Mercurial > hg > nginx
annotate src/http/modules/ngx_http_ssl_module.c @ 7653:8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
OCSP validation for client certificates is enabled by the "ssl_ocsp" directive.
OCSP responder can be optionally specified by "ssl_ocsp_responder".
When session is reused, peer chain is not available for validation.
If the verified chain contains certificates from the peer chain not available
at the server, validation will fail.
| author | Roman Arutyunyan <arut@nginx.com> |
|---|---|
| date | Fri, 22 May 2020 17:30:12 +0300 |
| parents | ef7ee19776db |
| children | b56f725dd4bb |
| rev | line source |
|---|---|
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1 |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
2 /* |
|
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
| 4412 | 4 * Copyright (C) Nginx, Inc. |
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
5 */ |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
6 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #include <ngx_config.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 #include <ngx_core.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 #include <ngx_http.h> |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
11 |
| 573 | 12 |
| 671 | 13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, |
| 14 ngx_pool_t *pool, ngx_str_t *s); | |
| 611 | 15 |
| 16 | |
| 3960 | 17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" |
|
6553
2014ed60f17f
SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6550
diff
changeset
|
18 #define NGX_DEFAULT_ECDH_CURVE "auto" |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
19 |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
20 #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
21 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
22 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
23 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
24 static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
25 const unsigned char **out, unsigned char *outlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
26 const unsigned char *in, unsigned int inlen, void *arg); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
27 #endif |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
28 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
29 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
30 static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
31 const unsigned char **out, unsigned int *outlen, void *arg); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
32 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
33 |
| 671 | 34 static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 35 ngx_http_variable_value_t *v, uintptr_t data); |
| 671 | 36 static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r, |
| 647 | 37 ngx_http_variable_value_t *v, uintptr_t data); |
| 611 | 38 |
| 39 static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf); | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
40 static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
41 static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, |
| 501 | 42 void *parent, void *child); |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
43 |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
44 static ngx_int_t ngx_http_ssl_compile_certificates(ngx_conf_t *cf, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
45 ngx_http_ssl_srv_conf_t *conf); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
46 |
| 2224 | 47 static char *ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, |
| 48 void *conf); | |
|
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
49 static char *ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
50 void *conf); |
| 973 | 51 static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, |
| 52 void *conf); | |
| 53 | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
54 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
55 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
56 |
| 547 | 57 static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { |
| 58 { ngx_string("SSLv2"), NGX_SSL_SSLv2 }, | |
| 59 { ngx_string("SSLv3"), NGX_SSL_SSLv3 }, | |
| 60 { ngx_string("TLSv1"), NGX_SSL_TLSv1 }, | |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
61 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 }, |
|
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
62 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 }, |
|
6981
08dc60979133
SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6817
diff
changeset
|
63 { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 }, |
| 547 | 64 { ngx_null_string, 0 } |
| 65 }; | |
| 66 | |
| 67 | |
| 2123 | 68 static ngx_conf_enum_t ngx_http_ssl_verify[] = { |
| 69 { ngx_string("off"), 0 }, | |
| 70 { ngx_string("on"), 1 }, | |
| 2994 | 71 { ngx_string("optional"), 2 }, |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
72 { ngx_string("optional_no_ca"), 3 }, |
| 2123 | 73 { ngx_null_string, 0 } |
| 74 }; | |
| 75 | |
| 76 | |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
77 static ngx_conf_enum_t ngx_http_ssl_ocsp[] = { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
78 { ngx_string("off"), 0 }, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
79 { ngx_string("on"), 1 }, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
80 { ngx_string("leaf"), 2 }, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
81 { ngx_null_string, 0 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
82 }; |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
83 |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
84 |
|
7270
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
85 static ngx_conf_deprecated_t ngx_http_ssl_deprecated = { |
|
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
86 ngx_conf_deprecated, "ssl", "listen ... ssl" |
|
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
87 }; |
|
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
88 |
|
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
89 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
90 static ngx_command_t ngx_http_ssl_commands[] = { |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
91 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
92 { ngx_string("ssl"), |
| 599 | 93 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
| 2224 | 94 ngx_http_ssl_enable, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
95 NGX_HTTP_SRV_CONF_OFFSET, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
96 offsetof(ngx_http_ssl_srv_conf_t, enable), |
|
7270
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
97 &ngx_http_ssl_deprecated }, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
98 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
99 { ngx_string("ssl_certificate"), |
| 599 | 100 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
101 ngx_conf_set_str_array_slot, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
102 NGX_HTTP_SRV_CONF_OFFSET, |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
103 offsetof(ngx_http_ssl_srv_conf_t, certificates), |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
104 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
105 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
106 { ngx_string("ssl_certificate_key"), |
| 599 | 107 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
108 ngx_conf_set_str_array_slot, |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
109 NGX_HTTP_SRV_CONF_OFFSET, |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
110 offsetof(ngx_http_ssl_srv_conf_t, certificate_keys), |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
111 NULL }, |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
112 |
|
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
113 { ngx_string("ssl_password_file"), |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
114 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
115 ngx_http_ssl_password_file, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
116 NGX_HTTP_SRV_CONF_OFFSET, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
117 0, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
118 NULL }, |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
119 |
| 2044 | 120 { ngx_string("ssl_dhparam"), |
| 121 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 122 ngx_conf_set_str_slot, | |
| 123 NGX_HTTP_SRV_CONF_OFFSET, | |
| 124 offsetof(ngx_http_ssl_srv_conf_t, dhparam), | |
| 125 NULL }, | |
| 126 | |
| 3960 | 127 { ngx_string("ssl_ecdh_curve"), |
| 128 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 129 ngx_conf_set_str_slot, | |
| 130 NGX_HTTP_SRV_CONF_OFFSET, | |
| 131 offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve), | |
| 132 NULL }, | |
| 133 | |
| 547 | 134 { ngx_string("ssl_protocols"), |
| 563 | 135 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE, |
| 547 | 136 ngx_conf_set_bitmask_slot, |
| 137 NGX_HTTP_SRV_CONF_OFFSET, | |
| 138 offsetof(ngx_http_ssl_srv_conf_t, protocols), | |
| 139 &ngx_http_ssl_protocols }, | |
| 140 | |
| 479 | 141 { ngx_string("ssl_ciphers"), |
| 563 | 142 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 479 | 143 ngx_conf_set_str_slot, |
| 144 NGX_HTTP_SRV_CONF_OFFSET, | |
| 145 offsetof(ngx_http_ssl_srv_conf_t, ciphers), | |
| 146 NULL }, | |
| 147 | |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
148 { ngx_string("ssl_buffer_size"), |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
149 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
150 ngx_conf_set_size_slot, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
151 NGX_HTTP_SRV_CONF_OFFSET, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
152 offsetof(ngx_http_ssl_srv_conf_t, buffer_size), |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
153 NULL }, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
154 |
| 647 | 155 { ngx_string("ssl_verify_client"), |
|
4273
e444e8f6538b
Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse.
Sergey Budnevitch <sb@waeme.net>
parents:
4234
diff
changeset
|
156 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 2123 | 157 ngx_conf_set_enum_slot, |
| 647 | 158 NGX_HTTP_SRV_CONF_OFFSET, |
| 159 offsetof(ngx_http_ssl_srv_conf_t, verify), | |
| 2123 | 160 &ngx_http_ssl_verify }, |
| 647 | 161 |
| 162 { ngx_string("ssl_verify_depth"), | |
|
5504
8ed467553f6b
SSL: fixed ssl_verify_depth to take only one argument.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5503
diff
changeset
|
163 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
| 647 | 164 ngx_conf_set_num_slot, |
| 165 NGX_HTTP_SRV_CONF_OFFSET, | |
| 166 offsetof(ngx_http_ssl_srv_conf_t, verify_depth), | |
| 167 NULL }, | |
| 168 | |
| 169 { ngx_string("ssl_client_certificate"), | |
| 170 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 171 ngx_conf_set_str_slot, | |
| 172 NGX_HTTP_SRV_CONF_OFFSET, | |
| 173 offsetof(ngx_http_ssl_srv_conf_t, client_certificate), | |
| 174 NULL }, | |
| 175 | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
176 { ngx_string("ssl_trusted_certificate"), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
177 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
178 ngx_conf_set_str_slot, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
179 NGX_HTTP_SRV_CONF_OFFSET, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
180 offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate), |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
181 NULL }, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
182 |
| 547 | 183 { ngx_string("ssl_prefer_server_ciphers"), |
| 184 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, | |
| 185 ngx_conf_set_flag_slot, | |
| 186 NGX_HTTP_SRV_CONF_OFFSET, | |
| 187 offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers), | |
| 188 NULL }, | |
| 189 | |
| 973 | 190 { ngx_string("ssl_session_cache"), |
| 191 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12, | |
| 192 ngx_http_ssl_session_cache, | |
| 193 NGX_HTTP_SRV_CONF_OFFSET, | |
| 194 0, | |
| 195 NULL }, | |
| 196 | |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
197 { ngx_string("ssl_session_tickets"), |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
198 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
199 ngx_conf_set_flag_slot, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
200 NGX_HTTP_SRV_CONF_OFFSET, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
201 offsetof(ngx_http_ssl_srv_conf_t, session_tickets), |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
202 NULL }, |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
203 |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
204 { ngx_string("ssl_session_ticket_key"), |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
205 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
206 ngx_conf_set_str_array_slot, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
207 NGX_HTTP_SRV_CONF_OFFSET, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
208 offsetof(ngx_http_ssl_srv_conf_t, session_ticket_keys), |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
209 NULL }, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
210 |
| 573 | 211 { ngx_string("ssl_session_timeout"), |
| 212 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 213 ngx_conf_set_sec_slot, | |
| 214 NGX_HTTP_SRV_CONF_OFFSET, | |
| 215 offsetof(ngx_http_ssl_srv_conf_t, session_timeout), | |
| 216 NULL }, | |
| 217 | |
| 2995 | 218 { ngx_string("ssl_crl"), |
| 219 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
| 220 ngx_conf_set_str_slot, | |
| 221 NGX_HTTP_SRV_CONF_OFFSET, | |
| 222 offsetof(ngx_http_ssl_srv_conf_t, crl), | |
| 223 NULL }, | |
| 224 | |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
225 { ngx_string("ssl_ocsp"), |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
226 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
227 ngx_conf_set_enum_slot, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
228 NGX_HTTP_SRV_CONF_OFFSET, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
229 offsetof(ngx_http_ssl_srv_conf_t, ocsp), |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
230 &ngx_http_ssl_ocsp }, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
231 |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
232 { ngx_string("ssl_ocsp_responder"), |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
233 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
234 ngx_conf_set_str_slot, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
235 NGX_HTTP_SRV_CONF_OFFSET, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
236 offsetof(ngx_http_ssl_srv_conf_t, ocsp_responder), |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
237 NULL }, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
238 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
239 { ngx_string("ssl_stapling"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
240 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
241 ngx_conf_set_flag_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
242 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
243 offsetof(ngx_http_ssl_srv_conf_t, stapling), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
244 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
245 |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
246 { ngx_string("ssl_stapling_file"), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
247 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
248 ngx_conf_set_str_slot, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
249 NGX_HTTP_SRV_CONF_OFFSET, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
250 offsetof(ngx_http_ssl_srv_conf_t, stapling_file), |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
251 NULL }, |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
252 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
253 { ngx_string("ssl_stapling_responder"), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
254 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
255 ngx_conf_set_str_slot, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
256 NGX_HTTP_SRV_CONF_OFFSET, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
257 offsetof(ngx_http_ssl_srv_conf_t, stapling_responder), |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
258 NULL }, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
259 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
260 { ngx_string("ssl_stapling_verify"), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
261 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
262 ngx_conf_set_flag_slot, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
263 NGX_HTTP_SRV_CONF_OFFSET, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
264 offsetof(ngx_http_ssl_srv_conf_t, stapling_verify), |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
265 NULL }, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
266 |
|
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
267 { ngx_string("ssl_early_data"), |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
268 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
269 ngx_conf_set_flag_slot, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
270 NGX_HTTP_SRV_CONF_OFFSET, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
271 offsetof(ngx_http_ssl_srv_conf_t, early_data), |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
272 NULL }, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
273 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
274 ngx_null_command |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
275 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
276 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
277 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
278 static ngx_http_module_t ngx_http_ssl_module_ctx = { |
| 611 | 279 ngx_http_ssl_add_variables, /* preconfiguration */ |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
280 ngx_http_ssl_init, /* postconfiguration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
281 |
| 541 | 282 NULL, /* create main configuration */ |
| 283 NULL, /* init main configuration */ | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
284 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
285 ngx_http_ssl_create_srv_conf, /* create server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
286 ngx_http_ssl_merge_srv_conf, /* merge server configuration */ |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
287 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
288 NULL, /* create location configuration */ |
| 485 | 289 NULL /* merge location configuration */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
290 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
291 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
292 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
293 ngx_module_t ngx_http_ssl_module = { |
| 509 | 294 NGX_MODULE_V1, |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
295 &ngx_http_ssl_module_ctx, /* module context */ |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
296 ngx_http_ssl_commands, /* module directives */ |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
297 NGX_HTTP_MODULE, /* module type */ |
| 541 | 298 NULL, /* init master */ |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
299 NULL, /* init module */ |
| 541 | 300 NULL, /* init process */ |
| 301 NULL, /* init thread */ | |
| 302 NULL, /* exit thread */ | |
| 303 NULL, /* exit process */ | |
| 304 NULL, /* exit master */ | |
| 305 NGX_MODULE_V1_PADDING | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
306 }; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
307 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
308 |
| 611 | 309 static ngx_http_variable_t ngx_http_ssl_vars[] = { |
| 310 | |
| 671 | 311 { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 312 (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 313 |
| 671 | 314 { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable, |
| 1565 | 315 (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 611 | 316 |
|
6816
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
317 { ngx_string("ssl_ciphers"), NULL, ngx_http_ssl_variable, |
|
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
318 (uintptr_t) ngx_ssl_get_ciphers, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
319 |
|
6817
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
320 { ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable, |
|
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
321 (uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
322 |
| 3154 | 323 { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable, |
| 324 (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 325 | |
|
5573
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
326 { ngx_string("ssl_session_reused"), NULL, ngx_http_ssl_variable, |
|
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
327 (uintptr_t) ngx_ssl_get_session_reused, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
328 |
|
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
329 { ngx_string("ssl_early_data"), NULL, ngx_http_ssl_variable, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
330 (uintptr_t) ngx_ssl_get_early_data, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
331 NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 }, |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
332 |
|
5658
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
333 { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable, |
|
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
334 (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
335 |
| 2045 | 336 { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable, |
| 337 (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 338 | |
| 2123 | 339 { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable, |
| 340 (uintptr_t) ngx_ssl_get_raw_certificate, | |
| 341 NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 342 | |
|
7091
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
343 { ngx_string("ssl_client_escaped_cert"), NULL, ngx_http_ssl_variable, |
|
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
344 (uintptr_t) ngx_ssl_get_escaped_certificate, |
|
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
345 NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
346 |
| 671 | 347 { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 348 (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 349 |
| 671 | 350 { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable, |
| 1565 | 351 (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 671 | 352 |
|
6780
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
353 { ngx_string("ssl_client_s_dn_legacy"), NULL, ngx_http_ssl_variable, |
|
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
354 (uintptr_t) ngx_ssl_get_subject_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
355 |
|
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
356 { ngx_string("ssl_client_i_dn_legacy"), NULL, ngx_http_ssl_variable, |
|
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
357 (uintptr_t) ngx_ssl_get_issuer_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
358 |
| 671 | 359 { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable, |
| 1565 | 360 (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
| 647 | 361 |
|
5700
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
362 { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable, |
|
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
363 (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
364 |
| 2994 | 365 { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable, |
| 366 (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
| 367 | |
|
6815
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
368 { ngx_string("ssl_client_v_start"), NULL, ngx_http_ssl_variable, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
369 (uintptr_t) ngx_ssl_get_client_v_start, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
370 |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
371 { ngx_string("ssl_client_v_end"), NULL, ngx_http_ssl_variable, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
372 (uintptr_t) ngx_ssl_get_client_v_end, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
373 |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
374 { ngx_string("ssl_client_v_remain"), NULL, ngx_http_ssl_variable, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
375 (uintptr_t) ngx_ssl_get_client_v_remain, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
|
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
376 |
|
7077
2a288909abc6
Variables: macros for null variables.
Ruslan Ermilov <ru@nginx.com>
parents:
6981
diff
changeset
|
377 ngx_http_null_variable |
| 611 | 378 }; |
| 379 | |
| 380 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
381 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP"); |
| 973 | 382 |
| 383 | |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
384 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
385 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
386 static int |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
387 ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
388 unsigned char *outlen, const unsigned char *in, unsigned int inlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
389 void *arg) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
390 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
391 unsigned int srvlen; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
392 unsigned char *srv; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
393 #if (NGX_DEBUG) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
394 unsigned int i; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
395 #endif |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
396 #if (NGX_HTTP_V2) |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
397 ngx_http_connection_t *hc; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
398 #endif |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
399 #if (NGX_HTTP_V2 || NGX_DEBUG) |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
400 ngx_connection_t *c; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
401 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
402 c = ngx_ssl_get_connection(ssl_conn); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
403 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
404 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
405 #if (NGX_DEBUG) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
406 for (i = 0; i < inlen; i += in[i] + 1) { |
| 6474 | 407 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
|
6478
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
408 "SSL ALPN supported by client: %*s", |
|
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
409 (size_t) in[i], &in[i + 1]); |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
410 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
411 #endif |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
412 |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
413 #if (NGX_HTTP_V2) |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
414 hc = c->data; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
415 |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
416 if (hc->addr_conf->http2) { |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
417 srv = |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
418 (unsigned char *) NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
419 srvlen = sizeof(NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
420 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
421 } else |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
422 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
423 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
424 srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
425 srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
426 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
427 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
428 if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen, |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
429 in, inlen) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
430 != OPENSSL_NPN_NEGOTIATED) |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
431 { |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
432 return SSL_TLSEXT_ERR_NOACK; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
433 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
434 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
435 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
|
6478
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
436 "SSL ALPN selected: %*s", (size_t) *outlen, *out); |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
437 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
438 return SSL_TLSEXT_ERR_OK; |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
439 } |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
440 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
441 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
442 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
443 |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
444 #ifdef TLSEXT_TYPE_next_proto_neg |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
445 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
446 static int |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
447 ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
448 const unsigned char **out, unsigned int *outlen, void *arg) |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
449 { |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
450 #if (NGX_HTTP_V2 || NGX_DEBUG) |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
451 ngx_connection_t *c; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
452 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
453 c = ngx_ssl_get_connection(ssl_conn); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
454 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL NPN advertised"); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
455 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
456 |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
457 #if (NGX_HTTP_V2) |
|
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
458 { |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
459 ngx_http_connection_t *hc; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
460 |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
461 hc = c->data; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
462 |
|
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
463 if (hc->addr_conf->http2) { |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
464 *out = |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
465 (unsigned char *) NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
|
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
466 *outlen = sizeof(NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
|
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
467 |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
468 return SSL_TLSEXT_ERR_OK; |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
469 } |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
470 } |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
471 #endif |
|
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
472 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
473 *out = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
474 *outlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
475 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
476 return SSL_TLSEXT_ERR_OK; |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
477 } |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
478 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
479 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
480 |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
481 |
| 973 | 482 static ngx_int_t |
| 671 | 483 ngx_http_ssl_static_variable(ngx_http_request_t *r, |
| 611 | 484 ngx_http_variable_value_t *v, uintptr_t data) |
| 485 { | |
| 671 | 486 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 611 | 487 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
488 size_t len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
489 ngx_str_t s; |
| 611 | 490 |
| 491 if (r->connection->ssl) { | |
| 492 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
493 (void) handler(r->connection, NULL, &s); |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
494 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
495 v->data = s.data; |
| 611 | 496 |
| 671 | 497 for (len = 0; v->data[len]; len++) { /* void */ } |
| 611 | 498 |
| 499 v->len = len; | |
| 500 v->valid = 1; | |
| 1565 | 501 v->no_cacheable = 0; |
| 611 | 502 v->not_found = 0; |
| 503 | |
| 504 return NGX_OK; | |
| 505 } | |
| 506 | |
| 507 v->not_found = 1; | |
| 508 | |
| 509 return NGX_OK; | |
| 510 } | |
| 511 | |
| 512 | |
| 513 static ngx_int_t | |
| 671 | 514 ngx_http_ssl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, |
| 647 | 515 uintptr_t data) |
| 516 { | |
| 671 | 517 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
| 647 | 518 |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
519 ngx_str_t s; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
520 |
| 647 | 521 if (r->connection->ssl) { |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
522 |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
523 if (handler(r->connection, r->pool, &s) != NGX_OK) { |
| 647 | 524 return NGX_ERROR; |
| 525 } | |
| 526 | |
|
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
527 v->len = s.len; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
528 v->data = s.data; |
|
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
529 |
| 647 | 530 if (v->len) { |
| 531 v->valid = 1; | |
| 1565 | 532 v->no_cacheable = 0; |
| 647 | 533 v->not_found = 0; |
| 534 | |
| 535 return NGX_OK; | |
| 536 } | |
| 537 } | |
| 538 | |
| 539 v->not_found = 1; | |
| 540 | |
| 541 return NGX_OK; | |
| 542 } | |
| 543 | |
| 544 | |
| 545 static ngx_int_t | |
| 611 | 546 ngx_http_ssl_add_variables(ngx_conf_t *cf) |
| 547 { | |
| 548 ngx_http_variable_t *var, *v; | |
| 549 | |
| 550 for (v = ngx_http_ssl_vars; v->name.len; v++) { | |
| 551 var = ngx_http_add_variable(cf, &v->name, v->flags); | |
| 552 if (var == NULL) { | |
| 553 return NGX_ERROR; | |
| 554 } | |
| 555 | |
| 637 | 556 var->get_handler = v->get_handler; |
| 611 | 557 var->data = v->data; |
| 558 } | |
| 559 | |
| 560 return NGX_OK; | |
| 561 } | |
| 562 | |
| 563 | |
| 501 | 564 static void * |
| 565 ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
566 { |
| 971 | 567 ngx_http_ssl_srv_conf_t *sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
568 |
| 971 | 569 sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)); |
| 570 if (sscf == NULL) { | |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
571 return NULL; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
572 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
573 |
| 479 | 574 /* |
| 575 * set by ngx_pcalloc(): | |
| 576 * | |
| 971 | 577 * sscf->protocols = 0; |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
578 * sscf->certificate_values = NULL; |
| 2044 | 579 * sscf->dhparam = { 0, NULL }; |
| 3960 | 580 * sscf->ecdh_curve = { 0, NULL }; |
| 2044 | 581 * sscf->client_certificate = { 0, NULL }; |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
582 * sscf->trusted_certificate = { 0, NULL }; |
| 2995 | 583 * sscf->crl = { 0, NULL }; |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3209
diff
changeset
|
584 * sscf->ciphers = { 0, NULL }; |
| 973 | 585 * sscf->shm_zone = NULL; |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
586 * sscf->ocsp_responder = { 0, NULL }; |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
587 * sscf->stapling_file = { 0, NULL }; |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
588 * sscf->stapling_responder = { 0, NULL }; |
| 479 | 589 */ |
| 590 | |
| 971 | 591 sscf->enable = NGX_CONF_UNSET; |
| 2123 | 592 sscf->prefer_server_ciphers = NGX_CONF_UNSET; |
|
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
593 sscf->early_data = NGX_CONF_UNSET; |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
594 sscf->buffer_size = NGX_CONF_UNSET_SIZE; |
| 2710 | 595 sscf->verify = NGX_CONF_UNSET_UINT; |
| 596 sscf->verify_depth = NGX_CONF_UNSET_UINT; | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
597 sscf->certificates = NGX_CONF_UNSET_PTR; |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
598 sscf->certificate_keys = NGX_CONF_UNSET_PTR; |
|
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
599 sscf->passwords = NGX_CONF_UNSET_PTR; |
| 973 | 600 sscf->builtin_session_cache = NGX_CONF_UNSET; |
| 601 sscf->session_timeout = NGX_CONF_UNSET; | |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
602 sscf->session_tickets = NGX_CONF_UNSET; |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
603 sscf->session_ticket_keys = NGX_CONF_UNSET_PTR; |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
604 sscf->ocsp = NGX_CONF_UNSET_UINT; |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
605 sscf->stapling = NGX_CONF_UNSET; |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
606 sscf->stapling_verify = NGX_CONF_UNSET; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
607 |
| 971 | 608 return sscf; |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
609 } |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
610 |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
611 |
| 501 | 612 static char * |
| 613 ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) | |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
614 { |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
615 ngx_http_ssl_srv_conf_t *prev = parent; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
616 ngx_http_ssl_srv_conf_t *conf = child; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
617 |
| 563 | 618 ngx_pool_cleanup_t *cln; |
| 619 | |
|
4234
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
620 if (conf->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
621 if (prev->enable == NGX_CONF_UNSET) { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
622 conf->enable = 0; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
623 |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
624 } else { |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
625 conf->enable = prev->enable; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
626 conf->file = prev->file; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
627 conf->line = prev->line; |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
628 } |
|
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
629 } |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
630 |
| 573 | 631 ngx_conf_merge_value(conf->session_timeout, |
| 632 prev->session_timeout, 300); | |
| 633 | |
| 547 | 634 ngx_conf_merge_value(conf->prefer_server_ciphers, |
| 635 prev->prefer_server_ciphers, 0); | |
| 636 | |
|
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
637 ngx_conf_merge_value(conf->early_data, prev->early_data, 0); |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
638 |
| 547 | 639 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, |
|
6157
b2899e7d0ef8
Disabled SSLv3 by default (ticket #653).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6035
diff
changeset
|
640 (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 |
|
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
641 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); |
| 547 | 642 |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
643 ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
644 NGX_SSL_BUFSIZE); |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
645 |
| 2123 | 646 ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); |
| 647 ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); | |
| 647 | 648 |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
649 ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL); |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
650 ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys, |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
651 NULL); |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
652 |
|
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
653 ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL); |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
654 |
| 2044 | 655 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); |
| 656 | |
| 647 | 657 ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate, |
| 658 ""); | |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
659 ngx_conf_merge_str_value(conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
660 prev->trusted_certificate, ""); |
| 2995 | 661 ngx_conf_merge_str_value(conf->crl, prev->crl, ""); |
| 647 | 662 |
| 3960 | 663 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve, |
| 664 NGX_DEFAULT_ECDH_CURVE); | |
| 665 | |
| 2124 | 666 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS); |
| 479 | 667 |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
668 ngx_conf_merge_uint_value(conf->ocsp, prev->ocsp, 0); |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
669 ngx_conf_merge_str_value(conf->ocsp_responder, prev->ocsp_responder, ""); |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
670 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
671 ngx_conf_merge_value(conf->stapling, prev->stapling, 0); |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
672 ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0); |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
673 ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, ""); |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
674 ngx_conf_merge_str_value(conf->stapling_responder, |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
675 prev->stapling_responder, ""); |
| 479 | 676 |
| 547 | 677 conf->ssl.log = cf->log; |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
678 |
| 2224 | 679 if (conf->enable) { |
| 680 | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
681 if (conf->certificates == NULL) { |
| 2224 | 682 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
| 683 "no \"ssl_certificate\" is defined for " | |
| 684 "the \"ssl\" directive in %s:%ui", | |
| 685 conf->file, conf->line); | |
| 686 return NGX_CONF_ERROR; | |
| 687 } | |
| 688 | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
689 if (conf->certificate_keys == NULL) { |
| 2224 | 690 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
| 691 "no \"ssl_certificate_key\" is defined for " | |
| 692 "the \"ssl\" directive in %s:%ui", | |
| 693 conf->file, conf->line); | |
| 694 return NGX_CONF_ERROR; | |
| 695 } | |
| 696 | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
697 if (conf->certificate_keys->nelts < conf->certificates->nelts) { |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
698 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
699 "no \"ssl_certificate_key\" is defined " |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
700 "for certificate \"%V\" and " |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
701 "the \"ssl\" directive in %s:%ui", |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
702 ((ngx_str_t *) conf->certificates->elts) |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
703 + conf->certificates->nelts - 1, |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
704 conf->file, conf->line); |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
705 return NGX_CONF_ERROR; |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
706 } |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
707 |
| 2224 | 708 } else { |
| 709 | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
710 if (conf->certificates == NULL) { |
| 2224 | 711 return NGX_CONF_OK; |
| 712 } | |
| 713 | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
714 if (conf->certificate_keys == NULL |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
715 || conf->certificate_keys->nelts < conf->certificates->nelts) |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
716 { |
| 2224 | 717 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
| 718 "no \"ssl_certificate_key\" is defined " | |
|
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
719 "for certificate \"%V\"", |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
720 ((ngx_str_t *) conf->certificates->elts) |
|
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
721 + conf->certificates->nelts - 1); |
| 2224 | 722 return NGX_CONF_ERROR; |
| 723 } | |
| 724 } | |
| 725 | |
| 969 | 726 if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
727 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
728 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
729 |
|
7473
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
730 cln = ngx_pool_cleanup_add(cf->pool, 0); |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
731 if (cln == NULL) { |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
732 ngx_ssl_cleanup_ctx(&conf->ssl); |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
733 return NGX_CONF_ERROR; |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
734 } |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
735 |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
736 cln->handler = ngx_ssl_cleanup_ctx; |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
737 cln->data = &conf->ssl; |
|
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
738 |
| 1219 | 739 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME |
| 740 | |
| 741 if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, | |
| 742 ngx_http_ssl_servername) | |
| 743 == 0) | |
| 744 { | |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
745 ngx_log_error(NGX_LOG_WARN, cf->log, 0, |
| 3209 | 746 "nginx was built with SNI support, however, now it is linked " |
|
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
747 "dynamically to an OpenSSL library which has no tlsext support, " |
|
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
748 "therefore SNI is not available"); |
| 1219 | 749 } |
| 750 | |
| 751 #endif | |
| 752 | |
|
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
753 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
754 SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL); |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
755 #endif |
|
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
756 |
|
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
757 #ifdef TLSEXT_TYPE_next_proto_neg |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
758 SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx, |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
759 ngx_http_ssl_npn_advertised, NULL); |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
760 #endif |
|
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
761 |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
762 if (ngx_http_ssl_compile_certificates(cf, conf) != NGX_OK) { |
|
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
763 return NGX_CONF_ERROR; |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
764 } |
|
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
765 |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
766 if (conf->certificate_values) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
767 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
768 #ifdef SSL_R_CERT_CB_ERROR |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
769 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
770 /* install callback to lookup certificates */ |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
771 |
|
7466
48c87377aabd
SSL: fixed possible segfault with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7465
diff
changeset
|
772 SSL_CTX_set_cert_cb(conf->ssl.ctx, ngx_http_ssl_certificate, conf); |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
773 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
774 #else |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
775 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
776 "variables in " |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
777 "\"ssl_certificate\" and \"ssl_certificate_key\" " |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
778 "directives are not supported on this platform"); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
779 return NGX_CONF_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
780 #endif |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
781 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
782 } else { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
783 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
784 /* configure certificates */ |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
785 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
786 if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
787 conf->certificate_keys, conf->passwords) |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
788 != NGX_OK) |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
789 { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
790 return NGX_CONF_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
791 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
792 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
793 |
|
6591
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
794 if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers, |
|
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
795 conf->prefer_server_ciphers) |
|
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
796 != NGX_OK) |
| 529 | 797 { |
|
5387
0fbcfab0bfd7
SSL: stop loading configs with invalid "ssl_ciphers" values.
Piotr Sikora <piotr@cloudflare.com>
parents:
5121
diff
changeset
|
798 return NGX_CONF_ERROR; |
| 547 | 799 } |
| 800 | |
|
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
801 conf->ssl.buffer_size = conf->buffer_size; |
|
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
802 |
| 647 | 803 if (conf->verify) { |
| 2123 | 804 |
|
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
805 if (conf->client_certificate.len == 0 && conf->verify != 3) { |
| 2123 | 806 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
|
7567
ef7ee19776db
SSL: fixed ssl_verify_client error message.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7473
diff
changeset
|
807 "no ssl_client_certificate for ssl_verify_client"); |
| 2123 | 808 return NGX_CONF_ERROR; |
| 809 } | |
| 810 | |
| 671 | 811 if (ngx_ssl_client_certificate(cf, &conf->ssl, |
| 970 | 812 &conf->client_certificate, |
| 813 conf->verify_depth) | |
| 671 | 814 != NGX_OK) |
| 815 { | |
| 816 return NGX_CONF_ERROR; | |
| 647 | 817 } |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
818 } |
| 2995 | 819 |
|
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
820 if (ngx_ssl_trusted_certificate(cf, &conf->ssl, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
821 &conf->trusted_certificate, |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
822 conf->verify_depth) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
823 != NGX_OK) |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
824 { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
825 return NGX_CONF_ERROR; |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
826 } |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
827 |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
828 if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) { |
|
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
829 return NGX_CONF_ERROR; |
| 647 | 830 } |
| 831 | |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
832 if (conf->ocsp) { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
833 |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
834 if (conf->verify == 3) { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
835 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
836 "\"ssl_ocsp\" is incompatible with " |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
837 "\"ssl_verify_client optional_no_ca\""); |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
838 return NGX_CONF_ERROR; |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
839 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
840 |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
841 if (ngx_ssl_ocsp(cf, &conf->ssl, &conf->ocsp_responder, conf->ocsp) |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
842 != NGX_OK) |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
843 { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
844 return NGX_CONF_ERROR; |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
845 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
846 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
847 |
| 2044 | 848 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) { |
| 849 return NGX_CONF_ERROR; | |
| 850 } | |
| 851 | |
| 3960 | 852 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) { |
| 853 return NGX_CONF_ERROR; | |
| 854 } | |
| 855 | |
| 973 | 856 ngx_conf_merge_value(conf->builtin_session_cache, |
| 2032 | 857 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE); |
| 973 | 858 |
| 859 if (conf->shm_zone == NULL) { | |
| 860 conf->shm_zone = prev->shm_zone; | |
| 861 } | |
| 862 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
863 if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx, |
|
7465
6708bec13757
SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7463
diff
changeset
|
864 conf->certificates, conf->builtin_session_cache, |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
865 conf->shm_zone, conf->session_timeout) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
866 != NGX_OK) |
| 973 | 867 { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
868 return NGX_CONF_ERROR; |
| 973 | 869 } |
| 573 | 870 |
|
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
871 ngx_conf_merge_value(conf->session_tickets, prev->session_tickets, 1); |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
872 |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
873 #ifdef SSL_OP_NO_TICKET |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
874 if (!conf->session_tickets) { |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
875 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET); |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
876 } |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
877 #endif |
|
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
878 |
|
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
879 ngx_conf_merge_ptr_value(conf->session_ticket_keys, |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
880 prev->session_ticket_keys, NULL); |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
881 |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
882 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys) |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
883 != NGX_OK) |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
884 { |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
885 return NGX_CONF_ERROR; |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
886 } |
|
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
887 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
888 if (conf->stapling) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
889 |
|
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
890 if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file, |
|
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
891 &conf->stapling_responder, conf->stapling_verify) |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
892 != NGX_OK) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
893 { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
894 return NGX_CONF_ERROR; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
895 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
896 |
|
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
897 } |
|
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
898 |
|
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
899 if (ngx_ssl_early_data(cf, &conf->ssl, conf->early_data) != NGX_OK) { |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
900 return NGX_CONF_ERROR; |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
901 } |
|
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
902 |
|
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
903 return NGX_CONF_OK; |
|
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
904 } |
| 563 | 905 |
| 906 | |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
907 static ngx_int_t |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
908 ngx_http_ssl_compile_certificates(ngx_conf_t *cf, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
909 ngx_http_ssl_srv_conf_t *conf) |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
910 { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
911 ngx_str_t *cert, *key; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
912 ngx_uint_t i, nelts; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
913 ngx_http_complex_value_t *cv; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
914 ngx_http_compile_complex_value_t ccv; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
915 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
916 cert = conf->certificates->elts; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
917 key = conf->certificate_keys->elts; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
918 nelts = conf->certificates->nelts; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
919 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
920 for (i = 0; i < nelts; i++) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
921 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
922 if (ngx_http_script_variables_count(&cert[i])) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
923 goto found; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
924 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
925 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
926 if (ngx_http_script_variables_count(&key[i])) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
927 goto found; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
928 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
929 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
930 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
931 return NGX_OK; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
932 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
933 found: |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
934 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
935 conf->certificate_values = ngx_array_create(cf->pool, nelts, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
936 sizeof(ngx_http_complex_value_t)); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
937 if (conf->certificate_values == NULL) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
938 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
939 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
940 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
941 conf->certificate_key_values = ngx_array_create(cf->pool, nelts, |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
942 sizeof(ngx_http_complex_value_t)); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
943 if (conf->certificate_key_values == NULL) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
944 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
945 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
946 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
947 for (i = 0; i < nelts; i++) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
948 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
949 cv = ngx_array_push(conf->certificate_values); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
950 if (cv == NULL) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
951 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
952 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
953 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
954 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t)); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
955 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
956 ccv.cf = cf; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
957 ccv.value = &cert[i]; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
958 ccv.complex_value = cv; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
959 ccv.zero = 1; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
960 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
961 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
962 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
963 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
964 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
965 cv = ngx_array_push(conf->certificate_key_values); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
966 if (cv == NULL) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
967 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
968 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
969 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
970 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t)); |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
971 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
972 ccv.cf = cf; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
973 ccv.value = &key[i]; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
974 ccv.complex_value = cv; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
975 ccv.zero = 1; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
976 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
977 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) { |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
978 return NGX_ERROR; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
979 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
980 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
981 |
|
7463
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
982 conf->passwords = ngx_ssl_preserve_passwords(cf, conf->passwords); |
|
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
983 if (conf->passwords == NULL) { |
|
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
984 return NGX_ERROR; |
|
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
985 } |
|
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
986 |
|
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
987 return NGX_OK; |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
988 } |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
989 |
|
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
990 |
| 973 | 991 static char * |
| 2224 | 992 ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 993 { | |
| 994 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 995 | |
| 996 char *rv; | |
| 997 | |
| 998 rv = ngx_conf_set_flag_slot(cf, cmd, conf); | |
| 999 | |
| 1000 if (rv != NGX_CONF_OK) { | |
| 1001 return rv; | |
| 1002 } | |
| 1003 | |
| 1004 sscf->file = cf->conf_file->file.name.data; | |
| 1005 sscf->line = cf->conf_file->line; | |
| 1006 | |
| 1007 return NGX_CONF_OK; | |
| 1008 } | |
| 1009 | |
| 1010 | |
| 1011 static char * | |
|
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1012 ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1013 { |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1014 ngx_http_ssl_srv_conf_t *sscf = conf; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1015 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1016 ngx_str_t *value; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1017 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1018 if (sscf->passwords != NGX_CONF_UNSET_PTR) { |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1019 return "is duplicate"; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1020 } |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1021 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1022 value = cf->args->elts; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1023 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1024 sscf->passwords = ngx_ssl_read_password_file(cf, &value[1]); |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1025 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1026 if (sscf->passwords == NULL) { |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1027 return NGX_CONF_ERROR; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1028 } |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1029 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1030 return NGX_CONF_OK; |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1031 } |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1032 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1033 |
|
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1034 static char * |
| 973 | 1035 ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 1036 { | |
| 1037 ngx_http_ssl_srv_conf_t *sscf = conf; | |
| 1038 | |
| 1039 size_t len; | |
| 1040 ngx_str_t *value, name, size; | |
| 1041 ngx_int_t n; | |
| 1042 ngx_uint_t i, j; | |
| 1043 | |
| 1044 value = cf->args->elts; | |
| 1045 | |
| 1046 for (i = 1; i < cf->args->nelts; i++) { | |
| 1047 | |
| 1778 | 1048 if (ngx_strcmp(value[i].data, "off") == 0) { |
| 1049 sscf->builtin_session_cache = NGX_SSL_NO_SCACHE; | |
| 1050 continue; | |
| 1051 } | |
| 1052 | |
| 2032 | 1053 if (ngx_strcmp(value[i].data, "none") == 0) { |
| 1054 sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE; | |
| 1055 continue; | |
| 1056 } | |
| 1057 | |
| 973 | 1058 if (ngx_strcmp(value[i].data, "builtin") == 0) { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1059 sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE; |
| 973 | 1060 continue; |
| 1061 } | |
| 1062 | |
| 1063 if (value[i].len > sizeof("builtin:") - 1 | |
| 1064 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1) | |
| 1065 == 0) | |
| 1066 { | |
| 1067 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1, | |
| 1068 value[i].len - (sizeof("builtin:") - 1)); | |
| 1069 | |
| 1070 if (n == NGX_ERROR) { | |
| 1071 goto invalid; | |
| 1072 } | |
| 1073 | |
| 1074 sscf->builtin_session_cache = n; | |
| 1075 | |
| 1076 continue; | |
| 1077 } | |
| 1078 | |
| 1079 if (value[i].len > sizeof("shared:") - 1 | |
| 1080 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1) | |
| 1081 == 0) | |
| 1082 { | |
| 1083 len = 0; | |
| 1084 | |
| 1085 for (j = sizeof("shared:") - 1; j < value[i].len; j++) { | |
| 1086 if (value[i].data[j] == ':') { | |
| 1087 break; | |
| 1088 } | |
| 1089 | |
| 1090 len++; | |
| 1091 } | |
| 1092 | |
| 1093 if (len == 0) { | |
| 1094 goto invalid; | |
| 1095 } | |
| 1096 | |
| 1097 name.len = len; | |
| 1098 name.data = value[i].data + sizeof("shared:") - 1; | |
| 1099 | |
| 1100 size.len = value[i].len - j - 1; | |
| 1101 size.data = name.data + len + 1; | |
| 1102 | |
| 1103 n = ngx_parse_size(&size); | |
| 1104 | |
| 1105 if (n == NGX_ERROR) { | |
| 1106 goto invalid; | |
| 1107 } | |
| 1108 | |
| 1109 if (n < (ngx_int_t) (8 * ngx_pagesize)) { | |
| 1110 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1111 "session cache \"%V\" is too small", |
| 973 | 1112 &value[i]); |
| 1113 | |
| 1114 return NGX_CONF_ERROR; | |
| 1115 } | |
| 1116 | |
| 1117 sscf->shm_zone = ngx_shared_memory_add(cf, &name, n, | |
| 1118 &ngx_http_ssl_module); | |
| 1119 if (sscf->shm_zone == NULL) { | |
| 1120 return NGX_CONF_ERROR; | |
| 1121 } | |
| 1122 | |
|
4153
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
1123 sscf->shm_zone->init = ngx_ssl_session_cache_init; |
|
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
1124 |
| 973 | 1125 continue; |
| 1126 } | |
| 1127 | |
| 1128 goto invalid; | |
| 1129 } | |
| 1130 | |
| 1131 if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) { | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1132 sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE; |
| 973 | 1133 } |
| 1134 | |
| 1135 return NGX_CONF_OK; | |
| 1136 | |
| 1137 invalid: | |
| 1138 | |
| 1139 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
| 1140 "invalid session cache \"%V\"", &value[i]); | |
| 1141 | |
| 1142 return NGX_CONF_ERROR; | |
| 1143 } | |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1144 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1145 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1146 static ngx_int_t |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1147 ngx_http_ssl_init(ngx_conf_t *cf) |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1148 { |
|
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1149 ngx_uint_t a, p, s; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1150 ngx_http_conf_addr_t *addr; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1151 ngx_http_conf_port_t *port; |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1152 ngx_http_ssl_srv_conf_t *sscf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1153 ngx_http_core_loc_conf_t *clcf; |
|
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1154 ngx_http_core_srv_conf_t **cscfp, *cscf; |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1155 ngx_http_core_main_conf_t *cmcf; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1156 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1157 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1158 cscfp = cmcf->servers.elts; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1159 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1160 for (s = 0; s < cmcf->servers.nelts; s++) { |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1161 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1162 sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1163 |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1164 if (sscf->ssl.ctx == NULL) { |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1165 continue; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1166 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1167 |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1168 clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index]; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1169 |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1170 if (sscf->stapling) { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1171 if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver, |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1172 clcf->resolver_timeout) |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1173 != NGX_OK) |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1174 { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1175 return NGX_ERROR; |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1176 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1177 } |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1178 |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1179 if (sscf->ocsp) { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1180 if (ngx_ssl_ocsp_resolver(cf, &sscf->ssl, clcf->resolver, |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1181 clcf->resolver_timeout) |
|
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1182 != NGX_OK) |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1183 { |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1184 return NGX_ERROR; |
|
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1185 } |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1186 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1187 } |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1188 |
|
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1189 if (cmcf->ports == NULL) { |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1190 return NGX_OK; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1191 } |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1192 |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1193 port = cmcf->ports->elts; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1194 for (p = 0; p < cmcf->ports->nelts; p++) { |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1195 |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1196 addr = port[p].addrs.elts; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1197 for (a = 0; a < port[p].addrs.nelts; a++) { |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1198 |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1199 if (!addr[a].opt.ssl) { |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1200 continue; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1201 } |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1202 |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1203 cscf = addr[a].default_server; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1204 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1205 |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1206 if (sscf->certificates == NULL) { |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1207 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1208 "no \"ssl_certificate\" is defined for " |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1209 "the \"listen ... ssl\" directive in %s:%ui", |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1210 cscf->file_name, cscf->line); |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1211 return NGX_ERROR; |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1212 } |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1213 } |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1214 } |
|
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1215 |
|
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1216 return NGX_OK; |
|
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1217 } |