Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 7320:696df3ac27ac

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: save sessions for upstream peers using a callback function. In TLSv1.3, NewSessionTicket messages arrive after the handshake and can come at any time. Therefore we use a callback to save the session when we know about it. This approach works for < TLSv1.3 as well. The callback function is set once per location on merge phase. Since SSL_get_session() in BoringSSL returns an unresumable session for TLSv1.3, peer save_session() methods have been updated as well to use a session supplied within the callback. To preserve API, the session is cached in c->ssl->session. It is preferably accessed in save_session() methods by ngx_ssl_get_session() and ngx_ssl_get0_session() wrappers.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 17 Jul 2018 12:53:23 +0300
parents dcab86115261
children 7ad0f4ace359
comparison
equal deleted inserted replaced
7319:dcab86115261 7320:696df3ac27ac
22 void *userdata); 22 void *userdata);
23 static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store); 23 static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
24 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, 24 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
25 int ret); 25 int ret);
26 static void ngx_ssl_passwords_cleanup(void *data); 26 static void ngx_ssl_passwords_cleanup(void *data);
27 static int ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn,
28 ngx_ssl_session_t *sess);
27 static void ngx_ssl_handshake_handler(ngx_event_t *ev); 29 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
28 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n); 30 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
29 static void ngx_ssl_write_handler(ngx_event_t *wev); 31 static void ngx_ssl_write_handler(ngx_event_t *wev);
30 static void ngx_ssl_read_handler(ngx_event_t *rev); 32 static void ngx_ssl_read_handler(ngx_event_t *rev);
31 static void ngx_ssl_shutdown_handler(ngx_event_t *ev); 33 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
1160 return NGX_OK; 1162 return NGX_OK;
1161 } 1163 }
1162 1164
1163 1165
1164 ngx_int_t 1166 ngx_int_t
1167 ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
1168 {
1169 if (!enable) {
1170 return NGX_OK;
1171 }
1172
1173 SSL_CTX_set_session_cache_mode(ssl->ctx,
1174 SSL_SESS_CACHE_CLIENT
1175 |SSL_SESS_CACHE_NO_INTERNAL);
1176
1177 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_client_session);
1178
1179 return NGX_OK;
1180 }
1181
1182
1183 static int
1184 ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
1185 {
1186 ngx_connection_t *c;
1187
1188 c = ngx_ssl_get_connection(ssl_conn);
1189
1190 if (c->ssl->save_session) {
1191 c->ssl->session = sess;
1192
1193 c->ssl->save_session(c);
1194
1195 c->ssl->session = NULL;
1196 }
1197
1198 return 0;
1199 }
1200
1201
1202 ngx_int_t
1165 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags) 1203 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
1166 { 1204 {
1167 ngx_ssl_connection_t *sc; 1205 ngx_ssl_connection_t *sc;
1168 1206
1169 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t)); 1207 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
1205 } 1243 }
1206 1244
1207 c->ssl = sc; 1245 c->ssl = sc;
1208 1246
1209 return NGX_OK; 1247 return NGX_OK;
1248 }
1249
1250
1251 ngx_ssl_session_t *
1252 ngx_ssl_get_session(ngx_connection_t *c)
1253 {
1254 #ifdef TLS1_3_VERSION
1255 if (c->ssl->session) {
1256 SSL_SESSION_up_ref(c->ssl->session);
1257 return c->ssl->session;
1258 }
1259 #endif
1260
1261 return SSL_get1_session(c->ssl->connection);
1262 }
1263
1264
1265 ngx_ssl_session_t *
1266 ngx_ssl_get0_session(ngx_connection_t *c)
1267 {
1268 if (c->ssl->session) {
1269 return c->ssl->session;
1270 }
1271
1272 return SSL_get0_session(c->ssl->connection);
1210 } 1273 }
1211 1274
1212 1275
1213 ngx_int_t 1276 ngx_int_t
1214 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session) 1277 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session)