Mercurial > hg > nginx

comparison src/http/ngx_http_upstream.c @ 5660:7022564a9e0e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Upstream: proxy_ssl_name and proxy_ssl_server_name directives. These directives allow to switch on Server Name Indication (SNI) while connecting to upstream servers. By default, proxy_ssl_server_name is currently off (that is, no SNI) and proxy_ssl_name is set to a host used in the proxy_pass directive.
author Maxim Dounin <mdounin@mdounin.ru>
date Fri, 18 Apr 2014 20:13:28 +0400
parents 345e4fd4bb64
children 060c2e692b96
comparison
equal deleted inserted replaced
5659:3fb6615bb87f 5660:7022564a9e0e
154 154
155 #if (NGX_HTTP_SSL) 155 #if (NGX_HTTP_SSL)
156 static void ngx_http_upstream_ssl_init_connection(ngx_http_request_t *, 156 static void ngx_http_upstream_ssl_init_connection(ngx_http_request_t *,
157 ngx_http_upstream_t *u, ngx_connection_t *c); 157 ngx_http_upstream_t *u, ngx_connection_t *c);
158 static void ngx_http_upstream_ssl_handshake(ngx_connection_t *c); 158 static void ngx_http_upstream_ssl_handshake(ngx_connection_t *c);
159 static ngx_int_t ngx_http_upstream_ssl_name(ngx_http_request_t *r,
160 ngx_http_upstream_t *u, ngx_connection_t *c);
159 #endif 161 #endif
160 162
161 163
162 ngx_http_upstream_header_t ngx_http_upstream_headers_in[] = { 164 ngx_http_upstream_header_t ngx_http_upstream_headers_in[] = {
163 165
579 u->cleanup = &cln->handler; 581 u->cleanup = &cln->handler;
580 582
581 if (u->resolved == NULL) { 583 if (u->resolved == NULL) {
582 584
583 uscf = u->conf->upstream; 585 uscf = u->conf->upstream;
586 #if (NGX_HTTP_SSL)
587 u->ssl_name = uscf->host;
588 #endif
584 589
585 } else { 590 } else {
591
592 #if (NGX_HTTP_SSL)
593 u->ssl_name = u->resolved->host;
594 #endif
586 595
587 if (u->resolved->sockaddr) { 596 if (u->resolved->sockaddr) {
588 597
589 if (ngx_http_upstream_create_round_robin_peer(r, u->resolved) 598 if (ngx_http_upstream_create_round_robin_peer(r, u->resolved)
590 != NGX_OK) 599 != NGX_OK)
1353 } 1362 }
1354 1363
1355 c->sendfile = 0; 1364 c->sendfile = 0;
1356 u->output.sendfile = 0; 1365 u->output.sendfile = 0;
1357 1366
1367 if (u->conf->ssl_server_name) {
1368 if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) {
1369 ngx_http_upstream_finalize_request(r, u,
1370 NGX_HTTP_INTERNAL_SERVER_ERROR);
1371 return;
1372 }
1373 }
1374
1358 if (u->conf->ssl_session_reuse) { 1375 if (u->conf->ssl_session_reuse) {
1359 if (u->peer.set_session(&u->peer, u->peer.data) != NGX_OK) { 1376 if (u->peer.set_session(&u->peer, u->peer.data) != NGX_OK) {
1360 ngx_http_upstream_finalize_request(r, u, 1377 ngx_http_upstream_finalize_request(r, u,
1361 NGX_HTTP_INTERNAL_SERVER_ERROR); 1378 NGX_HTTP_INTERNAL_SERVER_ERROR);
1362 return; 1379 return;
1405 c = r->connection; 1422 c = r->connection;
1406 1423
1407 ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR); 1424 ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);
1408 1425
1409 ngx_http_run_posted_requests(c); 1426 ngx_http_run_posted_requests(c);
1427 }
1428
1429
1430 static ngx_int_t
1431 ngx_http_upstream_ssl_name(ngx_http_request_t *r, ngx_http_upstream_t *u,
1432 ngx_connection_t *c)
1433 {
1434 u_char *p, *last;
1435 ngx_str_t name;
1436
1437 if (u->conf->ssl_name) {
1438 if (ngx_http_complex_value(r, u->conf->ssl_name, &name) != NGX_OK) {
1439 return NGX_ERROR;
1440 }
1441
1442 } else {
1443 name = u->ssl_name;
1444 }
1445
1446 if (name.len == 0) {
1447 goto done;
1448 }
1449
1450 /*
1451 * ssl name here may contain port, notably if derived from $proxy_host
1452 * or $http_host; we have to strip it
1453 */
1454
1455 p = name.data;
1456 last = name.data + name.len;
1457
1458 if (*p == '[') {
1459 p = ngx_strlchr(p, last, ']');
1460
1461 if (p == NULL) {
1462 p = name.data;
1463 }
1464 }
1465
1466 p = ngx_strlchr(p, last, ':');
1467
1468 if (p != NULL) {
1469 name.len = p - name.data;
1470 }
1471
1472 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
1473
1474 /* as per RFC 6066, literal IPv4 and IPv6 addresses are not permitted */
1475
1476 if (name.len == 0 || *name.data == '[') {
1477 goto done;
1478 }
1479
1480 if (ngx_inet_addr(name.data, name.len) != INADDR_NONE) {
1481 goto done;
1482 }
1483
1484 /*
1485 * SSL_set_tlsext_host_name() needs a null-terminated string,
1486 * hence we explicitly null-terminate name here
1487 */
1488
1489 p = ngx_palloc(r->pool, name.len + 1);
1490 if (p == NULL) {
1491 return NGX_ERROR;
1492 }
1493
1494 (void) ngx_cpystrn(p, name.data, name.len + 1);
1495
1496 name.data = p;
1497
1498 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
1499 "upstream SSL server name: \"%s\"", name.data);
1500
1501 if (SSL_set_tlsext_host_name(c->ssl->connection, name.data) == 0) {
1502 ngx_ssl_error(NGX_LOG_ERR, r->connection->log, 0,
1503 "SSL_set_tlsext_host_name(\"%s\") failed", name.data);
1504 return NGX_ERROR;
1505 }
1506
1507 #endif
1508
1509 done:
1510
1511 u->ssl_name = name;
1512
1513 return NGX_OK;
1410 } 1514 }
1411 1515
1412 #endif 1516 #endif
1413 1517
1414 1518