Mercurial > hg > nginx
annotate src/http/modules/ngx_http_ssl_module.c @ 8535:eb5aa85294e9 quic
QUIC: discard unrecognized long packes.
While there, updated comment about discarded packets.
author | Vladimir Homutov <vl@nginx.com> |
---|---|
date | Wed, 02 Sep 2020 09:54:15 +0300 |
parents | 0d2b2664b41c |
children | 7621ffaa79b3 |
rev | line source |
---|---|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
1 |
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
2 /* |
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
4412 | 4 * Copyright (C) Nginx, Inc. |
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
5 */ |
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
396
diff
changeset
|
6 |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #include <ngx_config.h> |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 #include <ngx_core.h> |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 #include <ngx_http.h> |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
11 |
573 | 12 |
671 | 13 typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, |
14 ngx_pool_t *pool, ngx_str_t *s); | |
611 | 15 |
16 | |
3960 | 17 #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" |
6553
2014ed60f17f
SSL: support for multiple curves (ticket #885).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6550
diff
changeset
|
18 #define NGX_DEFAULT_ECDH_CURVE "auto" |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
19 |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
20 #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
21 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
22 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
23 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
24 static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
25 const unsigned char **out, unsigned char *outlen, |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
26 const unsigned char *in, unsigned int inlen, void *arg); |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
27 #endif |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
28 |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
29 #ifdef TLSEXT_TYPE_next_proto_neg |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
30 static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
31 const unsigned char **out, unsigned int *outlen, void *arg); |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
32 #endif |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
33 |
671 | 34 static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r, |
611 | 35 ngx_http_variable_value_t *v, uintptr_t data); |
671 | 36 static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r, |
647 | 37 ngx_http_variable_value_t *v, uintptr_t data); |
611 | 38 |
39 static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf); | |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
40 static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
41 static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, |
501 | 42 void *parent, void *child); |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
43 |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
44 static ngx_int_t ngx_http_ssl_compile_certificates(ngx_conf_t *cf, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
45 ngx_http_ssl_srv_conf_t *conf); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
46 |
2224 | 47 static char *ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, |
48 void *conf); | |
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
49 static char *ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
50 void *conf); |
973 | 51 static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, |
52 void *conf); | |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
53 static char *ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
54 void *conf); |
973 | 55 |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
56 static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
57 |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
58 |
547 | 59 static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { |
60 { ngx_string("SSLv2"), NGX_SSL_SSLv2 }, | |
61 { ngx_string("SSLv3"), NGX_SSL_SSLv3 }, | |
62 { ngx_string("TLSv1"), NGX_SSL_TLSv1 }, | |
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
63 { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 }, |
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
64 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 }, |
6981
08dc60979133
SSL: added support for TLSv1.3 in ssl_protocols directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6817
diff
changeset
|
65 { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 }, |
547 | 66 { ngx_null_string, 0 } |
67 }; | |
68 | |
69 | |
2123 | 70 static ngx_conf_enum_t ngx_http_ssl_verify[] = { |
71 { ngx_string("off"), 0 }, | |
72 { ngx_string("on"), 1 }, | |
2994 | 73 { ngx_string("optional"), 2 }, |
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
74 { ngx_string("optional_no_ca"), 3 }, |
2123 | 75 { ngx_null_string, 0 } |
76 }; | |
77 | |
78 | |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
79 static ngx_conf_enum_t ngx_http_ssl_ocsp[] = { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
80 { ngx_string("off"), 0 }, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
81 { ngx_string("on"), 1 }, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
82 { ngx_string("leaf"), 2 }, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
83 { ngx_null_string, 0 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
84 }; |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
85 |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
86 |
7270
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
87 static ngx_conf_deprecated_t ngx_http_ssl_deprecated = { |
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
88 ngx_conf_deprecated, "ssl", "listen ... ssl" |
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
89 }; |
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
90 |
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
91 |
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
92 static ngx_command_t ngx_http_ssl_commands[] = { |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
93 |
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
94 { ngx_string("ssl"), |
599 | 95 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
2224 | 96 ngx_http_ssl_enable, |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
97 NGX_HTTP_SRV_CONF_OFFSET, |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
98 offsetof(ngx_http_ssl_srv_conf_t, enable), |
7270
46c0c7ef4913
SSL: deprecated the "ssl" directive.
Ruslan Ermilov <ru@nginx.com>
parents:
7269
diff
changeset
|
99 &ngx_http_ssl_deprecated }, |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
100 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
101 { ngx_string("ssl_certificate"), |
599 | 102 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
103 ngx_conf_set_str_array_slot, |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
104 NGX_HTTP_SRV_CONF_OFFSET, |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
105 offsetof(ngx_http_ssl_srv_conf_t, certificates), |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
106 NULL }, |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
107 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
108 { ngx_string("ssl_certificate_key"), |
599 | 109 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
110 ngx_conf_set_str_array_slot, |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
111 NGX_HTTP_SRV_CONF_OFFSET, |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
112 offsetof(ngx_http_ssl_srv_conf_t, certificate_keys), |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
113 NULL }, |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
114 |
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
115 { ngx_string("ssl_password_file"), |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
116 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
117 ngx_http_ssl_password_file, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
118 NGX_HTTP_SRV_CONF_OFFSET, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
119 0, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
120 NULL }, |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
121 |
2044 | 122 { ngx_string("ssl_dhparam"), |
123 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
124 ngx_conf_set_str_slot, | |
125 NGX_HTTP_SRV_CONF_OFFSET, | |
126 offsetof(ngx_http_ssl_srv_conf_t, dhparam), | |
127 NULL }, | |
128 | |
3960 | 129 { ngx_string("ssl_ecdh_curve"), |
130 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
131 ngx_conf_set_str_slot, | |
132 NGX_HTTP_SRV_CONF_OFFSET, | |
133 offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve), | |
134 NULL }, | |
135 | |
547 | 136 { ngx_string("ssl_protocols"), |
563 | 137 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE, |
547 | 138 ngx_conf_set_bitmask_slot, |
139 NGX_HTTP_SRV_CONF_OFFSET, | |
140 offsetof(ngx_http_ssl_srv_conf_t, protocols), | |
141 &ngx_http_ssl_protocols }, | |
142 | |
479 | 143 { ngx_string("ssl_ciphers"), |
563 | 144 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
479 | 145 ngx_conf_set_str_slot, |
146 NGX_HTTP_SRV_CONF_OFFSET, | |
147 offsetof(ngx_http_ssl_srv_conf_t, ciphers), | |
148 NULL }, | |
149 | |
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
150 { ngx_string("ssl_buffer_size"), |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
151 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
152 ngx_conf_set_size_slot, |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
153 NGX_HTTP_SRV_CONF_OFFSET, |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
154 offsetof(ngx_http_ssl_srv_conf_t, buffer_size), |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
155 NULL }, |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
156 |
647 | 157 { ngx_string("ssl_verify_client"), |
4273
e444e8f6538b
Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse.
Sergey Budnevitch <sb@waeme.net>
parents:
4234
diff
changeset
|
158 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
2123 | 159 ngx_conf_set_enum_slot, |
647 | 160 NGX_HTTP_SRV_CONF_OFFSET, |
161 offsetof(ngx_http_ssl_srv_conf_t, verify), | |
2123 | 162 &ngx_http_ssl_verify }, |
647 | 163 |
164 { ngx_string("ssl_verify_depth"), | |
5504
8ed467553f6b
SSL: fixed ssl_verify_depth to take only one argument.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5503
diff
changeset
|
165 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
647 | 166 ngx_conf_set_num_slot, |
167 NGX_HTTP_SRV_CONF_OFFSET, | |
168 offsetof(ngx_http_ssl_srv_conf_t, verify_depth), | |
169 NULL }, | |
170 | |
171 { ngx_string("ssl_client_certificate"), | |
172 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
173 ngx_conf_set_str_slot, | |
174 NGX_HTTP_SRV_CONF_OFFSET, | |
175 offsetof(ngx_http_ssl_srv_conf_t, client_certificate), | |
176 NULL }, | |
177 | |
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
178 { ngx_string("ssl_trusted_certificate"), |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
179 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
180 ngx_conf_set_str_slot, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
181 NGX_HTTP_SRV_CONF_OFFSET, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
182 offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate), |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
183 NULL }, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
184 |
547 | 185 { ngx_string("ssl_prefer_server_ciphers"), |
186 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, | |
187 ngx_conf_set_flag_slot, | |
188 NGX_HTTP_SRV_CONF_OFFSET, | |
189 offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers), | |
190 NULL }, | |
191 | |
973 | 192 { ngx_string("ssl_session_cache"), |
193 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12, | |
194 ngx_http_ssl_session_cache, | |
195 NGX_HTTP_SRV_CONF_OFFSET, | |
196 0, | |
197 NULL }, | |
198 | |
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
199 { ngx_string("ssl_session_tickets"), |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
200 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
201 ngx_conf_set_flag_slot, |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
202 NGX_HTTP_SRV_CONF_OFFSET, |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
203 offsetof(ngx_http_ssl_srv_conf_t, session_tickets), |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
204 NULL }, |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
205 |
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
206 { ngx_string("ssl_session_ticket_key"), |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
207 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
208 ngx_conf_set_str_array_slot, |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
209 NGX_HTTP_SRV_CONF_OFFSET, |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
210 offsetof(ngx_http_ssl_srv_conf_t, session_ticket_keys), |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
211 NULL }, |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
212 |
573 | 213 { ngx_string("ssl_session_timeout"), |
214 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
215 ngx_conf_set_sec_slot, | |
216 NGX_HTTP_SRV_CONF_OFFSET, | |
217 offsetof(ngx_http_ssl_srv_conf_t, session_timeout), | |
218 NULL }, | |
219 | |
2995 | 220 { ngx_string("ssl_crl"), |
221 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, | |
222 ngx_conf_set_str_slot, | |
223 NGX_HTTP_SRV_CONF_OFFSET, | |
224 offsetof(ngx_http_ssl_srv_conf_t, crl), | |
225 NULL }, | |
226 | |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
227 { ngx_string("ssl_ocsp"), |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
228 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
229 ngx_conf_set_enum_slot, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
230 NGX_HTTP_SRV_CONF_OFFSET, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
231 offsetof(ngx_http_ssl_srv_conf_t, ocsp), |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
232 &ngx_http_ssl_ocsp }, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
233 |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
234 { ngx_string("ssl_ocsp_responder"), |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
235 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
236 ngx_conf_set_str_slot, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
237 NGX_HTTP_SRV_CONF_OFFSET, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
238 offsetof(ngx_http_ssl_srv_conf_t, ocsp_responder), |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
239 NULL }, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
240 |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
241 { ngx_string("ssl_ocsp_cache"), |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
242 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
243 ngx_http_ssl_ocsp_cache, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
244 NGX_HTTP_SRV_CONF_OFFSET, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
245 0, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
246 NULL }, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
247 |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
248 { ngx_string("ssl_stapling"), |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
249 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
250 ngx_conf_set_flag_slot, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
251 NGX_HTTP_SRV_CONF_OFFSET, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
252 offsetof(ngx_http_ssl_srv_conf_t, stapling), |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
253 NULL }, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
254 |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
255 { ngx_string("ssl_stapling_file"), |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
256 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
257 ngx_conf_set_str_slot, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
258 NGX_HTTP_SRV_CONF_OFFSET, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
259 offsetof(ngx_http_ssl_srv_conf_t, stapling_file), |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
260 NULL }, |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
261 |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
262 { ngx_string("ssl_stapling_responder"), |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
263 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
264 ngx_conf_set_str_slot, |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
265 NGX_HTTP_SRV_CONF_OFFSET, |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
266 offsetof(ngx_http_ssl_srv_conf_t, stapling_responder), |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
267 NULL }, |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
268 |
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
269 { ngx_string("ssl_stapling_verify"), |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
270 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
271 ngx_conf_set_flag_slot, |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
272 NGX_HTTP_SRV_CONF_OFFSET, |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
273 offsetof(ngx_http_ssl_srv_conf_t, stapling_verify), |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
274 NULL }, |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
275 |
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
276 { ngx_string("ssl_early_data"), |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
277 NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
278 ngx_conf_set_flag_slot, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
279 NGX_HTTP_SRV_CONF_OFFSET, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
280 offsetof(ngx_http_ssl_srv_conf_t, early_data), |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
281 NULL }, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
282 |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
283 ngx_null_command |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
284 }; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
285 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
286 |
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
287 static ngx_http_module_t ngx_http_ssl_module_ctx = { |
611 | 288 ngx_http_ssl_add_variables, /* preconfiguration */ |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
289 ngx_http_ssl_init, /* postconfiguration */ |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
290 |
541 | 291 NULL, /* create main configuration */ |
292 NULL, /* init main configuration */ | |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
293 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
294 ngx_http_ssl_create_srv_conf, /* create server configuration */ |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
295 ngx_http_ssl_merge_srv_conf, /* merge server configuration */ |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
296 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
297 NULL, /* create location configuration */ |
485 | 298 NULL /* merge location configuration */ |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
299 }; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
300 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
301 |
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
302 ngx_module_t ngx_http_ssl_module = { |
509 | 303 NGX_MODULE_V1, |
395
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
304 &ngx_http_ssl_module_ctx, /* module context */ |
f8f0f1834266
nginx-0.0.7-2004-07-16-21:11:43 import
Igor Sysoev <igor@sysoev.ru>
parents:
394
diff
changeset
|
305 ngx_http_ssl_commands, /* module directives */ |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
306 NGX_HTTP_MODULE, /* module type */ |
541 | 307 NULL, /* init master */ |
393
5659d773cfa8
nginx-0.0.7-2004-07-15-20:35:51 import
Igor Sysoev <igor@sysoev.ru>
parents:
392
diff
changeset
|
308 NULL, /* init module */ |
541 | 309 NULL, /* init process */ |
310 NULL, /* init thread */ | |
311 NULL, /* exit thread */ | |
312 NULL, /* exit process */ | |
313 NULL, /* exit master */ | |
314 NGX_MODULE_V1_PADDING | |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
315 }; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
316 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
317 |
611 | 318 static ngx_http_variable_t ngx_http_ssl_vars[] = { |
319 | |
671 | 320 { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable, |
1565 | 321 (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
611 | 322 |
671 | 323 { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable, |
1565 | 324 (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
611 | 325 |
6816
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
326 { ngx_string("ssl_ciphers"), NULL, ngx_http_ssl_variable, |
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
327 (uintptr_t) ngx_ssl_get_ciphers, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
ea93c7d8752a
SSL: $ssl_ciphers (ticket #870).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6815
diff
changeset
|
328 |
6817
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
329 { ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable, |
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
330 (uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
e75e854657ba
SSL: $ssl_curves (ticket #1088).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6816
diff
changeset
|
331 |
3154 | 332 { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable, |
333 (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
334 | |
5573
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
335 { ngx_string("ssl_session_reused"), NULL, ngx_http_ssl_variable, |
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
336 (uintptr_t) ngx_ssl_get_session_reused, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
7c05f6590753
SSL: the $ssl_session_reused variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5545
diff
changeset
|
337 |
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
338 { ngx_string("ssl_early_data"), NULL, ngx_http_ssl_variable, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
339 (uintptr_t) ngx_ssl_get_early_data, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
340 NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 }, |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
341 |
5658
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
342 { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable, |
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
343 (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
94ae92776441
SSL: $ssl_server_name variable.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5573
diff
changeset
|
344 |
2045 | 345 { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable, |
346 (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
347 | |
2123 | 348 { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable, |
349 (uintptr_t) ngx_ssl_get_raw_certificate, | |
350 NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
351 | |
7091
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
352 { ngx_string("ssl_client_escaped_cert"), NULL, ngx_http_ssl_variable, |
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
353 (uintptr_t) ngx_ssl_get_escaped_certificate, |
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
354 NGX_HTTP_VAR_CHANGEABLE, 0 }, |
82f0b8dcca27
SSL: the $ssl_client_escaped_cert variable (ticket #857).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7077
diff
changeset
|
355 |
671 | 356 { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable, |
1565 | 357 (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
647 | 358 |
671 | 359 { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable, |
1565 | 360 (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
671 | 361 |
6780
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
362 { ngx_string("ssl_client_s_dn_legacy"), NULL, ngx_http_ssl_variable, |
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
363 (uintptr_t) ngx_ssl_get_subject_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
364 |
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
365 { ngx_string("ssl_client_i_dn_legacy"), NULL, ngx_http_ssl_variable, |
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
366 (uintptr_t) ngx_ssl_get_issuer_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
56d6bfe6b609
SSL: RFC2253 compliant $ssl_client_s_dn and $ssl_client_i_dn.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6591
diff
changeset
|
367 |
671 | 368 { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable, |
1565 | 369 (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
647 | 370 |
5700
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
371 { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable, |
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
372 (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
5e892d40e5cc
SSL: $ssl_client_fingerprint variable.
Sergey Budnevitch <sb@waeme.net>
parents:
5658
diff
changeset
|
373 |
2994 | 374 { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable, |
375 (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 }, | |
376 | |
6815
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
377 { ngx_string("ssl_client_v_start"), NULL, ngx_http_ssl_variable, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
378 (uintptr_t) ngx_ssl_get_client_v_start, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
379 |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
380 { ngx_string("ssl_client_v_end"), NULL, ngx_http_ssl_variable, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
381 (uintptr_t) ngx_ssl_get_client_v_end, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
382 |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
383 { ngx_string("ssl_client_v_remain"), NULL, ngx_http_ssl_variable, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
384 (uintptr_t) ngx_ssl_get_client_v_remain, NGX_HTTP_VAR_CHANGEABLE, 0 }, |
2d15fff64e3c
SSL: $ssl_client_v_start, $ssl_client_v_end, $ssl_client_v_remain.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6780
diff
changeset
|
385 |
7077
2a288909abc6
Variables: macros for null variables.
Ruslan Ermilov <ru@nginx.com>
parents:
6981
diff
changeset
|
386 ngx_http_null_variable |
611 | 387 }; |
388 | |
389 | |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
390 static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP"); |
973 | 391 |
392 | |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
393 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
394 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
395 static int |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
396 ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out, |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
397 unsigned char *outlen, const unsigned char *in, unsigned int inlen, |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
398 void *arg) |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
399 { |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
400 unsigned int srvlen; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
401 unsigned char *srv; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
402 #if (NGX_DEBUG) |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
403 unsigned int i; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
404 #endif |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
405 #if (NGX_HTTP_V2 || NGX_HTTP_QUIC) |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
406 ngx_http_connection_t *hc; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
407 #endif |
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
408 #if (NGX_HTTP_V2 || NGX_DEBUG) |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
409 ngx_connection_t *c; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
410 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
411 c = ngx_ssl_get_connection(ssl_conn); |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
412 #endif |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
413 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
414 #if (NGX_DEBUG) |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
415 for (i = 0; i < inlen; i += in[i] + 1) { |
6474 | 416 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
6478
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
417 "SSL ALPN supported by client: %*s", |
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
418 (size_t) in[i], &in[i + 1]); |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
419 } |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
420 #endif |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
421 |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
422 #if (NGX_HTTP_V2 || NGX_HTTP_QUIC) |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
423 hc = c->data; |
8269
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
424 #endif |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
425 |
8269
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
426 #if (NGX_HTTP_V2) |
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
427 if (hc->addr_conf->http2) { |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
428 srv = |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
429 (unsigned char *) NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
430 srvlen = sizeof(NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
431 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
432 } else |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
433 #endif |
8269
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
434 #if (NGX_HTTP_V3) |
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
435 if (hc->addr_conf->http3) { |
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
436 srv = (unsigned char *) NGX_HTTP_V3_ALPN_ADVERTISE; |
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
437 srvlen = sizeof(NGX_HTTP_V3_ALPN_ADVERTISE) - 1; |
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
438 } else |
c9c3a73df6e8
Support for HTTP/3 ALPN.
Roman Arutyunyan <arut@nginx.com>
parents:
8232
diff
changeset
|
439 #endif |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
440 #if (NGX_HTTP_QUIC) |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
441 if (hc->addr_conf->quic) { |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
442 srv = (unsigned char *) NGX_HTTP_QUIC_ALPN_ADVERTISE; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
443 srvlen = sizeof(NGX_HTTP_QUIC_ALPN_ADVERTISE) - 1; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
444 } else |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
445 #endif |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
446 { |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
447 srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
448 srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
449 } |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
450 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
451 if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen, |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
452 in, inlen) |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
453 != OPENSSL_NPN_NEGOTIATED) |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
454 { |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
455 return SSL_TLSEXT_ERR_NOACK; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
456 } |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
457 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
458 ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, |
6478
3ef7bb882ad4
Fixed logging with variable field width.
Sergey Kandaurov <pluknet@nginx.com>
parents:
6474
diff
changeset
|
459 "SSL ALPN selected: %*s", (size_t) *outlen, *out); |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
460 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
461 return SSL_TLSEXT_ERR_OK; |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
462 } |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
463 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
464 #endif |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
465 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
466 |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
467 #ifdef TLSEXT_TYPE_next_proto_neg |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
468 |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
469 static int |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
470 ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
471 const unsigned char **out, unsigned int *outlen, void *arg) |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
472 { |
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
473 #if (NGX_HTTP_V2 || NGX_DEBUG) |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
474 ngx_connection_t *c; |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
475 |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
476 c = ngx_ssl_get_connection(ssl_conn); |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
477 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL NPN advertised"); |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
478 #endif |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
479 |
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
480 #if (NGX_HTTP_V2) |
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
481 { |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
482 ngx_http_connection_t *hc; |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
483 |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
484 hc = c->data; |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
485 |
6246
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
486 if (hc->addr_conf->http2) { |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
487 *out = |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
488 (unsigned char *) NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; |
257b51c37c5a
The HTTP/2 implementation (RFC 7240, 7241).
Valentin Bartenev <vbart@nginx.com>
parents:
6157
diff
changeset
|
489 *outlen = sizeof(NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; |
5121
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
490 |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
491 return SSL_TLSEXT_ERR_OK; |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
492 } |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
493 } |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
494 #endif |
c0f7b94e88ba
Preliminary experimental support for SPDY draft 2.
Valentin Bartenev <vbart@nginx.com>
parents:
5106
diff
changeset
|
495 |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
496 *out = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
497 *outlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
498 |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
499 return SSL_TLSEXT_ERR_OK; |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
500 } |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
501 |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
502 #endif |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
503 |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
504 |
973 | 505 static ngx_int_t |
671 | 506 ngx_http_ssl_static_variable(ngx_http_request_t *r, |
611 | 507 ngx_http_variable_value_t *v, uintptr_t data) |
508 { | |
671 | 509 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
611 | 510 |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
511 size_t len; |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
512 ngx_str_t s; |
611 | 513 |
514 if (r->connection->ssl) { | |
515 | |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
516 (void) handler(r->connection, NULL, &s); |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
517 |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
518 v->data = s.data; |
611 | 519 |
671 | 520 for (len = 0; v->data[len]; len++) { /* void */ } |
611 | 521 |
522 v->len = len; | |
523 v->valid = 1; | |
1565 | 524 v->no_cacheable = 0; |
611 | 525 v->not_found = 0; |
526 | |
527 return NGX_OK; | |
528 } | |
529 | |
530 v->not_found = 1; | |
531 | |
532 return NGX_OK; | |
533 } | |
534 | |
535 | |
536 static ngx_int_t | |
671 | 537 ngx_http_ssl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, |
647 | 538 uintptr_t data) |
539 { | |
671 | 540 ngx_ssl_variable_handler_pt handler = (ngx_ssl_variable_handler_pt) data; |
647 | 541 |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
542 ngx_str_t s; |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
543 |
647 | 544 if (r->connection->ssl) { |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
545 |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
546 if (handler(r->connection, r->pool, &s) != NGX_OK) { |
647 | 547 return NGX_ERROR; |
548 } | |
549 | |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
550 v->len = s.len; |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
551 v->data = s.data; |
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1219
diff
changeset
|
552 |
647 | 553 if (v->len) { |
554 v->valid = 1; | |
1565 | 555 v->no_cacheable = 0; |
647 | 556 v->not_found = 0; |
557 | |
558 return NGX_OK; | |
559 } | |
560 } | |
561 | |
562 v->not_found = 1; | |
563 | |
564 return NGX_OK; | |
565 } | |
566 | |
567 | |
568 static ngx_int_t | |
611 | 569 ngx_http_ssl_add_variables(ngx_conf_t *cf) |
570 { | |
571 ngx_http_variable_t *var, *v; | |
572 | |
573 for (v = ngx_http_ssl_vars; v->name.len; v++) { | |
574 var = ngx_http_add_variable(cf, &v->name, v->flags); | |
575 if (var == NULL) { | |
576 return NGX_ERROR; | |
577 } | |
578 | |
637 | 579 var->get_handler = v->get_handler; |
611 | 580 var->data = v->data; |
581 } | |
582 | |
583 return NGX_OK; | |
584 } | |
585 | |
586 | |
501 | 587 static void * |
588 ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) | |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
589 { |
971 | 590 ngx_http_ssl_srv_conf_t *sscf; |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
591 |
971 | 592 sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)); |
593 if (sscf == NULL) { | |
2912
c7d57b539248
return NULL instead of NGX_CONF_ERROR on a create conf failure
Igor Sysoev <igor@sysoev.ru>
parents:
2716
diff
changeset
|
594 return NULL; |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
595 } |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
596 |
479 | 597 /* |
598 * set by ngx_pcalloc(): | |
599 * | |
971 | 600 * sscf->protocols = 0; |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
601 * sscf->certificate_values = NULL; |
2044 | 602 * sscf->dhparam = { 0, NULL }; |
3960 | 603 * sscf->ecdh_curve = { 0, NULL }; |
2044 | 604 * sscf->client_certificate = { 0, NULL }; |
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
605 * sscf->trusted_certificate = { 0, NULL }; |
2995 | 606 * sscf->crl = { 0, NULL }; |
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
3209
diff
changeset
|
607 * sscf->ciphers = { 0, NULL }; |
973 | 608 * sscf->shm_zone = NULL; |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
609 * sscf->ocsp_responder = { 0, NULL }; |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
610 * sscf->stapling_file = { 0, NULL }; |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
611 * sscf->stapling_responder = { 0, NULL }; |
479 | 612 */ |
613 | |
971 | 614 sscf->enable = NGX_CONF_UNSET; |
2123 | 615 sscf->prefer_server_ciphers = NGX_CONF_UNSET; |
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
616 sscf->early_data = NGX_CONF_UNSET; |
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
617 sscf->buffer_size = NGX_CONF_UNSET_SIZE; |
2710 | 618 sscf->verify = NGX_CONF_UNSET_UINT; |
619 sscf->verify_depth = NGX_CONF_UNSET_UINT; | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
620 sscf->certificates = NGX_CONF_UNSET_PTR; |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
621 sscf->certificate_keys = NGX_CONF_UNSET_PTR; |
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
622 sscf->passwords = NGX_CONF_UNSET_PTR; |
973 | 623 sscf->builtin_session_cache = NGX_CONF_UNSET; |
624 sscf->session_timeout = NGX_CONF_UNSET; | |
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
625 sscf->session_tickets = NGX_CONF_UNSET; |
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
626 sscf->session_ticket_keys = NGX_CONF_UNSET_PTR; |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
627 sscf->ocsp = NGX_CONF_UNSET_UINT; |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
628 sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR; |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
629 sscf->stapling = NGX_CONF_UNSET; |
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
630 sscf->stapling_verify = NGX_CONF_UNSET; |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
631 |
971 | 632 return sscf; |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
633 } |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
634 |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
635 |
501 | 636 static char * |
637 ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) | |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
638 { |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
639 ngx_http_ssl_srv_conf_t *prev = parent; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
640 ngx_http_ssl_srv_conf_t *conf = child; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
641 |
563 | 642 ngx_pool_cleanup_t *cln; |
643 | |
4234
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
644 if (conf->enable == NGX_CONF_UNSET) { |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
645 if (prev->enable == NGX_CONF_UNSET) { |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
646 conf->enable = 0; |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
647 |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
648 } else { |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
649 conf->enable = prev->enable; |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
650 conf->file = prev->file; |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
651 conf->line = prev->line; |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
652 } |
d5462eab1440
Fixed segfault on configuration testing with ssl (ticket #37).
Maxim Dounin <mdounin@mdounin.ru>
parents:
4153
diff
changeset
|
653 } |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
654 |
573 | 655 ngx_conf_merge_value(conf->session_timeout, |
656 prev->session_timeout, 300); | |
657 | |
547 | 658 ngx_conf_merge_value(conf->prefer_server_ciphers, |
659 prev->prefer_server_ciphers, 0); | |
660 | |
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
661 ngx_conf_merge_value(conf->early_data, prev->early_data, 0); |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
662 |
547 | 663 ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, |
6157
b2899e7d0ef8
Disabled SSLv3 by default (ticket #653).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6035
diff
changeset
|
664 (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 |
4400
a0505851e70c
Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4273
diff
changeset
|
665 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); |
547 | 666 |
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
667 ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
668 NGX_SSL_BUFSIZE); |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
669 |
2123 | 670 ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); |
671 ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); | |
647 | 672 |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
673 ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL); |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
674 ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys, |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
675 NULL); |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
676 |
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
677 ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL); |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
678 |
2044 | 679 ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); |
680 | |
647 | 681 ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate, |
682 ""); | |
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
683 ngx_conf_merge_str_value(conf->trusted_certificate, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
684 prev->trusted_certificate, ""); |
2995 | 685 ngx_conf_merge_str_value(conf->crl, prev->crl, ""); |
647 | 686 |
3960 | 687 ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve, |
688 NGX_DEFAULT_ECDH_CURVE); | |
689 | |
2124 | 690 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS); |
479 | 691 |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
692 ngx_conf_merge_uint_value(conf->ocsp, prev->ocsp, 0); |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
693 ngx_conf_merge_str_value(conf->ocsp_responder, prev->ocsp_responder, ""); |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
694 ngx_conf_merge_ptr_value(conf->ocsp_cache_zone, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
695 prev->ocsp_cache_zone, NULL); |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
696 |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
697 ngx_conf_merge_value(conf->stapling, prev->stapling, 0); |
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
698 ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0); |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
699 ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, ""); |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
700 ngx_conf_merge_str_value(conf->stapling_responder, |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
701 prev->stapling_responder, ""); |
479 | 702 |
547 | 703 conf->ssl.log = cf->log; |
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
704 |
2224 | 705 if (conf->enable) { |
706 | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
707 if (conf->certificates == NULL) { |
2224 | 708 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
709 "no \"ssl_certificate\" is defined for " | |
710 "the \"ssl\" directive in %s:%ui", | |
711 conf->file, conf->line); | |
712 return NGX_CONF_ERROR; | |
713 } | |
714 | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
715 if (conf->certificate_keys == NULL) { |
2224 | 716 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
717 "no \"ssl_certificate_key\" is defined for " | |
718 "the \"ssl\" directive in %s:%ui", | |
719 conf->file, conf->line); | |
720 return NGX_CONF_ERROR; | |
721 } | |
722 | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
723 if (conf->certificate_keys->nelts < conf->certificates->nelts) { |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
724 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
725 "no \"ssl_certificate_key\" is defined " |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
726 "for certificate \"%V\" and " |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
727 "the \"ssl\" directive in %s:%ui", |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
728 ((ngx_str_t *) conf->certificates->elts) |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
729 + conf->certificates->nelts - 1, |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
730 conf->file, conf->line); |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
731 return NGX_CONF_ERROR; |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
732 } |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
733 |
2224 | 734 } else { |
735 | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
736 if (conf->certificates == NULL) { |
2224 | 737 return NGX_CONF_OK; |
738 } | |
739 | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
740 if (conf->certificate_keys == NULL |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
741 || conf->certificate_keys->nelts < conf->certificates->nelts) |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
742 { |
2224 | 743 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
744 "no \"ssl_certificate_key\" is defined " | |
6550
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
745 "for certificate \"%V\"", |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
746 ((ngx_str_t *) conf->certificates->elts) |
51e1f047d15d
SSL: support for multiple certificates (ticket #814).
Maxim Dounin <mdounin@mdounin.ru>
parents:
6489
diff
changeset
|
747 + conf->certificates->nelts - 1); |
2224 | 748 return NGX_CONF_ERROR; |
749 } | |
750 } | |
751 | |
969 | 752 if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) { |
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
753 return NGX_CONF_ERROR; |
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
754 } |
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
755 |
7473
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
756 cln = ngx_pool_cleanup_add(cf->pool, 0); |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
757 if (cln == NULL) { |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
758 ngx_ssl_cleanup_ctx(&conf->ssl); |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
759 return NGX_CONF_ERROR; |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
760 } |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
761 |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
762 cln->handler = ngx_ssl_cleanup_ctx; |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
763 cln->data = &conf->ssl; |
8981dbb12254
SSL: fixed potential leak on memory allocation errors.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7466
diff
changeset
|
764 |
1219 | 765 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME |
766 | |
767 if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, | |
768 ngx_http_ssl_servername) | |
769 == 0) | |
770 { | |
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
771 ngx_log_error(NGX_LOG_WARN, cf->log, 0, |
3209 | 772 "nginx was built with SNI support, however, now it is linked " |
3140
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
773 "dynamically to an OpenSSL library which has no tlsext support, " |
ba9a8ba4207e
*) issue warning instead of failure: this is too common case
Igor Sysoev <igor@sysoev.ru>
parents:
2996
diff
changeset
|
774 "therefore SNI is not available"); |
1219 | 775 } |
776 | |
777 #endif | |
778 | |
5545
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
779 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
780 SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL); |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
781 #endif |
01e2a5bcdd8f
SSL: support ALPN (IETF's successor to NPN).
Piotr Sikora <piotr@cloudflare.com>
parents:
5504
diff
changeset
|
782 |
5106
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
783 #ifdef TLSEXT_TYPE_next_proto_neg |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
784 SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx, |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
785 ngx_http_ssl_npn_advertised, NULL); |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
786 #endif |
afee87b8190a
SSL: Next Protocol Negotiation extension support.
Valentin Bartenev <vbart@nginx.com>
parents:
5077
diff
changeset
|
787 |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
788 if (ngx_http_ssl_compile_certificates(cf, conf) != NGX_OK) { |
386
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
789 return NGX_CONF_ERROR; |
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
790 } |
fa72605e7089
nginx-0.0.7-2004-07-12-01:03:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
385
diff
changeset
|
791 |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
792 if (conf->certificate_values) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
793 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
794 #ifdef SSL_R_CERT_CB_ERROR |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
795 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
796 /* install callback to lookup certificates */ |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
797 |
7466
48c87377aabd
SSL: fixed possible segfault with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7465
diff
changeset
|
798 SSL_CTX_set_cert_cb(conf->ssl.ctx, ngx_http_ssl_certificate, conf); |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
799 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
800 #else |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
801 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
802 "variables in " |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
803 "\"ssl_certificate\" and \"ssl_certificate_key\" " |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
804 "directives are not supported on this platform"); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
805 return NGX_CONF_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
806 #endif |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
807 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
808 } else { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
809 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
810 /* configure certificates */ |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
811 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
812 if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
813 conf->certificate_keys, conf->passwords) |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
814 != NGX_OK) |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
815 { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
816 return NGX_CONF_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
817 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
818 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
819 |
6591
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
820 if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers, |
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
821 conf->prefer_server_ciphers) |
04d8d1f85649
SSL: ngx_ssl_ciphers() to set list of ciphers.
Tim Taubert <tim@timtaubert.de>
parents:
6553
diff
changeset
|
822 != NGX_OK) |
529 | 823 { |
5387
0fbcfab0bfd7
SSL: stop loading configs with invalid "ssl_ciphers" values.
Piotr Sikora <piotr@cloudflare.com>
parents:
5121
diff
changeset
|
824 return NGX_CONF_ERROR; |
547 | 825 } |
826 | |
5487
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
827 conf->ssl.buffer_size = conf->buffer_size; |
a297b7ad6f94
SSL: ssl_buffer_size directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5425
diff
changeset
|
828 |
647 | 829 if (conf->verify) { |
2123 | 830 |
4884
e406c997470a
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
Maxim Dounin <mdounin@mdounin.ru>
parents:
4879
diff
changeset
|
831 if (conf->client_certificate.len == 0 && conf->verify != 3) { |
2123 | 832 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
7567
ef7ee19776db
SSL: fixed ssl_verify_client error message.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7473
diff
changeset
|
833 "no ssl_client_certificate for ssl_verify_client"); |
2123 | 834 return NGX_CONF_ERROR; |
835 } | |
836 | |
671 | 837 if (ngx_ssl_client_certificate(cf, &conf->ssl, |
970 | 838 &conf->client_certificate, |
839 conf->verify_depth) | |
671 | 840 != NGX_OK) |
841 { | |
842 return NGX_CONF_ERROR; | |
647 | 843 } |
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
844 } |
2995 | 845 |
4872
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
846 if (ngx_ssl_trusted_certificate(cf, &conf->ssl, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
847 &conf->trusted_certificate, |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
848 conf->verify_depth) |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
849 != NGX_OK) |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
850 { |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
851 return NGX_CONF_ERROR; |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
852 } |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
853 |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
854 if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) { |
7c3cca603438
OCSP stapling: ssl_trusted_certificate directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
855 return NGX_CONF_ERROR; |
647 | 856 } |
857 | |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
858 if (conf->ocsp) { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
859 |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
860 if (conf->verify == 3) { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
861 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
862 "\"ssl_ocsp\" is incompatible with " |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
863 "\"ssl_verify_client optional_no_ca\""); |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
864 return NGX_CONF_ERROR; |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
865 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
866 |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
867 if (ngx_ssl_ocsp(cf, &conf->ssl, &conf->ocsp_responder, conf->ocsp, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
868 conf->ocsp_cache_zone) |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
869 != NGX_OK) |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
870 { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
871 return NGX_CONF_ERROR; |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
872 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
873 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
874 |
2044 | 875 if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) { |
876 return NGX_CONF_ERROR; | |
877 } | |
878 | |
3960 | 879 if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) { |
880 return NGX_CONF_ERROR; | |
881 } | |
882 | |
973 | 883 ngx_conf_merge_value(conf->builtin_session_cache, |
2032 | 884 prev->builtin_session_cache, NGX_SSL_NONE_SCACHE); |
973 | 885 |
886 if (conf->shm_zone == NULL) { | |
887 conf->shm_zone = prev->shm_zone; | |
888 } | |
889 | |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
890 if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx, |
7465
6708bec13757
SSL: adjusted session id context with dynamic certificates.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7463
diff
changeset
|
891 conf->certificates, conf->builtin_session_cache, |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
892 conf->shm_zone, conf->session_timeout) |
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
893 != NGX_OK) |
973 | 894 { |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
895 return NGX_CONF_ERROR; |
973 | 896 } |
573 | 897 |
5503
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
898 ngx_conf_merge_value(conf->session_tickets, prev->session_tickets, 1); |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
899 |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
900 #ifdef SSL_OP_NO_TICKET |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
901 if (!conf->session_tickets) { |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
902 SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET); |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
903 } |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
904 #endif |
d049b0ea00a3
SSL: ssl_session_tickets directive.
Dirkjan Bussink <d.bussink@gmail.com>
parents:
5487
diff
changeset
|
905 |
5425
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
906 ngx_conf_merge_ptr_value(conf->session_ticket_keys, |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
907 prev->session_ticket_keys, NULL); |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
908 |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
909 if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys) |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
910 != NGX_OK) |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
911 { |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
912 return NGX_CONF_ERROR; |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
913 } |
1356a3b96924
SSL: added ability to set keys used for Session Tickets (RFC5077).
Piotr Sikora <piotr@cloudflare.com>
parents:
5387
diff
changeset
|
914 |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
915 if (conf->stapling) { |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
916 |
4879
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
917 if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file, |
4a804fd04e6c
OCSP stapling: ssl_stapling_verify directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4875
diff
changeset
|
918 &conf->stapling_responder, conf->stapling_verify) |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
919 != NGX_OK) |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
920 { |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
921 return NGX_CONF_ERROR; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
922 } |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
923 |
4873
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
924 } |
dd74fd35ceb5
OCSP stapling: ssl_stapling_file support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4872
diff
changeset
|
925 |
7333
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
926 if (ngx_ssl_early_data(cf, &conf->ssl, conf->early_data) != NGX_OK) { |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
927 return NGX_CONF_ERROR; |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
928 } |
ba971deb4b44
SSL: support for TLSv1.3 early data with BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7270
diff
changeset
|
929 |
383
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
930 return NGX_CONF_OK; |
c05876036128
nginx-0.0.7-2004-07-08-19:17:47 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
931 } |
563 | 932 |
933 | |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
934 static ngx_int_t |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
935 ngx_http_ssl_compile_certificates(ngx_conf_t *cf, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
936 ngx_http_ssl_srv_conf_t *conf) |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
937 { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
938 ngx_str_t *cert, *key; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
939 ngx_uint_t i, nelts; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
940 ngx_http_complex_value_t *cv; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
941 ngx_http_compile_complex_value_t ccv; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
942 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
943 cert = conf->certificates->elts; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
944 key = conf->certificate_keys->elts; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
945 nelts = conf->certificates->nelts; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
946 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
947 for (i = 0; i < nelts; i++) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
948 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
949 if (ngx_http_script_variables_count(&cert[i])) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
950 goto found; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
951 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
952 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
953 if (ngx_http_script_variables_count(&key[i])) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
954 goto found; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
955 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
956 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
957 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
958 return NGX_OK; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
959 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
960 found: |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
961 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
962 conf->certificate_values = ngx_array_create(cf->pool, nelts, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
963 sizeof(ngx_http_complex_value_t)); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
964 if (conf->certificate_values == NULL) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
965 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
966 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
967 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
968 conf->certificate_key_values = ngx_array_create(cf->pool, nelts, |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
969 sizeof(ngx_http_complex_value_t)); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
970 if (conf->certificate_key_values == NULL) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
971 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
972 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
973 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
974 for (i = 0; i < nelts; i++) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
975 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
976 cv = ngx_array_push(conf->certificate_values); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
977 if (cv == NULL) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
978 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
979 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
980 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
981 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t)); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
982 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
983 ccv.cf = cf; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
984 ccv.value = &cert[i]; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
985 ccv.complex_value = cv; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
986 ccv.zero = 1; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
987 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
988 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
989 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
990 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
991 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
992 cv = ngx_array_push(conf->certificate_key_values); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
993 if (cv == NULL) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
994 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
995 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
996 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
997 ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t)); |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
998 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
999 ccv.cf = cf; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1000 ccv.value = &key[i]; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1001 ccv.complex_value = cv; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1002 ccv.zero = 1; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1003 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1004 if (ngx_http_compile_complex_value(&ccv) != NGX_OK) { |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1005 return NGX_ERROR; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1006 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1007 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1008 |
7463
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
1009 conf->passwords = ngx_ssl_preserve_passwords(cf, conf->passwords); |
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
1010 if (conf->passwords == NULL) { |
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
1011 return NGX_ERROR; |
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
1012 } |
180df83473a4
SSL: passwords support for dynamic certificate loading.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7462
diff
changeset
|
1013 |
7462
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1014 return NGX_OK; |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1015 } |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1016 |
be2af41d3620
SSL: variables support in ssl_certificate and ssl_certificate_key.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7333
diff
changeset
|
1017 |
973 | 1018 static char * |
2224 | 1019 ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
1020 { | |
1021 ngx_http_ssl_srv_conf_t *sscf = conf; | |
1022 | |
1023 char *rv; | |
1024 | |
1025 rv = ngx_conf_set_flag_slot(cf, cmd, conf); | |
1026 | |
1027 if (rv != NGX_CONF_OK) { | |
1028 return rv; | |
1029 } | |
1030 | |
1031 sscf->file = cf->conf_file->file.name.data; | |
1032 sscf->line = cf->conf_file->line; | |
1033 | |
1034 return NGX_CONF_OK; | |
1035 } | |
1036 | |
1037 | |
1038 static char * | |
5744
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1039 ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1040 { |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1041 ngx_http_ssl_srv_conf_t *sscf = conf; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1042 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1043 ngx_str_t *value; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1044 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1045 if (sscf->passwords != NGX_CONF_UNSET_PTR) { |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1046 return "is duplicate"; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1047 } |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1048 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1049 value = cf->args->elts; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1050 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1051 sscf->passwords = ngx_ssl_read_password_file(cf, &value[1]); |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1052 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1053 if (sscf->passwords == NULL) { |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1054 return NGX_CONF_ERROR; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1055 } |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1056 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1057 return NGX_CONF_OK; |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1058 } |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1059 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1060 |
42114bf12da0
SSL: the "ssl_password_file" directive.
Valentin Bartenev <vbart@nginx.com>
parents:
5700
diff
changeset
|
1061 static char * |
973 | 1062 ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
1063 { | |
1064 ngx_http_ssl_srv_conf_t *sscf = conf; | |
1065 | |
1066 size_t len; | |
1067 ngx_str_t *value, name, size; | |
1068 ngx_int_t n; | |
1069 ngx_uint_t i, j; | |
1070 | |
1071 value = cf->args->elts; | |
1072 | |
1073 for (i = 1; i < cf->args->nelts; i++) { | |
1074 | |
1778 | 1075 if (ngx_strcmp(value[i].data, "off") == 0) { |
1076 sscf->builtin_session_cache = NGX_SSL_NO_SCACHE; | |
1077 continue; | |
1078 } | |
1079 | |
2032 | 1080 if (ngx_strcmp(value[i].data, "none") == 0) { |
1081 sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE; | |
1082 continue; | |
1083 } | |
1084 | |
973 | 1085 if (ngx_strcmp(value[i].data, "builtin") == 0) { |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1086 sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE; |
973 | 1087 continue; |
1088 } | |
1089 | |
1090 if (value[i].len > sizeof("builtin:") - 1 | |
1091 && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1) | |
1092 == 0) | |
1093 { | |
1094 n = ngx_atoi(value[i].data + sizeof("builtin:") - 1, | |
1095 value[i].len - (sizeof("builtin:") - 1)); | |
1096 | |
1097 if (n == NGX_ERROR) { | |
1098 goto invalid; | |
1099 } | |
1100 | |
1101 sscf->builtin_session_cache = n; | |
1102 | |
1103 continue; | |
1104 } | |
1105 | |
1106 if (value[i].len > sizeof("shared:") - 1 | |
1107 && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1) | |
1108 == 0) | |
1109 { | |
1110 len = 0; | |
1111 | |
1112 for (j = sizeof("shared:") - 1; j < value[i].len; j++) { | |
1113 if (value[i].data[j] == ':') { | |
1114 break; | |
1115 } | |
1116 | |
1117 len++; | |
1118 } | |
1119 | |
1120 if (len == 0) { | |
1121 goto invalid; | |
1122 } | |
1123 | |
1124 name.len = len; | |
1125 name.data = value[i].data + sizeof("shared:") - 1; | |
1126 | |
1127 size.len = value[i].len - j - 1; | |
1128 size.data = name.data + len + 1; | |
1129 | |
1130 n = ngx_parse_size(&size); | |
1131 | |
1132 if (n == NGX_ERROR) { | |
1133 goto invalid; | |
1134 } | |
1135 | |
1136 if (n < (ngx_int_t) (8 * ngx_pagesize)) { | |
1137 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1138 "session cache \"%V\" is too small", |
973 | 1139 &value[i]); |
1140 | |
1141 return NGX_CONF_ERROR; | |
1142 } | |
1143 | |
1144 sscf->shm_zone = ngx_shared_memory_add(cf, &name, n, | |
1145 &ngx_http_ssl_module); | |
1146 if (sscf->shm_zone == NULL) { | |
1147 return NGX_CONF_ERROR; | |
1148 } | |
1149 | |
4153
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
1150 sscf->shm_zone->init = ngx_ssl_session_cache_init; |
7de74ed694c8
Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).
Maxim Dounin <mdounin@mdounin.ru>
parents:
3992
diff
changeset
|
1151 |
973 | 1152 continue; |
1153 } | |
1154 | |
1155 goto invalid; | |
1156 } | |
1157 | |
1158 if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) { | |
974
8dfb3aa75de2
move the session cache callbacks to the ngx_openssl_module
Igor Sysoev <igor@sysoev.ru>
parents:
973
diff
changeset
|
1159 sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE; |
973 | 1160 } |
1161 | |
1162 return NGX_CONF_OK; | |
1163 | |
1164 invalid: | |
1165 | |
1166 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, | |
1167 "invalid session cache \"%V\"", &value[i]); | |
1168 | |
1169 return NGX_CONF_ERROR; | |
1170 } | |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1171 |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1172 |
7654
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1173 static char * |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1174 ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1175 { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1176 ngx_http_ssl_srv_conf_t *sscf = conf; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1177 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1178 size_t len; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1179 ngx_int_t n; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1180 ngx_str_t *value, name, size; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1181 ngx_uint_t j; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1182 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1183 if (sscf->ocsp_cache_zone != NGX_CONF_UNSET_PTR) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1184 return "is duplicate"; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1185 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1186 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1187 value = cf->args->elts; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1188 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1189 if (ngx_strcmp(value[1].data, "off") == 0) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1190 sscf->ocsp_cache_zone = NULL; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1191 return NGX_CONF_OK; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1192 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1193 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1194 if (value[1].len <= sizeof("shared:") - 1 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1195 || ngx_strncmp(value[1].data, "shared:", sizeof("shared:") - 1) != 0) |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1196 { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1197 goto invalid; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1198 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1199 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1200 len = 0; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1201 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1202 for (j = sizeof("shared:") - 1; j < value[1].len; j++) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1203 if (value[1].data[j] == ':') { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1204 break; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1205 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1206 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1207 len++; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1208 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1209 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1210 if (len == 0) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1211 goto invalid; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1212 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1213 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1214 name.len = len; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1215 name.data = value[1].data + sizeof("shared:") - 1; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1216 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1217 size.len = value[1].len - j - 1; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1218 size.data = name.data + len + 1; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1219 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1220 n = ngx_parse_size(&size); |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1221 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1222 if (n == NGX_ERROR) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1223 goto invalid; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1224 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1225 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1226 if (n < (ngx_int_t) (8 * ngx_pagesize)) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1227 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1228 "OCSP cache \"%V\" is too small", &value[1]); |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1229 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1230 return NGX_CONF_ERROR; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1231 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1232 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1233 sscf->ocsp_cache_zone = ngx_shared_memory_add(cf, &name, n, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1234 &ngx_http_ssl_module_ctx); |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1235 if (sscf->ocsp_cache_zone == NULL) { |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1236 return NGX_CONF_ERROR; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1237 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1238 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1239 sscf->ocsp_cache_zone->init = ngx_ssl_ocsp_cache_init; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1240 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1241 return NGX_CONF_OK; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1242 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1243 invalid: |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1244 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1245 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1246 "invalid OCSP cache \"%V\"", &value[1]); |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1247 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1248 return NGX_CONF_ERROR; |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1249 } |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1250 |
b56f725dd4bb
OCSP: certificate status cache.
Roman Arutyunyan <arut@nginx.com>
parents:
7653
diff
changeset
|
1251 |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1252 static ngx_int_t |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1253 ngx_http_ssl_init(ngx_conf_t *cf) |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1254 { |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1255 ngx_uint_t a, p, s; |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1256 const char *name; |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1257 ngx_http_conf_addr_t *addr; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1258 ngx_http_conf_port_t *port; |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1259 ngx_http_ssl_srv_conf_t *sscf; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1260 ngx_http_core_loc_conf_t *clcf; |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1261 ngx_http_core_srv_conf_t **cscfp, *cscf; |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1262 ngx_http_core_main_conf_t *cmcf; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1263 |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1264 cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1265 cscfp = cmcf->servers.elts; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1266 |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1267 for (s = 0; s < cmcf->servers.nelts; s++) { |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1268 |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1269 sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1270 |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1271 if (sscf->ssl.ctx == NULL) { |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1272 continue; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1273 } |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1274 |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1275 clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index]; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1276 |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1277 if (sscf->stapling) { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1278 if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver, |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1279 clcf->resolver_timeout) |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1280 != NGX_OK) |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1281 { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1282 return NGX_ERROR; |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1283 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1284 } |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1285 |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1286 if (sscf->ocsp) { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1287 if (ngx_ssl_ocsp_resolver(cf, &sscf->ssl, clcf->resolver, |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1288 clcf->resolver_timeout) |
7653
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1289 != NGX_OK) |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1290 { |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1291 return NGX_ERROR; |
8409f9df6219
SSL: client certificate validation with OCSP (ticket #1534).
Roman Arutyunyan <arut@nginx.com>
parents:
7567
diff
changeset
|
1292 } |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1293 } |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1294 } |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1295 |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1296 if (cmcf->ports == NULL) { |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1297 return NGX_OK; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1298 } |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1299 |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1300 port = cmcf->ports->elts; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1301 for (p = 0; p < cmcf->ports->nelts; p++) { |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1302 |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1303 addr = port[p].addrs.elts; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1304 for (a = 0; a < port[p].addrs.nelts; a++) { |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1305 |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1306 if (!addr[a].opt.ssl && !addr[a].opt.quic) { |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1307 continue; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1308 } |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1309 |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1310 if (addr[a].opt.http3) { |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1311 name = "http3"; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1312 |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1313 } else if (addr[a].opt.quic) { |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1314 name = "quic"; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1315 |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1316 } else { |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1317 name = "ssl"; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1318 } |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1319 |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1320 cscf = addr[a].default_server; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1321 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1322 |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1323 if (sscf->certificates == NULL) { |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1324 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1325 "no \"ssl_certificate\" is defined for " |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1326 "the \"listen ... %s\" directive in %s:%ui", |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1327 name, cscf->file_name, cscf->line); |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1328 return NGX_ERROR; |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1329 } |
8167
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7567
diff
changeset
|
1330 |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1331 if (addr[a].opt.quic && !(sscf->protocols & NGX_SSL_TLSv1_3)) { |
8167
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7567
diff
changeset
|
1332 ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7567
diff
changeset
|
1333 "\"ssl_protocols\" did not enable TLSv1.3 for " |
8481
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1334 "the \"listen ... %s\" directives in %s:%ui", |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
8411
diff
changeset
|
1335 name, cscf->file_name, cscf->line); |
8167
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7567
diff
changeset
|
1336 return NGX_ERROR; |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7567
diff
changeset
|
1337 } |
7269
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1338 } |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1339 } |
7f955d3b9a0d
SSL: detect "listen ... ssl" without certificates (ticket #178).
Maxim Dounin <mdounin@mdounin.ru>
parents:
7091
diff
changeset
|
1340 |
4875
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1341 return NGX_OK; |
386a06a22c40
OCSP stapling: loading OCSP responses.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4873
diff
changeset
|
1342 } |