Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 8411:7995cd199b52 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merged with the default branch.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 26 May 2020 20:26:44 +0300
parents 7f0981be07c4 8409f9df6219
children 001ec7fce567
comparison
equal deleted inserted replaced
8410:c7d1b500bd0a 8411:7995cd199b52
128 128
129 int ngx_ssl_connection_index; 129 int ngx_ssl_connection_index;
130 int ngx_ssl_server_conf_index; 130 int ngx_ssl_server_conf_index;
131 int ngx_ssl_session_cache_index; 131 int ngx_ssl_session_cache_index;
132 int ngx_ssl_session_ticket_keys_index; 132 int ngx_ssl_session_ticket_keys_index;
133 int ngx_ssl_ocsp_index;
133 int ngx_ssl_certificate_index; 134 int ngx_ssl_certificate_index;
134 int ngx_ssl_next_certificate_index; 135 int ngx_ssl_next_certificate_index;
135 int ngx_ssl_certificate_name_index; 136 int ngx_ssl_certificate_name_index;
136 int ngx_ssl_stapling_index; 137 int ngx_ssl_stapling_index;
137 138
206 } 207 }
207 208
208 ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, 209 ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL,
209 NULL, NULL); 210 NULL, NULL);
210 if (ngx_ssl_session_ticket_keys_index == -1) { 211 if (ngx_ssl_session_ticket_keys_index == -1) {
212 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
213 "SSL_CTX_get_ex_new_index() failed");
214 return NGX_ERROR;
215 }
216
217 ngx_ssl_ocsp_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
218 if (ngx_ssl_ocsp_index == -1) {
211 ngx_ssl_error(NGX_LOG_ALERT, log, 0, 219 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
212 "SSL_CTX_get_ex_new_index() failed"); 220 "SSL_CTX_get_ex_new_index() failed");
213 return NGX_ERROR; 221 return NGX_ERROR;
214 } 222 }
215 223
1592 ngx_int_t 1600 ngx_int_t
1593 ngx_ssl_handshake(ngx_connection_t *c) 1601 ngx_ssl_handshake(ngx_connection_t *c)
1594 { 1602 {
1595 int n, sslerr; 1603 int n, sslerr;
1596 ngx_err_t err; 1604 ngx_err_t err;
1605 ngx_int_t rc;
1597 1606
1598 #ifdef SSL_READ_EARLY_DATA_SUCCESS 1607 #ifdef SSL_READ_EARLY_DATA_SUCCESS
1599 if (c->ssl->try_early_data) { 1608 if (c->ssl->try_early_data) {
1600 return ngx_ssl_try_early_data(c); 1609 return ngx_ssl_try_early_data(c);
1601 } 1610 }
1602 #endif 1611 #endif
1603 1612
1613 if (c->ssl->in_ocsp) {
1614 return ngx_ssl_ocsp_validate(c);
1615 }
1616
1604 ngx_ssl_clear_error(c->log); 1617 ngx_ssl_clear_error(c->log);
1605 1618
1606 n = SSL_do_handshake(c->ssl->connection); 1619 n = SSL_do_handshake(c->ssl->connection);
1607 1620
1608 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n); 1621 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
1618 } 1631 }
1619 1632
1620 #if (NGX_DEBUG) 1633 #if (NGX_DEBUG)
1621 ngx_ssl_handshake_log(c); 1634 ngx_ssl_handshake_log(c);
1622 #endif 1635 #endif
1623
1624 c->ssl->handshaked = 1;
1625 1636
1626 c->recv = ngx_ssl_recv; 1637 c->recv = ngx_ssl_recv;
1627 c->send = ngx_ssl_write; 1638 c->send = ngx_ssl_write;
1628 c->recv_chain = ngx_ssl_recv_chain; 1639 c->recv_chain = ngx_ssl_recv_chain;
1629 c->send_chain = ngx_ssl_send_chain; 1640 c->send_chain = ngx_ssl_send_chain;
1639 1650
1640 #endif 1651 #endif
1641 #endif 1652 #endif
1642 #endif 1653 #endif
1643 1654
1655 rc = ngx_ssl_ocsp_validate(c);
1656
1657 if (rc == NGX_ERROR) {
1658 return NGX_ERROR;
1659 }
1660
1661 if (rc == NGX_AGAIN) {
1662 c->read->handler = ngx_ssl_handshake_handler;
1663 c->write->handler = ngx_ssl_handshake_handler;
1664 return NGX_AGAIN;
1665 }
1666
1667 c->ssl->handshaked = 1;
1668
1644 return NGX_OK; 1669 return NGX_OK;
1645 } 1670 }
1646 1671
1647 sslerr = SSL_get_error(c->ssl->connection, n); 1672 sslerr = SSL_get_error(c->ssl->connection, n);
1648 1673
1708 { 1733 {
1709 int n, sslerr; 1734 int n, sslerr;
1710 u_char buf; 1735 u_char buf;
1711 size_t readbytes; 1736 size_t readbytes;
1712 ngx_err_t err; 1737 ngx_err_t err;
1738 ngx_int_t rc;
1713 1739
1714 ngx_ssl_clear_error(c->log); 1740 ngx_ssl_clear_error(c->log);
1715 1741
1716 readbytes = 0; 1742 readbytes = 0;
1717 1743
1742 c->ssl->try_early_data = 0; 1768 c->ssl->try_early_data = 0;
1743 1769
1744 c->ssl->early_buf = buf; 1770 c->ssl->early_buf = buf;
1745 c->ssl->early_preread = 1; 1771 c->ssl->early_preread = 1;
1746 1772
1747 c->ssl->handshaked = 1;
1748 c->ssl->in_early = 1; 1773 c->ssl->in_early = 1;
1749 1774
1750 c->recv = ngx_ssl_recv; 1775 c->recv = ngx_ssl_recv;
1751 c->send = ngx_ssl_write; 1776 c->send = ngx_ssl_write;
1752 c->recv_chain = ngx_ssl_recv_chain; 1777 c->recv_chain = ngx_ssl_recv_chain;
1753 c->send_chain = ngx_ssl_send_chain; 1778 c->send_chain = ngx_ssl_send_chain;
1779
1780 rc = ngx_ssl_ocsp_validate(c);
1781
1782 if (rc == NGX_ERROR) {
1783 return NGX_ERROR;
1784 }
1785
1786 if (rc == NGX_AGAIN) {
1787 c->read->handler = ngx_ssl_handshake_handler;
1788 c->write->handler = ngx_ssl_handshake_handler;
1789 return NGX_AGAIN;
1790 }
1791
1792 c->ssl->handshaked = 1;
1754 1793
1755 return NGX_OK; 1794 return NGX_OK;
1756 } 1795 }
1757 1796
1758 /* SSL_READ_EARLY_DATA_ERROR */ 1797 /* SSL_READ_EARLY_DATA_ERROR */
2737 2776
2738 if (c->qs) { 2777 if (c->qs) {
2739 /* QUIC streams inherit SSL object */ 2778 /* QUIC streams inherit SSL object */
2740 return NGX_OK; 2779 return NGX_OK;
2741 } 2780 }
2781
2782 ngx_ssl_ocsp_cleanup(c);
2742 2783
2743 if (SSL_in_init(c->ssl->connection)) { 2784 if (SSL_in_init(c->ssl->connection)) {
2744 /* 2785 /*
2745 * OpenSSL 1.0.2f complains if SSL_shutdown() is called during 2786 * OpenSSL 1.0.2f complains if SSL_shutdown() is called during
2746 * an SSL handshake, while previous versions always return 0. 2787 * an SSL handshake, while previous versions always return 0.
4897 X509_free(cert); 4938 X509_free(cert);
4898 4939
4899 rc = SSL_get_verify_result(c->ssl->connection); 4940 rc = SSL_get_verify_result(c->ssl->connection);
4900 4941
4901 if (rc == X509_V_OK) { 4942 if (rc == X509_V_OK) {
4902 ngx_str_set(s, "SUCCESS"); 4943 if (ngx_ssl_ocsp_get_status(c, &str) == NGX_OK) {
4903 return NGX_OK; 4944 ngx_str_set(s, "SUCCESS");
4904 } 4945 return NGX_OK;
4905 4946 }
4906 str = X509_verify_cert_error_string(rc); 4947
4948 } else {
4949 str = X509_verify_cert_error_string(rc);
4950 }
4907 4951
4908 s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str)); 4952 s->data = ngx_pnalloc(pool, sizeof("FAILED:") - 1 + ngx_strlen(str));
4909 if (s->data == NULL) { 4953 if (s->data == NULL) {
4910 return NGX_ERROR; 4954 return NGX_ERROR;
4911 } 4955 }