Mercurial > hg > nginx
annotate src/event/ngx_event_openssl.c @ 3992:a1dd9dc754ab
A new fix for the case when ssl_session_cache defined, but ssl is not
enabled in any server. The previous r1033 does not help when unused zone
becomes used after reconfiguration, so it is backed out.
The initial thought was to make SSL modules independed from SSL implementation
and to keep OpenSSL code dependance as much as in separate files.
| author | Igor Sysoev <igor@sysoev.ru> |
|---|---|
| date | Thu, 04 Aug 2011 11:12:30 +0000 |
| parents | df2ae4bc7415 |
| children | 5b776ad53c3c |
| rev | line source |
|---|---|
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
399
diff
changeset
|
1 |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
399
diff
changeset
|
2 /* |
|
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
399
diff
changeset
|
4 */ |
|
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
399
diff
changeset
|
5 |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
6 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 #include <ngx_config.h> |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #include <ngx_core.h> |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
9 #include <ngx_event.h> |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 |
| 541 | 11 |
| 12 typedef struct { | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
13 ngx_uint_t engine; /* unsigned engine:1; */ |
| 541 | 14 } ngx_openssl_conf_t; |
| 479 | 15 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
16 |
| 671 | 17 static int ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store); |
|
3300
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
18 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
19 int ret); |
| 547 | 20 static void ngx_ssl_handshake_handler(ngx_event_t *ev); |
| 489 | 21 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n); |
| 473 | 22 static void ngx_ssl_write_handler(ngx_event_t *wev); |
| 23 static void ngx_ssl_read_handler(ngx_event_t *rev); | |
| 577 | 24 static void ngx_ssl_shutdown_handler(ngx_event_t *ev); |
| 547 | 25 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, |
| 26 ngx_err_t err, char *text); | |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
27 static void ngx_ssl_clear_error(ngx_log_t *log); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
28 |
|
3992
a1dd9dc754ab
A new fix for the case when ssl_session_cache defined, but ssl is not
Igor Sysoev <igor@sysoev.ru>
parents:
3962
diff
changeset
|
29 ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
30 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
31 ngx_ssl_session_t *sess); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
32 static ngx_ssl_session_t *ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
33 u_char *id, int len, int *copy); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
34 static void ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
35 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
36 ngx_slab_pool_t *shpool, ngx_uint_t n); |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
37 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp, |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
38 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
39 |
| 541 | 40 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle); |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
41 static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); |
| 571 | 42 static void ngx_openssl_exit(ngx_cycle_t *cycle); |
| 541 | 43 |
| 44 | |
| 45 static ngx_command_t ngx_openssl_commands[] = { | |
| 46 | |
| 47 { ngx_string("ssl_engine"), | |
| 48 NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1, | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
49 ngx_openssl_engine, |
| 541 | 50 0, |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
51 0, |
| 541 | 52 NULL }, |
| 53 | |
| 54 ngx_null_command | |
| 55 }; | |
| 56 | |
| 57 | |
| 58 static ngx_core_module_t ngx_openssl_module_ctx = { | |
| 59 ngx_string("openssl"), | |
| 60 ngx_openssl_create_conf, | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
61 NULL |
| 577 | 62 }; |
| 541 | 63 |
| 64 | |
| 65 ngx_module_t ngx_openssl_module = { | |
| 66 NGX_MODULE_V1, | |
| 67 &ngx_openssl_module_ctx, /* module context */ | |
| 68 ngx_openssl_commands, /* module directives */ | |
| 69 NGX_CORE_MODULE, /* module type */ | |
| 70 NULL, /* init master */ | |
| 71 NULL, /* init module */ | |
| 72 NULL, /* init process */ | |
| 73 NULL, /* init thread */ | |
| 74 NULL, /* exit thread */ | |
| 75 NULL, /* exit process */ | |
| 571 | 76 ngx_openssl_exit, /* exit master */ |
| 541 | 77 NGX_MODULE_V1_PADDING |
| 547 | 78 }; |
| 79 | |
| 80 | |
| 81 static long ngx_ssl_protocols[] = { | |
| 82 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1, | |
| 83 SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1, | |
| 84 SSL_OP_NO_SSLv2|SSL_OP_NO_TLSv1, | |
| 85 SSL_OP_NO_TLSv1, | |
| 86 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3, | |
| 87 SSL_OP_NO_SSLv3, | |
| 88 SSL_OP_NO_SSLv2, | |
| 89 0, | |
| 90 }; | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
91 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
92 |
| 969 | 93 int ngx_ssl_connection_index; |
| 94 int ngx_ssl_server_conf_index; | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
95 int ngx_ssl_session_cache_index; |
| 671 | 96 |
| 97 | |
| 489 | 98 ngx_int_t |
| 99 ngx_ssl_init(ngx_log_t *log) | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
100 { |
| 968 | 101 OPENSSL_config(NULL); |
| 102 | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
103 SSL_library_init(); |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
104 SSL_load_error_strings(); |
| 541 | 105 |
| 479 | 106 ENGINE_load_builtin_engines(); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
107 |
|
3464
7f99ce2247f9
add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents:
3457
diff
changeset
|
108 OpenSSL_add_all_algorithms(); |
|
7f99ce2247f9
add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents:
3457
diff
changeset
|
109 |
| 969 | 110 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL); |
| 671 | 111 |
| 969 | 112 if (ngx_ssl_connection_index == -1) { |
| 671 | 113 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed"); |
| 114 return NGX_ERROR; | |
| 115 } | |
| 116 | |
| 969 | 117 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, |
| 118 NULL); | |
| 119 if (ngx_ssl_server_conf_index == -1) { | |
| 120 ngx_ssl_error(NGX_LOG_ALERT, log, 0, | |
| 121 "SSL_CTX_get_ex_new_index() failed"); | |
| 122 return NGX_ERROR; | |
| 123 } | |
| 124 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
125 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
126 NULL); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
127 if (ngx_ssl_session_cache_index == -1) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
128 ngx_ssl_error(NGX_LOG_ALERT, log, 0, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
129 "SSL_CTX_get_ex_new_index() failed"); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
130 return NGX_ERROR; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
131 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
132 |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
133 return NGX_OK; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
134 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
135 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
136 |
| 489 | 137 ngx_int_t |
| 969 | 138 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) |
| 547 | 139 { |
| 577 | 140 ssl->ctx = SSL_CTX_new(SSLv23_method()); |
| 547 | 141 |
| 142 if (ssl->ctx == NULL) { | |
| 143 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed"); | |
| 144 return NGX_ERROR; | |
| 145 } | |
| 146 | |
| 969 | 147 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) { |
| 148 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 149 "SSL_CTX_set_ex_data() failed"); | |
| 150 return NGX_ERROR; | |
| 151 } | |
| 152 | |
| 577 | 153 /* client side options */ |
| 154 | |
| 155 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG); | |
| 156 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG); | |
| 157 | |
| 158 /* server side options */ | |
| 563 | 159 |
| 160 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG); | |
| 161 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER); | |
| 162 | |
| 163 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */ | |
| 164 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING); | |
| 165 | |
| 166 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG); | |
| 167 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG); | |
| 168 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG); | |
| 169 | |
| 170 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); | |
| 171 | |
| 2044 | 172 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); |
| 547 | 173 |
| 174 if (ngx_ssl_protocols[protocols >> 1] != 0) { | |
| 175 SSL_CTX_set_options(ssl->ctx, ngx_ssl_protocols[protocols >> 1]); | |
| 176 } | |
| 177 | |
| 178 SSL_CTX_set_read_ahead(ssl->ctx, 1); | |
| 179 | |
|
3300
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
180 SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
181 |
| 547 | 182 return NGX_OK; |
| 183 } | |
| 184 | |
| 185 | |
| 186 ngx_int_t | |
| 563 | 187 ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, |
| 188 ngx_str_t *key) | |
| 547 | 189 { |
|
2536
a6d6d762c554
small optimization: " == NGX_ERROR" > " != NGX_OK"
Igor Sysoev <igor@sysoev.ru>
parents:
2504
diff
changeset
|
190 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) { |
| 547 | 191 return NGX_ERROR; |
| 192 } | |
| 193 | |
| 563 | 194 if (SSL_CTX_use_certificate_chain_file(ssl->ctx, (char *) cert->data) |
| 547 | 195 == 0) |
| 196 { | |
| 197 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 563 | 198 "SSL_CTX_use_certificate_chain_file(\"%s\") failed", |
| 199 cert->data); | |
| 200 return NGX_ERROR; | |
| 201 } | |
| 202 | |
|
2536
a6d6d762c554
small optimization: " == NGX_ERROR" > " != NGX_OK"
Igor Sysoev <igor@sysoev.ru>
parents:
2504
diff
changeset
|
203 if (ngx_conf_full_name(cf->cycle, key, 1) != NGX_OK) { |
| 563 | 204 return NGX_ERROR; |
| 205 } | |
| 206 | |
| 207 if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data, | |
| 647 | 208 SSL_FILETYPE_PEM) |
| 209 == 0) | |
| 563 | 210 { |
| 211 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 212 "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data); | |
| 547 | 213 return NGX_ERROR; |
| 214 } | |
| 215 | |
| 216 return NGX_OK; | |
| 217 } | |
| 218 | |
| 219 | |
| 220 ngx_int_t | |
| 671 | 221 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, |
| 222 ngx_int_t depth) | |
| 647 | 223 { |
| 671 | 224 STACK_OF(X509_NAME) *list; |
| 225 | |
| 226 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_http_ssl_verify_callback); | |
| 227 | |
| 228 SSL_CTX_set_verify_depth(ssl->ctx, depth); | |
| 229 | |
| 230 if (cert->len == 0) { | |
| 231 return NGX_OK; | |
| 232 } | |
| 233 | |
|
2536
a6d6d762c554
small optimization: " == NGX_ERROR" > " != NGX_OK"
Igor Sysoev <igor@sysoev.ru>
parents:
2504
diff
changeset
|
234 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) { |
| 647 | 235 return NGX_ERROR; |
| 236 } | |
| 237 | |
| 238 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL) | |
| 239 == 0) | |
| 240 { | |
| 241 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 242 "SSL_CTX_load_verify_locations(\"%s\") failed", | |
| 243 cert->data); | |
| 244 return NGX_ERROR; | |
| 245 } | |
| 246 | |
| 671 | 247 list = SSL_load_client_CA_file((char *) cert->data); |
| 248 | |
| 249 if (list == NULL) { | |
| 250 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 251 "SSL_load_client_CA_file(\"%s\") failed", cert->data); | |
| 252 return NGX_ERROR; | |
| 253 } | |
| 254 | |
| 255 /* | |
| 256 * before 0.9.7h and 0.9.8 SSL_load_client_CA_file() | |
| 257 * always leaved an error in the error queue | |
| 258 */ | |
| 259 | |
| 260 ERR_clear_error(); | |
| 261 | |
| 262 SSL_CTX_set_client_CA_list(ssl->ctx, list); | |
| 263 | |
| 647 | 264 return NGX_OK; |
| 265 } | |
| 266 | |
| 267 | |
| 2995 | 268 ngx_int_t |
| 269 ngx_ssl_crl(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *crl) | |
| 270 { | |
| 271 X509_STORE *store; | |
| 272 X509_LOOKUP *lookup; | |
| 273 | |
| 274 if (crl->len == 0) { | |
| 275 return NGX_OK; | |
| 276 } | |
| 277 | |
| 278 if (ngx_conf_full_name(cf->cycle, crl, 1) != NGX_OK) { | |
| 279 return NGX_ERROR; | |
| 280 } | |
| 281 | |
| 282 store = SSL_CTX_get_cert_store(ssl->ctx); | |
| 283 | |
| 284 if (store == NULL) { | |
| 285 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 286 "SSL_CTX_get_cert_store() failed"); | |
| 287 return NGX_ERROR; | |
| 288 } | |
| 289 | |
| 290 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); | |
| 291 | |
| 292 if (lookup == NULL) { | |
| 293 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 294 "X509_STORE_add_lookup() failed"); | |
| 295 return NGX_ERROR; | |
| 296 } | |
| 297 | |
| 298 if (X509_LOOKUP_load_file(lookup, (char *) crl->data, X509_FILETYPE_PEM) | |
| 299 == 0) | |
| 300 { | |
| 301 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 302 "X509_LOOKUP_load_file(\"%s\") failed", crl->data); | |
| 303 return NGX_ERROR; | |
| 304 } | |
| 305 | |
| 306 X509_STORE_set_flags(store, | |
| 307 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL); | |
| 308 | |
| 309 return NGX_OK; | |
| 310 } | |
| 311 | |
| 312 | |
| 671 | 313 static int |
| 314 ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store) | |
| 315 { | |
|
1977
40c9cb8576bb
get certificate info only for debug build
Igor Sysoev <igor@sysoev.ru>
parents:
1976
diff
changeset
|
316 #if (NGX_DEBUG) |
| 671 | 317 char *subject, *issuer; |
| 318 int err, depth; | |
| 319 X509 *cert; | |
|
1976
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
320 X509_NAME *sname, *iname; |
| 671 | 321 ngx_connection_t *c; |
| 322 ngx_ssl_conn_t *ssl_conn; | |
| 323 | |
| 324 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store, | |
| 325 SSL_get_ex_data_X509_STORE_CTX_idx()); | |
| 326 | |
| 327 c = ngx_ssl_get_connection(ssl_conn); | |
| 328 | |
| 329 cert = X509_STORE_CTX_get_current_cert(x509_store); | |
| 330 err = X509_STORE_CTX_get_error(x509_store); | |
| 331 depth = X509_STORE_CTX_get_error_depth(x509_store); | |
| 332 | |
|
1976
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
333 sname = X509_get_subject_name(cert); |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
334 subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)"; |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
335 |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
336 iname = X509_get_issuer_name(cert); |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
337 issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)"; |
| 671 | 338 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
339 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 671 | 340 "verify:%d, error:%d, depth:%d, " |
| 341 "subject:\"%s\",issuer: \"%s\"", | |
| 342 ok, err, depth, subject, issuer); | |
| 343 | |
|
1976
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
344 if (sname) { |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
345 OPENSSL_free(subject); |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
346 } |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
347 |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
348 if (iname) { |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
349 OPENSSL_free(issuer); |
|
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
350 } |
|
1977
40c9cb8576bb
get certificate info only for debug build
Igor Sysoev <igor@sysoev.ru>
parents:
1976
diff
changeset
|
351 #endif |
|
1976
c4d8867f0162
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1974
diff
changeset
|
352 |
| 671 | 353 return 1; |
| 354 } | |
| 355 | |
| 356 | |
|
3300
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
357 static void |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
358 ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret) |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
359 { |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
360 ngx_connection_t *c; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
361 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
362 if (where & SSL_CB_HANDSHAKE_START) { |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
363 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn); |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
364 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
365 if (c->ssl->handshaked) { |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
366 c->ssl->renegotiation = 1; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
367 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL renegotiation"); |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
368 } |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
369 } |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
370 } |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
371 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
372 |
|
3959
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
373 RSA * |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
374 ngx_ssl_rsa512_key_callback(SSL *ssl, int is_export, int key_length) |
| 547 | 375 { |
|
3959
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
376 static RSA *key; |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
377 |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
378 if (key_length == 512) { |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
379 if (key == NULL) { |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
380 key = RSA_generate_key(512, RSA_F4, NULL, NULL); |
|
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
381 } |
| 559 | 382 } |
| 383 | |
|
3959
b1f48fa31e6c
MSIE export versions are rare now, so RSA 512 key is generated on demand
Igor Sysoev <igor@sysoev.ru>
parents:
3851
diff
changeset
|
384 return key; |
| 547 | 385 } |
| 386 | |
| 387 | |
| 388 ngx_int_t | |
| 2044 | 389 ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file) |
| 390 { | |
| 391 DH *dh; | |
| 392 BIO *bio; | |
| 393 | |
| 394 /* | |
| 395 * -----BEGIN DH PARAMETERS----- | |
| 396 * MIGHAoGBALu8LcrYRnSQfEP89YDpz9vZWKP1aLQtSwju1OsPs1BMbAMCducQgAxc | |
| 397 * y7qokiYUxb7spWWl/fHSh6K8BJvmd4Bg6RqSp1fjBI9osHb302zI8pul34HcLKcl | |
| 398 * 7OZicMyaUDXYzs7vnqAnSmOrHlj6/UmI0PZdFGdX2gcd8EXP4WubAgEC | |
| 399 * -----END DH PARAMETERS----- | |
| 400 */ | |
| 401 | |
| 402 static unsigned char dh1024_p[] = { | |
| 403 0xBB, 0xBC, 0x2D, 0xCA, 0xD8, 0x46, 0x74, 0x90, 0x7C, 0x43, 0xFC, 0xF5, | |
| 404 0x80, 0xE9, 0xCF, 0xDB, 0xD9, 0x58, 0xA3, 0xF5, 0x68, 0xB4, 0x2D, 0x4B, | |
| 405 0x08, 0xEE, 0xD4, 0xEB, 0x0F, 0xB3, 0x50, 0x4C, 0x6C, 0x03, 0x02, 0x76, | |
| 406 0xE7, 0x10, 0x80, 0x0C, 0x5C, 0xCB, 0xBA, 0xA8, 0x92, 0x26, 0x14, 0xC5, | |
| 407 0xBE, 0xEC, 0xA5, 0x65, 0xA5, 0xFD, 0xF1, 0xD2, 0x87, 0xA2, 0xBC, 0x04, | |
| 408 0x9B, 0xE6, 0x77, 0x80, 0x60, 0xE9, 0x1A, 0x92, 0xA7, 0x57, 0xE3, 0x04, | |
| 409 0x8F, 0x68, 0xB0, 0x76, 0xF7, 0xD3, 0x6C, 0xC8, 0xF2, 0x9B, 0xA5, 0xDF, | |
| 410 0x81, 0xDC, 0x2C, 0xA7, 0x25, 0xEC, 0xE6, 0x62, 0x70, 0xCC, 0x9A, 0x50, | |
| 411 0x35, 0xD8, 0xCE, 0xCE, 0xEF, 0x9E, 0xA0, 0x27, 0x4A, 0x63, 0xAB, 0x1E, | |
| 412 0x58, 0xFA, 0xFD, 0x49, 0x88, 0xD0, 0xF6, 0x5D, 0x14, 0x67, 0x57, 0xDA, | |
| 413 0x07, 0x1D, 0xF0, 0x45, 0xCF, 0xE1, 0x6B, 0x9B | |
| 414 }; | |
| 415 | |
| 416 static unsigned char dh1024_g[] = { 0x02 }; | |
| 417 | |
| 418 | |
| 419 if (file->len == 0) { | |
| 420 | |
| 421 dh = DH_new(); | |
| 422 if (dh == NULL) { | |
| 423 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "DH_new() failed"); | |
| 424 return NGX_ERROR; | |
| 425 } | |
| 426 | |
| 427 dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL); | |
| 428 dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL); | |
| 429 | |
| 430 if (dh->p == NULL || dh->g == NULL) { | |
| 431 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "BN_bin2bn() failed"); | |
| 432 DH_free(dh); | |
| 433 return NGX_ERROR; | |
| 434 } | |
| 435 | |
| 436 SSL_CTX_set_tmp_dh(ssl->ctx, dh); | |
| 437 | |
| 438 DH_free(dh); | |
| 439 | |
| 440 return NGX_OK; | |
| 441 } | |
| 442 | |
|
2536
a6d6d762c554
small optimization: " == NGX_ERROR" > " != NGX_OK"
Igor Sysoev <igor@sysoev.ru>
parents:
2504
diff
changeset
|
443 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) { |
| 2044 | 444 return NGX_ERROR; |
| 445 } | |
| 446 | |
| 447 bio = BIO_new_file((char *) file->data, "r"); | |
| 448 if (bio == NULL) { | |
| 449 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 450 "BIO_new_file(\"%s\") failed", file->data); | |
| 451 return NGX_ERROR; | |
| 452 } | |
| 453 | |
| 454 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); | |
| 455 if (dh == NULL) { | |
| 456 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 457 "PEM_read_bio_DHparams(\"%s\") failed", file->data); | |
| 458 BIO_free(bio); | |
| 459 return NGX_ERROR; | |
| 460 } | |
| 461 | |
| 462 SSL_CTX_set_tmp_dh(ssl->ctx, dh); | |
| 463 | |
| 464 DH_free(dh); | |
| 465 BIO_free(bio); | |
| 466 | |
| 467 return NGX_OK; | |
| 468 } | |
| 469 | |
| 3960 | 470 ngx_int_t |
| 471 ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name) | |
| 472 { | |
| 473 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL | |
| 474 #ifndef OPENSSL_NO_ECDH | |
| 475 int nid; | |
| 476 EC_KEY *ecdh; | |
| 477 | |
| 478 /* | |
| 479 * Elliptic-Curve Diffie-Hellman parameters are either "named curves" | |
| 480 * from RFC 4492 section 5.1.1, or explicitely described curves over | |
| 481 * binary fields. OpenSSL only supports the "named curves", which provide | |
| 482 * maximum interoperability. | |
| 483 */ | |
| 484 | |
| 485 nid = OBJ_sn2nid((const char *) name->data); | |
| 486 if (nid == 0) { | |
| 487 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 488 "Unknown curve name \"%s\"", name->data); | |
| 489 return NGX_ERROR; | |
| 490 } | |
| 491 | |
| 492 ecdh = EC_KEY_new_by_curve_name(nid); | |
| 493 if (ecdh == NULL) { | |
| 494 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, | |
| 495 "Unable to create curve \"%s\"", name->data); | |
| 496 return NGX_ERROR; | |
| 497 } | |
| 498 | |
| 499 SSL_CTX_set_tmp_ecdh(ssl->ctx, ecdh); | |
| 500 | |
| 501 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE); | |
| 502 | |
| 503 EC_KEY_free(ecdh); | |
| 504 #endif | |
| 505 #endif | |
| 506 | |
| 507 return NGX_OK; | |
| 508 } | |
| 2044 | 509 |
| 510 ngx_int_t | |
| 547 | 511 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags) |
| 577 | 512 { |
| 547 | 513 ngx_ssl_connection_t *sc; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
514 |
| 547 | 515 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t)); |
| 516 if (sc == NULL) { | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
517 return NGX_ERROR; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
518 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
519 |
|
1779
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
520 sc->buffer = ((flags & NGX_SSL_BUFFER) != 0); |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
521 |
| 547 | 522 sc->connection = SSL_new(ssl->ctx); |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
523 |
| 547 | 524 if (sc->connection == NULL) { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
525 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed"); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
526 return NGX_ERROR; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
527 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
528 |
| 547 | 529 if (SSL_set_fd(sc->connection, c->fd) == 0) { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
530 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed"); |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
531 return NGX_ERROR; |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
532 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
533 |
| 577 | 534 if (flags & NGX_SSL_CLIENT) { |
| 535 SSL_set_connect_state(sc->connection); | |
| 536 | |
| 537 } else { | |
| 538 SSL_set_accept_state(sc->connection); | |
| 539 } | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
540 |
| 969 | 541 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) { |
| 671 | 542 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed"); |
| 543 return NGX_ERROR; | |
| 544 } | |
| 545 | |
| 547 | 546 c->ssl = sc; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
547 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
548 return NGX_OK; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
549 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
550 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
551 |
| 547 | 552 ngx_int_t |
| 577 | 553 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session) |
| 554 { | |
| 555 if (session) { | |
| 556 if (SSL_set_session(c->ssl->connection, session) == 0) { | |
| 557 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed"); | |
| 558 return NGX_ERROR; | |
| 559 } | |
| 560 } | |
| 561 | |
| 562 return NGX_OK; | |
| 563 } | |
| 564 | |
| 565 | |
| 566 ngx_int_t | |
| 547 | 567 ngx_ssl_handshake(ngx_connection_t *c) |
| 568 { | |
| 569 int n, sslerr; | |
| 570 ngx_err_t err; | |
| 571 | |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
572 ngx_ssl_clear_error(c->log); |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
573 |
| 547 | 574 n = SSL_do_handshake(c->ssl->connection); |
| 575 | |
| 577 | 576 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n); |
| 547 | 577 |
| 578 if (n == 1) { | |
| 579 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
580 if (ngx_handle_read_event(c->read, 0) != NGX_OK) { |
| 547 | 581 return NGX_ERROR; |
| 582 } | |
| 583 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
584 if (ngx_handle_write_event(c->write, 0) != NGX_OK) { |
| 547 | 585 return NGX_ERROR; |
| 586 } | |
| 587 | |
| 588 #if (NGX_DEBUG) | |
| 589 { | |
| 590 char buf[129], *s, *d; | |
| 3851 | 591 #if OPENSSL_VERSION_NUMBER >= 0x10000000L |
|
3488
92378c49456d
MSVC8 compatibility with OpenSSL 1.0.0
Igor Sysoev <igor@sysoev.ru>
parents:
3464
diff
changeset
|
592 const |
|
92378c49456d
MSVC8 compatibility with OpenSSL 1.0.0
Igor Sysoev <igor@sysoev.ru>
parents:
3464
diff
changeset
|
593 #endif |
| 547 | 594 SSL_CIPHER *cipher; |
| 595 | |
| 596 cipher = SSL_get_current_cipher(c->ssl->connection); | |
| 597 | |
| 598 if (cipher) { | |
| 599 SSL_CIPHER_description(cipher, &buf[1], 128); | |
| 600 | |
| 601 for (s = &buf[1], d = buf; *s; s++) { | |
| 602 if (*s == ' ' && *d == ' ') { | |
| 603 continue; | |
| 604 } | |
| 605 | |
| 606 if (*s == LF || *s == CR) { | |
| 607 continue; | |
| 608 } | |
| 609 | |
| 610 *++d = *s; | |
| 611 } | |
| 612 | |
| 613 if (*d != ' ') { | |
| 614 d++; | |
| 615 } | |
| 616 | |
| 617 *d = '\0'; | |
| 618 | |
| 583 | 619 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 547 | 620 "SSL: %s, cipher: \"%s\"", |
| 577 | 621 SSL_get_version(c->ssl->connection), &buf[1]); |
| 547 | 622 |
| 623 if (SSL_session_reused(c->ssl->connection)) { | |
| 583 | 624 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 547 | 625 "SSL reused session"); |
| 626 } | |
| 627 | |
| 628 } else { | |
| 629 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, | |
| 577 | 630 "SSL no shared ciphers"); |
| 547 | 631 } |
| 632 } | |
| 633 #endif | |
| 634 | |
| 635 c->ssl->handshaked = 1; | |
| 636 | |
| 637 c->recv = ngx_ssl_recv; | |
| 638 c->send = ngx_ssl_write; | |
| 577 | 639 c->recv_chain = ngx_ssl_recv_chain; |
| 640 c->send_chain = ngx_ssl_send_chain; | |
| 547 | 641 |
|
3300
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
642 /* initial handshake done, disable renegotiation (CVE-2009-3555) */ |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
643 if (c->ssl->connection->s3) { |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
644 c->ssl->connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
645 } |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
646 |
| 547 | 647 return NGX_OK; |
| 648 } | |
| 649 | |
| 650 sslerr = SSL_get_error(c->ssl->connection, n); | |
| 651 | |
| 652 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); | |
| 653 | |
| 654 if (sslerr == SSL_ERROR_WANT_READ) { | |
| 655 c->read->ready = 0; | |
| 656 c->read->handler = ngx_ssl_handshake_handler; | |
| 591 | 657 c->write->handler = ngx_ssl_handshake_handler; |
| 547 | 658 |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
659 if (ngx_handle_read_event(c->read, 0) != NGX_OK) { |
| 547 | 660 return NGX_ERROR; |
| 661 } | |
| 662 | |
| 663 return NGX_AGAIN; | |
| 664 } | |
| 665 | |
| 666 if (sslerr == SSL_ERROR_WANT_WRITE) { | |
| 667 c->write->ready = 0; | |
| 591 | 668 c->read->handler = ngx_ssl_handshake_handler; |
| 547 | 669 c->write->handler = ngx_ssl_handshake_handler; |
| 670 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
671 if (ngx_handle_write_event(c->write, 0) != NGX_OK) { |
| 547 | 672 return NGX_ERROR; |
| 673 } | |
| 674 | |
| 675 return NGX_AGAIN; | |
| 676 } | |
| 677 | |
| 678 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; | |
| 679 | |
| 680 c->ssl->no_wait_shutdown = 1; | |
| 681 c->ssl->no_send_shutdown = 1; | |
| 591 | 682 c->read->eof = 1; |
| 547 | 683 |
| 684 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) { | |
| 685 ngx_log_error(NGX_LOG_INFO, c->log, err, | |
| 577 | 686 "peer closed connection in SSL handshake"); |
| 547 | 687 |
| 688 return NGX_ERROR; | |
| 689 } | |
| 690 | |
| 591 | 691 c->read->error = 1; |
| 692 | |
| 547 | 693 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed"); |
| 694 | |
| 695 return NGX_ERROR; | |
| 696 } | |
| 697 | |
| 698 | |
| 699 static void | |
| 700 ngx_ssl_handshake_handler(ngx_event_t *ev) | |
| 701 { | |
| 702 ngx_connection_t *c; | |
| 703 | |
| 704 c = ev->data; | |
| 705 | |
| 549 | 706 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 577 | 707 "SSL handshake handler: %d", ev->write); |
| 547 | 708 |
| 591 | 709 if (ev->timedout) { |
| 710 c->ssl->handler(c); | |
| 711 return; | |
| 712 } | |
| 713 | |
| 547 | 714 if (ngx_ssl_handshake(c) == NGX_AGAIN) { |
| 715 return; | |
| 716 } | |
| 717 | |
| 718 c->ssl->handler(c); | |
| 719 } | |
| 720 | |
| 721 | |
| 489 | 722 ssize_t |
| 577 | 723 ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl) |
| 724 { | |
|
1154
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
725 u_char *last; |
| 577 | 726 ssize_t n, bytes; |
| 727 ngx_buf_t *b; | |
| 728 | |
| 729 bytes = 0; | |
| 730 | |
|
1154
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
731 b = cl->buf; |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
732 last = b->last; |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
733 |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
734 for ( ;; ) { |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
735 |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
736 n = ngx_ssl_recv(c, last, b->end - last); |
| 577 | 737 |
| 738 if (n > 0) { | |
|
1154
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
739 last += n; |
| 577 | 740 bytes += n; |
| 741 | |
|
1154
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
742 if (last == b->end) { |
| 577 | 743 cl = cl->next; |
|
1154
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
744 |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
745 if (cl == NULL) { |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
746 return bytes; |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
747 } |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
748 |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
749 b = cl->buf; |
|
427de53e45c2
ngx_ssl_recv_chain() must not update buf->last,
Igor Sysoev <igor@sysoev.ru>
parents:
1043
diff
changeset
|
750 last = b->last; |
| 577 | 751 } |
| 752 | |
| 753 continue; | |
| 754 } | |
| 755 | |
| 756 if (bytes) { | |
|
2052
b4085596a7e6
fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
757 |
|
b4085596a7e6
fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
758 if (n == 0 || n == NGX_ERROR) { |
|
b4085596a7e6
fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
759 c->read->ready = 1; |
|
b4085596a7e6
fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
760 } |
|
b4085596a7e6
fix "proxy_pass https://..." broken in r1427
Igor Sysoev <igor@sysoev.ru>
parents:
2049
diff
changeset
|
761 |
| 577 | 762 return bytes; |
| 763 } | |
| 764 | |
| 765 return n; | |
| 766 } | |
| 767 } | |
| 768 | |
| 769 | |
| 770 ssize_t | |
| 489 | 771 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size) |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
772 { |
| 489 | 773 int n, bytes; |
| 774 | |
| 775 if (c->ssl->last == NGX_ERROR) { | |
|
1426
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
776 c->read->error = 1; |
| 489 | 777 return NGX_ERROR; |
| 778 } | |
| 779 | |
| 577 | 780 if (c->ssl->last == NGX_DONE) { |
|
1426
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
781 c->read->ready = 0; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
782 c->read->eof = 1; |
| 577 | 783 return 0; |
| 784 } | |
| 785 | |
| 489 | 786 bytes = 0; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
787 |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
788 ngx_ssl_clear_error(c->log); |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
789 |
| 489 | 790 /* |
| 791 * SSL_read() may return data in parts, so try to read | |
| 792 * until SSL_read() would return no data | |
| 793 */ | |
| 794 | |
| 795 for ( ;; ) { | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
796 |
| 543 | 797 n = SSL_read(c->ssl->connection, buf, size); |
| 489 | 798 |
| 577 | 799 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
800 |
| 489 | 801 if (n > 0) { |
| 802 bytes += n; | |
| 803 } | |
| 804 | |
| 805 c->ssl->last = ngx_ssl_handle_recv(c, n); | |
| 806 | |
|
1426
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
807 if (c->ssl->last == NGX_OK) { |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
808 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
809 size -= n; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
810 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
811 if (size == 0) { |
| 489 | 812 return bytes; |
| 577 | 813 } |
| 489 | 814 |
|
1426
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
815 buf += n; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
816 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
817 continue; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
818 } |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
819 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
820 if (bytes) { |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
821 return bytes; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
822 } |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
823 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
824 switch (c->ssl->last) { |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
825 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
826 case NGX_DONE: |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
827 c->read->ready = 0; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
828 c->read->eof = 1; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
829 return 0; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
830 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
831 case NGX_ERROR: |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
832 c->read->error = 1; |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
833 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
834 /* fall thruogh */ |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
835 |
|
adbafd129d06
do not set read->eof, ready, and error prematurely
Igor Sysoev <igor@sysoev.ru>
parents:
1421
diff
changeset
|
836 case NGX_AGAIN: |
| 577 | 837 return c->ssl->last; |
| 479 | 838 } |
| 489 | 839 } |
| 840 } | |
| 841 | |
| 842 | |
| 843 static ngx_int_t | |
| 844 ngx_ssl_handle_recv(ngx_connection_t *c, int n) | |
| 845 { | |
| 547 | 846 int sslerr; |
| 847 ngx_err_t err; | |
| 489 | 848 |
|
3300
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
849 if (c->ssl->renegotiation) { |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
850 /* |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
851 * disable renegotiation (CVE-2009-3555): |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
852 * OpenSSL (at least up to 0.9.8l) does not handle disabled |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
853 * renegotiation gracefully, so drop connection here |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
854 */ |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
855 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
856 ngx_log_error(NGX_LOG_NOTICE, c->log, 0, "SSL renegotiation disabled"); |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
857 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
858 c->ssl->no_wait_shutdown = 1; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
859 c->ssl->no_send_shutdown = 1; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
860 |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
861 return NGX_ERROR; |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
862 } |
|
5a08dfb8d763
disable SSL renegotiation (CVE-2009-3555)
Igor Sysoev <igor@sysoev.ru>
parents:
3283
diff
changeset
|
863 |
| 489 | 864 if (n > 0) { |
| 479 | 865 |
| 473 | 866 if (c->ssl->saved_write_handler) { |
| 867 | |
| 509 | 868 c->write->handler = c->ssl->saved_write_handler; |
| 473 | 869 c->ssl->saved_write_handler = NULL; |
| 870 c->write->ready = 1; | |
| 871 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
872 if (ngx_handle_write_event(c->write, 0) != NGX_OK) { |
| 473 | 873 return NGX_ERROR; |
| 874 } | |
| 875 | |
| 563 | 876 ngx_post_event(c->write, &ngx_posted_events); |
| 473 | 877 } |
| 878 | |
| 489 | 879 return NGX_OK; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
880 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
881 |
| 543 | 882 sslerr = SSL_get_error(c->ssl->connection, n); |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
883 |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
884 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
885 |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
886 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
887 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
888 if (sslerr == SSL_ERROR_WANT_READ) { |
| 455 | 889 c->read->ready = 0; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
890 return NGX_AGAIN; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
891 } |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
892 |
|
445
f26432a1935a
nginx-0.1.0-2004-09-30-10:38:49 import
Igor Sysoev <igor@sysoev.ru>
parents:
444
diff
changeset
|
893 if (sslerr == SSL_ERROR_WANT_WRITE) { |
| 539 | 894 |
| 547 | 895 ngx_log_error(NGX_LOG_INFO, c->log, 0, |
| 577 | 896 "peer started SSL renegotiation"); |
| 473 | 897 |
| 898 c->write->ready = 0; | |
| 899 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
900 if (ngx_handle_write_event(c->write, 0) != NGX_OK) { |
| 473 | 901 return NGX_ERROR; |
| 902 } | |
| 903 | |
| 904 /* | |
| 905 * we do not set the timer because there is already the read event timer | |
| 906 */ | |
| 907 | |
| 908 if (c->ssl->saved_write_handler == NULL) { | |
| 509 | 909 c->ssl->saved_write_handler = c->write->handler; |
| 910 c->write->handler = ngx_ssl_write_handler; | |
| 473 | 911 } |
| 912 | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
913 return NGX_AGAIN; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
914 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
915 |
| 547 | 916 c->ssl->no_wait_shutdown = 1; |
| 917 c->ssl->no_send_shutdown = 1; | |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
918 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
919 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) { |
| 577 | 920 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 921 "peer shutdown SSL cleanly"); | |
| 922 return NGX_DONE; | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
923 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
924 |
| 547 | 925 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed"); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
926 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
927 return NGX_ERROR; |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
928 } |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
929 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
930 |
| 489 | 931 static void |
| 932 ngx_ssl_write_handler(ngx_event_t *wev) | |
| 473 | 933 { |
| 934 ngx_connection_t *c; | |
| 935 | |
| 936 c = wev->data; | |
| 547 | 937 |
| 509 | 938 c->read->handler(c->read); |
| 473 | 939 } |
| 940 | |
| 941 | |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
942 /* |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
943 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer |
| 473 | 944 * before the SSL_write() call to decrease a SSL overhead. |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
945 * |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
946 * Besides for protocols such as HTTP it is possible to always buffer |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
947 * the output to decrease a SSL overhead some more. |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
948 */ |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
949 |
| 489 | 950 ngx_chain_t * |
| 951 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit) | |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
952 { |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
953 int n; |
|
399
4e21d1291a14
nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents:
398
diff
changeset
|
954 ngx_uint_t flush; |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
955 ssize_t send, size; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
956 ngx_buf_t *buf; |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
957 |
|
2280
6453161bf53e
always use buffer, if connection is buffered,
Igor Sysoev <igor@sysoev.ru>
parents:
2165
diff
changeset
|
958 if (!c->ssl->buffer) { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
959 |
| 577 | 960 while (in) { |
| 961 if (ngx_buf_special(in->buf)) { | |
| 962 in = in->next; | |
| 963 continue; | |
| 964 } | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
965 |
| 577 | 966 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos); |
| 967 | |
| 968 if (n == NGX_ERROR) { | |
| 969 return NGX_CHAIN_ERROR; | |
| 970 } | |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
971 |
| 577 | 972 if (n == NGX_AGAIN) { |
| 597 | 973 c->buffered |= NGX_SSL_BUFFERED; |
| 577 | 974 return in; |
| 975 } | |
| 976 | |
| 977 in->buf->pos += n; | |
| 978 | |
| 979 if (in->buf->pos == in->buf->last) { | |
| 980 in = in->next; | |
| 981 } | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
982 } |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
983 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
984 return in; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
985 } |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
986 |
| 473 | 987 |
|
3962
df2ae4bc7415
fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents:
3961
diff
changeset
|
988 /* the maximum limit size is the maximum int32_t value - the page size */ |
|
df2ae4bc7415
fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents:
3961
diff
changeset
|
989 |
|
df2ae4bc7415
fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents:
3961
diff
changeset
|
990 if (limit == 0 || limit > (off_t) (NGX_MAX_INT32_VALUE - ngx_pagesize)) { |
|
df2ae4bc7415
fix SSL connection issues on platforms with 32-bit off_t
Igor Sysoev <igor@sysoev.ru>
parents:
3961
diff
changeset
|
991 limit = NGX_MAX_INT32_VALUE - ngx_pagesize; |
| 473 | 992 } |
| 993 | |
| 577 | 994 buf = c->ssl->buf; |
|
1779
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
995 |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
996 if (buf == NULL) { |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
997 buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE); |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
998 if (buf == NULL) { |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
999 return NGX_CHAIN_ERROR; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1000 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1001 |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1002 c->ssl->buf = buf; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1003 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1004 |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1005 if (buf->start == NULL) { |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1006 buf->start = ngx_palloc(c->pool, NGX_SSL_BUFSIZE); |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1007 if (buf->start == NULL) { |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1008 return NGX_CHAIN_ERROR; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1009 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1010 |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1011 buf->pos = buf->start; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1012 buf->last = buf->start; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1013 buf->end = buf->start + NGX_SSL_BUFSIZE; |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1014 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1015 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1016 send = 0; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1017 flush = (in == NULL) ? 1 : 0; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1018 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1019 for ( ;; ) { |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1020 |
|
3283
52b1624b93c2
fix segfault in SSL if limit_rate is used
Igor Sysoev <igor@sysoev.ru>
parents:
3159
diff
changeset
|
1021 while (in && buf->last < buf->end && send < limit) { |
| 583 | 1022 if (in->buf->last_buf || in->buf->flush) { |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1023 flush = 1; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1024 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1025 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1026 if (ngx_buf_special(in->buf)) { |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1027 in = in->next; |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1028 continue; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1029 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1030 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1031 size = in->buf->last - in->buf->pos; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1032 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1033 if (size > buf->end - buf->last) { |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1034 size = buf->end - buf->last; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1035 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1036 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1037 if (send + size > limit) { |
| 577 | 1038 size = (ssize_t) (limit - send); |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1039 flush = 1; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1040 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1041 |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1042 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1043 "SSL buf copy: %d", size); |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1044 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1045 ngx_memcpy(buf->last, in->buf->pos, size); |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1046 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1047 buf->last += size; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1048 in->buf->pos += size; |
|
3283
52b1624b93c2
fix segfault in SSL if limit_rate is used
Igor Sysoev <igor@sysoev.ru>
parents:
3159
diff
changeset
|
1049 send += size; |
| 577 | 1050 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1051 if (in->buf->pos == in->buf->last) { |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1052 in = in->next; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1053 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1054 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1055 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1056 size = buf->last - buf->pos; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1057 |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1058 if (!flush && buf->last < buf->end && c->ssl->buffer) { |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1059 break; |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1060 } |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1061 |
|
398
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1062 n = ngx_ssl_write(c, buf->pos, size); |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1063 |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1064 if (n == NGX_ERROR) { |
|
201b5f68b59f
nginx-0.0.7-2004-07-23-21:05:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
397
diff
changeset
|
1065 return NGX_CHAIN_ERROR; |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1066 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1067 |
| 511 | 1068 if (n == NGX_AGAIN) { |
| 597 | 1069 c->buffered |= NGX_SSL_BUFFERED; |
| 511 | 1070 return in; |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1071 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1072 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1073 buf->pos += n; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1074 c->sent += n; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1075 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1076 if (n < size) { |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1077 break; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1078 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1079 |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1080 if (buf->pos == buf->last) { |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1081 buf->pos = buf->start; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1082 buf->last = buf->start; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1083 } |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1084 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1085 if (in == NULL || send == limit) { |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1086 break; |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1087 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1088 } |
|
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1089 |
| 597 | 1090 if (buf->pos < buf->last) { |
| 1091 c->buffered |= NGX_SSL_BUFFERED; | |
| 1092 | |
| 1093 } else { | |
| 1094 c->buffered &= ~NGX_SSL_BUFFERED; | |
| 1095 } | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1096 |
|
399
4e21d1291a14
nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents:
398
diff
changeset
|
1097 return in; |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1098 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1099 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1100 |
| 539 | 1101 ssize_t |
| 489 | 1102 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size) |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1103 { |
| 547 | 1104 int n, sslerr; |
| 1105 ngx_err_t err; | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1106 |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1107 ngx_ssl_clear_error(c->log); |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1108 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1109 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size); |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1110 |
| 543 | 1111 n = SSL_write(c->ssl->connection, data, size); |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1112 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1113 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n); |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1114 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1115 if (n > 0) { |
| 539 | 1116 |
| 473 | 1117 if (c->ssl->saved_read_handler) { |
| 1118 | |
| 509 | 1119 c->read->handler = c->ssl->saved_read_handler; |
| 473 | 1120 c->ssl->saved_read_handler = NULL; |
| 1121 c->read->ready = 1; | |
| 1122 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
1123 if (ngx_handle_read_event(c->read, 0) != NGX_OK) { |
| 473 | 1124 return NGX_ERROR; |
| 1125 } | |
| 1126 | |
| 563 | 1127 ngx_post_event(c->read, &ngx_posted_events); |
| 473 | 1128 } |
| 1129 | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1130 return n; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1131 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1132 |
| 543 | 1133 sslerr = SSL_get_error(c->ssl->connection, n); |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1134 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1135 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1136 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1137 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1138 |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1139 if (sslerr == SSL_ERROR_WANT_WRITE) { |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1140 c->write->ready = 0; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1141 return NGX_AGAIN; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1142 } |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1143 |
|
445
f26432a1935a
nginx-0.1.0-2004-09-30-10:38:49 import
Igor Sysoev <igor@sysoev.ru>
parents:
444
diff
changeset
|
1144 if (sslerr == SSL_ERROR_WANT_READ) { |
| 452 | 1145 |
| 547 | 1146 ngx_log_error(NGX_LOG_INFO, c->log, 0, |
| 577 | 1147 "peer started SSL renegotiation"); |
| 473 | 1148 |
| 1149 c->read->ready = 0; | |
| 1150 | |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
1151 if (ngx_handle_read_event(c->read, 0) != NGX_OK) { |
| 473 | 1152 return NGX_ERROR; |
| 1153 } | |
| 1154 | |
| 1155 /* | |
| 1156 * we do not set the timer because there is already | |
| 1157 * the write event timer | |
| 1158 */ | |
| 1159 | |
| 1160 if (c->ssl->saved_read_handler == NULL) { | |
| 509 | 1161 c->ssl->saved_read_handler = c->read->handler; |
| 1162 c->read->handler = ngx_ssl_read_handler; | |
| 473 | 1163 } |
| 1164 | |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1165 return NGX_AGAIN; |
|
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1166 } |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1167 |
| 547 | 1168 c->ssl->no_wait_shutdown = 1; |
| 1169 c->ssl->no_send_shutdown = 1; | |
| 591 | 1170 c->write->error = 1; |
| 543 | 1171 |
| 547 | 1172 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed"); |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1173 |
|
397
de797f3b4c27
nginx-0.0.7-2004-07-23-09:37:29 import
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1174 return NGX_ERROR; |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1175 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1176 |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1177 |
| 489 | 1178 static void |
| 1179 ngx_ssl_read_handler(ngx_event_t *rev) | |
| 473 | 1180 { |
| 1181 ngx_connection_t *c; | |
| 1182 | |
| 1183 c = rev->data; | |
| 547 | 1184 |
| 509 | 1185 c->write->handler(c->write); |
| 473 | 1186 } |
| 1187 | |
| 1188 | |
|
1779
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1189 void |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1190 ngx_ssl_free_buffer(ngx_connection_t *c) |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1191 { |
|
1795
3a0132e2be2c
fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents:
1779
diff
changeset
|
1192 if (c->ssl->buf && c->ssl->buf->start) { |
|
3a0132e2be2c
fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents:
1779
diff
changeset
|
1193 if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) { |
|
3a0132e2be2c
fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents:
1779
diff
changeset
|
1194 c->ssl->buf->start = NULL; |
|
3a0132e2be2c
fix segfault introduced in r1780
Igor Sysoev <igor@sysoev.ru>
parents:
1779
diff
changeset
|
1195 } |
|
1779
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1196 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1197 } |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1198 |
|
06014cfdb5b1
create ssl buffer on demand and free it before keep-alive
Igor Sysoev <igor@sysoev.ru>
parents:
1778
diff
changeset
|
1199 |
| 489 | 1200 ngx_int_t |
| 1201 ngx_ssl_shutdown(ngx_connection_t *c) | |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1202 { |
|
1754
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1203 int n, sslerr, mode; |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1204 ngx_err_t err; |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1205 |
| 577 | 1206 if (c->timedout) { |
| 547 | 1207 mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN; |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1208 |
| 547 | 1209 } else { |
| 1210 mode = SSL_get_shutdown(c->ssl->connection); | |
| 473 | 1211 |
| 547 | 1212 if (c->ssl->no_wait_shutdown) { |
| 1213 mode |= SSL_RECEIVED_SHUTDOWN; | |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1214 } |
|
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1215 |
| 547 | 1216 if (c->ssl->no_send_shutdown) { |
| 1217 mode |= SSL_SENT_SHUTDOWN; | |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1218 } |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1219 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1220 |
| 547 | 1221 SSL_set_shutdown(c->ssl->connection, mode); |
| 1222 | |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1223 ngx_ssl_clear_error(c->log); |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1224 |
|
1754
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1225 n = SSL_shutdown(c->ssl->connection); |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1226 |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1227 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n); |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1228 |
| 461 | 1229 sslerr = 0; |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1230 |
| 1860 | 1231 /* SSL_shutdown() never returns -1, on error it returns 0 */ |
| 543 | 1232 |
|
1865
4bcbb0fe5c8d
fix bogus crit log message "SSL_shutdown() failed" introduced in r1755
Igor Sysoev <igor@sysoev.ru>
parents:
1861
diff
changeset
|
1233 if (n != 1 && ERR_peek_error()) { |
| 543 | 1234 sslerr = SSL_get_error(c->ssl->connection, n); |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1235 |
|
396
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1236 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, |
|
6f3b20c1ac50
nginx-0.0.7-2004-07-18-23:11:20 import
Igor Sysoev <igor@sysoev.ru>
parents:
395
diff
changeset
|
1237 "SSL_get_error: %d", sslerr); |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1238 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1239 |
|
1865
4bcbb0fe5c8d
fix bogus crit log message "SSL_shutdown() failed" introduced in r1755
Igor Sysoev <igor@sysoev.ru>
parents:
1861
diff
changeset
|
1240 if (n == 1 || sslerr == 0 || sslerr == SSL_ERROR_ZERO_RETURN) { |
|
1754
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1241 SSL_free(c->ssl->connection); |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1242 c->ssl = NULL; |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1243 |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1244 return NGX_OK; |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1245 } |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1246 |
|
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1247 if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) { |
| 577 | 1248 c->read->handler = ngx_ssl_shutdown_handler; |
| 589 | 1249 c->write->handler = ngx_ssl_shutdown_handler; |
| 577 | 1250 |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
1251 if (ngx_handle_read_event(c->read, 0) != NGX_OK) { |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1252 return NGX_ERROR; |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1253 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1254 |
|
2388
722b5aff05ae
use "!= NGX_OK" instead of "== NGX_ERROR"
Igor Sysoev <igor@sysoev.ru>
parents:
2315
diff
changeset
|
1255 if (ngx_handle_write_event(c->write, 0) != NGX_OK) { |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1256 return NGX_ERROR; |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1257 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1258 |
|
1754
427d442e1ad8
SSL_shutdown() never returns -1, on error it returns 0.
Igor Sysoev <igor@sysoev.ru>
parents:
1743
diff
changeset
|
1259 if (sslerr == SSL_ERROR_WANT_READ) { |
| 589 | 1260 ngx_add_timer(c->read, 30000); |
| 1261 } | |
| 1262 | |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1263 return NGX_AGAIN; |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1264 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1265 |
| 591 | 1266 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; |
| 1267 | |
| 1268 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed"); | |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1269 |
| 543 | 1270 SSL_free(c->ssl->connection); |
| 1271 c->ssl = NULL; | |
| 1272 | |
|
394
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1273 return NGX_ERROR; |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1274 } |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1275 |
|
e7a68e14ccd3
nginx-0.0.7-2004-07-16-10:33:35 import
Igor Sysoev <igor@sysoev.ru>
parents:
393
diff
changeset
|
1276 |
| 547 | 1277 static void |
| 577 | 1278 ngx_ssl_shutdown_handler(ngx_event_t *ev) |
| 1279 { | |
| 1280 ngx_connection_t *c; | |
| 1281 ngx_connection_handler_pt handler; | |
| 1282 | |
| 1283 c = ev->data; | |
| 1284 handler = c->ssl->handler; | |
| 1285 | |
| 1286 if (ev->timedout) { | |
| 1287 c->timedout = 1; | |
| 1288 } | |
| 1289 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1290 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler"); |
| 577 | 1291 |
| 1292 if (ngx_ssl_shutdown(c) == NGX_AGAIN) { | |
| 1293 return; | |
| 1294 } | |
| 1295 | |
| 1296 handler(c); | |
| 1297 } | |
| 1298 | |
| 1299 | |
| 1300 static void | |
| 547 | 1301 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err, |
| 1302 char *text) | |
| 1303 { | |
|
1876
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1304 int n; |
| 547 | 1305 ngx_uint_t level; |
| 1306 | |
| 1307 level = NGX_LOG_CRIT; | |
| 1308 | |
| 1309 if (sslerr == SSL_ERROR_SYSCALL) { | |
| 1310 | |
| 1311 if (err == NGX_ECONNRESET | |
| 1312 || err == NGX_EPIPE | |
| 1313 || err == NGX_ENOTCONN | |
| 589 | 1314 || err == NGX_ETIMEDOUT |
| 547 | 1315 || err == NGX_ECONNREFUSED |
|
1869
192443881e51
add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents:
1868
diff
changeset
|
1316 || err == NGX_ENETDOWN |
|
192443881e51
add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents:
1868
diff
changeset
|
1317 || err == NGX_ENETUNREACH |
|
192443881e51
add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN
Igor Sysoev <igor@sysoev.ru>
parents:
1868
diff
changeset
|
1318 || err == NGX_EHOSTDOWN |
| 547 | 1319 || err == NGX_EHOSTUNREACH) |
| 1320 { | |
| 1321 switch (c->log_error) { | |
| 1322 | |
| 1323 case NGX_ERROR_IGNORE_ECONNRESET: | |
| 1324 case NGX_ERROR_INFO: | |
| 1325 level = NGX_LOG_INFO; | |
| 1326 break; | |
| 1327 | |
| 1328 case NGX_ERROR_ERR: | |
| 1329 level = NGX_LOG_ERR; | |
| 1330 break; | |
| 1331 | |
| 1332 default: | |
| 1333 break; | |
| 1334 } | |
| 1335 } | |
|
1876
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1336 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1337 } else if (sslerr == SSL_ERROR_SSL) { |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1338 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1339 n = ERR_GET_REASON(ERR_peek_error()); |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1340 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1341 /* handshake failures */ |
|
3718
bfd84b583868
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
1342 if (n == SSL_R_BLOCK_CIPHER_PAD_IS_WRONG /* 129 */ |
|
bfd84b583868
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3516
diff
changeset
|
1343 || n == SSL_R_DIGEST_CHECK_FAILED /* 149 */ |
|
3455
028f0892e0cd
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3357
diff
changeset
|
1344 || n == SSL_R_LENGTH_MISMATCH /* 159 */ |
|
2315
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1345 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */ |
|
3455
028f0892e0cd
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3357
diff
changeset
|
1346 || n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */ |
|
2315
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1347 || n == SSL_R_NO_SHARED_CIPHER /* 193 */ |
|
3455
028f0892e0cd
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3357
diff
changeset
|
1348 || n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */ |
|
2315
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1349 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1350 || n == SSL_R_UNEXPECTED_RECORD /* 245 */ |
|
3455
028f0892e0cd
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3357
diff
changeset
|
1351 || n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */ |
|
3357
fc735aa50b8b
decrease SSL handshake error level to info
Igor Sysoev <igor@sysoev.ru>
parents:
3300
diff
changeset
|
1352 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */ |
|
2315
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1353 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1354 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */ |
|
1877
a55876dff8f5
low SSL handshake close notify alert error level
Igor Sysoev <igor@sysoev.ru>
parents:
1876
diff
changeset
|
1355 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */ |
|
2315
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1356 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1357 || n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC /* 1020 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1358 || n == SSL_R_TLSV1_ALERT_DECRYPTION_FAILED /* 1021 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1359 || n == SSL_R_TLSV1_ALERT_RECORD_OVERFLOW /* 1022 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1360 || n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE /* 1030 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1361 || n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE /* 1040 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1362 || n == SSL_R_SSLV3_ALERT_NO_CERTIFICATE /* 1041 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1363 || n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE /* 1042 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1364 || n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE /* 1043 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1365 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED /* 1044 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1366 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED /* 1045 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1367 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN /* 1046 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1368 || n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER /* 1047 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1369 || n == SSL_R_TLSV1_ALERT_UNKNOWN_CA /* 1048 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1370 || n == SSL_R_TLSV1_ALERT_ACCESS_DENIED /* 1049 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1371 || n == SSL_R_TLSV1_ALERT_DECODE_ERROR /* 1050 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1372 || n == SSL_R_TLSV1_ALERT_DECRYPT_ERROR /* 1051 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1373 || n == SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION /* 1060 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1374 || n == SSL_R_TLSV1_ALERT_PROTOCOL_VERSION /* 1070 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1375 || n == SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY /* 1071 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1376 || n == SSL_R_TLSV1_ALERT_INTERNAL_ERROR /* 1080 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1377 || n == SSL_R_TLSV1_ALERT_USER_CANCELLED /* 1090 */ |
|
31fafd8e7436
low some SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
2280
diff
changeset
|
1378 || n == SSL_R_TLSV1_ALERT_NO_RENEGOTIATION) /* 1100 */ |
|
1876
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1379 { |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1380 switch (c->log_error) { |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1381 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1382 case NGX_ERROR_IGNORE_ECONNRESET: |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1383 case NGX_ERROR_INFO: |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1384 level = NGX_LOG_INFO; |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1385 break; |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1386 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1387 case NGX_ERROR_ERR: |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1388 level = NGX_LOG_ERR; |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1389 break; |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1390 |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1391 default: |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1392 break; |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1393 } |
|
5d663752fd96
low SSL handshake errors level
Igor Sysoev <igor@sysoev.ru>
parents:
1873
diff
changeset
|
1394 } |
| 547 | 1395 } |
| 1396 | |
| 1397 ngx_ssl_error(level, c->log, err, text); | |
| 1398 } | |
| 1399 | |
| 1400 | |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1401 static void |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1402 ngx_ssl_clear_error(ngx_log_t *log) |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1403 { |
| 1868 | 1404 while (ERR_peek_error()) { |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1405 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error"); |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1406 } |
| 1868 | 1407 |
| 1408 ERR_clear_error(); | |
|
1755
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1409 } |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1410 |
|
59e36c1c6296
cleaning stale global SSL error
Igor Sysoev <igor@sysoev.ru>
parents:
1754
diff
changeset
|
1411 |
| 583 | 1412 void ngx_cdecl |
| 489 | 1413 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...) |
| 577 | 1414 { |
| 1861 | 1415 u_long n; |
| 1416 va_list args; | |
| 1417 u_char *p, *last; | |
| 1418 u_char errstr[NGX_MAX_CONF_ERRSTR]; | |
| 461 | 1419 |
| 1420 last = errstr + NGX_MAX_CONF_ERRSTR; | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1421 |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1422 va_start(args, fmt); |
|
2764
d4a717592877
use ngx_vslprintf(), ngx_slprintf()
Igor Sysoev <igor@sysoev.ru>
parents:
2720
diff
changeset
|
1423 p = ngx_vslprintf(errstr, last - 1, fmt, args); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1424 va_end(args); |
|
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1425 |
| 547 | 1426 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p); |
| 1427 | |
| 1861 | 1428 for ( ;; ) { |
| 583 | 1429 |
| 1430 n = ERR_get_error(); | |
| 1431 | |
| 1432 if (n == 0) { | |
| 1433 break; | |
| 1434 } | |
| 547 | 1435 |
| 1861 | 1436 if (p >= last) { |
| 1437 continue; | |
| 1438 } | |
| 1439 | |
| 547 | 1440 *p++ = ' '; |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1441 |
| 547 | 1442 ERR_error_string_n(n, (char *) p, last - p); |
| 1443 | |
| 1444 while (p < last && *p) { | |
| 1445 p++; | |
| 1446 } | |
| 1447 } | |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1448 |
|
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
1449 ngx_log_error(level, log, err, "%s)", errstr); |
|
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1450 } |
| 509 | 1451 |
| 1452 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1453 ngx_int_t |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1454 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1455 ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1456 { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1457 long cache_mode; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1458 |
| 1778 | 1459 if (builtin_session_cache == NGX_SSL_NO_SCACHE) { |
| 1460 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF); | |
| 1461 return NGX_OK; | |
| 1462 } | |
| 1463 | |
|
3457
17706823a57e
Set SSL session context for "ssl_session_cache none".
Igor Sysoev <igor@sysoev.ru>
parents:
3455
diff
changeset
|
1464 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len); |
|
17706823a57e
Set SSL session context for "ssl_session_cache none".
Igor Sysoev <igor@sysoev.ru>
parents:
3455
diff
changeset
|
1465 |
| 2032 | 1466 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) { |
| 1467 | |
| 1468 /* | |
| 1469 * If the server explicitly says that it does not support | |
| 1470 * session reuse (see SSL_SESS_CACHE_OFF above), then | |
| 1471 * Outlook Express fails to upload a sent email to | |
| 1472 * the Sent Items folder on the IMAP server via a separate IMAP | |
| 1473 * connection in the background. Therefore we have a special | |
| 1474 * mode (SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_STORE) | |
| 1475 * where the server pretends that it supports session reuse, | |
| 1476 * but it does not actually store any session. | |
| 1477 */ | |
| 1478 | |
| 1479 SSL_CTX_set_session_cache_mode(ssl->ctx, | |
| 1480 SSL_SESS_CACHE_SERVER | |
| 1481 |SSL_SESS_CACHE_NO_AUTO_CLEAR | |
| 1482 |SSL_SESS_CACHE_NO_INTERNAL_STORE); | |
| 1483 | |
| 1484 SSL_CTX_sess_set_cache_size(ssl->ctx, 1); | |
| 1485 | |
| 1486 return NGX_OK; | |
| 1487 } | |
| 1488 | |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1489 cache_mode = SSL_SESS_CACHE_SERVER; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1490 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1491 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1492 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1493 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1494 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1495 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1496 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1497 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1498 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1499 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1500 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1501 } |
|
1015
32ebb6b13ff3
ssl_session_timeout was set only if builtin cache was used
Igor Sysoev <igor@sysoev.ru>
parents:
1014
diff
changeset
|
1502 } |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1503 |
| 2710 | 1504 SSL_CTX_set_timeout(ssl->ctx, (long) timeout); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1505 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1506 if (shm_zone) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1507 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1508 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1509 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1510 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1511 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1512 == 0) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1513 { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1514 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1515 "SSL_CTX_set_ex_data() failed"); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1516 return NGX_ERROR; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1517 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1518 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1519 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1520 return NGX_OK; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1521 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1522 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1523 |
|
3992
a1dd9dc754ab
A new fix for the case when ssl_session_cache defined, but ssl is not
Igor Sysoev <igor@sysoev.ru>
parents:
3962
diff
changeset
|
1524 ngx_int_t |
|
993
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1525 ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data) |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1526 { |
|
2611
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1527 size_t len; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1528 ngx_slab_pool_t *shpool; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1529 ngx_ssl_session_cache_t *cache; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1530 |
|
993
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1531 if (data) { |
|
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1532 shm_zone->data = data; |
|
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1533 return NGX_OK; |
|
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1534 } |
|
1b9a4d92173f
pass the inherited shm_zone data
Igor Sysoev <igor@sysoev.ru>
parents:
989
diff
changeset
|
1535 |
|
2720
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1536 if (shm_zone->shm.exists) { |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1537 shm_zone->data = data; |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1538 return NGX_OK; |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1539 } |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1540 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1541 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1542 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1543 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t)); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1544 if (cache == NULL) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1545 return NGX_ERROR; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1546 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1547 |
|
2720
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1548 shpool->data = cache; |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1549 shm_zone->data = cache; |
|
b3b8c66bd520
support attaching to an existent Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
1550 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1551 ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel, |
|
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1552 ngx_ssl_session_rbtree_insert_value); |
|
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1553 |
| 1760 | 1554 ngx_queue_init(&cache->expire_queue); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1555 |
|
2716
d5896f6608e8
move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2710
diff
changeset
|
1556 len = sizeof(" in SSL session shared cache \"\"") + shm_zone->shm.name.len; |
|
2611
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1557 |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1558 shpool->log_ctx = ngx_slab_alloc(shpool, len); |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1559 if (shpool->log_ctx == NULL) { |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1560 return NGX_ERROR; |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1561 } |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1562 |
|
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1563 ngx_sprintf(shpool->log_ctx, " in SSL session shared cache \"%V\"%Z", |
|
2716
d5896f6608e8
move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory
Igor Sysoev <igor@sysoev.ru>
parents:
2710
diff
changeset
|
1564 &shm_zone->shm.name); |
|
2611
2bce3f6416c6
improve ngx_slab_alloc() error logging
Igor Sysoev <igor@sysoev.ru>
parents:
2536
diff
changeset
|
1565 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1566 return NGX_OK; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1567 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1568 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1569 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1570 /* |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1571 * The length of the session id is 16 bytes for SSLv2 sessions and |
|
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1572 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes. |
|
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1573 * It seems that the typical length of the external ASN1 representation |
|
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1574 * of a session is 118 or 119 bytes for SSLv3/TSLv1. |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1575 * |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1576 * Thus on 32-bit platforms we allocate separately an rbtree node, |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1577 * a session id, and an ASN1 representation, they take accordingly |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1578 * 64, 32, and 128 bytes. |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1579 * |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1580 * On 64-bit platforms we allocate separately an rbtree node + session_id, |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1581 * and an ASN1 representation, they take accordingly 128 and 128 bytes. |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1582 * |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1583 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1584 * so they are outside the code locked by shared pool mutex |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1585 */ |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1586 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1587 static int |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1588 ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1589 { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1590 int len; |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1591 u_char *p, *id, *cached_sess; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1592 uint32_t hash; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1593 SSL_CTX *ssl_ctx; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1594 ngx_shm_zone_t *shm_zone; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1595 ngx_connection_t *c; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1596 ngx_slab_pool_t *shpool; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1597 ngx_ssl_sess_id_t *sess_id; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1598 ngx_ssl_session_cache_t *cache; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1599 u_char buf[NGX_SSL_MAX_SESSION_SIZE]; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1600 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1601 len = i2d_SSL_SESSION(sess, NULL); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1602 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1603 /* do not cache too big session */ |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1604 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1605 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1606 return 0; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1607 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1608 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1609 p = buf; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1610 i2d_SSL_SESSION(sess, &p); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1611 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1612 c = ngx_ssl_get_connection(ssl_conn); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1613 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1614 ssl_ctx = SSL_get_SSL_CTX(ssl_conn); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1615 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1616 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1617 cache = shm_zone->data; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1618 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1619 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1620 ngx_shmtx_lock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1621 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1622 /* drop one or two expired sessions */ |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1623 ngx_ssl_expire_sessions(cache, shpool, 1); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1624 |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1625 cached_sess = ngx_slab_alloc_locked(shpool, len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1626 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1627 if (cached_sess == NULL) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1628 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1629 /* drop the oldest non-expired session and try once more */ |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1630 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1631 ngx_ssl_expire_sessions(cache, shpool, 0); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1632 |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1633 cached_sess = ngx_slab_alloc_locked(shpool, len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1634 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1635 if (cached_sess == NULL) { |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1636 sess_id = NULL; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1637 goto failed; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1638 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1639 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1640 |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1641 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t)); |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1642 if (sess_id == NULL) { |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1643 goto failed; |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1644 } |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1645 |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1646 #if (NGX_PTR_SIZE == 8) |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1647 |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1648 id = sess_id->sess_id; |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1649 |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1650 #else |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1651 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1652 id = ngx_slab_alloc_locked(shpool, sess->session_id_length); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1653 if (id == NULL) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1654 goto failed; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1655 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1656 |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1657 #endif |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1658 |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1659 ngx_memcpy(cached_sess, buf, len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1660 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1661 ngx_memcpy(id, sess->session_id, sess->session_id_length); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1662 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1663 hash = ngx_crc32_short(sess->session_id, sess->session_id_length); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1664 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1665 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 3155 | 1666 "ssl new session: %08XD:%d:%d", |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1667 hash, sess->session_id_length, len); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1668 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1669 sess_id->node.key = hash; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1670 sess_id->node.data = (u_char) sess->session_id_length; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1671 sess_id->id = id; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1672 sess_id->len = len; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1673 sess_id->session = cached_sess; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1674 |
|
1757
7ab8bd535eed
use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents:
1756
diff
changeset
|
1675 sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1676 |
| 1760 | 1677 ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1678 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1679 ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1680 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1681 ngx_shmtx_unlock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1682 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1683 return 0; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1684 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1685 failed: |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1686 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1687 if (cached_sess) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1688 ngx_slab_free_locked(shpool, cached_sess); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1689 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1690 |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1691 if (sess_id) { |
|
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1692 ngx_slab_free_locked(shpool, sess_id); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1693 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1694 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1695 ngx_shmtx_unlock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1696 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1697 ngx_log_error(NGX_LOG_ALERT, c->log, 0, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1698 "could not add new SSL session to the session cache"); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1699 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1700 return 0; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1701 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1702 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1703 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1704 static ngx_ssl_session_t * |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1705 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn, u_char *id, int len, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1706 int *copy) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1707 { |
|
989
5595e47d4f17
d2i_SSL_SESSION() was changed in 0.9.7f
Igor Sysoev <igor@sysoev.ru>
parents:
974
diff
changeset
|
1708 #if OPENSSL_VERSION_NUMBER >= 0x0090707fL |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1709 const |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1710 #endif |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1711 u_char *p; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1712 uint32_t hash; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1713 ngx_int_t rc; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1714 ngx_shm_zone_t *shm_zone; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1715 ngx_slab_pool_t *shpool; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1716 ngx_rbtree_node_t *node, *sentinel; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1717 ngx_ssl_session_t *sess; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1718 ngx_ssl_sess_id_t *sess_id; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1719 ngx_ssl_session_cache_t *cache; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1720 u_char buf[NGX_SSL_MAX_SESSION_SIZE]; |
|
3961
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1721 #if (NGX_DEBUG) |
|
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1722 ngx_connection_t *c; |
|
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1723 #endif |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1724 |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1725 hash = ngx_crc32_short(id, (size_t) len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1726 *copy = 0; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1727 |
|
3961
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1728 #if (NGX_DEBUG) |
|
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1729 c = ngx_ssl_get_connection(ssl_conn); |
|
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1730 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1731 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, |
| 3155 | 1732 "ssl get session: %08XD:%d", hash, len); |
|
3961
4048aa055411
fix build by gcc46 with -Wunused-value option
Igor Sysoev <igor@sysoev.ru>
parents:
3960
diff
changeset
|
1733 #endif |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1734 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1735 shm_zone = SSL_CTX_get_ex_data(SSL_get_SSL_CTX(ssl_conn), |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1736 ngx_ssl_session_cache_index); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1737 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1738 cache = shm_zone->data; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1739 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1740 sess = NULL; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1741 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1742 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1743 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1744 ngx_shmtx_lock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1745 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1746 node = cache->session_rbtree.root; |
|
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1747 sentinel = cache->session_rbtree.sentinel; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1748 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1749 while (node != sentinel) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1750 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1751 if (hash < node->key) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1752 node = node->left; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1753 continue; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1754 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1755 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1756 if (hash > node->key) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1757 node = node->right; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1758 continue; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1759 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1760 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1761 /* hash == node->key */ |
|
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1762 |
|
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1763 do { |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1764 sess_id = (ngx_ssl_sess_id_t *) node; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1765 |
|
1029
ce08bc4cb97b
ngx_strn2cmp() > ngx_memn2cmp()
Igor Sysoev <igor@sysoev.ru>
parents:
1027
diff
changeset
|
1766 rc = ngx_memn2cmp(id, sess_id->id, |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1767 (size_t) len, (size_t) node->data); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1768 if (rc == 0) { |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1769 |
|
1757
7ab8bd535eed
use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents:
1756
diff
changeset
|
1770 if (sess_id->expire > ngx_time()) { |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1771 ngx_memcpy(buf, sess_id->session, sess_id->len); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1772 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1773 ngx_shmtx_unlock(&shpool->mutex); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1774 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1775 p = buf; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1776 sess = d2i_SSL_SESSION(NULL, &p, sess_id->len); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1777 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1778 return sess; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1779 } |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1780 |
| 1760 | 1781 ngx_queue_remove(&sess_id->queue); |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1782 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1783 ngx_rbtree_delete(&cache->session_rbtree, node); |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1784 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1785 ngx_slab_free_locked(shpool, sess_id->session); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1786 #if (NGX_PTR_SIZE == 4) |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1787 ngx_slab_free_locked(shpool, sess_id->id); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1788 #endif |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1789 ngx_slab_free_locked(shpool, sess_id); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1790 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1791 sess = NULL; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1792 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1793 goto done; |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1794 } |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1795 |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1796 node = (rc < 0) ? node->left : node->right; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1797 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1798 } while (node != sentinel && hash == node->key); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1799 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1800 break; |
|
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1801 } |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1802 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1803 done: |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1804 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1805 ngx_shmtx_unlock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1806 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1807 return sess; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1808 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1809 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1810 |
|
1924
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1811 void |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1812 ngx_ssl_remove_cached_session(SSL_CTX *ssl, ngx_ssl_session_t *sess) |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1813 { |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1814 SSL_CTX_remove_session(ssl, sess); |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1815 |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1816 ngx_ssl_remove_session(ssl, sess); |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1817 } |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1818 |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1819 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1820 static void |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1821 ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1822 { |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1823 size_t len; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1824 u_char *id; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1825 uint32_t hash; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1826 ngx_int_t rc; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1827 ngx_shm_zone_t *shm_zone; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1828 ngx_slab_pool_t *shpool; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1829 ngx_rbtree_node_t *node, *sentinel; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1830 ngx_ssl_sess_id_t *sess_id; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1831 ngx_ssl_session_cache_t *cache; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1832 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1833 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1834 |
|
1924
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1835 if (shm_zone == NULL) { |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1836 return; |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1837 } |
|
291689a7e5dc
invalidate SSL session if there is no valid client certificate
Igor Sysoev <igor@sysoev.ru>
parents:
1877
diff
changeset
|
1838 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1839 cache = shm_zone->data; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1840 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1841 id = sess->session_id; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1842 len = (size_t) sess->session_id_length; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1843 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1844 hash = ngx_crc32_short(id, len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1845 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1846 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0, |
| 3155 | 1847 "ssl remove session: %08XD:%uz", hash, len); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1848 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1849 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1850 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1851 ngx_shmtx_lock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1852 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1853 node = cache->session_rbtree.root; |
|
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1854 sentinel = cache->session_rbtree.sentinel; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1855 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1856 while (node != sentinel) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1857 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1858 if (hash < node->key) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1859 node = node->left; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1860 continue; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1861 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1862 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1863 if (hash > node->key) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1864 node = node->right; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1865 continue; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1866 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1867 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1868 /* hash == node->key */ |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1869 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1870 do { |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1871 sess_id = (ngx_ssl_sess_id_t *) node; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1872 |
|
1029
ce08bc4cb97b
ngx_strn2cmp() > ngx_memn2cmp()
Igor Sysoev <igor@sysoev.ru>
parents:
1027
diff
changeset
|
1873 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data); |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1874 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1875 if (rc == 0) { |
| 1760 | 1876 |
| 1877 ngx_queue_remove(&sess_id->queue); | |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1878 |
|
1759
89234cfbf810
embed session_rbtree and sentinel inside ngx_ssl_session_cache_t
Igor Sysoev <igor@sysoev.ru>
parents:
1758
diff
changeset
|
1879 ngx_rbtree_delete(&cache->session_rbtree, node); |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1880 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1881 ngx_slab_free_locked(shpool, sess_id->session); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1882 #if (NGX_PTR_SIZE == 4) |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1883 ngx_slab_free_locked(shpool, sess_id->id); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1884 #endif |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1885 ngx_slab_free_locked(shpool, sess_id); |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1886 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1887 goto done; |
| 1025 | 1888 } |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1889 |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1890 node = (rc < 0) ? node->left : node->right; |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1891 |
|
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1892 } while (node != sentinel && hash == node->key); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1893 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1894 break; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1895 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1896 |
|
1013
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1897 done: |
|
7dd987e09701
stop rbtree search early if equal hash was found
Igor Sysoev <igor@sysoev.ru>
parents:
993
diff
changeset
|
1898 |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1899 ngx_shmtx_unlock(&shpool->mutex); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1900 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1901 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1902 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1903 static void |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1904 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1905 ngx_slab_pool_t *shpool, ngx_uint_t n) |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1906 { |
|
1757
7ab8bd535eed
use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents:
1756
diff
changeset
|
1907 time_t now; |
| 1760 | 1908 ngx_queue_t *q; |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1909 ngx_ssl_sess_id_t *sess_id; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1910 |
|
1757
7ab8bd535eed
use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents:
1756
diff
changeset
|
1911 now = ngx_time(); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1912 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1913 while (n < 3) { |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1914 |
| 1760 | 1915 if (ngx_queue_empty(&cache->expire_queue)) { |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1916 return; |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1917 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1918 |
| 1760 | 1919 q = ngx_queue_last(&cache->expire_queue); |
| 1920 | |
| 1921 sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue); | |
| 1922 | |
|
1757
7ab8bd535eed
use ngx_time() instead of ngx_timeofday()
Igor Sysoev <igor@sysoev.ru>
parents:
1756
diff
changeset
|
1923 if (n++ != 0 && sess_id->expire > now) { |
| 1439 | 1924 return; |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1925 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1926 |
| 1760 | 1927 ngx_queue_remove(q); |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1928 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1929 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0, |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1930 "expire session: %08Xi", sess_id->node.key); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1931 |
| 1760 | 1932 ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node); |
| 1933 | |
|
1014
5ffd76a9ccf3
optimize the SSL session cache allocations
Igor Sysoev <igor@sysoev.ru>
parents:
1013
diff
changeset
|
1934 ngx_slab_free_locked(shpool, sess_id->session); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1935 #if (NGX_PTR_SIZE == 4) |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1936 ngx_slab_free_locked(shpool, sess_id->id); |
|
1017
ee25c79bea34
optimize the SSL session cache allocations on 64-bit platforms
Igor Sysoev <igor@sysoev.ru>
parents:
1015
diff
changeset
|
1937 #endif |
|
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1938 ngx_slab_free_locked(shpool, sess_id); |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1939 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1940 } |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1941 |
|
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
969
diff
changeset
|
1942 |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1943 static void |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1944 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp, |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1945 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel) |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1946 { |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1947 ngx_rbtree_node_t **p; |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1948 ngx_ssl_sess_id_t *sess_id, *sess_id_temp; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1949 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1950 for ( ;; ) { |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1951 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1952 if (node->key < temp->key) { |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1953 |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1954 p = &temp->left; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1955 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1956 } else if (node->key > temp->key) { |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1957 |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1958 p = &temp->right; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1959 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1960 } else { /* node->key == temp->key */ |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1961 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1962 sess_id = (ngx_ssl_sess_id_t *) node; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1963 sess_id_temp = (ngx_ssl_sess_id_t *) temp; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1964 |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1965 p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id, |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1966 (size_t) node->data, (size_t) temp->data) |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1967 < 0) ? &temp->left : &temp->right; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1968 } |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1969 |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1970 if (*p == sentinel) { |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1971 break; |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1972 } |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1973 |
|
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1974 temp = *p; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1975 } |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1976 |
|
1743
4fc402c3ec73
optimize rbtree initialization and insert
Igor Sysoev <igor@sysoev.ru>
parents:
1439
diff
changeset
|
1977 *p = node; |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1978 node->parent = temp; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1979 node->left = sentinel; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1980 node->right = sentinel; |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1981 ngx_rbt_red(node); |
|
1043
7073b87fa8e9
style fix: remove trailing spaces
Igor Sysoev <igor@sysoev.ru>
parents:
1029
diff
changeset
|
1982 } |
|
1027
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1983 |
|
ff07ccfaad50
fix duplicate rbtree keys case
Igor Sysoev <igor@sysoev.ru>
parents:
1025
diff
changeset
|
1984 |
| 509 | 1985 void |
| 1986 ngx_ssl_cleanup_ctx(void *data) | |
| 1987 { | |
| 589 | 1988 ngx_ssl_t *ssl = data; |
| 509 | 1989 |
| 589 | 1990 SSL_CTX_free(ssl->ctx); |
| 509 | 1991 } |
| 541 | 1992 |
| 1993 | |
| 671 | 1994 ngx_int_t |
| 1995 ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) | |
| 611 | 1996 { |
| 671 | 1997 s->data = (u_char *) SSL_get_version(c->ssl->connection); |
| 1998 return NGX_OK; | |
| 611 | 1999 } |
| 2000 | |
| 2001 | |
| 671 | 2002 ngx_int_t |
| 2003 ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) | |
| 611 | 2004 { |
| 671 | 2005 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection); |
| 2006 return NGX_OK; | |
| 611 | 2007 } |
| 2008 | |
| 2009 | |
| 647 | 2010 ngx_int_t |
| 3154 | 2011 ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) |
| 2012 { | |
| 2013 int len; | |
| 2014 u_char *p, *buf; | |
| 2015 SSL_SESSION *sess; | |
| 2016 | |
| 2017 sess = SSL_get0_session(c->ssl->connection); | |
| 2018 | |
| 2019 len = i2d_SSL_SESSION(sess, NULL); | |
| 2020 | |
| 2021 buf = ngx_alloc(len, c->log); | |
| 2022 if (buf == NULL) { | |
| 2023 return NGX_ERROR; | |
| 2024 } | |
| 2025 | |
| 2026 s->len = 2 * len; | |
| 2027 s->data = ngx_pnalloc(pool, 2 * len); | |
| 2028 if (s->data == NULL) { | |
| 3159 | 2029 ngx_free(buf); |
| 3154 | 2030 return NGX_ERROR; |
| 2031 } | |
| 2032 | |
| 2033 p = buf; | |
| 2034 i2d_SSL_SESSION(sess, &p); | |
| 2035 | |
| 2036 ngx_hex_dump(s->data, buf, len); | |
| 2037 | |
| 2038 ngx_free(buf); | |
| 2039 | |
| 2040 return NGX_OK; | |
| 2041 } | |
| 2042 | |
| 2043 | |
| 2044 ngx_int_t | |
| 2123 | 2045 ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) |
| 2045 | 2046 { |
| 2047 size_t len; | |
| 2048 BIO *bio; | |
| 2049 X509 *cert; | |
| 2050 | |
| 2051 s->len = 0; | |
| 2052 | |
| 2053 cert = SSL_get_peer_certificate(c->ssl->connection); | |
| 2054 if (cert == NULL) { | |
| 2055 return NGX_OK; | |
| 2056 } | |
| 2057 | |
| 2058 bio = BIO_new(BIO_s_mem()); | |
| 2059 if (bio == NULL) { | |
| 2060 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed"); | |
| 2061 X509_free(cert); | |
| 2062 return NGX_ERROR; | |
| 2063 } | |
| 2064 | |
| 2065 if (PEM_write_bio_X509(bio, cert) == 0) { | |
| 2066 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed"); | |
| 2067 goto failed; | |
| 2068 } | |
| 2069 | |
| 2070 len = BIO_pending(bio); | |
| 2071 s->len = len; | |
| 2072 | |
| 2049 | 2073 s->data = ngx_pnalloc(pool, len); |
| 2045 | 2074 if (s->data == NULL) { |
| 2075 goto failed; | |
| 2076 } | |
| 2077 | |
| 2078 BIO_read(bio, s->data, len); | |
| 2079 | |
| 2080 BIO_free(bio); | |
| 2081 X509_free(cert); | |
| 2082 | |
| 2083 return NGX_OK; | |
| 2084 | |
| 2085 failed: | |
| 2086 | |
| 2087 BIO_free(bio); | |
| 2088 X509_free(cert); | |
| 2089 | |
| 2090 return NGX_ERROR; | |
| 2091 } | |
| 2092 | |
| 2093 | |
| 2094 ngx_int_t | |
| 2123 | 2095 ngx_ssl_get_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) |
| 2096 { | |
| 2097 u_char *p; | |
| 2098 size_t len; | |
| 2099 ngx_uint_t i; | |
| 2100 ngx_str_t cert; | |
| 2101 | |
| 2102 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) { | |
| 2103 return NGX_ERROR; | |
| 2104 } | |
| 2105 | |
| 2106 if (cert.len == 0) { | |
| 2107 s->len = 0; | |
| 2108 return NGX_OK; | |
| 2109 } | |
| 2110 | |
| 2111 len = cert.len - 1; | |
| 2112 | |
| 2113 for (i = 0; i < cert.len - 1; i++) { | |
| 2114 if (cert.data[i] == LF) { | |
| 2115 len++; | |
| 2116 } | |
| 2117 } | |
| 2118 | |
| 2119 s->len = len; | |
| 2120 s->data = ngx_pnalloc(pool, len); | |
| 2121 if (s->data == NULL) { | |
| 2122 return NGX_ERROR; | |
| 2123 } | |
| 2124 | |
| 2125 p = s->data; | |
| 2126 | |
|
3002
bf0c7e58e016
fix memory corruption in $ssl_client_cert
Igor Sysoev <igor@sysoev.ru>
parents:
2997
diff
changeset
|
2127 for (i = 0; i < cert.len - 1; i++) { |
| 2123 | 2128 *p++ = cert.data[i]; |
| 2129 if (cert.data[i] == LF) { | |
| 2130 *p++ = '\t'; | |
| 2131 } | |
| 2132 } | |
| 2133 | |
| 2134 return NGX_OK; | |
| 2135 } | |
| 2136 | |
| 2137 | |
| 2138 ngx_int_t | |
| 647 | 2139 ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) |
| 2140 { | |
| 2141 char *p; | |
| 2142 size_t len; | |
| 2143 X509 *cert; | |
| 2144 X509_NAME *name; | |
| 2145 | |
| 2146 s->len = 0; | |
| 2147 | |
| 2148 cert = SSL_get_peer_certificate(c->ssl->connection); | |
| 2149 if (cert == NULL) { | |
| 2150 return NGX_OK; | |
| 2151 } | |
| 2152 | |
| 2153 name = X509_get_subject_name(cert); | |
| 2154 if (name == NULL) { | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2155 X509_free(cert); |
| 647 | 2156 return NGX_ERROR; |
| 2157 } | |
| 2158 | |
| 2159 p = X509_NAME_oneline(name, NULL, 0); | |
| 2160 | |
| 2161 for (len = 0; p[len]; len++) { /* void */ } | |
| 2162 | |
| 2163 s->len = len; | |
| 2049 | 2164 s->data = ngx_pnalloc(pool, len); |
| 647 | 2165 if (s->data == NULL) { |
| 2166 OPENSSL_free(p); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2167 X509_free(cert); |
| 647 | 2168 return NGX_ERROR; |
| 2169 } | |
| 2170 | |
| 2171 ngx_memcpy(s->data, p, len); | |
| 2172 | |
| 2173 OPENSSL_free(p); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2174 X509_free(cert); |
| 647 | 2175 |
| 2176 return NGX_OK; | |
| 2177 } | |
| 2178 | |
| 2179 | |
| 2180 ngx_int_t | |
| 2181 ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) | |
| 2182 { | |
| 2183 char *p; | |
| 2184 size_t len; | |
| 2185 X509 *cert; | |
| 2186 X509_NAME *name; | |
| 2187 | |
| 2188 s->len = 0; | |
| 2189 | |
| 2190 cert = SSL_get_peer_certificate(c->ssl->connection); | |
| 2191 if (cert == NULL) { | |
| 2192 return NGX_OK; | |
| 2193 } | |
| 2194 | |
| 2195 name = X509_get_issuer_name(cert); | |
| 2196 if (name == NULL) { | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2197 X509_free(cert); |
| 647 | 2198 return NGX_ERROR; |
| 2199 } | |
| 2200 | |
| 2201 p = X509_NAME_oneline(name, NULL, 0); | |
| 2202 | |
| 2203 for (len = 0; p[len]; len++) { /* void */ } | |
| 2204 | |
| 2205 s->len = len; | |
| 2049 | 2206 s->data = ngx_pnalloc(pool, len); |
| 647 | 2207 if (s->data == NULL) { |
| 2208 OPENSSL_free(p); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2209 X509_free(cert); |
| 647 | 2210 return NGX_ERROR; |
| 2211 } | |
| 2212 | |
| 2213 ngx_memcpy(s->data, p, len); | |
| 2214 | |
| 2215 OPENSSL_free(p); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2216 X509_free(cert); |
| 647 | 2217 |
| 2218 return NGX_OK; | |
| 2219 } | |
| 2220 | |
| 2221 | |
| 671 | 2222 ngx_int_t |
| 2223 ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) | |
| 2224 { | |
| 2225 size_t len; | |
| 2226 X509 *cert; | |
| 2227 BIO *bio; | |
| 2228 | |
| 2229 s->len = 0; | |
| 2230 | |
| 2231 cert = SSL_get_peer_certificate(c->ssl->connection); | |
| 2232 if (cert == NULL) { | |
| 2233 return NGX_OK; | |
| 2234 } | |
| 2235 | |
| 2236 bio = BIO_new(BIO_s_mem()); | |
| 2237 if (bio == NULL) { | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2238 X509_free(cert); |
| 671 | 2239 return NGX_ERROR; |
| 2240 } | |
| 2241 | |
| 2242 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert)); | |
| 2243 len = BIO_pending(bio); | |
| 2244 | |
| 2245 s->len = len; | |
| 2049 | 2246 s->data = ngx_pnalloc(pool, len); |
| 671 | 2247 if (s->data == NULL) { |
| 2248 BIO_free(bio); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2249 X509_free(cert); |
| 671 | 2250 return NGX_ERROR; |
| 2251 } | |
| 2252 | |
| 2253 BIO_read(bio, s->data, len); | |
| 2254 BIO_free(bio); | |
|
1974
f32cc6df6bd6
fix memory leak when ssl_verify_client is on
Igor Sysoev <igor@sysoev.ru>
parents:
1948
diff
changeset
|
2255 X509_free(cert); |
| 671 | 2256 |
| 2257 return NGX_OK; | |
| 2258 } | |
| 2259 | |
| 2260 | |
| 2994 | 2261 ngx_int_t |
| 2262 ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) | |
| 2263 { | |
| 2264 X509 *cert; | |
| 2265 | |
| 2266 if (SSL_get_verify_result(c->ssl->connection) != X509_V_OK) { | |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3488
diff
changeset
|
2267 ngx_str_set(s, "FAILED"); |
| 2994 | 2268 return NGX_OK; |
| 2269 } | |
| 2270 | |
| 2271 cert = SSL_get_peer_certificate(c->ssl->connection); | |
| 2272 | |
| 2273 if (cert) { | |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3488
diff
changeset
|
2274 ngx_str_set(s, "SUCCESS"); |
| 2994 | 2275 |
| 2276 } else { | |
|
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3488
diff
changeset
|
2277 ngx_str_set(s, "NONE"); |
| 2994 | 2278 } |
| 2279 | |
| 2280 X509_free(cert); | |
| 2281 | |
| 2282 return NGX_OK; | |
| 2283 } | |
| 2284 | |
| 2285 | |
| 541 | 2286 static void * |
| 2287 ngx_openssl_create_conf(ngx_cycle_t *cycle) | |
| 2288 { | |
| 2289 ngx_openssl_conf_t *oscf; | |
| 577 | 2290 |
| 541 | 2291 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t)); |
| 2292 if (oscf == NULL) { | |
|
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2764
diff
changeset
|
2293 return NULL; |
| 541 | 2294 } |
| 577 | 2295 |
| 541 | 2296 /* |
| 2297 * set by ngx_pcalloc(): | |
| 577 | 2298 * |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2299 * oscf->engine = 0; |
| 577 | 2300 */ |
| 541 | 2301 |
| 2302 return oscf; | |
| 2303 } | |
| 2304 | |
| 2305 | |
| 2306 static char * | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2307 ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
| 541 | 2308 { |
| 2309 ngx_openssl_conf_t *oscf = conf; | |
| 571 | 2310 |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2311 ENGINE *engine; |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2312 ngx_str_t *value; |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2313 |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2314 if (oscf->engine) { |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2315 return "is duplicate"; |
| 541 | 2316 } |
| 577 | 2317 |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2318 oscf->engine = 1; |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2319 |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2320 value = cf->args->elts; |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2321 |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2322 engine = ENGINE_by_id((const char *) value[1].data); |
| 541 | 2323 |
| 2324 if (engine == NULL) { | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2325 ngx_ssl_error(NGX_LOG_WARN, cf->log, 0, |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2326 "ENGINE_by_id(\"%V\") failed", &value[1]); |
| 541 | 2327 return NGX_CONF_ERROR; |
| 2328 } | |
| 2329 | |
| 2330 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) { | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2331 ngx_ssl_error(NGX_LOG_WARN, cf->log, 0, |
| 541 | 2332 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed", |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2333 &value[1]); |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2334 |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2335 ENGINE_free(engine); |
|
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2336 |
| 541 | 2337 return NGX_CONF_ERROR; |
| 2338 } | |
| 2339 | |
| 2340 ENGINE_free(engine); | |
| 2341 | |
| 2342 return NGX_CONF_OK; | |
|
2504
9e9a985d956a
load SSL engine before certificates,
Igor Sysoev <igor@sysoev.ru>
parents:
2388
diff
changeset
|
2343 } |
| 571 | 2344 |
| 2345 | |
| 2346 static void | |
| 2347 ngx_openssl_exit(ngx_cycle_t *cycle) | |
| 2348 { | |
|
3464
7f99ce2247f9
add OpenSSL_add_all_algorithms(), this fixes the error
Igor Sysoev <igor@sysoev.ru>
parents:
3457
diff
changeset
|
2349 EVP_cleanup(); |
| 571 | 2350 ENGINE_cleanup(); |
| 2351 } |