Mercurial > hg > nginx

comparison src/mail/ngx_mail_ssl_module.c @ 7729:3bff3f397c05

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: ssl_conf_command directive. With the ssl_conf_command directive it is now possible to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html). In particular, this allows configuring PrioritizeChaCha option (ticket #1445): ssl_conf_command Options PrioritizeChaCha; It can be also used to configure TLSv1.3 ciphers in OpenSSL, which fails to configure them via the SSL_CTX_set_cipher_list() interface (ticket #1529): ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; Configuration commands are applied after nginx own configuration for SSL, so they can be used to override anything set by nginx. Note though that configuring OpenSSL directly with ssl_conf_command might result in a behaviour nginx does not expect, and should be done with care.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 22 Oct 2020 18:00:22 +0300
parents ef7ee19776db
children 7ce28b4cc57e
comparison
equal deleted inserted replaced
7728:485dba3e2a01 7729:3bff3f397c05
23 void *conf); 23 void *conf);
24 static char *ngx_mail_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, 24 static char *ngx_mail_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
25 void *conf); 25 void *conf);
26 static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, 26 static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
27 void *conf); 27 void *conf);
28
29 static char *ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post,
30 void *data);
28 31
29 32
30 static ngx_conf_enum_t ngx_mail_starttls_state[] = { 33 static ngx_conf_enum_t ngx_mail_starttls_state[] = {
31 { ngx_string("off"), NGX_MAIL_STARTTLS_OFF }, 34 { ngx_string("off"), NGX_MAIL_STARTTLS_OFF },
32 { ngx_string("on"), NGX_MAIL_STARTTLS_ON }, 35 { ngx_string("on"), NGX_MAIL_STARTTLS_ON },
59 static ngx_conf_deprecated_t ngx_mail_ssl_deprecated = { 62 static ngx_conf_deprecated_t ngx_mail_ssl_deprecated = {
60 ngx_conf_deprecated, "ssl", "listen ... ssl" 63 ngx_conf_deprecated, "ssl", "listen ... ssl"
61 }; 64 };
62 65
63 66
67 static ngx_conf_post_t ngx_mail_ssl_conf_command_post =
68 { ngx_mail_ssl_conf_command_check };
69
70
64 static ngx_command_t ngx_mail_ssl_commands[] = { 71 static ngx_command_t ngx_mail_ssl_commands[] = {
65 72
66 { ngx_string("ssl"), 73 { ngx_string("ssl"),
67 NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG, 74 NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG,
68 ngx_mail_ssl_enable, 75 ngx_mail_ssl_enable,
193 NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, 200 NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
194 ngx_conf_set_str_slot, 201 ngx_conf_set_str_slot,
195 NGX_MAIL_SRV_CONF_OFFSET, 202 NGX_MAIL_SRV_CONF_OFFSET,
196 offsetof(ngx_mail_ssl_conf_t, crl), 203 offsetof(ngx_mail_ssl_conf_t, crl),
197 NULL }, 204 NULL },
205
206 { ngx_string("ssl_conf_command"),
207 NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE2,
208 ngx_conf_set_keyval_slot,
209 NGX_MAIL_SRV_CONF_OFFSET,
210 offsetof(ngx_mail_ssl_conf_t, conf_commands),
211 &ngx_mail_ssl_conf_command_post },
198 212
199 ngx_null_command 213 ngx_null_command
200 }; 214 };
201 215
202 216
257 scf->enable = NGX_CONF_UNSET; 271 scf->enable = NGX_CONF_UNSET;
258 scf->starttls = NGX_CONF_UNSET_UINT; 272 scf->starttls = NGX_CONF_UNSET_UINT;
259 scf->certificates = NGX_CONF_UNSET_PTR; 273 scf->certificates = NGX_CONF_UNSET_PTR;
260 scf->certificate_keys = NGX_CONF_UNSET_PTR; 274 scf->certificate_keys = NGX_CONF_UNSET_PTR;
261 scf->passwords = NGX_CONF_UNSET_PTR; 275 scf->passwords = NGX_CONF_UNSET_PTR;
276 scf->conf_commands = NGX_CONF_UNSET_PTR;
262 scf->prefer_server_ciphers = NGX_CONF_UNSET; 277 scf->prefer_server_ciphers = NGX_CONF_UNSET;
263 scf->verify = NGX_CONF_UNSET_UINT; 278 scf->verify = NGX_CONF_UNSET_UINT;
264 scf->verify_depth = NGX_CONF_UNSET_UINT; 279 scf->verify_depth = NGX_CONF_UNSET_UINT;
265 scf->builtin_session_cache = NGX_CONF_UNSET; 280 scf->builtin_session_cache = NGX_CONF_UNSET;
266 scf->session_timeout = NGX_CONF_UNSET; 281 scf->session_timeout = NGX_CONF_UNSET;
313 ngx_conf_merge_str_value(conf->trusted_certificate, 328 ngx_conf_merge_str_value(conf->trusted_certificate,
314 prev->trusted_certificate, ""); 329 prev->trusted_certificate, "");
315 ngx_conf_merge_str_value(conf->crl, prev->crl, ""); 330 ngx_conf_merge_str_value(conf->crl, prev->crl, "");
316 331
317 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS); 332 ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);
333
334 ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
318 335
319 336
320 conf->ssl.log = cf->log; 337 conf->ssl.log = cf->log;
321 338
322 if (conf->listen) { 339 if (conf->listen) {
459 != NGX_OK) 476 != NGX_OK)
460 { 477 {
461 return NGX_CONF_ERROR; 478 return NGX_CONF_ERROR;
462 } 479 }
463 480
481 if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
482 return NGX_CONF_ERROR;
483 }
484
464 return NGX_CONF_OK; 485 return NGX_CONF_OK;
465 } 486 }
466 487
467 488
468 static char * 489 static char *
652 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, 673 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
653 "invalid session cache \"%V\"", &value[i]); 674 "invalid session cache \"%V\"", &value[i]);
654 675
655 return NGX_CONF_ERROR; 676 return NGX_CONF_ERROR;
656 } 677 }
678
679
680 static char *
681 ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
682 {
683 #ifndef SSL_CONF_FLAG_FILE
684 return "is not supported on this platform";
685 #endif
686
687 return NGX_CONF_OK;
688 }