Mercurial > hg > nginx

comparison src/http/ngx_http_upstream.c @ 7941:65946a191197

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: SSL_sendfile() support with kernel TLS. Requires OpenSSL 3.0 compiled with "enable-ktls" option. Further, KTLS needs to be enabled in kernel, and in OpenSSL, either via OpenSSL configuration file or with "ssl_conf_command Options KTLS;" in nginx configuration. On FreeBSD, kernel TLS is available starting with FreeBSD 13.0, and can be enabled with "sysctl kern.ipc.tls.enable=1" and "kldload ktls_ocf" to load a software backend, see man ktls(4) for details. On Linux, kernel TLS is available starting with kernel 4.13 (at least 5.2 is recommended), and needs kernel compiled with CONFIG_TLS=y (with CONFIG_TLS=m, which is used at least on Ubuntu 21.04 by default, the tls module needs to be loaded with "modprobe tls").
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 21 Oct 2021 18:44:07 +0300
parents 058a67435e83
children 862f6130d357
comparison
equal deleted inserted replaced
7940:46a02ed7c966 7941:65946a191197
1681 ngx_http_upstream_finalize_request(r, u, 1681 ngx_http_upstream_finalize_request(r, u,
1682 NGX_HTTP_INTERNAL_SERVER_ERROR); 1682 NGX_HTTP_INTERNAL_SERVER_ERROR);
1683 return; 1683 return;
1684 } 1684 }
1685 1685
1686 c->sendfile = 0;
1687 u->output.sendfile = 0;
1688
1689 if (u->conf->ssl_server_name || u->conf->ssl_verify) { 1686 if (u->conf->ssl_server_name || u->conf->ssl_verify) {
1690 if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) { 1687 if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) {
1691 ngx_http_upstream_finalize_request(r, u, 1688 ngx_http_upstream_finalize_request(r, u,
1692 NGX_HTTP_INTERNAL_SERVER_ERROR); 1689 NGX_HTTP_INTERNAL_SERVER_ERROR);
1693 return; 1690 return;
1787 ngx_log_error(NGX_LOG_ERR, c->log, 0, 1784 ngx_log_error(NGX_LOG_ERR, c->log, 0,
1788 "upstream SSL certificate does not match \"%V\"", 1785 "upstream SSL certificate does not match \"%V\"",
1789 &u->ssl_name); 1786 &u->ssl_name);
1790 goto failed; 1787 goto failed;
1791 } 1788 }
1789 }
1790
1791 if (!c->ssl->sendfile) {
1792 c->sendfile = 0;
1793 u->output.sendfile = 0;
1792 } 1794 }
1793 1795
1794 c->write->handler = ngx_http_upstream_handler; 1796 c->write->handler = ngx_http_upstream_handler;
1795 c->read->handler = ngx_http_upstream_handler; 1797 c->read->handler = ngx_http_upstream_handler;
1796 1798