0; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
536 v->len = version.len; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
537 v->data = version.data; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
538 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
539 return NGX_OK; |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
540 } |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
541 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
542 |
|
3dfc1584ad75
Stream ssl_preread: $ssl_preread_protocol variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7228
diff
changeset
|
543 static ngx_int_t |
| 6695 | 544 ngx_stream_ssl_preread_server_name_variable(ngx_stream_session_t *s, |
| 545 ngx_variable_value_t *v, uintptr_t data) | |
| 546 { | |
| 547 ngx_stream_ssl_preread_ctx_t *ctx; | |
| 548 | |
| 549 ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module); | |
| 550 | |
| 551 if (ctx == NULL) { | |
| 552 v->not_found = 1; | |
| 553 return NGX_OK; | |
| 554 } | |
| 555 | |
| 556 v->valid = 1; | |
| 557 v->no_cacheable = 0; | |
| 558 v->not_found = 0; | |
| 559 v->len = ctx->host.len; | |
| 560 v->data = ctx->host.data; | |
| 561 | |
| 562 return NGX_OK; | |
| 563 } | |
| 564 | |
| 565 | |
| 566 static ngx_int_t | |
|
7227
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
567 ngx_stream_ssl_preread_alpn_protocols_variable(ngx_stream_session_t *s, |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
568 ngx_variable_value_t *v, uintptr_t data) |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
569 { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
570 ngx_stream_ssl_preread_ctx_t *ctx; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
571 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
572 ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module); |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
573 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
574 if (ctx == NULL) { |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
575 v->not_found = 1; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
576 return NGX_OK; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
577 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
578 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
579 v->valid = 1; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
580 v->no_cacheable = 0; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
581 v->not_found = 0; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
582 v->len = ctx->alpn.len; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
583 v->data = ctx->alpn.data; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
584 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
585 return NGX_OK; |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
586 } |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
587 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
588 |
|
79eb4f7b6725
Stream ssl_preread: $ssl_preread_alpn_protocols variable.
Roman Arutyunyan <arut@nginx.com>
parents:
7077
diff
changeset
|
589 static ngx_int_t |
| 6695 | 590 ngx_stream_ssl_preread_add_variables(ngx_conf_t *cf) |
| 591 { | |
| 592 ngx_stream_variable_t *var, *v; | |
| 593 | |
| 594 for (v = ngx_stream_ssl_preread_vars; v->name.len; v++) { | |
| 595 var = ngx_stream_add_variable(cf, &v->name, v->flags); | |
| 596 if (var == NULL) { | |
| 597 return NGX_ERROR; | |
| 598 } | |
| 599 | |
| 600 var->get_handler = v->get_handler; | |
| 601 var->data = v->data; | |
| 602 } | |
| 603 | |
| 604 return NGX_OK; | |
| 605 } | |
| 606 | |
| 607 | |
| 608 static void * | |
| 609 ngx_stream_ssl_preread_create_srv_conf(ngx_conf_t *cf) | |
| 610 { | |
| 611 ngx_stream_ssl_preread_srv_conf_t *conf; | |
| 612 | |
| 613 conf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_ssl_preread_srv_conf_t)); | |
| 614 if (conf == NULL) { | |
| 615 return NULL; | |
| 616 } | |
| 617 | |
| 618 conf->enabled = NGX_CONF_UNSET; | |
| 619 | |
| 620 return conf; | |
| 621 } | |
| 622 | |
| 623 | |
| 624 static char * | |
| 625 ngx_stream_ssl_preread_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) | |
| 626 { | |
| 627 ngx_stream_ssl_preread_srv_conf_t *prev = parent; | |
| 628 ngx_stream_ssl_preread_srv_conf_t *conf = child; | |
| 629 | |
| 630 ngx_conf_merge_value(conf->enabled, prev->enabled, 0); | |
| 631 | |
| 632 return NGX_CONF_OK; | |
| 633 } | |
| 634 | |
| 635 | |
| 636 static ngx_int_t | |
| 637 ngx_stream_ssl_preread_init(ngx_conf_t *cf) | |
| 638 { | |
| 639 ngx_stream_handler_pt *h; | |
| 640 ngx_stream_core_main_conf_t *cmcf; | |
| 641 | |
| 642 cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module); | |
| 643 | |
| 644 h = ngx_array_push(&cmcf->phases[NGX_STREAM_PREREAD_PHASE].handlers); | |
| 645 if (h == NULL) { | |
| 646 return NGX_ERROR; | |
| 647 } | |
| 648 | |
| 649 *h = ngx_stream_ssl_preread_handler; | |
| 650 | |
| 651 return NGX_OK; | |
| 652 } |