annotate src/stream/ngx_stream_ssl_module.c @ 6791:cb4a4e9bba8e

Perl: fixed optimization in SSI command handler. As the pointer to the first argument was tested instead of the argument itself, array of arguments was always created, even if there were no arguments. Fix is to test args[0] instead of args. Found by Coverity (CID 1356862).
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 01 Nov 2016 20:39:21 +0300
parents 3908156a51fa
children ea93c7d8752a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2 /*
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
3 * Copyright (C) Igor Sysoev
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
4 * Copyright (C) Nginx, Inc.
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
5 */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 #include <ngx_config.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 #include <ngx_core.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 #include <ngx_stream.h>
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
14 ngx_pool_t *pool, ngx_str_t *s);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
15
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
16
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
6553
2014ed60f17f SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6550
diff changeset
18 #define NGX_DEFAULT_ECDH_CURVE "auto"
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
21 static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
22 static ngx_int_t ngx_stream_ssl_init_connection(ngx_ssl_t *ssl,
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
23 ngx_connection_t *c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
24 static void ngx_stream_ssl_handshake_handler(ngx_connection_t *c);
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
25 static ngx_int_t ngx_stream_ssl_static_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
26 ngx_stream_variable_value_t *v, uintptr_t data);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
27 static ngx_int_t ngx_stream_ssl_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
28 ngx_stream_variable_value_t *v, uintptr_t data);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
29
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
30 static ngx_int_t ngx_stream_ssl_add_variables(ngx_conf_t *cf);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 static void *ngx_stream_ssl_create_conf(ngx_conf_t *cf);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 static char *ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33 void *child);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 static char *ngx_stream_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 void *conf);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 static char *ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 void *conf);
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
39 static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 static ngx_conf_bitmask_t ngx_stream_ssl_protocols[] = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 { ngx_string("SSLv2"), NGX_SSL_SSLv2 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44 { ngx_string("SSLv3"), NGX_SSL_SSLv3 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 { ngx_null_string, 0 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52 static ngx_command_t ngx_stream_ssl_commands[] = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54 { ngx_string("ssl_handshake_timeout"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56 ngx_conf_set_msec_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 offsetof(ngx_stream_ssl_conf_t, handshake_timeout),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 { ngx_string("ssl_certificate"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
63 ngx_conf_set_str_array_slot,
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 NGX_STREAM_SRV_CONF_OFFSET,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
65 offsetof(ngx_stream_ssl_conf_t, certificates),
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 { ngx_string("ssl_certificate_key"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
70 ngx_conf_set_str_array_slot,
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 NGX_STREAM_SRV_CONF_OFFSET,
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
72 offsetof(ngx_stream_ssl_conf_t, certificate_keys),
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 { ngx_string("ssl_password_file"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ngx_stream_ssl_password_file,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 { ngx_string("ssl_dhparam"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 offsetof(ngx_stream_ssl_conf_t, dhparam),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 { ngx_string("ssl_ecdh_curve"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 offsetof(ngx_stream_ssl_conf_t, ecdh_curve),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 { ngx_string("ssl_protocols"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_1MORE,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 ngx_conf_set_bitmask_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 offsetof(ngx_stream_ssl_conf_t, protocols),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 &ngx_stream_ssl_protocols },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103 { ngx_string("ssl_ciphers"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 ngx_conf_set_str_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 offsetof(ngx_stream_ssl_conf_t, ciphers),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 { ngx_string("ssl_prefer_server_ciphers"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112 ngx_conf_set_flag_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 offsetof(ngx_stream_ssl_conf_t, prefer_server_ciphers),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 { ngx_string("ssl_session_cache"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE12,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 ngx_stream_ssl_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 { ngx_string("ssl_session_tickets"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 ngx_conf_set_flag_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 offsetof(ngx_stream_ssl_conf_t, session_tickets),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 { ngx_string("ssl_session_ticket_key"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 ngx_conf_set_str_array_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 offsetof(ngx_stream_ssl_conf_t, session_ticket_keys),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 { ngx_string("ssl_session_timeout"),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 ngx_conf_set_sec_slot,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 NGX_STREAM_SRV_CONF_OFFSET,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 offsetof(ngx_stream_ssl_conf_t, session_timeout),
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 NULL },
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 ngx_null_command
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 static ngx_stream_module_t ngx_stream_ssl_module_ctx = {
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
150 ngx_stream_ssl_add_variables, /* preconfiguration */
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
151 ngx_stream_ssl_init, /* postconfiguration */
6174
68c106e6fa0a Stream: added postconfiguration method to stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 6157
diff changeset
152
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 NULL, /* create main configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 NULL, /* init main configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 ngx_stream_ssl_create_conf, /* create server configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 ngx_stream_ssl_merge_conf /* merge server configuration */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 ngx_module_t ngx_stream_ssl_module = {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 NGX_MODULE_V1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 &ngx_stream_ssl_module_ctx, /* module context */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 ngx_stream_ssl_commands, /* module directives */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 NGX_STREAM_MODULE, /* module type */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 NULL, /* init master */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 NULL, /* init module */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 NULL, /* init process */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 NULL, /* init thread */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170 NULL, /* exit thread */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 NULL, /* exit process */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 NULL, /* exit master */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 NGX_MODULE_V1_PADDING
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
177 static ngx_stream_variable_t ngx_stream_ssl_vars[] = {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
178
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
179 { ngx_string("ssl_protocol"), NULL, ngx_stream_ssl_static_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
180 (uintptr_t) ngx_ssl_get_protocol, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
181
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
182 { ngx_string("ssl_cipher"), NULL, ngx_stream_ssl_static_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
183 (uintptr_t) ngx_ssl_get_cipher_name, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
184
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
185 { ngx_string("ssl_session_id"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
186 (uintptr_t) ngx_ssl_get_session_id, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
187
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
188 { ngx_string("ssl_session_reused"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
189 (uintptr_t) ngx_ssl_get_session_reused, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
190
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
191 { ngx_string("ssl_server_name"), NULL, ngx_stream_ssl_variable,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
192 (uintptr_t) ngx_ssl_get_server_name, NGX_STREAM_VAR_CHANGEABLE, 0 },
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
193
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
194 { ngx_null_string, NULL, NULL, 0, 0, 0 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
195 };
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
196
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
197
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 static ngx_str_t ngx_stream_ssl_sess_id_ctx = ngx_string("STREAM");
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
201 static ngx_int_t
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
202 ngx_stream_ssl_handler(ngx_stream_session_t *s)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
203 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
204 ngx_connection_t *c;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
205 ngx_stream_ssl_conf_t *sslcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
206
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
207 c = s->connection;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
208
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
209 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
210
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
211 if (s->ssl && c->ssl == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
212 c->log->action = "SSL handshaking";
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
213
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
214 if (sslcf->ssl.ctx == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
215 ngx_log_error(NGX_LOG_ERR, c->log, 0,
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
216 "no \"ssl_certificate\" is defined "
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
217 "in server listening on SSL port");
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
218 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
219 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
220
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
221 return ngx_stream_ssl_init_connection(&sslcf->ssl, c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
222 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
223
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
224 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
225 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
226
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
227
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
228 static ngx_int_t
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
229 ngx_stream_ssl_init_connection(ngx_ssl_t *ssl, ngx_connection_t *c)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
230 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
231 ngx_int_t rc;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
232 ngx_stream_session_t *s;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
233 ngx_stream_ssl_conf_t *sslcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
234
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
235 s = c->data;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
236
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
237 if (ngx_ssl_create_connection(ssl, c, 0) == NGX_ERROR) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
238 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
239 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
240
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
241 rc = ngx_ssl_handshake(c);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
242
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
243 if (rc == NGX_ERROR) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
244 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
245 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
246
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
247 if (rc == NGX_AGAIN) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
248 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
249
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
250 ngx_add_timer(c->read, sslcf->handshake_timeout);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
251
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
252 c->ssl->handler = ngx_stream_ssl_handshake_handler;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
253
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
254 return NGX_AGAIN;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
255 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
256
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
257 /* rc == NGX_OK */
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
258
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
259 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
260 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
261
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
262
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
263 static void
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
264 ngx_stream_ssl_handshake_handler(ngx_connection_t *c)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
265 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
266 ngx_stream_session_t *s;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
267
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
268 s = c->data;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
269
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
270 if (!c->ssl->handshaked) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
271 ngx_stream_finalize_session(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
272 return;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
273 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
274
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
275 if (c->read->timer_set) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
276 ngx_del_timer(c->read);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
277 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
278
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
279 ngx_stream_core_run_phases(s);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
280 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
281
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
282
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
283 static ngx_int_t
6611
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
284 ngx_stream_ssl_static_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
285 ngx_stream_variable_value_t *v, uintptr_t data)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
286 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
287 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
288
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
289 size_t len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
290 ngx_str_t str;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
291
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
292 if (s->connection->ssl) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
293
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
294 (void) handler(s->connection, NULL, &str);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
295
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
296 v->data = str.data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
297
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
298 for (len = 0; v->data[len]; len++) { /* void */ }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
299
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
300 v->len = len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
301 v->valid = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
302 v->no_cacheable = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
303 v->not_found = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
304
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
305 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
306 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
307
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
308 v->not_found = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
309
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
310 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
311 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
312
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
313
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
314 static ngx_int_t
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
315 ngx_stream_ssl_variable(ngx_stream_session_t *s,
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
316 ngx_stream_variable_value_t *v, uintptr_t data)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
317 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
318 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
319
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
320 ngx_str_t str;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
321
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
322 if (s->connection->ssl) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
323
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
324 if (handler(s->connection, s->connection->pool, &str) != NGX_OK) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
325 return NGX_ERROR;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
326 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
327
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
328 v->len = str.len;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
329 v->data = str.data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
330
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
331 if (v->len) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
332 v->valid = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
333 v->no_cacheable = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
334 v->not_found = 0;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
335
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
336 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
337 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
338 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
339
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
340 v->not_found = 1;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
341
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
342 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
343 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
344
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
345
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
346 static ngx_int_t
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
347 ngx_stream_ssl_add_variables(ngx_conf_t *cf)
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
348 {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
349 ngx_stream_variable_t *var, *v;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
350
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
351 for (v = ngx_stream_ssl_vars; v->name.len; v++) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
352 var = ngx_stream_add_variable(cf, &v->name, v->flags);
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
353 if (var == NULL) {
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
354 return NGX_ERROR;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
355 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
356
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
357 var->get_handler = v->get_handler;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
358 var->data = v->data;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
359 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
360
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
361 return NGX_OK;
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
362 }
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
363
85e7bcb37d6b Stream: SSL-related variables.
Vladimir Homutov <vl@nginx.com>
parents: 6606
diff changeset
364
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 static void *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366 ngx_stream_ssl_create_conf(ngx_conf_t *cf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 ngx_stream_ssl_conf_t *scf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 scf = ngx_pcalloc(cf->pool, sizeof(ngx_stream_ssl_conf_t));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371 if (scf == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 return NULL;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 /*
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 * set by ngx_pcalloc():
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 * scf->protocols = 0;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 * scf->dhparam = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 * scf->ecdh_curve = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 * scf->ciphers = { 0, NULL };
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 * scf->shm_zone = NULL;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 */
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 scf->handshake_timeout = NGX_CONF_UNSET_MSEC;
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
386 scf->certificates = NGX_CONF_UNSET_PTR;
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
387 scf->certificate_keys = NGX_CONF_UNSET_PTR;
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 scf->passwords = NGX_CONF_UNSET_PTR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 scf->prefer_server_ciphers = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 scf->builtin_session_cache = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 scf->session_timeout = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392 scf->session_tickets = NGX_CONF_UNSET;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 scf->session_ticket_keys = NGX_CONF_UNSET_PTR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 return scf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402 ngx_stream_ssl_conf_t *prev = parent;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 ngx_stream_ssl_conf_t *conf = child;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 ngx_pool_cleanup_t *cln;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 ngx_conf_merge_msec_value(conf->handshake_timeout,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 prev->handshake_timeout, 60000);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 ngx_conf_merge_value(conf->session_timeout,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 prev->session_timeout, 300);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 ngx_conf_merge_value(conf->prefer_server_ciphers,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 prev->prefer_server_ciphers, 0);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
6157
b2899e7d0ef8 Disabled SSLv3 by default (ticket #653).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6115
diff changeset
417 (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
420 ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL);
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
421 ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys,
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
422 NULL);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, "");
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 NGX_DEFAULT_ECDH_CURVE);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434 conf->ssl.log = cf->log;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
436 if (conf->certificates == NULL) {
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
440 if (conf->certificate_keys == NULL
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
441 || conf->certificate_keys->nelts < conf->certificates->nelts)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
442 {
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 "no \"ssl_certificate_key\" is defined "
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 "for certificate \"%V\"",
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
446 ((ngx_str_t *) conf->certificates->elts)
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
447 + conf->certificates->nelts - 1);
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 if (ngx_ssl_create(&conf->ssl, conf->protocols, NULL) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 cln = ngx_pool_cleanup_add(cf->pool, 0);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456 if (cln == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 cln->handler = ngx_ssl_cleanup_ctx;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 cln->data = &conf->ssl;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462
6550
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
463 if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
51e1f047d15d SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents: 6489
diff changeset
464 conf->certificate_keys, conf->passwords)
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469
6591
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
470 if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
471 conf->prefer_server_ciphers)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents: 6553
diff changeset
472 != NGX_OK)
6115
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 ngx_conf_merge_value(conf->builtin_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 if (conf->shm_zone == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489 conf->shm_zone = prev->shm_zone;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493 conf->builtin_session_cache,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494 conf->shm_zone, conf->session_timeout)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
496 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
497 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
500 ngx_conf_merge_value(conf->session_tickets,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
501 prev->session_tickets, 1);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
502
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
503 #ifdef SSL_OP_NO_TICKET
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
504 if (!conf->session_tickets) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
505 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
506 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
507 #endif
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
508
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
509 ngx_conf_merge_ptr_value(conf->session_ticket_keys,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
510 prev->session_ticket_keys, NULL);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
511
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
512 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
513 != NGX_OK)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
514 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
515 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
516 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
517
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
518 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
519 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
520
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
521
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
522 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
523 ngx_stream_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
524 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
525 ngx_stream_ssl_conf_t *scf = conf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
526
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
527 ngx_str_t *value;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
528
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
529 if (scf->passwords != NGX_CONF_UNSET_PTR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
530 return "is duplicate";
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
531 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
532
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
533 value = cf->args->elts;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
534
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
535 scf->passwords = ngx_ssl_read_password_file(cf, &value[1]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
536
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
537 if (scf->passwords == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
538 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
539 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
540
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
541 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
542 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
543
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
544
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
545 static char *
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
546 ngx_stream_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
547 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
548 ngx_stream_ssl_conf_t *scf = conf;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
549
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
550 size_t len;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
551 ngx_str_t *value, name, size;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
552 ngx_int_t n;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
553 ngx_uint_t i, j;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
554
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
555 value = cf->args->elts;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
556
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
557 for (i = 1; i < cf->args->nelts; i++) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
558
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
559 if (ngx_strcmp(value[i].data, "off") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
560 scf->builtin_session_cache = NGX_SSL_NO_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
561 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
562 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
563
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
564 if (ngx_strcmp(value[i].data, "none") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
565 scf->builtin_session_cache = NGX_SSL_NONE_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
566 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
567 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
568
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
569 if (ngx_strcmp(value[i].data, "builtin") == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
570 scf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
571 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
572 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
573
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
574 if (value[i].len > sizeof("builtin:") - 1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
575 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
576 == 0)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
577 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
578 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
579 value[i].len - (sizeof("builtin:") - 1));
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
580
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
581 if (n == NGX_ERROR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
582 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
583 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
584
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
585 scf->builtin_session_cache = n;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
586
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
587 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
588 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
589
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
590 if (value[i].len > sizeof("shared:") - 1
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
591 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
592 == 0)
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
593 {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
594 len = 0;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
595
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
596 for (j = sizeof("shared:") - 1; j < value[i].len; j++) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
597 if (value[i].data[j] == ':') {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
598 break;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
599 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
600
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
601 len++;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
602 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
603
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
604 if (len == 0) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
605 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
606 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
607
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
608 name.len = len;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
609 name.data = value[i].data + sizeof("shared:") - 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
610
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
611 size.len = value[i].len - j - 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
612 size.data = name.data + len + 1;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
613
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
614 n = ngx_parse_size(&size);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
615
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
616 if (n == NGX_ERROR) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
617 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
618 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
619
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
620 if (n < (ngx_int_t) (8 * ngx_pagesize)) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
621 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
622 "session cache \"%V\" is too small",
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
623 &value[i]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
624
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
625 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
626 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
627
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
628 scf->shm_zone = ngx_shared_memory_add(cf, &name, n,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
629 &ngx_stream_ssl_module);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
630 if (scf->shm_zone == NULL) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
631 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
632 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
633
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
634 scf->shm_zone->init = ngx_ssl_session_cache_init;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
635
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
636 continue;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
637 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
638
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
639 goto invalid;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
640 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
641
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
642 if (scf->shm_zone && scf->builtin_session_cache == NGX_CONF_UNSET) {
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
643 scf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
644 }
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
645
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
646 return NGX_CONF_OK;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
647
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
648 invalid:
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
649
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
650 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
651 "invalid session cache \"%V\"", &value[i]);
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
652
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
653 return NGX_CONF_ERROR;
61d7ae76647d Stream: port from NGINX+.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
654 }
6693
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
655
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
656
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
657 static ngx_int_t
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
658 ngx_stream_ssl_init(ngx_conf_t *cf)
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
659 {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
660 ngx_stream_handler_pt *h;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
661 ngx_stream_core_main_conf_t *cmcf;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
662
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
663 cmcf = ngx_stream_conf_get_module_main_conf(cf, ngx_stream_core_module);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
664
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
665 h = ngx_array_push(&cmcf->phases[NGX_STREAM_SSL_PHASE].handlers);
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
666 if (h == NULL) {
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
667 return NGX_ERROR;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
668 }
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
669
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
670 *h = ngx_stream_ssl_handler;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
671
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
672 return NGX_OK;
3908156a51fa Stream: phases.
Roman Arutyunyan <arut@nginx.com>
parents: 6611
diff changeset
673 }