nginx: src/event/ngx_event_openssl.c annotate

annotate src/event/ngx_event_openssl.c @ 7454:e72c8a8a8b10

SSL: separate checks for errors in ngx_ssl_read_password_file(). Checking multiple errors at once is a bad practice, as in general it is not guaranteed that an object can be used after the error. In this particular case, checking errors after multiple allocations can result in excessive errors being logged when there is no memory available.

author	Maxim Dounin <mdounin@mdounin.ru>
date	Thu, 31 Jan 2019 19:36:51 +0300
parents	873150addfeb
children	992bf7540a98

rev	line source
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	1
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	2 /*
444 42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright Igor Sysoev <igor@sysoev.ru> parents: 441 diff changeset	3 * Copyright (C) Igor Sysoev
4412 d620f497c50f Copyright updated. Maxim Konovalov <maxim@nginx.com> parents: 4400 diff changeset	4 * Copyright (C) Nginx, Inc.
441 da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	5 */
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files Igor Sysoev <igor@sysoev.ru> parents: 399 diff changeset	6
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	7
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	8 #include <ngx_config.h>
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	9 #include <ngx_core.h>
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	10 #include <ngx_event.h>
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	11
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	12
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	13 #define NGX_SSL_PASSWORD_BUFFER_SIZE 4096
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	14
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	15
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	16 typedef struct {
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	17 ngx_uint_t engine; /* unsigned engine:1; */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	18 } ngx_openssl_conf_t;
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	19
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	20
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	21 static int ngx_ssl_password_callback(char *buf, int size, int rwflag,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	22 void *userdata);
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	23 static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	24 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	25 int ret);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	26 static void ngx_ssl_passwords_cleanup(void *data);
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	27 static int ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn,
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	28 ngx_ssl_session_t *sess);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	29 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	30 static ngx_int_t ngx_ssl_try_early_data(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	31 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	32 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	33 static void ngx_ssl_handshake_log(ngx_connection_t *c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	34 #endif
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	35 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	36 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	37 static ssize_t ngx_ssl_recv_early(ngx_connection_t c, u_char buf,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	38 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	39 #endif
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	40 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	41 static void ngx_ssl_write_handler(ngx_event_t *wev);
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	42 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	43 static ssize_t ngx_ssl_write_early(ngx_connection_t c, u_char data,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	44 size_t size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	45 #endif
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	46 static void ngx_ssl_read_handler(ngx_event_t *rev);
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	47 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	48 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	49 ngx_err_t err, char *text);
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	50 static void ngx_ssl_clear_error(ngx_log_t *log);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	51
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	52 static ngx_int_t ngx_ssl_session_id_context(ngx_ssl_t *ssl,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	53 ngx_str_t *sess_ctx);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	54 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	55 ngx_ssl_session_t *sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	56 static ngx_ssl_session_t ngx_ssl_get_cached_session(ngx_ssl_conn_t ssl_conn,
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	57 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	58 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	59 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	60 u_char id, int len, int copy);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	61 static void ngx_ssl_remove_session(SSL_CTX ssl, ngx_ssl_session_t sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	62 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	63 ngx_slab_pool_t *shpool, ngx_uint_t n);
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	64 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	65 ngx_rbtree_node_t node, ngx_rbtree_node_t sentinel);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	66
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	67 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	68 static int ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	69 unsigned char name, unsigned char iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	70 HMAC_CTX *hctx, int enc);
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	71 static void ngx_ssl_session_ticket_keys_cleanup(void *data);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	72 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	73
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	74 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	75 static ngx_int_t ngx_ssl_check_name(ngx_str_t name, ASN1_STRING str);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	76 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	77
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	78 static time_t ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	79 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	80 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	81 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	82 ASN1_TIME *asn1time);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	83
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	84 static void ngx_openssl_create_conf(ngx_cycle_t cycle);
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	85 static char ngx_openssl_engine(ngx_conf_t cf, ngx_command_t cmd, void conf);
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	86 static void ngx_openssl_exit(ngx_cycle_t *cycle);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	87
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	88
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	89 static ngx_command_t ngx_openssl_commands[] = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	90
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	91 { ngx_string("ssl_engine"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	92 NGX_MAIN_CONF\|NGX_DIRECT_CONF\|NGX_CONF_TAKE1,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	93 ngx_openssl_engine,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	94 0,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	95 0,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	96 NULL },
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	97
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	98 ngx_null_command
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	99 };
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	100
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	101
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	102 static ngx_core_module_t ngx_openssl_module_ctx = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	103 ngx_string("openssl"),
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	104 ngx_openssl_create_conf,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	105 NULL
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	106 };
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	107
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	108
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	109 ngx_module_t ngx_openssl_module = {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	110 NGX_MODULE_V1,
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	111 &ngx_openssl_module_ctx, /* module context */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	112 ngx_openssl_commands, /* module directives */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	113 NGX_CORE_MODULE, /* module type */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	114 NULL, /* init master */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	115 NULL, /* init module */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	116 NULL, /* init process */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	117 NULL, /* init thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	118 NULL, /* exit thread */
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	119 NULL, /* exit process */
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	120 ngx_openssl_exit, /* exit master */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	121 NGX_MODULE_V1_PADDING
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	122 };
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	123
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	124
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	125 int ngx_ssl_connection_index;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	126 int ngx_ssl_server_conf_index;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	127 int ngx_ssl_session_cache_index;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	128 int ngx_ssl_session_ticket_keys_index;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	129 int ngx_ssl_certificate_index;
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	130 int ngx_ssl_next_certificate_index;
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	131 int ngx_ssl_certificate_name_index;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	132 int ngx_ssl_stapling_index;
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	133
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	134
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	135 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	136 ngx_ssl_init(ngx_log_t *log)
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	137 {
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	138 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	139
6902 5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	140 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) == 0) {
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	141 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed");
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	142 return NGX_ERROR;
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	143 }
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	144
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	145 /*
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	146 * OPENSSL_init_ssl() may leave errors in the error queue
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	147 * while returning success
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	148 */
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	149
5cb85b0ee00b SSL: clear error queue after OPENSSL_init_ssl(). Sergey Kandaurov <pluknet@nginx.com> parents: 6854 diff changeset	150 ERR_clear_error();
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	151
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	152 #else
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	153
968 1b60ecc8cdb7 OPENSSL_config() Igor Sysoev <igor@sysoev.ru> parents: 671 diff changeset	154 OPENSSL_config(NULL);
1b60ecc8cdb7 OPENSSL_config() Igor Sysoev <igor@sysoev.ru> parents: 671 diff changeset	155
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	156 SSL_library_init();
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	157 SSL_load_error_strings();
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	158
3464 7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	159 OpenSSL_add_all_algorithms();
7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	160
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	161 #endif
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	162
4868 22a6ef66b6f5 SSL: added version checks for ssl compression workaround. Maxim Dounin <mdounin@mdounin.ru> parents: 4867 diff changeset	163 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	164 #ifndef SSL_OP_NO_COMPRESSION
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	165 {
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	166 /*
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	167 * Disable gzip compression in OpenSSL prior to 1.0.0 version,
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	168 * this saves about 522K per connection.
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	169 */
4867 90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	170 int n;
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	171 STACK_OF(SSL_COMP) *ssl_comp_methods;
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	172
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	173 ssl_comp_methods = SSL_COMP_get_compression_methods();
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	174 n = sk_SSL_COMP_num(ssl_comp_methods);
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	175
4867 90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	176 while (n--) {
90bbf2adb2c9 SSL: fixed compression workaround to remove all methods. Maxim Dounin <mdounin@mdounin.ru> parents: 4696 diff changeset	177 (void) sk_SSL_COMP_pop(ssl_comp_methods);
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	178 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	179 }
b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	180 #endif
4868 22a6ef66b6f5 SSL: added version checks for ssl compression workaround. Maxim Dounin <mdounin@mdounin.ru> parents: 4867 diff changeset	181 #endif
4696 b43fe2deb053 Disabled gzip compression in OpenSSL prior to 1.0.0 version. Igor Sysoev <igor@sysoev.ru> parents: 4651 diff changeset	182
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	183 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	184
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	185 if (ngx_ssl_connection_index == -1) {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	186 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	187 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	188 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	189
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	190 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	191 NULL);
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	192 if (ngx_ssl_server_conf_index == -1) {
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	193 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	194 "SSL_CTX_get_ex_new_index() failed");
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	195 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	196 }
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	197
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	198 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	199 NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	200 if (ngx_ssl_session_cache_index == -1) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	201 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	202 "SSL_CTX_get_ex_new_index() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	203 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	204 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	205
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	206 ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	207 NULL, NULL);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	208 if (ngx_ssl_session_ticket_keys_index == -1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	209 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	210 "SSL_CTX_get_ex_new_index() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	211 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	212 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	213
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	214 ngx_ssl_certificate_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	215 NULL);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	216 if (ngx_ssl_certificate_index == -1) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	217 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	218 "SSL_CTX_get_ex_new_index() failed");
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	219 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	220 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	221
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	222 ngx_ssl_next_certificate_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	223 NULL);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	224 if (ngx_ssl_next_certificate_index == -1) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	225 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	226 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	227 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	228
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	229 ngx_ssl_certificate_name_index = X509_get_ex_new_index(0, NULL, NULL, NULL,
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	230 NULL);
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	231
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	232 if (ngx_ssl_certificate_name_index == -1) {
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	233 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	234 return NGX_ERROR;
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	235 }
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	236
6545 a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	237 ngx_ssl_stapling_index = X509_get_ex_new_index(0, NULL, NULL, NULL, NULL);
a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	238
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	239 if (ngx_ssl_stapling_index == -1) {
6545 a873b4d9cd80 OCSP stapling: staple now stored in certificate, not SSL context. Maxim Dounin <mdounin@mdounin.ru> parents: 6490 diff changeset	240 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "X509_get_ex_new_index() failed");
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	241 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	242 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	243
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	244 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	245 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	246
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	247
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	248 ngx_int_t
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	249 ngx_ssl_create(ngx_ssl_t ssl, ngx_uint_t protocols, void data)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	250 {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	251 ssl->ctx = SSL_CTX_new(SSLv23_method());
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	252
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	253 if (ssl->ctx == NULL) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	254 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	255 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	256 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	257
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	258 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	259 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	260 "SSL_CTX_set_ex_data() failed");
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	261 return NGX_ERROR;
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	262 }
065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	263
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	264 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, NULL) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	265 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	266 "SSL_CTX_set_ex_data() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	267 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	268 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	269
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	270 ssl->buffer_size = NGX_SSL_BUFSIZE;
a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	271
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	272 /* client side options */
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	273
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	274 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	275 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	276 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	277
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	278 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	279 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	280 #endif
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	281
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	282 /* server side options */
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	283
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	284 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	285 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	286 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	287
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	288 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	289 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	290 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	291
5378 a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING. Piotr Sikora <piotr@cloudflare.com> parents: 5365 diff changeset	292 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	293 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	294 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
5378 a73678f5f96f SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING. Piotr Sikora <piotr@cloudflare.com> parents: 5365 diff changeset	295 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	296
5778 45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	297 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	298 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
5778 45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	299 #endif
45ed2f1f0a6a SSL: let it build against BoringSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5777 diff changeset	300
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	301 #ifdef SSL_OP_TLS_D5_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	302 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	303 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	304
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	305 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	306 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	307 #endif
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	308
275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	309 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	310 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
5823 275e35d54626 SSL: guard use of all SSL options for bug workarounds. Piotr Sikora <piotr@cloudflare.com> parents: 5779 diff changeset	311 #endif
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	312
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	313 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	314
7318 3443fe40bdc7 SSL: fixed SSL_clear_options() usage with OpenSSL 1.1.0+. Maxim Dounin <mdounin@mdounin.ru> parents: 7317 diff changeset	315 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	316 /* only in 0.9.8m+ */
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	317 SSL_CTX_clear_options(ssl->ctx,
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	318 SSL_OP_NO_SSLv2\|SSL_OP_NO_SSLv3\|SSL_OP_NO_TLSv1);
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	319 #endif
3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	320
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	321 if (!(protocols & NGX_SSL_SSLv2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	322 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	323 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	324 if (!(protocols & NGX_SSL_SSLv3)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	325 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	326 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	327 if (!(protocols & NGX_SSL_TLSv1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	328 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	329 }
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	330 #ifdef SSL_OP_NO_TLSv1_1
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	331 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	332 if (!(protocols & NGX_SSL_TLSv1_1)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	333 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	334 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	335 #endif
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	336 #ifdef SSL_OP_NO_TLSv1_2
6034 3e847964ab55 SSL: clear protocol options. Maxim Dounin <mdounin@mdounin.ru> parents: 5986 diff changeset	337 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
4400 a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	338 if (!(protocols & NGX_SSL_TLSv1_2)) {
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	339 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	340 }
a0505851e70c Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4236 diff changeset	341 #endif
6981 08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	342 #ifdef SSL_OP_NO_TLSv1_3
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	343 SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	344 if (!(protocols & NGX_SSL_TLSv1_3)) {
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	345 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	346 }
08dc60979133 SSL: added support for TLSv1.3 in ssl_protocols directive. Sergey Kandaurov <pluknet@nginx.com> parents: 6902 diff changeset	347 #endif
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	348
7372 ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	349 #ifdef SSL_CTX_set_min_proto_version
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	350 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	351 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	352 #endif
ed8738b1c7c4 SSL: explicitly set maximum version (ticket #1654). Maxim Dounin <mdounin@mdounin.ru> parents: 7365 diff changeset	353
7332 7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	354 #ifdef TLS1_3_VERSION
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	355 SSL_CTX_set_min_proto_version(ssl->ctx, 0);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	356 SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	357 #endif
7ad0f4ace359 SSL: enabled TLSv1.3 with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7320 diff changeset	358
4185 6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	359 #ifdef SSL_OP_NO_COMPRESSION
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	360 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	361 #endif
6af5959a2ace Disabling SSL compression. This saves about 300K per SSL connection. Igor Sysoev <igor@sysoev.ru> parents: 4064 diff changeset	362
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	363 #ifdef SSL_OP_NO_ANTI_REPLAY
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	364 SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_ANTI_REPLAY);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	365 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	366
4186 cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	367 #ifdef SSL_MODE_RELEASE_BUFFERS
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	368 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_RELEASE_BUFFERS);
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	369 #endif
cce2fd0acc0f Releasing memory of idle SSL connection. This saves about 34K per SSL Igor Sysoev <igor@sysoev.ru> parents: 4185 diff changeset	370
6036 4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	371 #ifdef SSL_MODE_NO_AUTO_CHAIN
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	372 SSL_CTX_set_mode(ssl->ctx, SSL_MODE_NO_AUTO_CHAIN);
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	373 #endif
4e3f87c02cb4 SSL: use of SSL_MODE_NO_AUTO_CHAIN. Maxim Dounin <mdounin@mdounin.ru> parents: 6034 diff changeset	374
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	375 SSL_CTX_set_read_ahead(ssl->ctx, 1);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	376
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	377 SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	378
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	379 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	380 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	381
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	382
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	383 ngx_int_t
6550 51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	384 ngx_ssl_certificates(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *certs,
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	385 ngx_array_t keys, ngx_array_t passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	386 {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	387 ngx_str_t cert, key;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	388 ngx_uint_t i;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	389
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	390 cert = certs->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	391 key = keys->elts;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	392
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	393 for (i = 0; i < certs->nelts; i++) {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	394
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	395 if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	396 != NGX_OK)
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	397 {
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	398 return NGX_ERROR;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	399 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	400 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	401
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	402 return NGX_OK;
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	403 }
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	404
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	405
51e1f047d15d SSL: support for multiple certificates (ticket #814). Maxim Dounin <mdounin@mdounin.ru> parents: 6549 diff changeset	406 ngx_int_t
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	407 ngx_ssl_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	408 ngx_str_t key, ngx_array_t passwords)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	409 {
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	410 BIO *bio;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	411 X509 *x509;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	412 u_long n;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	413 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	414 ngx_uint_t tries;
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	415
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	416 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	417 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	418 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	419
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	420 /*
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	421 * we can't use SSL_CTX_use_certificate_chain_file() as it doesn't
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	422 * allow to access certificate later from SSL_CTX, so we reimplement
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	423 * it here
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	424 */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	425
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	426 bio = BIO_new_file((char *) cert->data, "r");
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	427 if (bio == NULL) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	428 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	429 "BIO_new_file(\"%s\") failed", cert->data);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	430 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	431 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	432
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	433 x509 = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	434 if (x509 == NULL) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	435 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	436 "PEM_read_bio_X509_AUX(\"%s\") failed", cert->data);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	437 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	438 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	439 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	440
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	441 if (SSL_CTX_use_certificate(ssl->ctx, x509) == 0) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	442 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	443 "SSL_CTX_use_certificate(\"%s\") failed", cert->data);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	444 X509_free(x509);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	445 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	446 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	447 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	448
6812 a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	449 if (X509_set_ex_data(x509, ngx_ssl_certificate_name_index, cert->data)
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	450 == 0)
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	451 {
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	452 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	453 X509_free(x509);
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	454 BIO_free(bio);
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	455 return NGX_ERROR;
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	456 }
a7ec59df0c4d OCSP stapling: added certificate name to warnings. Maxim Dounin <mdounin@mdounin.ru> parents: 6780 diff changeset	457
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	458 if (X509_set_ex_data(x509, ngx_ssl_next_certificate_index,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	459 SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index))
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	460 == 0)
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	461 {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	462 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "X509_set_ex_data() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	463 X509_free(x509);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	464 BIO_free(bio);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	465 return NGX_ERROR;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	466 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	467
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	468 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, x509)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	469 == 0)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	470 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	471 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	472 "SSL_CTX_set_ex_data() failed");
5384 cfbf1d1cc233 SSL: fixed possible memory and file descriptor leak on HUP signal. Piotr Sikora <piotr@cloudflare.com> parents: 5378 diff changeset	473 X509_free(x509);
cfbf1d1cc233 SSL: fixed possible memory and file descriptor leak on HUP signal. Piotr Sikora <piotr@cloudflare.com> parents: 5378 diff changeset	474 BIO_free(bio);
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	475 return NGX_ERROR;
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	476 }
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	477
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	478 /* read rest of the chain */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	479
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	480 for ( ;; ) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	481
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	482 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	483 if (x509 == NULL) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	484 n = ERR_peek_last_error();
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	485
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	486 if (ERR_GET_LIB(n) == ERR_LIB_PEM
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	487 && ERR_GET_REASON(n) == PEM_R_NO_START_LINE)
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	488 {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	489 /* end of file */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	490 ERR_clear_error();
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	491 break;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	492 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	493
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	494 /* some real error */
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	495
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	496 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	497 "PEM_read_bio_X509(\"%s\") failed", cert->data);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	498 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	499 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	500 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	501
6549 d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	502 #ifdef SSL_CTRL_CHAIN_CERT
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	503
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	504 /*
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	505 * SSL_CTX_add0_chain_cert() is needed to add chain to
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	506 * a particular certificate when multiple certificates are used;
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	507 * only available in OpenSSL 1.0.2+
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	508 */
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	509
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	510 if (SSL_CTX_add0_chain_cert(ssl->ctx, x509) == 0) {
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	511 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	512 "SSL_CTX_add0_chain_cert(\"%s\") failed",
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	513 cert->data);
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	514 X509_free(x509);
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	515 BIO_free(bio);
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	516 return NGX_ERROR;
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	517 }
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	518
d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	519 #else
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	520 if (SSL_CTX_add_extra_chain_cert(ssl->ctx, x509) == 0) {
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	521 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	522 "SSL_CTX_add_extra_chain_cert(\"%s\") failed",
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	523 cert->data);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	524 X509_free(x509);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	525 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	526 return NGX_ERROR;
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	527 }
6549 d3302eb87a0c SSL: support for per-certificate chains. Maxim Dounin <mdounin@mdounin.ru> parents: 6548 diff changeset	528 #endif
4875 386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	529 }
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	530
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	531 BIO_free(bio);
386a06a22c40 OCSP stapling: loading OCSP responses. Maxim Dounin <mdounin@mdounin.ru> parents: 4872 diff changeset	532
5934 2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	533 if (ngx_strncmp(key->data, "engine:", sizeof("engine:") - 1) == 0) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	534
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	535 #ifndef OPENSSL_NO_ENGINE
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	536
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	537 u_char p, last;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	538 ENGINE *engine;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	539 EVP_PKEY *pkey;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	540
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	541 p = key->data + sizeof("engine:") - 1;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	542 last = (u_char *) ngx_strchr(p, ':');
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	543
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	544 if (last == NULL) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	545 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	546 "invalid syntax in \"%V\"", key);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	547 return NGX_ERROR;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	548 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	549
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	550 *last = '\0';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	551
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	552 engine = ENGINE_by_id((char *) p);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	553
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	554 if (engine == NULL) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	555 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	556 "ENGINE_by_id(\"%s\") failed", p);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	557 return NGX_ERROR;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	558 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	559
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	560 *last++ = ':';
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	561
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	562 pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	563
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	564 if (pkey == NULL) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	565 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	566 "ENGINE_load_private_key(\"%s\") failed", last);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	567 ENGINE_free(engine);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	568 return NGX_ERROR;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	569 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	570
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	571 ENGINE_free(engine);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	572
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	573 if (SSL_CTX_use_PrivateKey(ssl->ctx, pkey) == 0) {
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	574 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	575 "SSL_CTX_use_PrivateKey(\"%s\") failed", last);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	576 EVP_PKEY_free(pkey);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	577 return NGX_ERROR;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	578 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	579
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	580 EVP_PKEY_free(pkey);
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	581
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	582 return NGX_OK;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	583
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	584 #else
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	585
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	586 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	587 "loading \"engine:...\" certificate keys "
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	588 "is not supported");
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	589 return NGX_ERROR;
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	590
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	591 #endif
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	592 }
2c33ed82cde1 SSL: loading certificate keys via ENGINE_load_private_key(). Dmitrii Pichulin parents: 5902 diff changeset	593
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	594 if (ngx_conf_full_name(cf->cycle, key, 1) != NGX_OK) {
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	595 return NGX_ERROR;
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	596 }
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	597
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	598 if (passwords) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	599 tries = passwords->nelts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	600 pwd = passwords->elts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	601
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	602 SSL_CTX_set_default_passwd_cb(ssl->ctx, ngx_ssl_password_callback);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	603 SSL_CTX_set_default_passwd_cb_userdata(ssl->ctx, pwd);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	604
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	605 } else {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	606 tries = 1;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	607 #if (NGX_SUPPRESS_WARN)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	608 pwd = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	609 #endif
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	610 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	611
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	612 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	613
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	614 if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	615 SSL_FILETYPE_PEM)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	616 != 0)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	617 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	618 break;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	619 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	620
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	621 if (--tries) {
5892 42520df85ebb SSL: simplified ssl_password_file error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 5882 diff changeset	622 ERR_clear_error();
42520df85ebb SSL: simplified ssl_password_file error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 5882 diff changeset	623 SSL_CTX_set_default_passwd_cb_userdata(ssl->ctx, ++pwd);
42520df85ebb SSL: simplified ssl_password_file error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 5882 diff changeset	624 continue;
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	625 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	626
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	627 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	628 "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	629 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	630 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	631
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	632 SSL_CTX_set_default_passwd_cb(ssl->ctx, NULL);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	633
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	634 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	635 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	636
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	637
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	638 static int
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	639 ngx_ssl_password_callback(char buf, int size, int rwflag, void userdata)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	640 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	641 ngx_str_t *pwd = userdata;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	642
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	643 if (rwflag) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	644 ngx_log_error(NGX_LOG_ALERT, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	645 "ngx_ssl_password_callback() is called for encryption");
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	646 return 0;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	647 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	648
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	649 if (pwd->len > (size_t) size) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	650 ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	651 "password is truncated to %d bytes", size);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	652 } else {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	653 size = pwd->len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	654 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	655
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	656 ngx_memcpy(buf, pwd->data, size);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	657
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	658 return size;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	659 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	660
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	661
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	662 ngx_int_t
6591 04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	663 ngx_ssl_ciphers(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *ciphers,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	664 ngx_uint_t prefer_server_ciphers)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	665 {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	666 if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	667 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	668 "SSL_CTX_set_cipher_list(\"%V\") failed",
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	669 ciphers);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	670 return NGX_ERROR;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	671 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	672
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	673 if (prefer_server_ciphers) {
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	674 SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	675 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	676
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	677 #if (OPENSSL_VERSION_NUMBER < 0x10100001L && !defined LIBRESSL_VERSION_NUMBER)
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	678 /* a temporary 512-bit RSA key is required for export versions of MSIE */
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	679 SSL_CTX_set_tmp_rsa_callback(ssl->ctx, ngx_ssl_rsa512_key_callback);
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	680 #endif
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	681
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	682 return NGX_OK;
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	683 }
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	684
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	685
04d8d1f85649 SSL: ngx_ssl_ciphers() to set list of ciphers. Tim Taubert <tim@timtaubert.de> parents: 6554 diff changeset	686 ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	687 ngx_ssl_client_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	688 ngx_int_t depth)
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	689 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	690 STACK_OF(X509_NAME) *list;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	691
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	692 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	693
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	694 SSL_CTX_set_verify_depth(ssl->ctx, depth);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	695
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	696 if (cert->len == 0) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	697 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	698 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	699
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	700 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	701 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	702 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	703
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	704 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	705 == 0)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	706 {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	707 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	708 "SSL_CTX_load_verify_locations(\"%s\") failed",
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	709 cert->data);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	710 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	711 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	712
5365 6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	713 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	714 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	715 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	716 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	717
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	718 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	719
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	720 list = SSL_load_client_CA_file((char *) cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	721
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	722 if (list == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	723 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	724 "SSL_load_client_CA_file(\"%s\") failed", cert->data);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	725 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	726 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	727
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	728 /*
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	729 * before 0.9.7h and 0.9.8 SSL_load_client_CA_file()
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	730 * always leaved an error in the error queue
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	731 */
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	732
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	733 ERR_clear_error();
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	734
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	735 SSL_CTX_set_client_CA_list(ssl->ctx, list);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	736
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	737 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	738 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	739
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	740
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	741 ngx_int_t
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	742 ngx_ssl_trusted_certificate(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *cert,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	743 ngx_int_t depth)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	744 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	745 SSL_CTX_set_verify_depth(ssl->ctx, depth);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	746
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	747 if (cert->len == 0) {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	748 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	749 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	750
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	751 if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	752 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	753 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	754
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	755 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	756 == 0)
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	757 {
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	758 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	759 "SSL_CTX_load_verify_locations(\"%s\") failed",
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	760 cert->data);
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	761 return NGX_ERROR;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	762 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	763
5365 6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	764 /*
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	765 * SSL_CTX_load_verify_locations() may leave errors in the error queue
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	766 * while returning success
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	767 */
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	768
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	769 ERR_clear_error();
6c35a1f428f2 SSL: clear error queue after SSL_CTX_load_verify_locations(). Maxim Dounin <mdounin@mdounin.ru> parents: 5330 diff changeset	770
4872 7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	771 return NGX_OK;
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	772 }
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	773
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	774
7c3cca603438 OCSP stapling: ssl_trusted_certificate directive. Maxim Dounin <mdounin@mdounin.ru> parents: 4868 diff changeset	775 ngx_int_t
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	776 ngx_ssl_crl(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *crl)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	777 {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	778 X509_STORE *store;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	779 X509_LOOKUP *lookup;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	780
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	781 if (crl->len == 0) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	782 return NGX_OK;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	783 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	784
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	785 if (ngx_conf_full_name(cf->cycle, crl, 1) != NGX_OK) {
2995 cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	786 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	787 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	788
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	789 store = SSL_CTX_get_cert_store(ssl->ctx);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	790
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	791 if (store == NULL) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	792 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	793 "SSL_CTX_get_cert_store() failed");
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	794 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	795 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	796
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	797 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	798
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	799 if (lookup == NULL) {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	800 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	801 "X509_STORE_add_lookup() failed");
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	802 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	803 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	804
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	805 if (X509_LOOKUP_load_file(lookup, (char *) crl->data, X509_FILETYPE_PEM)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	806 == 0)
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	807 {
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	808 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	809 "X509_LOOKUP_load_file(\"%s\") failed", crl->data);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	810 return NGX_ERROR;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	811 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	812
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	813 X509_STORE_set_flags(store,
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	814 X509_V_FLAG_CRL_CHECK\|X509_V_FLAG_CRL_CHECK_ALL);
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	815
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	816 return NGX_OK;
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	817 }
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	818
cc07d164f0dc ssl_crl Igor Sysoev <igor@sysoev.ru> parents: 2994 diff changeset	819
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	820 static int
5222 23a186e8ca45 Style: remove unnecessary references to HTTP from non-HTTP modules. Piotr Sikora <piotr@cloudflare.com> parents: 5081 diff changeset	821 ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	822 {
1977 40c9cb8576bb get certificate info only for debug build Igor Sysoev <igor@sysoev.ru> parents: 1976 diff changeset	823 #if (NGX_DEBUG)
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	824 char subject, issuer;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	825 int err, depth;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	826 X509 *cert;
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	827 X509_NAME sname, iname;
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	828 ngx_connection_t *c;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	829 ngx_ssl_conn_t *ssl_conn;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	830
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	831 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	832 SSL_get_ex_data_X509_STORE_CTX_idx());
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	833
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	834 c = ngx_ssl_get_connection(ssl_conn);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	835
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	836 cert = X509_STORE_CTX_get_current_cert(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	837 err = X509_STORE_CTX_get_error(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	838 depth = X509_STORE_CTX_get_error_depth(x509_store);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	839
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	840 sname = X509_get_subject_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	841 subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	842
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	843 iname = X509_get_issuer_name(cert);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	844 issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	845
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	846 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	847 "verify:%d, error:%d, depth:%d, "
5775 294d020bbcfe SSL: misplaced space in debug message. Maxim Dounin <mdounin@mdounin.ru> parents: 5767 diff changeset	848 "subject:\"%s\", issuer:\"%s\"",
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	849 ok, err, depth, subject, issuer);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	850
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	851 if (sname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	852 OPENSSL_free(subject);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	853 }
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	854
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	855 if (iname) {
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	856 OPENSSL_free(issuer);
c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	857 }
1977 40c9cb8576bb get certificate info only for debug build Igor Sysoev <igor@sysoev.ru> parents: 1976 diff changeset	858 #endif
1976 c4d8867f0162 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1974 diff changeset	859
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	860 return 1;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	861 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	862
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	863
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	864 static void
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	865 ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	866 {
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	867 BIO rbio, wbio;
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	868 ngx_connection_t *c;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	869
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	870 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	871
6982 ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	872 if ((where & SSL_CB_HANDSHAKE_START)
ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	873 && SSL_is_server((ngx_ssl_conn_t *) ssl_conn))
ac9b1df5b246 SSL: disabled renegotiation detection in client mode. Sergey Kandaurov <pluknet@nginx.com> parents: 6981 diff changeset	874 {
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	875 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	876
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	877 if (c->ssl->handshaked) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	878 c->ssl->renegotiation = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	879 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL renegotiation");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	880 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	881 }
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	882
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	883 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	884
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	885 if ((where & SSL_CB_ACCEPT_LOOP) == SSL_CB_ACCEPT_LOOP) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	886 c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	887
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	888 if (!c->ssl->handshake_buffer_set) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	889 /*
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	890 * By default OpenSSL uses 4k buffer during a handshake,
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	891 * which is too low for long certificate chains and might
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	892 * result in extra round-trips.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	893 *
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	894 * To adjust a buffer size we detect that buffering was added
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	895 * to write side of the connection by comparing rbio and wbio.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	896 * If they are different, we assume that it's due to buffering
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	897 * added to wbio, and set buffer size.
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	898 */
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	899
5423 5b5a486bd40e SSL: fixed build with OpenSSL 0.9.7. Maxim Dounin <mdounin@mdounin.ru> parents: 5395 diff changeset	900 rbio = SSL_get_rbio((ngx_ssl_conn_t *) ssl_conn);
5b5a486bd40e SSL: fixed build with OpenSSL 0.9.7. Maxim Dounin <mdounin@mdounin.ru> parents: 5395 diff changeset	901 wbio = SSL_get_wbio((ngx_ssl_conn_t *) ssl_conn);
5395 a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	902
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	903 if (rbio != wbio) {
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	904 (void) BIO_set_write_buffer_size(wbio, NGX_SSL_BUFSIZE);
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	905 c->ssl->handshake_buffer_set = 1;
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	906 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	907 }
a720f0b0e083 SSL: adjust buffer used by OpenSSL during handshake (ticket #413). Maxim Dounin <mdounin@mdounin.ru> parents: 5384 diff changeset	908 }
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	909 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	910
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	911
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	912 RSA *
5223 71d85de7b53b Style: replace SSL ssl with ngx_ssl_conn_t ssl_conn. Piotr Sikora <piotr@cloudflare.com> parents: 5222 diff changeset	913 ngx_ssl_rsa512_key_callback(ngx_ssl_conn_t *ssl_conn, int is_export,
71d85de7b53b Style: replace SSL ssl with ngx_ssl_conn_t ssl_conn. Piotr Sikora <piotr@cloudflare.com> parents: 5222 diff changeset	914 int key_length)
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	915 {
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	916 static RSA *key;
b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	917
5754 c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	918 if (key_length != 512) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	919 return NULL;
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	920 }
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	921
6489 c256dfdd469d SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6488 diff changeset	922 #if (OPENSSL_VERSION_NUMBER < 0x10100003L && !defined OPENSSL_NO_DEPRECATED)
5755 8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	923
5754 c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	924 if (key == NULL) {
c7ecd097b883 SSL: return temporary RSA key only when the key length matches. Piotr Sikora <piotr@cloudflare.com> parents: 5747 diff changeset	925 key = RSA_generate_key(512, RSA_F4, NULL, NULL);
559 c1f965ef9718 nginx-0.3.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 549 diff changeset	926 }
c1f965ef9718 nginx-0.3.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 549 diff changeset	927
5755 8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	928 #endif
8df08465fcfd SSL: fixed build with OPENSSL_NO_DEPRECATED defined. Maxim Dounin <mdounin@mdounin.ru> parents: 5754 diff changeset	929
3959 b1f48fa31e6c MSIE export versions are rare now, so RSA 512 key is generated on demand Igor Sysoev <igor@sysoev.ru> parents: 3851 diff changeset	930 return key;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	931 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	932
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	933
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	934 ngx_array_t *
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	935 ngx_ssl_read_password_file(ngx_conf_t cf, ngx_str_t file)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	936 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	937 u_char p, last, *end;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	938 size_t len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	939 ssize_t n;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	940 ngx_fd_t fd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	941 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	942 ngx_array_t *passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	943 ngx_pool_cleanup_t *cln;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	944 u_char buf[NGX_SSL_PASSWORD_BUFFER_SIZE];
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	945
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	946 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	947 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	948 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	949
7454 e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	950 passwords = ngx_array_create(cf->temp_pool, 4, sizeof(ngx_str_t));
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	951 if (passwords == NULL) {
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	952 return NULL;
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	953 }
e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	954
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	955 cln = ngx_pool_cleanup_add(cf->temp_pool, 0);
7454 e72c8a8a8b10 SSL: separate checks for errors in ngx_ssl_read_password_file(). Maxim Dounin <mdounin@mdounin.ru> parents: 7453 diff changeset	956 if (cln == NULL) {
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	957 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	958 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	959
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	960 cln->handler = ngx_ssl_passwords_cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	961 cln->data = passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	962
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	963 fd = ngx_open_file(file->data, NGX_FILE_RDONLY, NGX_FILE_OPEN, 0);
7086 577628e6b6a6 Style. Sergey Kandaurov <pluknet@nginx.com> parents: 7074 diff changeset	964
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	965 if (fd == NGX_INVALID_FILE) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	966 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	967 ngx_open_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	968 return NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	969 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	970
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	971 len = 0;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	972 last = buf;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	973
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	974 do {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	975 n = ngx_read_fd(fd, last, NGX_SSL_PASSWORD_BUFFER_SIZE - len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	976
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	977 if (n == -1) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	978 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	979 ngx_read_fd_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	980 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	981 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	982 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	983
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	984 end = last + n;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	985
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	986 if (len && n == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	987 *end++ = LF;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	988 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	989
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	990 p = buf;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	991
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	992 for ( ;; ) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	993 last = ngx_strlchr(last, end, LF);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	994
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	995 if (last == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	996 break;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	997 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	998
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	999 len = last++ - p;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1000
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1001 if (len && p[len - 1] == CR) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1002 len--;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1003 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1004
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1005 if (len) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1006 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1007 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1008 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1009 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1010 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1011
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1012 pwd->len = len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1013 pwd->data = ngx_pnalloc(cf->temp_pool, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1014
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1015 if (pwd->data == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1016 passwords->nelts--;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1017 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1018 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1019 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1020
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1021 ngx_memcpy(pwd->data, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1022 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1023
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1024 p = last;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1025 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1026
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1027 len = end - p;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1028
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1029 if (len == NGX_SSL_PASSWORD_BUFFER_SIZE) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1030 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1031 "too long line in \"%s\"", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1032 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1033 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1034 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1035
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1036 ngx_memmove(buf, p, len);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1037 last = buf + len;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1038
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1039 } while (n != 0);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1040
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1041 if (passwords->nelts == 0) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1042 pwd = ngx_array_push(passwords);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1043 if (pwd == NULL) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1044 passwords = NULL;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1045 goto cleanup;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1046 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1047
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1048 ngx_memzero(pwd, sizeof(ngx_str_t));
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1049 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1050
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1051 cleanup:
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1052
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1053 if (ngx_close_file(fd) == NGX_FILE_ERROR) {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1054 ngx_conf_log_error(NGX_LOG_ALERT, cf, ngx_errno,
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1055 ngx_close_file_n " \"%s\" failed", file->data);
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1056 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1057
7395 9ca82f273967 Core: ngx_explicit_memzero(). Maxim Dounin <mdounin@mdounin.ru> parents: 7372 diff changeset	1058 ngx_explicit_memzero(buf, NGX_SSL_PASSWORD_BUFFER_SIZE);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1059
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1060 return passwords;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1061 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1062
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1063
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1064 static void
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1065 ngx_ssl_passwords_cleanup(void *data)
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1066 {
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1067 ngx_array_t *passwords = data;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1068
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1069 ngx_str_t *pwd;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1070 ngx_uint_t i;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1071
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1072 pwd = passwords->elts;
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1073
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1074 for (i = 0; i < passwords->nelts; i++) {
7395 9ca82f273967 Core: ngx_explicit_memzero(). Maxim Dounin <mdounin@mdounin.ru> parents: 7372 diff changeset	1075 ngx_explicit_memzero(pwd[i].data, pwd[i].len);
5744 42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1076 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1077 }
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1078
42114bf12da0 SSL: the "ssl_password_file" directive. Valentin Bartenev <vbart@nginx.com> parents: 5700 diff changeset	1079
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1080 ngx_int_t
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1081 ngx_ssl_dhparam(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *file)
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1082 {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1083 DH *dh;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1084 BIO *bio;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1085
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1086 if (file->len == 0) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1087 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1088 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1089
5330 314c3d7cc3a5 Backed out f1a91825730a and 7094bd12c1ff. Maxim Dounin <mdounin@mdounin.ru> parents: 5317 diff changeset	1090 if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1091 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1092 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1093
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1094 bio = BIO_new_file((char *) file->data, "r");
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1095 if (bio == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1096 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1097 "BIO_new_file(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1098 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1099 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1100
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1101 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1102 if (dh == NULL) {
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1103 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1104 "PEM_read_bio_DHparams(\"%s\") failed", file->data);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1105 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1106 return NGX_ERROR;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1107 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1108
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1109 SSL_CTX_set_tmp_dh(ssl->ctx, dh);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1110
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1111 DH_free(dh);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1112 BIO_free(bio);
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1113
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1114 return NGX_OK;
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1115 }
f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1116
4522 14411ee4d89f Whitespace fixes. Maxim Dounin <mdounin@mdounin.ru> parents: 4499 diff changeset	1117
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1118 ngx_int_t
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1119 ngx_ssl_ecdh_curve(ngx_conf_t cf, ngx_ssl_t ssl, ngx_str_t *name)
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1120 {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1121 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1122 #ifndef OPENSSL_NO_ECDH
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1123
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1124 /*
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1125 * Elliptic-Curve Diffie-Hellman parameters are either "named curves"
4572 67653855682e Fixed spelling in multiline C comments. Ruslan Ermilov <ru@nginx.com> parents: 4522 diff changeset	1126 * from RFC 4492 section 5.1.1, or explicitly described curves over
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	1127 * binary fields. OpenSSL only supports the "named curves", which provide
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1128 * maximum interoperability.
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1129 */
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1130
6983 3518287d995e SSL: compatibility with OpenSSL master branch. Sergey Kandaurov <pluknet@nginx.com> parents: 6982 diff changeset	1131 #if (defined SSL_CTX_set1_curves_list \|\| defined SSL_CTRL_SET_CURVES_LIST)
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1132
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1133 /*
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1134 * OpenSSL 1.0.2+ allows configuring a curve list instead of a single
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1135 * curve previously supported. By default an internal list is used,
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1136 * with prime256v1 being preferred by server in OpenSSL 1.0.2b+
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1137 * and X25519 in OpenSSL 1.1.0+.
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1138 *
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1139 * By default a curve preferred by the client will be used for
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1140 * key exchange. The SSL_OP_CIPHER_SERVER_PREFERENCE option can
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1141 * be used to prefer server curves instead, similar to what it
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1142 * does for ciphers.
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1143 */
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1144
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1145 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1146
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1147 #if SSL_CTRL_SET_ECDH_AUTO
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1148 /* not needed in OpenSSL 1.1.0+ */
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1149 SSL_CTX_set_ecdh_auto(ssl->ctx, 1);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1150 #endif
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1151
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1152 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1153 return NGX_OK;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1154 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1155
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1156 if (SSL_CTX_set1_curves_list(ssl->ctx, (char *) name->data) == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1157 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1158 "SSL_CTX_set1_curves_list(\"%s\") failed", name->data);
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1159 return NGX_ERROR;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1160 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1161
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1162 #else
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1163
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1164 int nid;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1165 char *curve;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1166 EC_KEY *ecdh;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1167
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1168 if (ngx_strcmp(name->data, "auto") == 0) {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1169 curve = "prime256v1";
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1170
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1171 } else {
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1172 curve = (char *) name->data;
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1173 }
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1174
2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1175 nid = OBJ_sn2nid(curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1176 if (nid == 0) {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1177 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1178 "OBJ_sn2nid(\"%s\") failed: unknown curve", curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1179 return NGX_ERROR;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1180 }
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1181
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1182 ecdh = EC_KEY_new_by_curve_name(nid);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1183 if (ecdh == NULL) {
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1184 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1185 "EC_KEY_new_by_curve_name(\"%s\") failed", curve);
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1186 return NGX_ERROR;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1187 }
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1188
5003 82234f3f5ca2 SSL: speedup loading of configs with many ssl servers. Maxim Dounin <mdounin@mdounin.ru> parents: 4877 diff changeset	1189 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
82234f3f5ca2 SSL: speedup loading of configs with many ssl servers. Maxim Dounin <mdounin@mdounin.ru> parents: 4877 diff changeset	1190
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1191 SSL_CTX_set_tmp_ecdh(ssl->ctx, ecdh);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1192
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1193 EC_KEY_free(ecdh);
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1194 #endif
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1195 #endif
6553 2014ed60f17f SSL: support for multiple curves (ticket #885). Maxim Dounin <mdounin@mdounin.ru> parents: 6552 diff changeset	1196 #endif
3960 0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1197
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1198 return NGX_OK;
0832a6997227 ECDHE support Igor Sysoev <igor@sysoev.ru> parents: 3959 diff changeset	1199 }
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1200
4522 14411ee4d89f Whitespace fixes. Maxim Dounin <mdounin@mdounin.ru> parents: 4499 diff changeset	1201
2044 f45cec1cd270 DH parameters, ssl_dhparam Igor Sysoev <igor@sysoev.ru> parents: 2032 diff changeset	1202 ngx_int_t
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1203 ngx_ssl_early_data(ngx_conf_t cf, ngx_ssl_t ssl, ngx_uint_t enable)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1204 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1205 if (!enable) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1206 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1207 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1208
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1209 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1210
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1211 /* BoringSSL */
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1212
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1213 SSL_CTX_set_early_data_enabled(ssl->ctx, 1);
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1214
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1215 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1216
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1217 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1218
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1219 SSL_CTX_set_max_early_data(ssl->ctx, NGX_SSL_BUFSIZE);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1220
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1221 #else
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1222 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1223 "\"ssl_early_data\" is not supported on this platform, "
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1224 "ignored");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1225 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1226
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1227 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1228 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1229
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1230
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	1231 ngx_int_t
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1232 ngx_ssl_client_session_cache(ngx_conf_t cf, ngx_ssl_t ssl, ngx_uint_t enable)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1233 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1234 if (!enable) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1235 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1236 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1237
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1238 SSL_CTX_set_session_cache_mode(ssl->ctx,
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1239 SSL_SESS_CACHE_CLIENT
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1240 \|SSL_SESS_CACHE_NO_INTERNAL);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1241
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1242 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_client_session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1243
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1244 return NGX_OK;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1245 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1246
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1247
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1248 static int
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1249 ngx_ssl_new_client_session(ngx_ssl_conn_t ssl_conn, ngx_ssl_session_t sess)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1250 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1251 ngx_connection_t *c;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1252
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1253 c = ngx_ssl_get_connection(ssl_conn);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1254
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1255 if (c->ssl->save_session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1256 c->ssl->session = sess;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1257
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1258 c->ssl->save_session(c);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1259
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1260 c->ssl->session = NULL;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1261 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1262
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1263 return 0;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1264 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1265
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1266
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1267 ngx_int_t
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1268 ngx_ssl_create_connection(ngx_ssl_t ssl, ngx_connection_t c, ngx_uint_t flags)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1269 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1270 ngx_ssl_connection_t *sc;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1271
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1272 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1273 if (sc == NULL) {
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1274 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1275 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1276
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	1277 sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	1278 sc->buffer_size = ssl->buffer_size;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	1279
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	1280 sc->session_ctx = ssl->ctx;
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	1281
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1282 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1283 if (SSL_CTX_get_max_early_data(ssl->ctx)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1284 sc->try_early_data = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1285 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1286 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1287
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1288 sc->connection = SSL_new(ssl->ctx);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1289
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1290 if (sc->connection == NULL) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1291 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1292 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1293 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1294
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1295 if (SSL_set_fd(sc->connection, c->fd) == 0) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1296 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1297 return NGX_ERROR;
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1298 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1299
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1300 if (flags & NGX_SSL_CLIENT) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1301 SSL_set_connect_state(sc->connection);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1302
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1303 } else {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1304 SSL_set_accept_state(sc->connection);
7319 dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	1305
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	1306 #ifdef SSL_OP_NO_RENEGOTIATION
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	1307 SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
dcab86115261 SSL: use of the SSL_OP_NO_RENEGOTIATION option (ticket #1376). Maxim Dounin <mdounin@mdounin.ru> parents: 7318 diff changeset	1308 #endif
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1309 }
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1310
969 065b39794fff ngx_ssl_get_server_conf() Igor Sysoev <igor@sysoev.ru> parents: 968 diff changeset	1311 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1312 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1313 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1314 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	1315
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1316 c->ssl = sc;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1317
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1318 return NGX_OK;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1319 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1320
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1321
7320 696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1322 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1323 ngx_ssl_get_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1324 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1325 #ifdef TLS1_3_VERSION
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1326 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1327 SSL_SESSION_up_ref(c->ssl->session);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1328 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1329 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1330 #endif
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1331
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1332 return SSL_get1_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1333 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1334
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1335
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1336 ngx_ssl_session_t *
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1337 ngx_ssl_get0_session(ngx_connection_t *c)
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1338 {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1339 if (c->ssl->session) {
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1340 return c->ssl->session;
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1341 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1342
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1343 return SSL_get0_session(c->ssl->connection);
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1344 }
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1345
696df3ac27ac SSL: save sessions for upstream peers using a callback function. Sergey Kandaurov <pluknet@nginx.com> parents: 7319 diff changeset	1346
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1347 ngx_int_t
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1348 ngx_ssl_set_session(ngx_connection_t c, ngx_ssl_session_t session)
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1349 {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1350 if (session) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1351 if (SSL_set_session(c->ssl->connection, session) == 0) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1352 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1353 return NGX_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1354 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1355 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1356
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1357 return NGX_OK;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1358 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1359
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1360
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1361 ngx_int_t
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1362 ngx_ssl_handshake(ngx_connection_t *c)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1363 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1364 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1365 ngx_err_t err;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1366
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1367 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1368 if (c->ssl->try_early_data) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1369 return ngx_ssl_try_early_data(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1370 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1371 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1372
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	1373 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	1374
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1375 n = SSL_do_handshake(c->ssl->connection);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1376
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1377 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1378
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1379 if (n == 1) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1380
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	1381 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1382 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1383 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1384
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	1385 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1386 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1387 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1388
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1389 #if (NGX_DEBUG)
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1390 ngx_ssl_handshake_log(c);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1391 #endif
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1392
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1393 c->ssl->handshaked = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1394
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1395 c->recv = ngx_ssl_recv;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1396 c->send = ngx_ssl_write;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1397 c->recv_chain = ngx_ssl_recv_chain;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1398 c->send_chain = ngx_ssl_send_chain;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1399
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1400 #ifndef SSL_OP_NO_RENEGOTIATION
6255 b40af2fd1c16 SSL: compatibility with OpenSSL master branch. Maxim Dounin <mdounin@mdounin.ru> parents: 6036 diff changeset	1401 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	1402 #ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	1403
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1404 /* initial handshake done, disable renegotiation (CVE-2009-3555) */
6995 eb5d119323d8 SSL: allowed renegotiation in client mode with OpenSSL < 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6983 diff changeset	1405 if (c->ssl->connection->s3 && SSL_is_server(c->ssl->connection)) {
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1406 c->ssl->connection->s3->flags \|= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1407 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1408
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	1409 #endif
6255 b40af2fd1c16 SSL: compatibility with OpenSSL master branch. Maxim Dounin <mdounin@mdounin.ru> parents: 6036 diff changeset	1410 #endif
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1411 #endif
5946 ee941e49bd88 SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS. Lukas Tribus <luky-37@hotmail.com> parents: 5934 diff changeset	1412
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1413 return NGX_OK;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1414 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1415
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1416 sslerr = SSL_get_error(c->ssl->connection, n);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1417
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1418 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1419
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1420 if (sslerr == SSL_ERROR_WANT_READ) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1421 c->read->ready = 0;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1422 c->read->handler = ngx_ssl_handshake_handler;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1423 c->write->handler = ngx_ssl_handshake_handler;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1424
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	1425 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1426 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1427 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1428
5024 03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1429 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1430 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1431 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1432
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1433 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1434 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1435
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1436 if (sslerr == SSL_ERROR_WANT_WRITE) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1437 c->write->ready = 0;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1438 c->read->handler = ngx_ssl_handshake_handler;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1439 c->write->handler = ngx_ssl_handshake_handler;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1440
5024 03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1441 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1442 return NGX_ERROR;
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1443 }
03513220b83b SSL: fixed ngx_ssl_handshake() with level-triggered event methods. Maxim Dounin <mdounin@mdounin.ru> parents: 5023 diff changeset	1444
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	1445 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1446 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1447 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1448
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1449 return NGX_AGAIN;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1450 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1451
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1452 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1453
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1454 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1455 c->ssl->no_send_shutdown = 1;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1456 c->read->eof = 1;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1457
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1458 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
5747 57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake". Maxim Dounin <mdounin@mdounin.ru> parents: 5744 diff changeset	1459 ngx_connection_error(c, err,
57c05ff57980 SSL: logging level of "peer closed connection in SSL handshake". Maxim Dounin <mdounin@mdounin.ru> parents: 5744 diff changeset	1460 "peer closed connection in SSL handshake");
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1461
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1462 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1463 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1464
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1465 c->read->error = 1;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1466
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1467 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1468
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1469 return NGX_ERROR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1470 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1471
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1472
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1473 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1474
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1475 static ngx_int_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1476 ngx_ssl_try_early_data(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1477 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1478 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1479 u_char buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1480 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1481 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1482
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1483 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1484
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1485 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1486
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1487 n = SSL_read_early_data(c->ssl->connection, &buf, 1, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1488
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1489 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1490 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1491
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1492 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1493 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1494 return ngx_ssl_handshake(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1495 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1496
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1497 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1498
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1499 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1500 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1501 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1502
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1503 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1504 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1505 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1506
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1507 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1508 ngx_ssl_handshake_log(c);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1509 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1510
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1511 c->ssl->try_early_data = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1512
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1513 c->ssl->early_buf = buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1514 c->ssl->early_preread = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1515
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1516 c->ssl->handshaked = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1517 c->ssl->in_early = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1518
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1519 c->recv = ngx_ssl_recv;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1520 c->send = ngx_ssl_write;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1521 c->recv_chain = ngx_ssl_recv_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1522 c->send_chain = ngx_ssl_send_chain;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1523
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1524 return NGX_OK;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1525 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1526
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1527 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1528
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1529 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1530
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1531 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1532
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1533 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1534 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1535 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1536 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1537
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1538 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1539 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1540 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1541
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1542 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1543 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1544 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1545
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1546 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1547 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1548
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1549 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1550 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1551 c->read->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1552 c->write->handler = ngx_ssl_handshake_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1553
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1554 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1555 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1556 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1557
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1558 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1559 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1560 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1561
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1562 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1563 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1564
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1565 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1566
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1567 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1568 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1569 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1570
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1571 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1572 ngx_connection_error(c, err,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1573 "peer closed connection in SSL handshake");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1574
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1575 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1576 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1577
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1578 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1579
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1580 ngx_ssl_connection_error(c, sslerr, err, "SSL_read_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1581
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1582 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1583 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1584
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1585 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1586
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1587
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1588 #if (NGX_DEBUG)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1589
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1590 static void
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1591 ngx_ssl_handshake_log(ngx_connection_t *c)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1592 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1593 char buf[129], s, d;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1594 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1595 const
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1596 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1597 SSL_CIPHER *cipher;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1598
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1599 cipher = SSL_get_current_cipher(c->ssl->connection);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1600
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1601 if (cipher) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1602 SSL_CIPHER_description(cipher, &buf[1], 128);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1603
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1604 for (s = &buf[1], d = buf; *s; s++) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1605 if (s == ' ' && d == ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1606 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1607 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1608
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1609 if (s == LF \|\| s == CR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1610 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1611 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1612
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1613 ++d = s;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1614 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1615
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1616 if (*d != ' ') {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1617 d++;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1618 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1619
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1620 *d = '\0';
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1621
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1622 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1623 "SSL: %s, cipher: \"%s\"",
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1624 SSL_get_version(c->ssl->connection), &buf[1]);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1625
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1626 if (SSL_session_reused(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1627 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1628 "SSL reused session");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1629 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1630
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1631 } else {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1632 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1633 "SSL no shared ciphers");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1634 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1635 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1636
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1637 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1638
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1639
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1640 static void
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1641 ngx_ssl_handshake_handler(ngx_event_t *ev)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1642 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1643 ngx_connection_t *c;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1644
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1645 c = ev->data;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1646
549 e16a8d574da5 nginx-0.2.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 547 diff changeset	1647 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1648 "SSL handshake handler: %d", ev->write);
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1649
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1650 if (ev->timedout) {
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1651 c->ssl->handler(c);
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1652 return;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1653 }
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	1654
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1655 if (ngx_ssl_handshake(c) == NGX_AGAIN) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1656 return;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1657 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1658
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1659 c->ssl->handler(c);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1660 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1661
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1662
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1663 ssize_t
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1664 ngx_ssl_recv_chain(ngx_connection_t c, ngx_chain_t cl, off_t limit)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1665 {
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1666 u_char *last;
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1667 ssize_t n, bytes, size;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1668 ngx_buf_t *b;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1669
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1670 bytes = 0;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1671
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1672 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1673 last = b->last;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1674
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1675 for ( ;; ) {
5882 ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1676 size = b->end - last;
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1677
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1678 if (limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1679 if (bytes >= limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1680 return bytes;
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1681 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1682
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1683 if (bytes + size > limit) {
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1684 size = (ssize_t) (limit - bytes);
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1685 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1686 }
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1687
ec81934727a1 Core: added limit to recv_chain(). Roman Arutyunyan <arut@nginx.com> parents: 5834 diff changeset	1688 n = ngx_ssl_recv(c, last, size);
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1689
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1690 if (n > 0) {
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1691 last += n;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1692 bytes += n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1693
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1694 if (last == b->end) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1695 cl = cl->next;
1154 427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1696
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1697 if (cl == NULL) {
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1698 return bytes;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1699 }
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1700
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1701 b = cl->buf;
427de53e45c2 ngx_ssl_recv_chain() must not update buf->last, Igor Sysoev <igor@sysoev.ru> parents: 1043 diff changeset	1702 last = b->last;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1703 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1704
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1705 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1706 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1707
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1708 if (bytes) {
2052 b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	1709
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	1710 if (n == 0 \|\| n == NGX_ERROR) {
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	1711 c->read->ready = 1;
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	1712 }
b4085596a7e6 fix "proxy_pass https://..." broken in r1427 Igor Sysoev <igor@sysoev.ru> parents: 2049 diff changeset	1713
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1714 return bytes;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1715 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1716
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1717 return n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1718 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1719 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1720
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1721
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1722 ssize_t
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1723 ngx_ssl_recv(ngx_connection_t c, u_char buf, size_t size)
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1724 {
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1725 int n, bytes;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1726
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1727 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1728 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1729 return ngx_ssl_recv_early(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1730 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1731 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1732
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1733 if (c->ssl->last == NGX_ERROR) {
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1734 c->read->error = 1;
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1735 return NGX_ERROR;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1736 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1737
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1738 if (c->ssl->last == NGX_DONE) {
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1739 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1740 c->read->eof = 1;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1741 return 0;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1742 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1743
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1744 bytes = 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1745
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	1746 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	1747
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1748 /*
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1749 * SSL_read() may return data in parts, so try to read
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1750 * until SSL_read() would return no data
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1751 */
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1752
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1753 for ( ;; ) {
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1754
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	1755 n = SSL_read(c->ssl->connection, buf, size);
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1756
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1757 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1758
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1759 if (n > 0) {
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1760 bytes += n;
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1761 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1762
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1763 c->ssl->last = ngx_ssl_handle_recv(c, n);
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1764
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1765 if (c->ssl->last == NGX_OK) {
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1766
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1767 size -= n;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1768
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1769 if (size == 0) {
5450 9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	1770 c->read->ready = 1;
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1771 return bytes;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1772 }
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1773
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1774 buf += n;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1775
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1776 continue;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1777 }
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1778
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1779 if (bytes) {
5450 9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	1780 if (c->ssl->last != NGX_AGAIN) {
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	1781 c->read->ready = 1;
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	1782 }
9868c72f6f43 SSL: fixed c->read->ready handling in ngx_ssl_recv(). Maxim Dounin <mdounin@mdounin.ru> parents: 5425 diff changeset	1783
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1784 return bytes;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1785 }
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1786
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1787 switch (c->ssl->last) {
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1788
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1789 case NGX_DONE:
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1790 c->read->ready = 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1791 c->read->eof = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1792 return 0;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1793
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1794 case NGX_ERROR:
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1795 c->read->error = 1;
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1796
4499 778ef9c3fd2d Fixed spelling in single-line comments. Ruslan Ermilov <ru@nginx.com> parents: 4497 diff changeset	1797 /* fall through */
1426 adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1798
adbafd129d06 do not set read->eof, ready, and error prematurely Igor Sysoev <igor@sysoev.ru> parents: 1421 diff changeset	1799 case NGX_AGAIN:
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	1800 return c->ssl->last;
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	1801 }
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1802 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1803 }
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1804
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1805
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1806 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1807
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1808 static ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1809 ngx_ssl_recv_early(ngx_connection_t c, u_char buf, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1810 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1811 int n, bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1812 size_t readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1813
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1814 if (c->ssl->last == NGX_ERROR) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1815 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1816 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1817 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1818
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1819 if (c->ssl->last == NGX_DONE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1820 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1821 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1822 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1823 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1824
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1825 bytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1826
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1827 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1828
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1829 if (c->ssl->early_preread) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1830
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1831 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1832 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1833 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1834 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1835 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1836
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1837 *buf = c->ssl->early_buf;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1838
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1839 c->ssl->early_preread = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1840
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1841 bytes = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1842 size -= 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1843 buf += 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1844 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1845
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	1846 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	1847 return NGX_AGAIN;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	1848 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	1849
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1850 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1851 * SSL_read_early_data() may return data in parts, so try to read
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1852 * until SSL_read_early_data() would return no data
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1853 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1854
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1855 for ( ;; ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1856
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1857 readbytes = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1858
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1859 n = SSL_read_early_data(c->ssl->connection, buf, size, &readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1860
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1861 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1862 "SSL_read_early_data: %d, %uz", n, readbytes);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1863
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1864 if (n == SSL_READ_EARLY_DATA_SUCCESS) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1865
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1866 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1867
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1868 bytes += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1869 size -= readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1870
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1871 if (size == 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1872 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1873 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1874 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1875
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1876 buf += readbytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1877
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1878 continue;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1879 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1880
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1881 if (n == SSL_READ_EARLY_DATA_FINISH) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1882
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1883 c->ssl->last = ngx_ssl_handle_recv(c, 1);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1884 c->ssl->in_early = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1885
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1886 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1887 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1888 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1889 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1890
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1891 return ngx_ssl_recv(c, buf, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1892 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1893
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1894 /* SSL_READ_EARLY_DATA_ERROR */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1895
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1896 c->ssl->last = ngx_ssl_handle_recv(c, 0);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1897
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1898 if (bytes) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1899 if (c->ssl->last != NGX_AGAIN) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1900 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1901 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1902
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1903 return bytes;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1904 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1905
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1906 switch (c->ssl->last) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1907
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1908 case NGX_DONE:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1909 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1910 c->read->eof = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1911 return 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1912
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1913 case NGX_ERROR:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1914 c->read->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1915
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1916 /* fall through */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1917
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1918 case NGX_AGAIN:
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1919 return c->ssl->last;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1920 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1921 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1922 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1923
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1924 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1925
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	1926
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1927 static ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1928 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1929 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1930 int sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	1931 ngx_err_t err;
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1932
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1933 #ifndef SSL_OP_NO_RENEGOTIATION
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1934
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1935 if (c->ssl->renegotiation) {
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1936 /*
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1937 * disable renegotiation (CVE-2009-3555):
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1938 * OpenSSL (at least up to 0.9.8l) does not handle disabled
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1939 * renegotiation gracefully, so drop connection here
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1940 */
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1941
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1942 ngx_log_error(NGX_LOG_NOTICE, c->log, 0, "SSL renegotiation disabled");
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1943
4236 2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1944 while (ERR_peek_error()) {
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1945 ngx_ssl_error(NGX_LOG_DEBUG, c->log, 0,
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1946 "ignoring stale global SSL error");
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1947 }
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1948
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1949 ERR_clear_error();
2ada2a26b24c Silently ignoring a stale global SSL error left after disabled renegotiation. Igor Sysoev <igor@sysoev.ru> parents: 4228 diff changeset	1950
3300 5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1951 c->ssl->no_wait_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1952 c->ssl->no_send_shutdown = 1;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1953
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1954 return NGX_ERROR;
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1955 }
5a08dfb8d763 disable SSL renegotiation (CVE-2009-3555) Igor Sysoev <igor@sysoev.ru> parents: 3283 diff changeset	1956
7356 e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1957 #endif
e3ba4026c02d SSL: disabled renegotiation checks with SSL_OP_NO_RENEGOTIATION. Maxim Dounin <mdounin@mdounin.ru> parents: 7353 diff changeset	1958
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1959 if (n > 0) {
479 c52408583801 nginx-0.1.14-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 473 diff changeset	1960
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1961 if (c->ssl->saved_write_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1962
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	1963 c->write->handler = c->ssl->saved_write_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1964 c->ssl->saved_write_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1965 c->write->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1966
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	1967 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1968 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1969 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1970
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	1971 ngx_post_event(c->write, &ngx_posted_events);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1972 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	1973
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	1974 return NGX_OK;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1975 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1976
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	1977 sslerr = SSL_get_error(c->ssl->connection, n);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1978
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	1979 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1980
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	1981 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1982
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	1983 if (sslerr == SSL_ERROR_WANT_READ) {
7353 87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1984
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1985 if (c->ssl->saved_write_handler) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1986
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1987 c->write->handler = c->ssl->saved_write_handler;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1988 c->ssl->saved_write_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1989 c->write->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1990
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1991 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1992 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1993 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1994
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1995 ngx_post_event(c->write, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1996 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	1997
455 295d97d70c69 nginx-0.1.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 452 diff changeset	1998 c->read->ready = 0;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	1999 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2000 }
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2001
445 f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	2002 if (sslerr == SSL_ERROR_WANT_WRITE) {
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2003
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2004 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2005 "SSL_read: want write");
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2006
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2007 c->write->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2008
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2009 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2010 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2011 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2012
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2013 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2014 * we do not set the timer because there is already the read event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2015 */
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2016
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2017 if (c->ssl->saved_write_handler == NULL) {
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2018 c->ssl->saved_write_handler = c->write->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2019 c->write->handler = ngx_ssl_write_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2020 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2021
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2022 return NGX_AGAIN;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2023 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2024
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2025 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2026 c->ssl->no_send_shutdown = 1;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2027
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2028 if (sslerr == SSL_ERROR_ZERO_RETURN \|\| ERR_peek_error() == 0) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2029 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2030 "peer shutdown SSL cleanly");
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2031 return NGX_DONE;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2032 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2033
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2034 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2035
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2036 return NGX_ERROR;
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2037 }
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2038
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2039
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2040 static void
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2041 ngx_ssl_write_handler(ngx_event_t *wev)
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2042 {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2043 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2044
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2045 c = wev->data;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2046
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2047 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL write handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2048
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2049 c->read->handler(c->read);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2050 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2051
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2052
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2053 /*
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2054 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2055 * before the SSL_write() call to decrease a SSL overhead.
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2056 *
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2057 * Besides for protocols such as HTTP it is possible to always buffer
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2058 * the output to decrease a SSL overhead some more.
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2059 */
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2060
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2061 ngx_chain_t *
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2062 ngx_ssl_send_chain(ngx_connection_t c, ngx_chain_t in, off_t limit)
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2063 {
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2064 int n;
399 4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import Igor Sysoev <igor@sysoev.ru> parents: 398 diff changeset	2065 ngx_uint_t flush;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2066 ssize_t send, size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2067 ngx_buf_t *buf;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2068
2280 6453161bf53e always use buffer, if connection is buffered, Igor Sysoev <igor@sysoev.ru> parents: 2165 diff changeset	2069 if (!c->ssl->buffer) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2070
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2071 while (in) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2072 if (ngx_buf_special(in->buf)) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2073 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2074 continue;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2075 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2076
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2077 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2078
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2079 if (n == NGX_ERROR) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2080 return NGX_CHAIN_ERROR;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2081 }
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2082
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2083 if (n == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2084 return in;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2085 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2086
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2087 in->buf->pos += n;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2088
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2089 if (in->buf->pos == in->buf->last) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2090 in = in->next;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2091 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2092 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2093
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2094 return in;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2095 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2096
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2097
3962 df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2098 /* the maximum limit size is the maximum int32_t value - the page size */
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2099
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2100 if (limit == 0 \|\| limit > (off_t) (NGX_MAX_INT32_VALUE - ngx_pagesize)) {
df2ae4bc7415 fix SSL connection issues on platforms with 32-bit off_t Igor Sysoev <igor@sysoev.ru> parents: 3961 diff changeset	2101 limit = NGX_MAX_INT32_VALUE - ngx_pagesize;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2102 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2103
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2104 buf = c->ssl->buf;
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2105
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2106 if (buf == NULL) {
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2107 buf = ngx_create_temp_buf(c->pool, c->ssl->buffer_size);
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2108 if (buf == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2109 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2110 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2111
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2112 c->ssl->buf = buf;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2113 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2114
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2115 if (buf->start == NULL) {
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2116 buf->start = ngx_palloc(c->pool, c->ssl->buffer_size);
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2117 if (buf->start == NULL) {
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2118 return NGX_CHAIN_ERROR;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2119 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2120
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2121 buf->pos = buf->start;
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2122 buf->last = buf->start;
5487 a297b7ad6f94 SSL: ssl_buffer_size directive. Maxim Dounin <mdounin@mdounin.ru> parents: 5450 diff changeset	2123 buf->end = buf->start + c->ssl->buffer_size;
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2124 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2125
5023 70a35b7b63ea SSL: take into account data in the buffer while limiting output. Valentin Bartenev <vbart@nginx.com> parents: 5022 diff changeset	2126 send = buf->last - buf->pos;
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2127 flush = (in == NULL) ? 1 : buf->flush;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2128
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2129 for ( ;; ) {
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2130
3283 52b1624b93c2 fix segfault in SSL if limit_rate is used Igor Sysoev <igor@sysoev.ru> parents: 3159 diff changeset	2131 while (in && buf->last < buf->end && send < limit) {
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2132 if (in->buf->last_buf \|\| in->buf->flush) {
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2133 flush = 1;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2134 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2135
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2136 if (ngx_buf_special(in->buf)) {
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2137 in = in->next;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2138 continue;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2139 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2140
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2141 size = in->buf->last - in->buf->pos;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2142
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2143 if (size > buf->end - buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2144 size = buf->end - buf->last;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2145 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2146
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2147 if (send + size > limit) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2148 size = (ssize_t) (limit - send);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2149 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2150
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2151 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6480 f01ab2dbcfdc Fixed logging. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	2152 "SSL buf copy: %z", size);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2153
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2154 ngx_memcpy(buf->last, in->buf->pos, size);
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2155
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2156 buf->last += size;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2157 in->buf->pos += size;
3283 52b1624b93c2 fix segfault in SSL if limit_rate is used Igor Sysoev <igor@sysoev.ru> parents: 3159 diff changeset	2158 send += size;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2159
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2160 if (in->buf->pos == in->buf->last) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2161 in = in->next;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2162 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2163 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2164
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2165 if (!flush && send < limit && buf->last < buf->end) {
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2166 break;
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2167 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2168
5021 674f8739e443 SSL: calculation of buffer size moved closer to its usage. Valentin Bartenev <vbart@nginx.com> parents: 5020 diff changeset	2169 size = buf->last - buf->pos;
674f8739e443 SSL: calculation of buffer size moved closer to its usage. Valentin Bartenev <vbart@nginx.com> parents: 5020 diff changeset	2170
5022 1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2171 if (size == 0) {
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2172 buf->flush = 0;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2173 c->buffered &= ~NGX_SSL_BUFFERED;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2174 return in;
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2175 }
1d819608ad4a SSL: avoid calling SSL_write() with zero data size. Valentin Bartenev <vbart@nginx.com> parents: 5021 diff changeset	2176
398 201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2177 n = ngx_ssl_write(c, buf->pos, size);
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2178
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2179 if (n == NGX_ERROR) {
201b5f68b59f nginx-0.0.7-2004-07-23-21:05:37 import Igor Sysoev <igor@sysoev.ru> parents: 397 diff changeset	2180 return NGX_CHAIN_ERROR;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2181 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2182
511 c12967aadd87 nginx-0.1.30-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 509 diff changeset	2183 if (n == NGX_AGAIN) {
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2184 break;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2185 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2186
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2187 buf->pos += n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2188
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2189 if (n < size) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2190 break;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2191 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2192
5019 69693a098655 SSL: resetting of flush flag after the data was written. Valentin Bartenev <vbart@nginx.com> parents: 5018 diff changeset	2193 flush = 0;
69693a098655 SSL: resetting of flush flag after the data was written. Valentin Bartenev <vbart@nginx.com> parents: 5018 diff changeset	2194
5018 0ea36741bb35 SSL: removed conditions that always hold true. Valentin Bartenev <vbart@nginx.com> parents: 5003 diff changeset	2195 buf->pos = buf->start;
0ea36741bb35 SSL: removed conditions that always hold true. Valentin Bartenev <vbart@nginx.com> parents: 5003 diff changeset	2196 buf->last = buf->start;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2197
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2198 if (in == NULL \|\| send == limit) {
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2199 break;
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2200 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2201 }
f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2202
5020 587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2203 buf->flush = flush;
587dbe2edc5f SSL: preservation of flush flag for buffered data. Valentin Bartenev <vbart@nginx.com> parents: 5019 diff changeset	2204
597 9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2205 if (buf->pos < buf->last) {
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2206 c->buffered \|= NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2207
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2208 } else {
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2209 c->buffered &= ~NGX_SSL_BUFFERED;
9262f520ce21 nginx-0.3.20-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 591 diff changeset	2210 }
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2211
399 4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import Igor Sysoev <igor@sysoev.ru> parents: 398 diff changeset	2212 return in;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2213 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2214
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2215
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2216 ssize_t
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2217 ngx_ssl_write(ngx_connection_t c, u_char data, size_t size)
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2218 {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2219 int n, sslerr;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2220 ngx_err_t err;
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2221
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2222 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2223 if (c->ssl->in_early) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2224 return ngx_ssl_write_early(c, data, size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2225 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2226 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2227
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2228 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2229
6480 f01ab2dbcfdc Fixed logging. Sergey Kandaurov <pluknet@nginx.com> parents: 6474 diff changeset	2230 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2231
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2232 n = SSL_write(c->ssl->connection, data, size);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2233
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2234 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2235
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2236 if (n > 0) {
539 371c1cee100d nginx-0.1.44-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 513 diff changeset	2237
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2238 if (c->ssl->saved_read_handler) {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2239
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2240 c->read->handler = c->ssl->saved_read_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2241 c->ssl->saved_read_handler = NULL;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2242 c->read->ready = 1;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2243
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2244 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2245 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2246 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2247
563 9c2f3ed7a247 nginx-0.3.3-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 559 diff changeset	2248 ngx_post_event(c->read, &ngx_posted_events);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2249 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2250
5986 c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write(). Ruslan Ermilov <ru@nginx.com> parents: 5946 diff changeset	2251 c->sent += n;
c2f309fb7ad2 SSL: account sent bytes in ngx_ssl_write(). Ruslan Ermilov <ru@nginx.com> parents: 5946 diff changeset	2252
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2253 return n;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2254 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2255
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2256 sslerr = SSL_get_error(c->ssl->connection, n);
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2257
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2258 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2259
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2260 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2261
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2262 if (sslerr == SSL_ERROR_WANT_WRITE) {
7353 87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2263
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2264 if (c->ssl->saved_read_handler) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2265
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2266 c->read->handler = c->ssl->saved_read_handler;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2267 c->ssl->saved_read_handler = NULL;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2268 c->read->ready = 1;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2269
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2270 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2271 return NGX_ERROR;
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2272 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2273
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2274 ngx_post_event(c->read, &ngx_posted_events);
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2275 }
87d2ea860f38 SSL: restore handlers after blocking. Maxim Dounin <mdounin@mdounin.ru> parents: 7352 diff changeset	2276
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2277 c->write->ready = 0;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2278 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2279 }
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2280
445 f26432a1935a nginx-0.1.0-2004-09-30-10:38:49 import Igor Sysoev <igor@sysoev.ru> parents: 444 diff changeset	2281 if (sslerr == SSL_ERROR_WANT_READ) {
452 23fb87bddda1 nginx-0.1.1-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 445 diff changeset	2282
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2283 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2284 "SSL_write: want read");
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2285
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2286 c->read->ready = 0;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2287
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2288 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2289 return NGX_ERROR;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2290 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2291
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2292 /*
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2293 * we do not set the timer because there is already
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2294 * the write event timer
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2295 */
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2296
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2297 if (c->ssl->saved_read_handler == NULL) {
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2298 c->ssl->saved_read_handler = c->read->handler;
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2299 c->read->handler = ngx_ssl_read_handler;
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2300 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2301
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2302 return NGX_AGAIN;
de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2303 }
395 f8f0f1834266 nginx-0.0.7-2004-07-16-21:11:43 import Igor Sysoev <igor@sysoev.ru> parents: 394 diff changeset	2304
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2305 c->ssl->no_wait_shutdown = 1;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2306 c->ssl->no_send_shutdown = 1;
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2307 c->write->error = 1;
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2308
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2309 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2310
397 de797f3b4c27 nginx-0.0.7-2004-07-23-09:37:29 import Igor Sysoev <igor@sysoev.ru> parents: 396 diff changeset	2311 return NGX_ERROR;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2312 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2313
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2314
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2315 #ifdef SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2316
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2317 ssize_t
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2318 ngx_ssl_write_early(ngx_connection_t c, u_char data, size_t size)
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2319 {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2320 int n, sslerr;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2321 size_t written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2322 ngx_err_t err;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2323
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2324 ngx_ssl_clear_error(c->log);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2325
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2326 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %uz", size);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2327
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2328 written = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2329
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2330 n = SSL_write_early_data(c->ssl->connection, data, size, &written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2331
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2332 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2333 "SSL_write_early_data: %d, %uz", n, written);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2334
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2335 if (n > 0) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2336
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2337 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2338
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2339 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2340 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2341 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2342
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2343 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2344 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2345 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2346
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2347 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2348 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2349
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2350 if (c->ssl->write_blocked) {
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2351 c->ssl->write_blocked = 0;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2352 ngx_post_event(c->read, &ngx_posted_events);
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2353 }
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2354
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2355 c->sent += written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2356
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2357 return written;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2358 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2359
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2360 sslerr = SSL_get_error(c->ssl->connection, n);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2361
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2362 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2363
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2364 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2365
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2366 if (sslerr == SSL_ERROR_WANT_WRITE) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2367
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2368 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2369 "SSL_write_early_data: want write");
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2370
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2371 if (c->ssl->saved_read_handler) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2372
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2373 c->read->handler = c->ssl->saved_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2374 c->ssl->saved_read_handler = NULL;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2375 c->read->ready = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2376
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2377 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2378 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2379 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2380
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2381 ngx_post_event(c->read, &ngx_posted_events);
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2382 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2383
7431 294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2384 /*
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2385 * OpenSSL 1.1.1a fails to handle SSL_read_early_data()
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2386 * if an SSL_write_early_data() call blocked on writing,
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2387 * see https://github.com/openssl/openssl/issues/7757
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2388 */
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2389
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2390 c->ssl->write_blocked = 1;
294162223c7c SSL: avoid reading on pending SSL_write_early_data(). Sergey Kandaurov <pluknet@nginx.com> parents: 7395 diff changeset	2391
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2392 c->write->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2393 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2394 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2395
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2396 if (sslerr == SSL_ERROR_WANT_READ) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2397
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2398 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2399 "SSL_write_early_data: want read");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2400
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2401 c->read->ready = 0;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2402
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2403 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2404 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2405 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2406
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2407 /*
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2408 * we do not set the timer because there is already
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2409 * the write event timer
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2410 */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2411
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2412 if (c->ssl->saved_read_handler == NULL) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2413 c->ssl->saved_read_handler = c->read->handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2414 c->read->handler = ngx_ssl_read_handler;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2415 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2416
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2417 return NGX_AGAIN;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2418 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2419
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2420 c->ssl->no_wait_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2421 c->ssl->no_send_shutdown = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2422 c->write->error = 1;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2423
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2424 ngx_ssl_connection_error(c, sslerr, err, "SSL_write_early_data() failed");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2425
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2426 return NGX_ERROR;
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2427 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2428
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2429 #endif
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2430
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	2431
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2432 static void
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2433 ngx_ssl_read_handler(ngx_event_t *rev)
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2434 {
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2435 ngx_connection_t *c;
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2436
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2437 c = rev->data;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2438
7352 0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2439 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL read handler");
0de0b16a551c SSL: corrected SSL_ERROR_WANT_WRITE / SSL_ERROR_WANT_READ logging. Maxim Dounin <mdounin@mdounin.ru> parents: 7333 diff changeset	2440
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2441 c->write->handler(c->write);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2442 }
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2443
8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2444
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2445 void
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2446 ngx_ssl_free_buffer(ngx_connection_t *c)
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2447 {
1795 3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	2448 if (c->ssl->buf && c->ssl->buf->start) {
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	2449 if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) {
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	2450 c->ssl->buf->start = NULL;
3a0132e2be2c fix segfault introduced in r1780 Igor Sysoev <igor@sysoev.ru> parents: 1779 diff changeset	2451 }
1779 06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2452 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2453 }
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2454
06014cfdb5b1 create ssl buffer on demand and free it before keep-alive Igor Sysoev <igor@sysoev.ru> parents: 1778 diff changeset	2455
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2456 ngx_int_t
45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2457 ngx_ssl_shutdown(ngx_connection_t *c)
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2458 {
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2459 int n, sslerr, mode;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2460 ngx_err_t err;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2461
6407 062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2462 if (SSL_in_init(c->ssl->connection)) {
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2463 /*
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2464 * OpenSSL 1.0.2f complains if SSL_shutdown() is called during
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2465 * an SSL handshake, while previous versions always return 0.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2466 * Avoid calling SSL_shutdown() if handshake wasn't completed.
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2467 */
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2468
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2469 SSL_free(c->ssl->connection);
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2470 c->ssl = NULL;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2471
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2472 return NGX_OK;
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2473 }
062c189fee20 SSL: avoid calling SSL_shutdown() during handshake (ticket #901). Maxim Dounin <mdounin@mdounin.ru> parents: 6406 diff changeset	2474
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2475 if (c->timedout) {
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2476 mode = SSL_RECEIVED_SHUTDOWN\|SSL_SENT_SHUTDOWN;
4064 5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	2477 SSL_set_quiet_shutdown(c->ssl->connection, 1);
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2478
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2479 } else {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2480 mode = SSL_get_shutdown(c->ssl->connection);
473 8e8f3af115b5 nginx-0.1.11-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 469 diff changeset	2481
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2482 if (c->ssl->no_wait_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2483 mode \|= SSL_RECEIVED_SHUTDOWN;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2484 }
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2485
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2486 if (c->ssl->no_send_shutdown) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2487 mode \|= SSL_SENT_SHUTDOWN;
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2488 }
4064 5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	2489
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	2490 if (c->ssl->no_wait_shutdown && c->ssl->no_send_shutdown) {
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	2491 SSL_set_quiet_shutdown(c->ssl->connection, 1);
5b776ad53c3c Proper SSL shutdown handling. Maxim Dounin <mdounin@mdounin.ru> parents: 3992 diff changeset	2492 }
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2493 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2494
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2495 SSL_set_shutdown(c->ssl->connection, mode);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2496
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2497 ngx_ssl_clear_error(c->log);
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2498
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2499 n = SSL_shutdown(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2500
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2501 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2502
461 a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	2503 sslerr = 0;
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2504
6406 d194cad6dd3a SSL: fixed SSL_shutdown() comment. Maxim Dounin <mdounin@mdounin.ru> parents: 6261 diff changeset	2505 /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors */
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2506
1865 4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755 Igor Sysoev <igor@sysoev.ru> parents: 1861 diff changeset	2507 if (n != 1 && ERR_peek_error()) {
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2508 sslerr = SSL_get_error(c->ssl->connection, n);
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2509
396 6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2510 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
6f3b20c1ac50 nginx-0.0.7-2004-07-18-23:11:20 import Igor Sysoev <igor@sysoev.ru> parents: 395 diff changeset	2511 "SSL_get_error: %d", sslerr);
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2512 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2513
1865 4bcbb0fe5c8d fix bogus crit log message "SSL_shutdown() failed" introduced in r1755 Igor Sysoev <igor@sysoev.ru> parents: 1861 diff changeset	2514 if (n == 1 \|\| sslerr == 0 \|\| sslerr == SSL_ERROR_ZERO_RETURN) {
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2515 SSL_free(c->ssl->connection);
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2516 c->ssl = NULL;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2517
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2518 return NGX_OK;
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2519 }
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2520
427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2521 if (sslerr == SSL_ERROR_WANT_READ \|\| sslerr == SSL_ERROR_WANT_WRITE) {
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2522 c->read->handler = ngx_ssl_shutdown_handler;
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	2523 c->write->handler = ngx_ssl_shutdown_handler;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2524
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2525 if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2526 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2527 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2528
2388 722b5aff05ae use "!= NGX_OK" instead of "== NGX_ERROR" Igor Sysoev <igor@sysoev.ru> parents: 2315 diff changeset	2529 if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2530 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2531 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2532
1754 427d442e1ad8 SSL_shutdown() never returns -1, on error it returns 0. Igor Sysoev <igor@sysoev.ru> parents: 1743 diff changeset	2533 if (sslerr == SSL_ERROR_WANT_READ) {
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	2534 ngx_add_timer(c->read, 30000);
d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	2535 }
d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	2536
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2537 return NGX_AGAIN;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2538 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2539
591 8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2540 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2541
8c0cdd81580e nginx-0.3.17-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 589 diff changeset	2542 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2543
543 511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2544 SSL_free(c->ssl->connection);
511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2545 c->ssl = NULL;
511a89da35ad nginx-0.2.0-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 541 diff changeset	2546
394 e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2547 return NGX_ERROR;
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2548 }
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2549
e7a68e14ccd3 nginx-0.0.7-2004-07-16-10:33:35 import Igor Sysoev <igor@sysoev.ru> parents: 393 diff changeset	2550
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2551 static void
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2552 ngx_ssl_shutdown_handler(ngx_event_t *ev)
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2553 {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2554 ngx_connection_t *c;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2555 ngx_connection_handler_pt handler;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2556
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2557 c = ev->data;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2558 handler = c->ssl->handler;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2559
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2560 if (ev->timedout) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2561 c->timedout = 1;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2562 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2563
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2564 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2565
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2566 if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2567 return;
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2568 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2569
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2570 handler(c);
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2571 }
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2572
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2573
4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2574 static void
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2575 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2576 char *text)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2577 {
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2578 int n;
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2579 ngx_uint_t level;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2580
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2581 level = NGX_LOG_CRIT;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2582
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2583 if (sslerr == SSL_ERROR_SYSCALL) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2584
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2585 if (err == NGX_ECONNRESET
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2586 \|\| err == NGX_EPIPE
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2587 \|\| err == NGX_ENOTCONN
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	2588 \|\| err == NGX_ETIMEDOUT
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2589 \|\| err == NGX_ECONNREFUSED
1869 192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	2590 \|\| err == NGX_ENETDOWN
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	2591 \|\| err == NGX_ENETUNREACH
192443881e51 add NGX_ENETDOWN, NGX_ENETUNREACH, and NGX_EHOSTDOWN Igor Sysoev <igor@sysoev.ru> parents: 1868 diff changeset	2592 \|\| err == NGX_EHOSTDOWN
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2593 \|\| err == NGX_EHOSTUNREACH)
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2594 {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2595 switch (c->log_error) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2596
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2597 case NGX_ERROR_IGNORE_ECONNRESET:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2598 case NGX_ERROR_INFO:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2599 level = NGX_LOG_INFO;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2600 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2601
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2602 case NGX_ERROR_ERR:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2603 level = NGX_LOG_ERR;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2604 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2605
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2606 default:
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2607 break;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2608 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2609 }
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2610
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2611 } else if (sslerr == SSL_ERROR_SSL) {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2612
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2613 n = ERR_GET_REASON(ERR_peek_error());
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2614
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2615 /* handshake failures */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2616 if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */
7360 8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2617 #ifdef SSL_R_NO_SUITABLE_KEY_SHARE
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2618 \|\| n == SSL_R_NO_SUITABLE_KEY_SHARE /* 101 */
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2619 #endif
7361 c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2620 #ifdef SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2621 \|\| n == SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM /* 118 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2622 #endif
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2623 \|\| n == SSL_R_BLOCK_CIPHER_PAD_IS_WRONG /* 129 */
3718 bfd84b583868 decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3516 diff changeset	2624 \|\| n == SSL_R_DIGEST_CHECK_FAILED /* 149 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2625 \|\| n == SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST /* 151 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2626 \|\| n == SSL_R_EXCESSIVE_MESSAGE_SIZE /* 152 */
7311 778358452a81 SSL: logging level of "https proxy request" errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7291 diff changeset	2627 \|\| n == SSL_R_HTTPS_PROXY_REQUEST /* 155 */
778358452a81 SSL: logging level of "https proxy request" errors. Maxim Dounin <mdounin@mdounin.ru> parents: 7291 diff changeset	2628 \|\| n == SSL_R_HTTP_REQUEST /* 156 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	2629 \|\| n == SSL_R_LENGTH_MISMATCH /* 159 */
6652 1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6591 diff changeset	2630 #ifdef SSL_R_NO_CIPHERS_PASSED
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2631 \|\| n == SSL_R_NO_CIPHERS_PASSED /* 182 */
6652 1891b2892b68 SSL: guarded SSL_R_NO_CIPHERS_PASSED not present in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6591 diff changeset	2632 #endif
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	2633 \|\| n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2634 \|\| n == SSL_R_NO_COMPRESSION_SPECIFIED /* 187 */
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2635 \|\| n == SSL_R_NO_SHARED_CIPHER /* 193 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	2636 \|\| n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2637 #ifdef SSL_R_PARSE_TLSEXT
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2638 \|\| n == SSL_R_PARSE_TLSEXT /* 227 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2639 #endif
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2640 \|\| n == SSL_R_UNEXPECTED_MESSAGE /* 244 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2641 \|\| n == SSL_R_UNEXPECTED_RECORD /* 245 */
3455 028f0892e0cd decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3357 diff changeset	2642 \|\| n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */
3357 fc735aa50b8b decrease SSL handshake error level to info Igor Sysoev <igor@sysoev.ru> parents: 3300 diff changeset	2643 \|\| n == SSL_R_UNKNOWN_PROTOCOL /* 252 */
7361 c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2644 #ifdef SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2645 \|\| n == SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS /* 253 */
c09c7d47acb9 SSL: logging level of "no suitable signature algorithm". Maxim Dounin <mdounin@mdounin.ru> parents: 7360 diff changeset	2646 #endif
7317 6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	2647 \|\| n == SSL_R_UNSUPPORTED_PROTOCOL /* 258 */
7360 8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2648 #ifdef SSL_R_NO_SHARED_GROUP
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2649 \|\| n == SSL_R_NO_SHARED_GROUP /* 266 */
8f25a44d9add SSL: logging level of "no suitable key share". Maxim Dounin <mdounin@mdounin.ru> parents: 7357 diff changeset	2650 #endif
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2651 \|\| n == SSL_R_WRONG_VERSION_NUMBER /* 267 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2652 \|\| n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */
4228 5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2653 #ifdef SSL_R_RENEGOTIATE_EXT_TOO_LONG
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2654 \|\| n == SSL_R_RENEGOTIATE_EXT_TOO_LONG /* 335 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2655 \|\| n == SSL_R_RENEGOTIATION_ENCODING_ERR /* 336 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2656 \|\| n == SSL_R_RENEGOTIATION_MISMATCH /* 337 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2657 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2658 #ifdef SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2659 \|\| n == SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED /* 338 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2660 #endif
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2661 #ifdef SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2662 \|\| n == SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING /* 345 */
5fef0313f2ff Decrease of log level of some SSL handshake errors. Igor Sysoev <igor@sysoev.ru> parents: 4186 diff changeset	2663 #endif
5902 b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	2664 #ifdef SSL_R_INAPPROPRIATE_FALLBACK
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	2665 \|\| n == SSL_R_INAPPROPRIATE_FALLBACK /* 373 */
b7a37f6a25ea SSL: logging level of "inappropriate fallback" (ticket #662). Maxim Dounin <mdounin@mdounin.ru> parents: 5892 diff changeset	2666 #endif
7317 6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	2667 #ifdef SSL_R_VERSION_TOO_LOW
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	2668 \|\| n == SSL_R_VERSION_TOO_LOW /* 396 */
6565f0dbe8c5 SSL: logging levels of "unsupported protocol", "version too low". Maxim Dounin <mdounin@mdounin.ru> parents: 7311 diff changeset	2669 #endif
1877 a55876dff8f5 low SSL handshake close notify alert error level Igor Sysoev <igor@sysoev.ru> parents: 1876 diff changeset	2670 \|\| n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
6486 978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	2671 #ifdef SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE
2315 31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2672 \|\| n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2673 \|\| n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC /* 1020 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2674 \|\| n == SSL_R_TLSV1_ALERT_DECRYPTION_FAILED /* 1021 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2675 \|\| n == SSL_R_TLSV1_ALERT_RECORD_OVERFLOW /* 1022 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2676 \|\| n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE /* 1030 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2677 \|\| n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE /* 1040 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2678 \|\| n == SSL_R_SSLV3_ALERT_NO_CERTIFICATE /* 1041 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2679 \|\| n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE /* 1042 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2680 \|\| n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE /* 1043 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2681 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED /* 1044 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2682 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED /* 1045 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2683 \|\| n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN /* 1046 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2684 \|\| n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER /* 1047 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2685 \|\| n == SSL_R_TLSV1_ALERT_UNKNOWN_CA /* 1048 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2686 \|\| n == SSL_R_TLSV1_ALERT_ACCESS_DENIED /* 1049 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2687 \|\| n == SSL_R_TLSV1_ALERT_DECODE_ERROR /* 1050 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2688 \|\| n == SSL_R_TLSV1_ALERT_DECRYPT_ERROR /* 1051 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2689 \|\| n == SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION /* 1060 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2690 \|\| n == SSL_R_TLSV1_ALERT_PROTOCOL_VERSION /* 1070 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2691 \|\| n == SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY /* 1071 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2692 \|\| n == SSL_R_TLSV1_ALERT_INTERNAL_ERROR /* 1080 */
31fafd8e7436 low some SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 2280 diff changeset	2693 \|\| n == SSL_R_TLSV1_ALERT_USER_CANCELLED /* 1090 */
6486 978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	2694 \|\| n == SSL_R_TLSV1_ALERT_NO_RENEGOTIATION /* 1100 */
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	2695 #endif
978ad80b3732 SSL: guarded error codes not present in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6485 diff changeset	2696 )
1876 5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2697 {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2698 switch (c->log_error) {
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2699
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2700 case NGX_ERROR_IGNORE_ECONNRESET:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2701 case NGX_ERROR_INFO:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2702 level = NGX_LOG_INFO;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2703 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2704
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2705 case NGX_ERROR_ERR:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2706 level = NGX_LOG_ERR;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2707 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2708
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2709 default:
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2710 break;
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2711 }
5d663752fd96 low SSL handshake errors level Igor Sysoev <igor@sysoev.ru> parents: 1873 diff changeset	2712 }
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2713 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2714
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2715 ngx_ssl_error(level, c->log, err, text);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2716 }
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2717
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2718
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2719 static void
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2720 ngx_ssl_clear_error(ngx_log_t *log)
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2721 {
1868 c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	2722 while (ERR_peek_error()) {
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2723 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error");
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2724 }
1868 c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	2725
c2cd0720f292 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1865 diff changeset	2726 ERR_clear_error();
1755 59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2727 }
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2728
59e36c1c6296 cleaning stale global SSL error Igor Sysoev <igor@sysoev.ru> parents: 1754 diff changeset	2729
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2730 void ngx_cdecl
489 45a460f82aec nginx-0.1.19-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 479 diff changeset	2731 ngx_ssl_error(ngx_uint_t level, ngx_log_t log, ngx_err_t err, char fmt, ...)
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	2732 {
4877 f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2733 int flags;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2734 u_long n;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2735 va_list args;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2736 u_char p, last;
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2737 u_char errstr[NGX_MAX_CONF_ERRSTR];
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2738 const char *data;
461 a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	2739
a88a3e4e158f nginx-0.1.5-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 455 diff changeset	2740 last = errstr + NGX_MAX_CONF_ERRSTR;
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2741
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2742 va_start(args, fmt);
2764 d4a717592877 use ngx_vslprintf(), ngx_slprintf() Igor Sysoev <igor@sysoev.ru> parents: 2720 diff changeset	2743 p = ngx_vslprintf(errstr, last - 1, fmt, args);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2744 va_end(args);
5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2745
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2746 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2747
1861 f00b30557c81 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1860 diff changeset	2748 for ( ;; ) {
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2749
4877 f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2750 n = ERR_peek_error_line_data(NULL, NULL, &data, &flags);
583 4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2751
4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2752 if (n == 0) {
4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2753 break;
4e296b7d25bf nginx-0.3.13-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 577 diff changeset	2754 }
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2755
6775 8081e1f3ab8b SSL: overcame possible buffer over-read in ngx_ssl_error(). Valentin Bartenev <vbart@nginx.com> parents: 6725 diff changeset	2756 /* ERR_error_string_n() requires at least one byte */
8081e1f3ab8b SSL: overcame possible buffer over-read in ngx_ssl_error(). Valentin Bartenev <vbart@nginx.com> parents: 6725 diff changeset	2757
8081e1f3ab8b SSL: overcame possible buffer over-read in ngx_ssl_error(). Valentin Bartenev <vbart@nginx.com> parents: 6725 diff changeset	2758 if (p >= last - 1) {
4877 f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2759 goto next;
1861 f00b30557c81 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1860 diff changeset	2760 }
f00b30557c81 pull all errors Igor Sysoev <igor@sysoev.ru> parents: 1860 diff changeset	2761
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2762 *p++ = ' ';
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2763
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2764 ERR_error_string_n(n, (char *) p, last - p);
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2765
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2766 while (p < last && *p) {
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2767 p++;
818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2768 }
4877 f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2769
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2770 if (p < last && *data && (flags & ERR_TXT_STRING)) {
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2771 *p++ = ':';
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2772 p = ngx_cpystrn(p, (u_char *) data, last - p);
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2773 }
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2774
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2775 next:
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2776
f2e450929c1f OCSP stapling: log error data in ngx_ssl_error(). Maxim Dounin <mdounin@mdounin.ru> parents: 4875 diff changeset	2777 (void) ERR_get_error();
547 818fbd4750b9 nginx-0.2.2-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 543 diff changeset	2778 }
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2779
6259 2f34ea503ac4 SSL: handled long string truncation in ngx_ssl_error(). Vladimir Homutov <vl@nginx.com> parents: 6255 diff changeset	2780 ngx_log_error(level, log, err, "%*s)", p - errstr, errstr);
393 5659d773cfa8 nginx-0.0.7-2004-07-15-20:35:51 import Igor Sysoev <igor@sysoev.ru> parents: diff changeset	2781 }
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2782
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	2783
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2784 ngx_int_t
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2785 ngx_ssl_session_cache(ngx_ssl_t ssl, ngx_str_t sess_ctx,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2786 ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2787 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2788 long cache_mode;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2789
5424 767aa37f12de SSL: SSL_CTX_set_timeout() now always called. Maxim Dounin <mdounin@mdounin.ru> parents: 5423 diff changeset	2790 SSL_CTX_set_timeout(ssl->ctx, (long) timeout);
767aa37f12de SSL: SSL_CTX_set_timeout() now always called. Maxim Dounin <mdounin@mdounin.ru> parents: 5423 diff changeset	2791
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2792 if (ngx_ssl_session_id_context(ssl, sess_ctx) != NGX_OK) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2793 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2794 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2795
1778 14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	2796 if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	2797 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	2798 return NGX_OK;
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	2799 }
14510c3cc6cb ssl_session_cache off Igor Sysoev <igor@sysoev.ru> parents: 1760 diff changeset	2800
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2801 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2802
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2803 /*
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2804 * If the server explicitly says that it does not support
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2805 * session reuse (see SSL_SESS_CACHE_OFF above), then
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2806 * Outlook Express fails to upload a sent email to
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2807 * the Sent Items folder on the IMAP server via a separate IMAP
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	2808 * connection in the background. Therefore we have a special
2032 12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2809 * mode (SSL_SESS_CACHE_SERVER\|SSL_SESS_CACHE_NO_INTERNAL_STORE)
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2810 * where the server pretends that it supports session reuse,
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2811 * but it does not actually store any session.
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2812 */
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2813
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2814 SSL_CTX_set_session_cache_mode(ssl->ctx,
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2815 SSL_SESS_CACHE_SERVER
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2816 \|SSL_SESS_CACHE_NO_AUTO_CLEAR
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2817 \|SSL_SESS_CACHE_NO_INTERNAL_STORE);
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2818
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2819 SSL_CTX_sess_set_cache_size(ssl->ctx, 1);
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2820
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2821 return NGX_OK;
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2822 }
12b3ad3353f9 ssl_session_cache none Igor Sysoev <igor@sysoev.ru> parents: 1977 diff changeset	2823
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2824 cache_mode = SSL_SESS_CACHE_SERVER;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2825
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2826 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2827 cache_mode \|= SSL_SESS_CACHE_NO_INTERNAL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2828 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2829
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2830 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2831
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2832 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2833
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2834 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2835 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2836 }
1015 32ebb6b13ff3 ssl_session_timeout was set only if builtin cache was used Igor Sysoev <igor@sysoev.ru> parents: 1014 diff changeset	2837 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2838
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2839 if (shm_zone) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2840 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2841 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2842 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2843
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2844 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2845 == 0)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2846 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2847 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2848 "SSL_CTX_set_ex_data() failed");
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2849 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2850 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2851 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2852
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2853 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2854 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2855
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2856
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2857 static ngx_int_t
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2858 ngx_ssl_session_id_context(ngx_ssl_t ssl, ngx_str_t sess_ctx)
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2859 {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2860 int n, i;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2861 X509 *cert;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2862 X509_NAME *name;
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2863 EVP_MD_CTX *md;
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2864 unsigned int len;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2865 STACK_OF(X509_NAME) *list;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2866 u_char buf[EVP_MAX_MD_SIZE];
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2867
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2868 /*
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2869 * Session ID context is set based on the string provided,
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2870 * the server certificates, and the client CA list.
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2871 */
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2872
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2873 md = EVP_MD_CTX_create();
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2874 if (md == NULL) {
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2875 return NGX_ERROR;
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2876 }
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2877
ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2878 if (EVP_DigestInit_ex(md, EVP_sha1(), NULL) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2879 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2880 "EVP_DigestInit_ex() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2881 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2882 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2883
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2884 if (EVP_DigestUpdate(md, sess_ctx->data, sess_ctx->len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2885 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2886 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2887 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2888 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2889
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2890 for (cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2891 cert;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2892 cert = X509_get_ex_data(cert, ngx_ssl_next_certificate_index))
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2893 {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2894 if (X509_digest(cert, EVP_sha1(), buf, &len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2895 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2896 "X509_digest() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2897 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2898 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2899
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2900 if (EVP_DigestUpdate(md, buf, len) == 0) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2901 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2902 "EVP_DigestUpdate() failed");
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2903 goto failed;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	2904 }
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2905 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2906
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2907 list = SSL_CTX_get_client_CA_list(ssl->ctx);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2908
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2909 if (list != NULL) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2910 n = sk_X509_NAME_num(list);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2911
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2912 for (i = 0; i < n; i++) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2913 name = sk_X509_NAME_value(list, i);
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2914
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2915 if (X509_NAME_digest(name, EVP_sha1(), buf, &len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2916 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2917 "X509_NAME_digest() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2918 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2919 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2920
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2921 if (EVP_DigestUpdate(md, buf, len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2922 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2923 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2924 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2925 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2926 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2927 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2928
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2929 if (EVP_DigestFinal_ex(md, buf, &len) == 0) {
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2930 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2931 "EVP_DigestUpdate() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2932 goto failed;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2933 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2934
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2935 EVP_MD_CTX_destroy(md);
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2936
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2937 if (SSL_CTX_set_session_id_context(ssl->ctx, buf, len) == 0) {
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2938 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2939 "SSL_CTX_set_session_id_context() failed");
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2940 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2941 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2942
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2943 return NGX_OK;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2944
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2945 failed:
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2946
6490 ddf761495ce6 SSL: EVP_MD_CTX was made opaque in OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6489 diff changeset	2947 EVP_MD_CTX_destroy(md);
5834 ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2948
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2949 return NGX_ERROR;
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2950 }
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2951
ca63fc5ed9b1 SSL: session id context now includes certificate hash. Maxim Dounin <mdounin@mdounin.ru> parents: 5823 diff changeset	2952
3992 a1dd9dc754ab A new fix for the case when ssl_session_cache defined, but ssl is not Igor Sysoev <igor@sysoev.ru> parents: 3962 diff changeset	2953 ngx_int_t
993 1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2954 ngx_ssl_session_cache_init(ngx_shm_zone_t shm_zone, void data)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2955 {
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2956 size_t len;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2957 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2958 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2959
993 1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2960 if (data) {
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2961 shm_zone->data = data;
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2962 return NGX_OK;
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2963 }
1b9a4d92173f pass the inherited shm_zone data Igor Sysoev <igor@sysoev.ru> parents: 989 diff changeset	2964
5640 4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	2965 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	2966
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2967 if (shm_zone->shm.exists) {
5640 4c6ceca4f5f7 Win32: fixed shared ssl_session_cache (ticket #528). Maxim Dounin <mdounin@mdounin.ru> parents: 5634 diff changeset	2968 shm_zone->data = shpool->data;
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2969 return NGX_OK;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2970 }
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2971
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2972 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2973 if (cache == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2974 return NGX_ERROR;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2975 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2976
2720 b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2977 shpool->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2978 shm_zone->data = cache;
b3b8c66bd520 support attaching to an existent Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2716 diff changeset	2979
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	2980 ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel,
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	2981 ngx_ssl_session_rbtree_insert_value);
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	2982
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	2983 ngx_queue_init(&cache->expire_queue);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2984
2716 d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2710 diff changeset	2985 len = sizeof(" in SSL session shared cache \"\"") + shm_zone->shm.name.len;
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2986
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2987 shpool->log_ctx = ngx_slab_alloc(shpool, len);
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2988 if (shpool->log_ctx == NULL) {
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2989 return NGX_ERROR;
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2990 }
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2991
2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2992 ngx_sprintf(shpool->log_ctx, " in SSL session shared cache \"%V\"%Z",
2716 d5896f6608e8 move zone name from ngx_shm_zone_t to ngx_shm_t to use Win32 shared memory Igor Sysoev <igor@sysoev.ru> parents: 2710 diff changeset	2993 &shm_zone->shm.name);
2611 2bce3f6416c6 improve ngx_slab_alloc() error logging Igor Sysoev <igor@sysoev.ru> parents: 2536 diff changeset	2994
5634 5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	2995 shpool->log_nomem = 0;
5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	2996
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2997 return NGX_OK;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2998 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	2999
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3000
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3001 /*
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3002 * The length of the session id is 16 bytes for SSLv2 sessions and
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3003 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3004 * It seems that the typical length of the external ASN1 representation
5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3005 * of a session is 118 or 119 bytes for SSLv3/TSLv1.
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3006 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3007 * Thus on 32-bit platforms we allocate separately an rbtree node,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3008 * a session id, and an ASN1 representation, they take accordingly
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3009 * 64, 32, and 128 bytes.
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3010 *
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3011 * On 64-bit platforms we allocate separately an rbtree node + session_id,
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3012 * and an ASN1 representation, they take accordingly 128 and 128 bytes.
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3013 *
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3014 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3015 * so they are outside the code locked by shared pool mutex
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3016 */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3017
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3018 static int
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3019 ngx_ssl_new_session(ngx_ssl_conn_t ssl_conn, ngx_ssl_session_t sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3020 {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3021 int len;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3022 u_char p, id, cached_sess, session_id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3023 uint32_t hash;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3024 SSL_CTX *ssl_ctx;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3025 unsigned int session_id_length;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3026 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3027 ngx_connection_t *c;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3028 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3029 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3030 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3031 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3032
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3033 len = i2d_SSL_SESSION(sess, NULL);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3034
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3035 /* do not cache too big session */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3036
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3037 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3038 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3039 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3040
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3041 p = buf;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3042 i2d_SSL_SESSION(sess, &p);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3043
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3044 c = ngx_ssl_get_connection(ssl_conn);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3045
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3046 ssl_ctx = c->ssl->session_ctx;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3047 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3048
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3049 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3050 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3051
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3052 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3053
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3054 /* drop one or two expired sessions */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3055 ngx_ssl_expire_sessions(cache, shpool, 1);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3056
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3057 cached_sess = ngx_slab_alloc_locked(shpool, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3058
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3059 if (cached_sess == NULL) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3060
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3061 /* drop the oldest non-expired session and try once more */
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3062
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3063 ngx_ssl_expire_sessions(cache, shpool, 0);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3064
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3065 cached_sess = ngx_slab_alloc_locked(shpool, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3066
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3067 if (cached_sess == NULL) {
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3068 sess_id = NULL;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3069 goto failed;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3070 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3071 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3072
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3073 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3074
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3075 if (sess_id == NULL) {
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3076
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3077 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3078
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3079 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3080
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3081 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3082
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3083 if (sess_id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3084 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3085 }
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3086 }
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3087
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3088 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3089
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3090 session_id = (u_char *) SSL_SESSION_get_id(sess, &session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3091
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3092 #else
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3093
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3094 session_id = sess->session_id;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3095 session_id_length = sess->session_id_length;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3096
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3097 #endif
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3098
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3099 #if (NGX_PTR_SIZE == 8)
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3100
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3101 id = sess_id->sess_id;
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3102
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3103 #else
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3104
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3105 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3106
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3107 if (id == NULL) {
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3108
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3109 /* drop the oldest non-expired session and try once more */
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3110
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3111 ngx_ssl_expire_sessions(cache, shpool, 0);
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3112
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3113 id = ngx_slab_alloc_locked(shpool, session_id_length);
5081 bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3114
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3115 if (id == NULL) {
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3116 goto failed;
bebcc2f837d3 SSL: retry "sess_id" and "id" allocations. Maxim Dounin <mdounin@mdounin.ru> parents: 5024 diff changeset	3117 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3118 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3119
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3120 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3121
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3122 ngx_memcpy(cached_sess, buf, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3123
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3124 ngx_memcpy(id, session_id, session_id_length);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3125
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3126 hash = ngx_crc32_short(session_id, session_id_length);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3127
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3128 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3129 "ssl new session: %08XD:%ud:%d",
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3130 hash, session_id_length, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3131
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3132 sess_id->node.key = hash;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3133 sess_id->node.data = (u_char) session_id_length;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3134 sess_id->id = id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3135 sess_id->len = len;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3136 sess_id->session = cached_sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3137
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	3138 sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3139
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3140 ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3141
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3142 ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3143
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3144 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3145
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3146 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3147
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3148 failed:
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3149
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3150 if (cached_sess) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3151 ngx_slab_free_locked(shpool, cached_sess);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3152 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3153
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3154 if (sess_id) {
ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3155 ngx_slab_free_locked(shpool, sess_id);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3156 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3157
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3158 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3159
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3160 ngx_log_error(NGX_LOG_ALERT, c->log, 0,
5634 5024d29354f1 Core: slab log_nomem flag. Maxim Dounin <mdounin@mdounin.ru> parents: 5573 diff changeset	3161 "could not allocate new session%s", shpool->log_ctx);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3162
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3163 return 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3164 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3165
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3166
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3167 static ngx_ssl_session_t *
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3168 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3169 #if OPENSSL_VERSION_NUMBER >= 0x10100003L
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3170 const
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3171 #endif
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3172 u_char id, int len, int copy)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3173 {
989 5595e47d4f17 d2i_SSL_SESSION() was changed in 0.9.7f Igor Sysoev <igor@sysoev.ru> parents: 974 diff changeset	3174 #if OPENSSL_VERSION_NUMBER >= 0x0090707fL
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3175 const
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3176 #endif
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3177 u_char *p;
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3178 size_t slen;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3179 uint32_t hash;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3180 ngx_int_t rc;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3181 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3182 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3183 ngx_rbtree_node_t node, sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3184 ngx_ssl_session_t *sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3185 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3186 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3187 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
3961 4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3188 ngx_connection_t *c;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3189
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3190 hash = ngx_crc32_short((u_char *) (uintptr_t) id, (size_t) len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3191 *copy = 0;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3192
3961 4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3193 c = ngx_ssl_get_connection(ssl_conn);
4048aa055411 fix build by gcc46 with -Wunused-value option Igor Sysoev <igor@sysoev.ru> parents: 3960 diff changeset	3194
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3195 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
3155 e720c4a68ee0 fix debug log message Igor Sysoev <igor@sysoev.ru> parents: 3154 diff changeset	3196 "ssl get session: %08XD:%d", hash, len);
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3197
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3198 shm_zone = SSL_CTX_get_ex_data(c->ssl->session_ctx,
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3199 ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3200
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3201 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3202
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3203 sess = NULL;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3204
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3205 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3206
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3207 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3208
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3209 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3210 sentinel = cache->session_rbtree.sentinel;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3211
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3212 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3213
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3214 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3215 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3216 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3217 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3218
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3219 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3220 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3221 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3222 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3223
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3224 /* hash == node->key */
7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3225
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3226 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3227
6487 9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3228 rc = ngx_memn2cmp((u_char *) (uintptr_t) id, sess_id->id,
9dd43f4ef67e SSL: get_session callback changed in OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6486 diff changeset	3229 (size_t) len, (size_t) node->data);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3230
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3231 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3232
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3233 if (sess_id->expire > ngx_time()) {
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3234 slen = sess_id->len;
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3235
cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3236 ngx_memcpy(buf, sess_id->session, slen);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3237
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3238 ngx_shmtx_unlock(&shpool->mutex);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3239
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3240 p = buf;
7365 cd4fa2fab8d8 SSL: fixed unlocked access to sess_id->len. Ruslan Ermilov <ru@nginx.com> parents: 7361 diff changeset	3241 sess = d2i_SSL_SESSION(NULL, &p, slen);
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3242
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3243 return sess;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3244 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3245
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3246 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3247
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3248 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3249
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3250 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3251 #if (NGX_PTR_SIZE == 4)
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3252 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3253 #endif
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3254 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3255
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3256 sess = NULL;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3257
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3258 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3259 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3260
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3261 node = (rc < 0) ? node->left : node->right;
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3262 }
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3263
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3264 done:
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3265
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3266 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3267
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3268 return sess;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3269 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3270
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3271
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3272 void
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3273 ngx_ssl_remove_cached_session(SSL_CTX ssl, ngx_ssl_session_t sess)
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3274 {
6474 2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	3275 SSL_CTX_remove_session(ssl, sess);
2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	3276
2cd019520210 Style. Ruslan Ermilov <ru@nginx.com> parents: 6407 diff changeset	3277 ngx_ssl_remove_session(ssl, sess);
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3278 }
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3279
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3280
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3281 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3282 ngx_ssl_remove_session(SSL_CTX ssl, ngx_ssl_session_t sess)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3283 {
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3284 u_char *id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3285 uint32_t hash;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3286 ngx_int_t rc;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3287 unsigned int len;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3288 ngx_shm_zone_t *shm_zone;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3289 ngx_slab_pool_t *shpool;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3290 ngx_rbtree_node_t node, sentinel;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3291 ngx_ssl_sess_id_t *sess_id;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3292 ngx_ssl_session_cache_t *cache;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3293
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3294 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3295
1924 291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3296 if (shm_zone == NULL) {
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3297 return;
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3298 }
291689a7e5dc invalidate SSL session if there is no valid client certificate Igor Sysoev <igor@sysoev.ru> parents: 1877 diff changeset	3299
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3300 cache = shm_zone->data;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3301
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3302 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3303
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3304 id = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3305
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3306 #else
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3307
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3308 id = sess->session_id;
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3309 len = sess->session_id_length;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3310
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3311 #endif
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3312
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3313 hash = ngx_crc32_short(id, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3314
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3315 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	3316 "ssl remove session: %08XD:%ud", hash, len);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3317
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3318 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3319
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3320 ngx_shmtx_lock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3321
1759 89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3322 node = cache->session_rbtree.root;
89234cfbf810 embed session_rbtree and sentinel inside ngx_ssl_session_cache_t Igor Sysoev <igor@sysoev.ru> parents: 1758 diff changeset	3323 sentinel = cache->session_rbtree.sentinel;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3324
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3325 while (node != sentinel) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3326
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3327 if (hash < node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3328 node = node->left;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3329 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3330 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3331
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3332 if (hash > node->key) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3333 node = node->right;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3334 continue;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3335 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3336
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3337 /* hash == node->key */
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3338
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3339 sess_id = (ngx_ssl_sess_id_t *) node;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3340
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3341 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3342
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3343 if (rc == 0) {
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3344
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3345 ngx_queue_remove(&sess_id->queue);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3346
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3347 ngx_rbtree_delete(&cache->session_rbtree, node);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3348
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3349 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3350 #if (NGX_PTR_SIZE == 4)
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3351 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3352 #endif
4497 95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3353 ngx_slab_free_locked(shpool, sess_id);
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3354
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3355 goto done;
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3356 }
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3357
95ab6658654a Fix of rbtree lookup on hash collisions. Maxim Dounin <mdounin@mdounin.ru> parents: 4414 diff changeset	3358 node = (rc < 0) ? node->left : node->right;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3359 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3360
1013 7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3361 done:
7dd987e09701 stop rbtree search early if equal hash was found Igor Sysoev <igor@sysoev.ru> parents: 993 diff changeset	3362
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3363 ngx_shmtx_unlock(&shpool->mutex);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3364 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3365
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3366
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3367 static void
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3368 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3369 ngx_slab_pool_t *shpool, ngx_uint_t n)
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3370 {
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	3371 time_t now;
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3372 ngx_queue_t *q;
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3373 ngx_ssl_sess_id_t *sess_id;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3374
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	3375 now = ngx_time();
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3376
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3377 while (n < 3) {
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3378
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3379 if (ngx_queue_empty(&cache->expire_queue)) {
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3380 return;
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3381 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3382
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3383 q = ngx_queue_last(&cache->expire_queue);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3384
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3385 sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3386
1757 7ab8bd535eed use ngx_time() instead of ngx_timeofday() Igor Sysoev <igor@sysoev.ru> parents: 1756 diff changeset	3387 if (n++ != 0 && sess_id->expire > now) {
1439 36548ad85be1 style fix Igor Sysoev <igor@sysoev.ru> parents: 1426 diff changeset	3388 return;
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3389 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3390
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3391 ngx_queue_remove(q);
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3392
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3393 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3394 "expire session: %08Xi", sess_id->node.key);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3395
1760 49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3396 ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
49429f5b2d94 use ngx_queue.h Igor Sysoev <igor@sysoev.ru> parents: 1759 diff changeset	3397
1014 5ffd76a9ccf3 optimize the SSL session cache allocations Igor Sysoev <igor@sysoev.ru> parents: 1013 diff changeset	3398 ngx_slab_free_locked(shpool, sess_id->session);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3399 #if (NGX_PTR_SIZE == 4)
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3400 ngx_slab_free_locked(shpool, sess_id->id);
1017 ee25c79bea34 optimize the SSL session cache allocations on 64-bit platforms Igor Sysoev <igor@sysoev.ru> parents: 1015 diff changeset	3401 #endif
974 8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3402 ngx_slab_free_locked(shpool, sess_id);
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3403 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3404 }
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3405
8dfb3aa75de2 move the session cache callbacks to the ngx_openssl_module Igor Sysoev <igor@sysoev.ru> parents: 969 diff changeset	3406
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3407 static void
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3408 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3409 ngx_rbtree_node_t node, ngx_rbtree_node_t sentinel)
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3410 {
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3411 ngx_rbtree_node_t **p;
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3412 ngx_ssl_sess_id_t sess_id, sess_id_temp;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3413
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3414 for ( ;; ) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3415
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3416 if (node->key < temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3417
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3418 p = &temp->left;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3419
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3420 } else if (node->key > temp->key) {
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3421
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3422 p = &temp->right;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3423
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3424 } else { /* node->key == temp->key */
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3425
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3426 sess_id = (ngx_ssl_sess_id_t *) node;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3427 sess_id_temp = (ngx_ssl_sess_id_t *) temp;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3428
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3429 p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3430 (size_t) node->data, (size_t) temp->data)
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3431 < 0) ? &temp->left : &temp->right;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3432 }
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3433
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3434 if (*p == sentinel) {
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3435 break;
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3436 }
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3437
4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3438 temp = *p;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3439 }
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3440
1743 4fc402c3ec73 optimize rbtree initialization and insert Igor Sysoev <igor@sysoev.ru> parents: 1439 diff changeset	3441 *p = node;
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3442 node->parent = temp;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3443 node->left = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3444 node->right = sentinel;
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3445 ngx_rbt_red(node);
1043 7073b87fa8e9 style fix: remove trailing spaces Igor Sysoev <igor@sysoev.ru> parents: 1029 diff changeset	3446 }
1027 ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3447
ff07ccfaad50 fix duplicate rbtree keys case Igor Sysoev <igor@sysoev.ru> parents: 1025 diff changeset	3448
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3449 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3450
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3451 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3452 ngx_ssl_session_ticket_keys(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3453 {
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3454 u_char buf[80];
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3455 size_t size;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3456 ssize_t n;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3457 ngx_str_t *path;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3458 ngx_file_t file;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3459 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3460 ngx_array_t *keys;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3461 ngx_file_info_t fi;
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3462 ngx_pool_cleanup_t *cln;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3463 ngx_ssl_session_ticket_key_t *key;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3464
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3465 if (paths == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3466 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3467 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3468
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3469 keys = ngx_array_create(cf->pool, paths->nelts,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3470 sizeof(ngx_ssl_session_ticket_key_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3471 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3472 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3473 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3474
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3475 cln = ngx_pool_cleanup_add(cf->pool, 0);
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3476 if (cln == NULL) {
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3477 return NGX_ERROR;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3478 }
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3479
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3480 cln->handler = ngx_ssl_session_ticket_keys_cleanup;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3481 cln->data = keys;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3482
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3483 path = paths->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3484 for (i = 0; i < paths->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3485
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3486 if (ngx_conf_full_name(cf->cycle, &path[i], 1) != NGX_OK) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3487 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3488 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3489
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3490 ngx_memzero(&file, sizeof(ngx_file_t));
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3491 file.name = path[i];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3492 file.log = cf->log;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3493
7087 47b7ffc3339d Fixed calls to ngx_open_file() in certain places. Sergey Kandaurov <pluknet@nginx.com> parents: 7086 diff changeset	3494 file.fd = ngx_open_file(file.name.data, NGX_FILE_RDONLY,
47b7ffc3339d Fixed calls to ngx_open_file() in certain places. Sergey Kandaurov <pluknet@nginx.com> parents: 7086 diff changeset	3495 NGX_FILE_OPEN, 0);
7086 577628e6b6a6 Style. Sergey Kandaurov <pluknet@nginx.com> parents: 7074 diff changeset	3496
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3497 if (file.fd == NGX_INVALID_FILE) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3498 ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3499 ngx_open_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3500 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3501 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3502
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3503 if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3504 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3505 ngx_fd_info_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3506 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3507 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3508
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3509 size = ngx_file_size(&fi);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3510
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3511 if (size != 48 && size != 80) {
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3512 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3513 "\"%V\" must be 48 or 80 bytes", &file.name);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3514 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3515 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3516
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3517 n = ngx_read_file(&file, buf, size, 0);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3518
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3519 if (n == NGX_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3520 ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3521 ngx_read_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3522 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3523 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3524
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3525 if ((size_t) n != size) {
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3526 ngx_conf_log_error(NGX_LOG_CRIT, cf, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3527 ngx_read_file_n " \"%V\" returned only "
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3528 "%z bytes instead of %uz", &file.name, n, size);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3529 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3530 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3531
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3532 key = ngx_array_push(keys);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3533 if (key == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3534 goto failed;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3535 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3536
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3537 if (size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3538 key->size = 48;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3539 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3540 ngx_memcpy(key->aes_key, buf + 16, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3541 ngx_memcpy(key->hmac_key, buf + 32, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3542
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3543 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3544 key->size = 80;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3545 ngx_memcpy(key->name, buf, 16);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3546 ngx_memcpy(key->hmac_key, buf + 16, 32);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3547 ngx_memcpy(key->aes_key, buf + 48, 32);
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3548 }
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3549
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3550 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3551 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3552 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3553 }
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3554
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3555 ngx_explicit_memzero(&buf, 80);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3556 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3557
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3558 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_ticket_keys_index, keys)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3559 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3560 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3561 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3562 "SSL_CTX_set_ex_data() failed");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3563 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3564 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3565
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3566 if (SSL_CTX_set_tlsext_ticket_key_cb(ssl->ctx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3567 ngx_ssl_session_ticket_key_callback)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3568 == 0)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3569 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3570 ngx_log_error(NGX_LOG_WARN, cf->log, 0,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3571 "nginx was built with Session Tickets support, however, "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3572 "now it is linked dynamically to an OpenSSL library "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3573 "which has no tlsext support, therefore Session Tickets "
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3574 "are not available");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3575 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3576
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3577 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3578
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3579 failed:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3580
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3581 if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3582 ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3583 ngx_close_file_n " \"%V\" failed", &file.name);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3584 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3585
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3586 ngx_explicit_memzero(&buf, 80);
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3587
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3588 return NGX_ERROR;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3589 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3590
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3591
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3592 static int
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3593 ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3594 unsigned char name, unsigned char iv, EVP_CIPHER_CTX *ectx,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3595 HMAC_CTX *hctx, int enc)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3596 {
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3597 size_t size;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3598 SSL_CTX *ssl_ctx;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3599 ngx_uint_t i;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3600 ngx_array_t *keys;
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3601 ngx_connection_t *c;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3602 ngx_ssl_session_ticket_key_t *key;
6686 f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3603 const EVP_MD *digest;
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3604 const EVP_CIPHER *cipher;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3605 #if (NGX_DEBUG)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3606 u_char buf[32];
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3607 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3608
6261 97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3609 c = ngx_ssl_get_connection(ssl_conn);
97f102a13f33 SSL: preserve default server context in connection (ticket #235). Maxim Dounin <mdounin@mdounin.ru> parents: 6259 diff changeset	3610 ssl_ctx = c->ssl->session_ctx;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3611
6686 f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3612 #ifdef OPENSSL_NO_SHA256
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3613 digest = EVP_sha1();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3614 #else
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3615 digest = EVP_sha256();
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3616 #endif
f28e74f02c88 SSL: factored out digest and cipher in session ticket callback. Sergey Kandaurov <pluknet@nginx.com> parents: 6660 diff changeset	3617
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3618 keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_ticket_keys_index);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3619 if (keys == NULL) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3620 return -1;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3621 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3622
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3623 key = keys->elts;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3624
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3625 if (enc == 1) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3626 /* encrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3627
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	3628 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3629 "ssl session ticket encrypt, key: \"%*s\" (%s session)",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3630 ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3631 SSL_session_reused(ssl_conn) ? "reused" : "new");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3632
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3633 if (key[0].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3634 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3635 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3636
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3637 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3638 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3639 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3640 }
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3641
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3642 if (RAND_bytes(iv, EVP_CIPHER_iv_length(cipher)) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3643 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "RAND_bytes() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3644 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3645 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3646
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3647 if (EVP_EncryptInit_ex(ectx, cipher, NULL, key[0].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3648 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3649 "EVP_EncryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3650 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3651 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3652
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3653 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3654 if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3655 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3656 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3657 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3658 #else
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3659 HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL);
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3660 #endif
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3661
5760 4b668378ad8b Style: use ngx_memcpy() instead of memcpy(). Piotr Sikora <piotr@cloudflare.com> parents: 5756 diff changeset	3662 ngx_memcpy(name, key[0].name, 16);
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3663
6660 3eb1a92a2f05 SSL: adopted session ticket handling for OpenSSL 1.1.0. Sergey Kandaurov <pluknet@nginx.com> parents: 6659 diff changeset	3664 return 1;
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3665
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3666 } else {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3667 /* decrypt session ticket */
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3668
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3669 for (i = 0; i < keys->nelts; i++) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3670 if (ngx_memcmp(name, key[i].name, 16) == 0) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3671 goto found;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3672 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3673 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3674
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	3675 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3676 "ssl session ticket decrypt, key: \"%*s\" not found",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3677 ngx_hex_dump(buf, name, 16) - buf, buf);
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3678
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3679 return 0;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3680
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3681 found:
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3682
5657 3b48f9e69e70 SSL: fixed misuse of NGX_LOG_DEBUG_HTTP. Maxim Dounin <mdounin@mdounin.ru> parents: 5640 diff changeset	3683 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3684 "ssl session ticket decrypt, key: \"%*s\"%s",
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3685 ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3686 (i == 0) ? " (default)" : "");
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3687
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3688 if (key[i].size == 48) {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3689 cipher = EVP_aes_128_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3690 size = 16;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3691
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3692 } else {
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3693 cipher = EVP_aes_256_cbc();
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3694 size = 32;
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3695 }
75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3696
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3697 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3698 if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3699 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3700 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3701 }
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3702 #else
6854 75e7d55214bd SSL: support AES256 encryption of tickets. Maxim Dounin <mdounin@mdounin.ru> parents: 6842 diff changeset	3703 HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL);
6687 dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3704 #endif
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3705
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3706 if (EVP_DecryptInit_ex(ectx, cipher, NULL, key[i].aes_key, iv) != 1) {
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3707 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3708 "EVP_DecryptInit_ex() failed");
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3709 return -1;
dfa626cdde6b SSL: improved session ticket callback error handling. Sergey Kandaurov <pluknet@nginx.com> parents: 6686 diff changeset	3710 }
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3711
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3712 return (i == 0) ? 1 : 2 /* renew */;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3713 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3714 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3715
7453 873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3716
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3717 static void
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3718 ngx_ssl_session_ticket_keys_cleanup(void *data)
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3719 {
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3720 ngx_array_t *keys = data;
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3721
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3722 ngx_explicit_memzero(keys->elts,
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3723 keys->nelts * sizeof(ngx_ssl_session_ticket_key_t));
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3724 }
873150addfeb SSL: explicitly zero out session ticket keys. Ruslan Ermilov <ru@nginx.com> parents: 7431 diff changeset	3725
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3726 #else
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3727
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3728 ngx_int_t
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3729 ngx_ssl_session_ticket_keys(ngx_conf_t cf, ngx_ssl_t ssl, ngx_array_t *paths)
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3730 {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3731 if (paths) {
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3732 ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
7074 07a49cce21ca SSL: fixed typo in the error message. Sergey Kandaurov <pluknet@nginx.com> parents: 6995 diff changeset	3733 "\"ssl_session_ticket_key\" ignored, not supported");
5425 1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3734 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3735
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3736 return NGX_OK;
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3737 }
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3738
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3739 #endif
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3740
1356a3b96924 SSL: added ability to set keys used for Session Tickets (RFC5077). Piotr Sikora <piotr@cloudflare.com> parents: 5424 diff changeset	3741
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3742 void
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3743 ngx_ssl_cleanup_ctx(void *data)
9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3744 {
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3745 ngx_ssl_t *ssl = data;
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3746
6548 8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3747 X509 cert, next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3748
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3749 cert = SSL_CTX_get_ex_data(ssl->ctx, ngx_ssl_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3750
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3751 while (cert) {
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3752 next = X509_get_ex_data(cert, ngx_ssl_next_certificate_index);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3753 X509_free(cert);
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3754 cert = next;
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3755 }
8a34e92d8ab5 SSL: made it possible to iterate though all certificates. Maxim Dounin <mdounin@mdounin.ru> parents: 6545 diff changeset	3756
589 d4e858a5751a nginx-0.3.16-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 583 diff changeset	3757 SSL_CTX_free(ssl->ctx);
509 9b8c906f6e63 nginx-0.1.29-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 501 diff changeset	3758 }
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	3759
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	3760
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3761 ngx_int_t
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3762 ngx_ssl_check_host(ngx_connection_t c, ngx_str_t name)
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3763 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3764 X509 *cert;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3765
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3766 cert = SSL_get_peer_certificate(c->ssl->connection);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3767 if (cert == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3768 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3769 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3770
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	3771 #ifdef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3772
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3773 /* X509_check_host() is only available in OpenSSL 1.0.2+ */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3774
5669 cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	3775 if (name->len == 0) {
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	3776 goto failed;
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	3777 }
cac82b9b3499 SSL: explicit handling of empty names. Maxim Dounin <mdounin@mdounin.ru> parents: 5666 diff changeset	3778
5767 abd460ece11e SSL: fix build with recent OpenSSL. Piotr Sikora <piotr@cloudflare.com> parents: 5760 diff changeset	3779 if (X509_check_host(cert, (char *) name->data, name->len, 0, NULL) != 1) {
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3780 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3781 "X509_check_host(): no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3782 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3783 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3784
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3785 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3786 "X509_check_host(): match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3787
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3788 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3789
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3790 #else
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3791 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3792 int n, i;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3793 X509_NAME *sname;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3794 ASN1_STRING *str;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3795 X509_NAME_ENTRY *entry;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3796 GENERAL_NAME *altname;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3797 STACK_OF(GENERAL_NAME) *altnames;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3798
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3799 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3800 * As per RFC6125 and RFC2818, we check subjectAltName extension,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3801 * and if it's not present - commonName in Subject is checked.
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3802 */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3803
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3804 altnames = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3805
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3806 if (altnames) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3807 n = sk_GENERAL_NAME_num(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3808
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3809 for (i = 0; i < n; i++) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3810 altname = sk_GENERAL_NAME_value(altnames, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3811
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3812 if (altname->type != GEN_DNS) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3813 continue;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3814 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3815
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3816 str = altname->d.dNSName;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3817
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3818 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3819 "SSL subjectAltName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3820 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3821
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3822 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3823 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3824 "SSL subjectAltName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3825 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3826 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3827 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3828 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3829
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3830 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3831 "SSL subjectAltName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3832
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3833 GENERAL_NAMES_free(altnames);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3834 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3835 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3836
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3837 /*
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3838 * If there is no subjectAltName extension, check commonName
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3839 * in Subject. While RFC2818 requires to only check "most specific"
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3840 * CN, both Apache and OpenSSL check all CNs, and so do we.
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3841 */
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3842
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3843 sname = X509_get_subject_name(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3844
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3845 if (sname == NULL) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3846 goto failed;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3847 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3848
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3849 i = -1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3850 for ( ;; ) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3851 i = X509_NAME_get_index_by_NID(sname, NID_commonName, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3852
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3853 if (i < 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3854 break;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3855 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3856
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3857 entry = X509_NAME_get_entry(sname, i);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3858 str = X509_NAME_ENTRY_get_data(entry);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3859
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3860 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3861 "SSL commonName: \"%*s\"",
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3862 ASN1_STRING_length(str), ASN1_STRING_data(str));
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3863
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3864 if (ngx_ssl_check_name(name, str) == NGX_OK) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3865 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3866 "SSL commonName: match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3867 goto found;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3868 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3869 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3870
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3871 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3872 "SSL commonName: no match");
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3873 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3874 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3875
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3876 failed:
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3877
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3878 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3879 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3880
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3881 found:
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3882
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3883 X509_free(cert);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3884 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3885 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3886
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3887
6725 9b9ae81cd4f0 SSL: use X509_check_host() with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 6699 diff changeset	3888 #ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3889
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3890 static ngx_int_t
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3891 ngx_ssl_check_name(ngx_str_t name, ASN1_STRING pattern)
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3892 {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3893 u_char s, p, *end;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3894 size_t slen, plen;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3895
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3896 s = name->data;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3897 slen = name->len;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3898
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3899 p = ASN1_STRING_data(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3900 plen = ASN1_STRING_length(pattern);
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3901
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3902 if (slen == plen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3903 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3904 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3905
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3906 if (plen > 2 && p[0] == '*' && p[1] == '.') {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3907 plen -= 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3908 p += 1;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3909
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3910 end = s + slen;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3911 s = ngx_strlchr(s, end, '.');
5666 a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	3912
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	3913 if (s == NULL) {
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	3914 return NGX_ERROR;
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	3915 }
a77c0839c993 SSL: added explicit check for ngx_strlchr() result. Maxim Dounin <mdounin@mdounin.ru> parents: 5661 diff changeset	3916
5661 060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3917 slen = end - s;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3918
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3919 if (plen == slen && ngx_strncasecmp(s, p, plen) == 0) {
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3920 return NGX_OK;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3921 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3922 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3923
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3924 return NGX_ERROR;
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3925 }
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3926
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3927 #endif
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3928
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3929
060c2e692b96 Upstream: proxy_ssl_verify and friends. Maxim Dounin <mdounin@mdounin.ru> parents: 5658 diff changeset	3930 ngx_int_t
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3931 ngx_ssl_get_protocol(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3932 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3933 s->data = (u_char *) SSL_get_version(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3934 return NGX_OK;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3935 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3936
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3937
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3938 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3939 ngx_ssl_get_cipher_name(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3940 {
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3941 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	3942 return NGX_OK;
611 3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3943 }
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3944
3f8a2132b93d nginx-0.3.27-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 597 diff changeset	3945
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	3946 ngx_int_t
6816 ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3947 ngx_ssl_get_ciphers(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3948 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3949 #ifdef SSL_CTRL_GET_RAW_CIPHERLIST
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3950
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3951 int n, i, bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3952 size_t len;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3953 u_char ciphers, p;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3954 const SSL_CIPHER *cipher;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3955
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3956 bytes = SSL_get0_raw_cipherlist(c->ssl->connection, NULL);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3957 n = SSL_get0_raw_cipherlist(c->ssl->connection, &ciphers);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3958
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3959 if (n <= 0) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3960 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3961 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3962 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3963
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3964 len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3965 n /= bytes;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3966
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3967 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3968 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3969
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3970 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3971 len += ngx_strlen(SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3972
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3973 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3974 len += sizeof("0x") - 1 + bytes * (sizeof("00") - 1);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3975 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3976
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3977 len += sizeof(":") - 1;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3978 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3979
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3980 s->data = ngx_pnalloc(pool, len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3981 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3982 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3983 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3984
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3985 p = s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3986
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3987 for (i = 0; i < n; i++) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3988 cipher = SSL_CIPHER_find(c->ssl->connection, ciphers + i * bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3989
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3990 if (cipher) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3991 p = ngx_sprintf(p, "%s", SSL_CIPHER_get_name(cipher));
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3992
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3993 } else {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3994 p = ngx_sprintf(p, "0x");
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3995 p = ngx_hex_dump(p, ciphers + i * bytes, bytes);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3996 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3997
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3998 *p++ = ':';
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	3999 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4000
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4001 p--;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4002
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4003 s->len = p - s->data;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4004
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4005 #else
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4006
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4007 u_char buf[4096];
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4008
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4009 if (SSL_get_shared_ciphers(c->ssl->connection, (char *) buf, 4096)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4010 == NULL)
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4011 {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4012 s->len = 0;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4013 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4014 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4015
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4016 s->len = ngx_strlen(buf);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4017 s->data = ngx_pnalloc(pool, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4018 if (s->data == NULL) {
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4019 return NGX_ERROR;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4020 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4021
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4022 ngx_memcpy(s->data, buf, s->len);
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4023
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4024 #endif
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4025
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4026 return NGX_OK;
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4027 }
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4028
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4029
ea93c7d8752a SSL: $ssl_ciphers (ticket #870). Maxim Dounin <mdounin@mdounin.ru> parents: 6815 diff changeset	4030 ngx_int_t
6817 e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4031 ngx_ssl_get_curves(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4032 {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4033 #ifdef SSL_CTRL_GET_CURVES
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4034
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4035 int *curves, n, i, nid;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4036 u_char *p;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4037 size_t len;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4038
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4039 n = SSL_get1_curves(c->ssl->connection, NULL);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4040
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4041 if (n <= 0) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4042 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4043 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4044 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4045
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4046 curves = ngx_palloc(pool, n * sizeof(int));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4047
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4048 n = SSL_get1_curves(c->ssl->connection, curves);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4049 len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4050
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4051 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4052 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4053
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4054 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4055 len += sizeof("0x0000") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4056
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4057 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4058 len += ngx_strlen(OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4059 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4060
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4061 len += sizeof(":") - 1;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4062 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4063
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4064 s->data = ngx_pnalloc(pool, len);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4065 if (s->data == NULL) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4066 return NGX_ERROR;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4067 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4068
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4069 p = s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4070
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4071 for (i = 0; i < n; i++) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4072 nid = curves[i];
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4073
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4074 if (nid & TLSEXT_nid_unknown) {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4075 p = ngx_sprintf(p, "0x%04xd", nid & 0xffff);
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4076
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4077 } else {
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4078 p = ngx_sprintf(p, "%s", OBJ_nid2sn(nid));
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4079 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4080
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4081 *p++ = ':';
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4082 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4083
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4084 p--;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4085
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4086 s->len = p - s->data;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4087
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4088 #else
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4089
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4090 s->len = 0;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4091
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4092 #endif
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4093
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4094 return NGX_OK;
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4095 }
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4096
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4097
e75e854657ba SSL: $ssl_curves (ticket #1088). Maxim Dounin <mdounin@mdounin.ru> parents: 6816 diff changeset	4098 ngx_int_t
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4099 ngx_ssl_get_session_id(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4100 {
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4101 u_char *buf;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4102 SSL_SESSION *sess;
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4103 unsigned int len;
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4104
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4105 sess = SSL_get0_session(c->ssl->connection);
5537 49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4106 if (sess == NULL) {
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4107 s->len = 0;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4108 return NGX_OK;
49b1ad48b55c SSL: fixed $ssl_session_id possible segfault after 97e3769637a7. Maxim Dounin <mdounin@mdounin.ru> parents: 5531 diff changeset	4109 }
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4110
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4111 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4112
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4113 buf = (u_char *) SSL_SESSION_get_id(sess, &len);
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4114
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4115 #else
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4116
5531 97e3769637a7 SSL: fixed $ssl_session_id variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5487 diff changeset	4117 buf = sess->session_id;
97e3769637a7 SSL: fixed $ssl_session_id variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5487 diff changeset	4118 len = sess->session_id_length;
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4119
5756 5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4120 #endif
5b7276408565 SSL: stop accessing SSL_SESSION's fields directly. Piotr Sikora <piotr@cloudflare.com> parents: 5755 diff changeset	4121
3154 823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4122 s->len = 2 * len;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4123 s->data = ngx_pnalloc(pool, 2 * len);
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4124 if (s->data == NULL) {
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4125 return NGX_ERROR;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4126 }
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4127
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4128 ngx_hex_dump(s->data, buf, len);
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4129
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4130 return NGX_OK;
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4131 }
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4132
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4133
823f72db46c0 $ssl_session_id Igor Sysoev <igor@sysoev.ru> parents: 3002 diff changeset	4134 ngx_int_t
5573 7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4135 ngx_ssl_get_session_reused(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4136 {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4137 if (SSL_session_reused(c->ssl->connection)) {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4138 ngx_str_set(s, "r");
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4139
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4140 } else {
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4141 ngx_str_set(s, ".");
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4142 }
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4143
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4144 return NGX_OK;
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4145 }
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4146
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4147
7c05f6590753 SSL: the $ssl_session_reused variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5537 diff changeset	4148 ngx_int_t
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4149 ngx_ssl_get_early_data(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4150 {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4151 s->len = 0;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4152
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4153 #ifdef SSL_ERROR_EARLY_DATA_REJECTED
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4154
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4155 /* BoringSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4156
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4157 if (SSL_in_early_data(c->ssl->connection)) {
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4158 ngx_str_set(s, "1");
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4159 }
7357 548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4160
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4161 #elif defined SSL_READ_EARLY_DATA_SUCCESS
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4162
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4163 /* OpenSSL */
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4164
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4165 if (!SSL_is_init_finished(c->ssl->connection)) {
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4166 ngx_str_set(s, "1");
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4167 }
548a63b354a2 SSL: support for TLSv1.3 early data with OpenSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 7356 diff changeset	4168
7333 ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4169 #endif
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4170
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4171 return NGX_OK;
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4172 }
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4173
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4174
ba971deb4b44 SSL: support for TLSv1.3 early data with BoringSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 7332 diff changeset	4175 ngx_int_t
5658 94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4176 ngx_ssl_get_server_name(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4177 {
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4178 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4179
7092 2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4180 size_t len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4181 const char *name;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4182
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4183 name = SSL_get_servername(c->ssl->connection, TLSEXT_NAMETYPE_host_name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4184
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4185 if (name) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4186 len = ngx_strlen(name);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4187
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4188 s->len = len;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4189 s->data = ngx_pnalloc(pool, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4190 if (s->data == NULL) {
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4191 return NGX_ERROR;
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4192 }
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4193
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4194 ngx_memcpy(s->data, name, len);
2e8de3d81783 SSL: fixed possible use-after-free in $ssl_server_name. Maxim Dounin <mdounin@mdounin.ru> parents: 7091 diff changeset	4195
5658 94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4196 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4197 }
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4198
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4199 #endif
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4200
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4201 s->len = 0;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4202 return NGX_OK;
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4203 }
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4204
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4205
94ae92776441 SSL: $ssl_server_name variable. Maxim Dounin <mdounin@mdounin.ru> parents: 5657 diff changeset	4206 ngx_int_t
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4207 ngx_ssl_get_raw_certificate(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2045 2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4208 {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4209 size_t len;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4210 BIO *bio;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4211 X509 *cert;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4212
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4213 s->len = 0;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4214
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4215 cert = SSL_get_peer_certificate(c->ssl->connection);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4216 if (cert == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4217 return NGX_OK;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4218 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4219
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4220 bio = BIO_new(BIO_s_mem());
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4221 if (bio == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4222 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4223 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4224 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4225 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4226
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4227 if (PEM_write_bio_X509(bio, cert) == 0) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4228 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed");
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4229 goto failed;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4230 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4231
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4232 len = BIO_pending(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4233 s->len = len;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4234
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	4235 s->data = ngx_pnalloc(pool, len);
2045 2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4236 if (s->data == NULL) {
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4237 goto failed;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4238 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4239
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4240 BIO_read(bio, s->data, len);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4241
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4242 BIO_free(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4243 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4244
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4245 return NGX_OK;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4246
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4247 failed:
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4248
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4249 BIO_free(bio);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4250 X509_free(cert);
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4251
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4252 return NGX_ERROR;
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4253 }
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4254
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4255
2b11822b12d6 $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2044 diff changeset	4256 ngx_int_t
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4257 ngx_ssl_get_certificate(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4258 {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4259 u_char *p;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4260 size_t len;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4261 ngx_uint_t i;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4262 ngx_str_t cert;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4263
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4264 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4265 return NGX_ERROR;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4266 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4267
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4268 if (cert.len == 0) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4269 s->len = 0;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4270 return NGX_OK;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4271 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4272
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4273 len = cert.len - 1;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4274
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4275 for (i = 0; i < cert.len - 1; i++) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4276 if (cert.data[i] == LF) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4277 len++;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4278 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4279 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4280
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4281 s->len = len;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4282 s->data = ngx_pnalloc(pool, len);
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4283 if (s->data == NULL) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4284 return NGX_ERROR;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4285 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4286
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4287 p = s->data;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4288
3002 bf0c7e58e016 fix memory corruption in $ssl_client_cert Igor Sysoev <igor@sysoev.ru> parents: 2997 diff changeset	4289 for (i = 0; i < cert.len - 1; i++) {
2123 9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4290 *p++ = cert.data[i];
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4291 if (cert.data[i] == LF) {
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4292 *p++ = '\t';
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4293 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4294 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4295
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4296 return NGX_OK;
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4297 }
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4298
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4299
9697407e9ecb ) ssl_verify_client ask Igor Sysoev <igor@sysoev.ru>* parents: 2052 diff changeset	4300 ngx_int_t
7091 82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4301 ngx_ssl_get_escaped_certificate(ngx_connection_t c, ngx_pool_t pool,
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4302 ngx_str_t *s)
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4303 {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4304 ngx_str_t cert;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4305 uintptr_t n;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4306
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4307 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4308 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4309 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4310
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4311 if (cert.len == 0) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4312 s->len = 0;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4313 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4314 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4315
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4316 n = ngx_escape_uri(NULL, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4317
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4318 s->len = cert.len + n * 2;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4319 s->data = ngx_pnalloc(pool, s->len);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4320 if (s->data == NULL) {
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4321 return NGX_ERROR;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4322 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4323
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4324 ngx_escape_uri(s->data, cert.data, cert.len, NGX_ESCAPE_URI_COMPONENT);
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4325
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4326 return NGX_OK;
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4327 }
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4328
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4329
82f0b8dcca27 SSL: the $ssl_client_escaped_cert variable (ticket #857). Maxim Dounin <mdounin@mdounin.ru> parents: 7087 diff changeset	4330 ngx_int_t
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4331 ngx_ssl_get_subject_dn(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4332 {
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4333 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4334 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4335 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4336
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4337 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4338
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4339 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4340 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4341 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4342 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4343
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4344 name = X509_get_subject_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4345 if (name == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4346 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4347 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4348
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4349 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4350 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4351 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4352 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4353 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4354
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4355 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4356 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4357 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4358
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4359 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4360 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4361 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4362 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4363 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4364
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4365 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4366
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4367 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4368 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4369
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4370 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4371
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4372 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4373
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4374 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4375 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4376
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4377 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4378 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4379
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4380
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4381 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4382 ngx_ssl_get_issuer_dn(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4383 {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4384 BIO *bio;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4385 X509 *cert;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4386 X509_NAME *name;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4387
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4388 s->len = 0;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4389
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4390 cert = SSL_get_peer_certificate(c->ssl->connection);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4391 if (cert == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4392 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4393 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4394
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4395 name = X509_get_issuer_name(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4396 if (name == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4397 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4398 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4399
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4400 bio = BIO_new(BIO_s_mem());
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4401 if (bio == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4402 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4403 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4404 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4405
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4406 if (X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253) < 0) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4407 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4408 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4409
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4410 s->len = BIO_pending(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4411 s->data = ngx_pnalloc(pool, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4412 if (s->data == NULL) {
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4413 goto failed;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4414 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4415
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4416 BIO_read(bio, s->data, s->len);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4417
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4418 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4419 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4420
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4421 return NGX_OK;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4422
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4423 failed:
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4424
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4425 BIO_free(bio);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4426 X509_free(cert);
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4427
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4428 return NGX_ERROR;
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4429 }
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4430
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4431
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4432 ngx_int_t
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4433 ngx_ssl_get_subject_dn_legacy(ngx_connection_t c, ngx_pool_t pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4434 ngx_str_t *s)
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4435 {
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4436 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4437 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4438 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4439 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4440
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4441 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4442
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4443 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4444 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4445 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4446 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4447
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4448 name = X509_get_subject_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4449 if (name == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4450 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4451 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4452 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4453
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4454 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4455
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4456 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4457
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4458 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	4459 s->data = ngx_pnalloc(pool, len);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4460 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4461 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4462 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4463 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4464 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4465
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4466 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4467
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4468 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4469 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4470
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4471 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4472 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4473
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4474
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4475 ngx_int_t
6780 56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4476 ngx_ssl_get_issuer_dn_legacy(ngx_connection_t c, ngx_pool_t pool,
56d6bfe6b609 SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn. Dmitry Volyntsev <xeioex@nginx.com> parents: 6775 diff changeset	4477 ngx_str_t *s)
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4478 {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4479 char *p;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4480 size_t len;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4481 X509 *cert;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4482 X509_NAME *name;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4483
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4484 s->len = 0;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4485
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4486 cert = SSL_get_peer_certificate(c->ssl->connection);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4487 if (cert == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4488 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4489 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4490
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4491 name = X509_get_issuer_name(cert);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4492 if (name == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4493 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4494 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4495 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4496
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4497 p = X509_NAME_oneline(name, NULL, 0);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4498
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4499 for (len = 0; p[len]; len++) { /* void */ }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4500
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4501 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	4502 s->data = ngx_pnalloc(pool, len);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4503 if (s->data == NULL) {
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4504 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4505 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4506 return NGX_ERROR;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4507 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4508
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4509 ngx_memcpy(s->data, p, len);
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4510
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4511 OPENSSL_free(p);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4512 X509_free(cert);
647 95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4513
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4514 return NGX_OK;
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4515 }
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4516
95d7da23ea53 nginx-0.3.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 611 diff changeset	4517
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4518 ngx_int_t
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4519 ngx_ssl_get_serial_number(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4520 {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4521 size_t len;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4522 X509 *cert;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4523 BIO *bio;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4524
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4525 s->len = 0;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4526
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4527 cert = SSL_get_peer_certificate(c->ssl->connection);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4528 if (cert == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4529 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4530 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4531
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4532 bio = BIO_new(BIO_s_mem());
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4533 if (bio == NULL) {
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4534 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4535 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4536 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4537
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4538 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4539 len = BIO_pending(bio);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4540
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4541 s->len = len;
2049 2a92804f4109 ) back out r2040 Igor Sysoev <igor@sysoev.ru>* parents: 2045 diff changeset	4542 s->data = ngx_pnalloc(pool, len);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4543 if (s->data == NULL) {
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4544 BIO_free(bio);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4545 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4546 return NGX_ERROR;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4547 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4548
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4549 BIO_read(bio, s->data, len);
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4550 BIO_free(bio);
1974 f32cc6df6bd6 fix memory leak when ssl_verify_client is on Igor Sysoev <igor@sysoev.ru> parents: 1948 diff changeset	4551 X509_free(cert);
671 cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4552
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4553 return NGX_OK;
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4554 }
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4555
cec32b3753ac nginx-0.3.57-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 647 diff changeset	4556
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4557 ngx_int_t
5700 5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4558 ngx_ssl_get_fingerprint(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4559 {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4560 X509 *cert;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4561 unsigned int len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4562 u_char buf[EVP_MAX_MD_SIZE];
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4563
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4564 s->len = 0;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4565
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4566 cert = SSL_get_peer_certificate(c->ssl->connection);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4567 if (cert == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4568 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4569 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4570
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4571 if (!X509_digest(cert, EVP_sha1(), buf, &len)) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4572 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4573 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4574 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4575
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4576 s->len = 2 * len;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4577 s->data = ngx_pnalloc(pool, 2 * len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4578 if (s->data == NULL) {
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4579 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4580 return NGX_ERROR;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4581 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4582
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4583 ngx_hex_dump(s->data, buf, len);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4584
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4585 X509_free(cert);
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4586
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4587 return NGX_OK;
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4588 }
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4589
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4590
5e892d40e5cc SSL: $ssl_client_fingerprint variable. Sergey Budnevitch <sb@waeme.net> parents: 5669 diff changeset	4591 ngx_int_t
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4592 ngx_ssl_get_client_verify(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4593 {
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4594 X509 *cert;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4595 long rc;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4596 const char *str;
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4597
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4598 cert = SSL_get_peer_certificate(c->ssl->connection);
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4599 if (cert == NULL) {
3516 dd1570b6f237 ngx_str_set() and ngx_str_null() Igor Sysoev <igor@sysoev.ru> parents: 3488 diff changeset	4600 ngx_str_set(s, "NONE");
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4601 return NGX_OK;
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4602 }
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4603
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4604 X509_free(cert);
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4605
6814 379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4606 rc = SSL_get_verify_result(c->ssl->connection);
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4607
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4608 if (rc == X509_V_OK) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4609 ngx_str_set(s, "SUCCESS");
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4610 return NGX_OK;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4611 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4612
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4613 str = X509_verify_cert_error_string(rc);
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4614
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4615 s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str));
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4616 if (s->data == NULL) {
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4617 return NGX_ERROR;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4618 }
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4619
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4620 s->len = ngx_sprintf(s->data, "FAILED:%s", str) - s->data;
379139020d36 SSL: $ssl_client_verify extended with a failure reason. Maxim Dounin <mdounin@mdounin.ru> parents: 6812 diff changeset	4621
2994 f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4622 return NGX_OK;
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4623 }
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4624
f33c48457d0c ) $ssl_client_verify Igor Sysoev <igor@sysoev.ru>* parents: 2912 diff changeset	4625
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4626 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4627 ngx_ssl_get_client_v_start(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4628 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4629 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4630 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4631 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4632
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4633 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4634
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4635 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4636 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4637 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4638 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4639
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4640 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4641 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4642 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4643 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4644 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4645
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4646 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4647 ASN1_TIME_print(bio, X509_get0_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4648 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4649 ASN1_TIME_print(bio, X509_get_notBefore(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4650 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4651
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4652 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4653
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4654 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4655 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4656 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4657 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4658 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4659 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4660 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4661
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4662 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4663 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4664 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4665
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4666 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4667 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4668
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4669
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4670 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4671 ngx_ssl_get_client_v_end(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4672 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4673 BIO *bio;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4674 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4675 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4676
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4677 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4678
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4679 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4680 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4681 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4682 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4683
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4684 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4685 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4686 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4687 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4688 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4689
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4690 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4691 ASN1_TIME_print(bio, X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4692 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4693 ASN1_TIME_print(bio, X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4694 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4695
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4696 len = BIO_pending(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4697
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4698 s->len = len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4699 s->data = ngx_pnalloc(pool, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4700 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4701 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4702 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4703 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4704 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4705
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4706 BIO_read(bio, s->data, len);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4707 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4708 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4709
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4710 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4711 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4712
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4713
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4714 ngx_int_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4715 ngx_ssl_get_client_v_remain(ngx_connection_t c, ngx_pool_t pool, ngx_str_t *s)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4716 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4717 X509 *cert;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4718 time_t now, end;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4719
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4720 s->len = 0;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4721
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4722 cert = SSL_get_peer_certificate(c->ssl->connection);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4723 if (cert == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4724 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4725 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4726
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4727 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4728 end = ngx_ssl_parse_time(X509_get0_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4729 #else
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4730 end = ngx_ssl_parse_time(X509_get_notAfter(cert));
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4731 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4732
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4733 if (end == (time_t) NGX_ERROR) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4734 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4735 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4736 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4737
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4738 now = ngx_time();
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4739
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4740 if (end < now + 86400) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4741 ngx_str_set(s, "0");
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4742 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4743 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4744 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4745
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4746 s->data = ngx_pnalloc(pool, NGX_TIME_T_LEN);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4747 if (s->data == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4748 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4749 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4750 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4751
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4752 s->len = ngx_sprintf(s->data, "%T", (end - now) / 86400) - s->data;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4753
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4754 X509_free(cert);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4755
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4756 return NGX_OK;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4757 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4758
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4759
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4760 static time_t
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4761 ngx_ssl_parse_time(
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4762 #if OPENSSL_VERSION_NUMBER > 0x10100000L
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4763 const
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4764 #endif
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4765 ASN1_TIME *asn1time)
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4766 {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4767 BIO *bio;
6842 25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	4768 char *value;
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4769 size_t len;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4770 time_t time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4771
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4772 /*
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4773 * OpenSSL doesn't provide a way to convert ASN1_TIME
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4774 * into time_t. To do this, we use ASN1_TIME_print(),
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4775 * which uses the "MMM DD HH:MM:SS YYYY [GMT]" format (e.g.,
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4776 * "Feb 3 00:55:52 2015 GMT"), and parse the result.
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4777 */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4778
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4779 bio = BIO_new(BIO_s_mem());
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4780 if (bio == NULL) {
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4781 return NGX_ERROR;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4782 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4783
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4784 /* fake weekday prepended to match C asctime() format */
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4785
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4786 BIO_write(bio, "Tue ", sizeof("Tue ") - 1);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4787 ASN1_TIME_print(bio, asn1time);
6842 25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	4788 len = BIO_get_mem_data(bio, &value);
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	4789
25d0d6dabe00 SSL: backed out changeset e7cb5deb951d, reimplemented properly. Maxim Dounin <mdounin@mdounin.ru> parents: 6841 diff changeset	4790 time = ngx_parse_http_time((u_char *) value, len);
6815 2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4791
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4792 BIO_free(bio);
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4793
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4794 return time;
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4795 }
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4796
2d15fff64e3c SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain. Maxim Dounin <mdounin@mdounin.ru> parents: 6814 diff changeset	4797
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4798 static void *
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4799 ngx_openssl_create_conf(ngx_cycle_t *cycle)
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4800 {
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4801 ngx_openssl_conf_t *oscf;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	4802
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4803 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4804 if (oscf == NULL) {
2912 c7d57b539248 return NULL instead of NGX_CONF_ERROR on a create conf failure Igor Sysoev <igor@sysoev.ru> parents: 2764 diff changeset	4805 return NULL;
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4806 }
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	4807
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4808 /*
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4809 * set by ngx_pcalloc():
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	4810 *
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4811 * oscf->engine = 0;
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	4812 */
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4813
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4814 return oscf;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4815 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4816
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4817
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4818 static char *
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4819 ngx_openssl_engine(ngx_conf_t cf, ngx_command_t cmd, void *conf)
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4820 {
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4821 #ifndef OPENSSL_NO_ENGINE
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4822
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4823 ngx_openssl_conf_t *oscf = conf;
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4824
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4825 ENGINE *engine;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4826 ngx_str_t *value;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4827
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4828 if (oscf->engine) {
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4829 return "is duplicate";
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4830 }
577 4d9ea73a627a nginx-0.3.10-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 571 diff changeset	4831
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4832 oscf->engine = 1;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4833
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4834 value = cf->args->elts;
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4835
6552 addd98357629 SSL: style. Maxim Dounin <mdounin@mdounin.ru> parents: 6551 diff changeset	4836 engine = ENGINE_by_id((char *) value[1].data);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4837
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4838 if (engine == NULL) {
6699 9cf2dce316e5 Fixed log levels of configuration parsing errors. Valentin Bartenev <vbart@nginx.com> parents: 6687 diff changeset	4839 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4840 "ENGINE_by_id(\"%V\") failed", &value[1]);
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4841 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4842 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4843
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4844 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
6699 9cf2dce316e5 Fixed log levels of configuration parsing errors. Valentin Bartenev <vbart@nginx.com> parents: 6687 diff changeset	4845 ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4846 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4847 &value[1]);
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4848
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4849 ENGINE_free(engine);
9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4850
541 b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4851 return NGX_CONF_ERROR;
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4852 }
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4853
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4854 ENGINE_free(engine);
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4855
b09ee85d0ac8 nginx-0.1.45-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 539 diff changeset	4856 return NGX_CONF_OK;
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4857
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4858 #else
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4859
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4860 return "is not supported";
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4861
4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4862 #endif
2504 9e9a985d956a load SSL engine before certificates, Igor Sysoev <igor@sysoev.ru> parents: 2388 diff changeset	4863 }
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4864
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4865
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4866 static void
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4867 ngx_openssl_exit(ngx_cycle_t *cycle)
458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4868 {
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	4869 #if OPENSSL_VERSION_NUMBER < 0x10100003L
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	4870
3464 7f99ce2247f9 add OpenSSL_add_all_algorithms(), this fixes the error Igor Sysoev <igor@sysoev.ru> parents: 3457 diff changeset	4871 EVP_cleanup();
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4872 #ifndef OPENSSL_NO_ENGINE
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4873 ENGINE_cleanup();
5777 4d092aa2f463 SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP. Piotr Sikora <piotr@cloudflare.com> parents: 5775 diff changeset	4874 #endif
6488 a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	4875
a57b2b8999e7 SSL: initialization changes for OpenSSL 1.1.0. Maxim Dounin <mdounin@mdounin.ru> parents: 6487 diff changeset	4876 #endif
571 458b6c3fea65 nginx-0.3.7-RELEASE import Igor Sysoev <igor@sysoev.ru> parents: 563 diff changeset	4877 }

Mercurial > hg > nginx

annotate src/event/ngx_event_openssl.c @ 7454:e72c8a8a8b10