Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 9136:85abf534cead

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: provided "nginx" appname when loading OpenSSL configs. Following OpenSSL 0.9.8f, OpenSSL tries to load application-specific configuration section first, and then falls back to the "openssl_conf" default section if application-specific section is not found, by using CONF_modules_load_file(CONF_MFLAGS_DEFAULT_SECTION). Therefore this change is not expected to introduce any compatibility issues with existing configurations. It does, however, make it easier to configure specific OpenSSL settings for nginx in system-wide OpenSSL configuration (ticket #2449). Instead of checking OPENSSL_VERSION_NUMBER when using the OPENSSL_init_ssl() interface, the code now tests for OPENSSL_INIT_LOAD_CONFIG to be defined and true, and also explicitly excludes LibreSSL. This ensures that this interface is not used with BoringSSL and LibreSSL, which do not provide additional library initialization settings, notably the OPENSSL_INIT_set_config_appname() call.
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 21 Jun 2023 01:29:55 +0300
parents 0af598651e33
children 0ba26c99b3a1
comparison
equal deleted inserted replaced
9135:904c99bede17 9136:85abf534cead
138 138
139 139
140 ngx_int_t 140 ngx_int_t
141 ngx_ssl_init(ngx_log_t *log) 141 ngx_ssl_init(ngx_log_t *log)
142 { 142 {
143 #if OPENSSL_VERSION_NUMBER >= 0x10100003L 143 #if (OPENSSL_INIT_LOAD_CONFIG && !defined LIBRESSL_VERSION_NUMBER)
144 144
145 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) == 0) { 145 OPENSSL_INIT_SETTINGS *init;
146
147 init = OPENSSL_INIT_new();
148 if (init == NULL) {
149 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_INIT_new() failed");
150 return NGX_ERROR;
151 }
152
153 #ifndef OPENSSL_NO_STDIO
154 if (OPENSSL_INIT_set_config_appname(init, "nginx") == 0) {
155 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
156 "OPENSSL_INIT_set_config_appname() failed");
157 return NGX_ERROR;
158 }
159 #endif
160
161 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, init) == 0) {
146 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed"); 162 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed");
147 return NGX_ERROR; 163 return NGX_ERROR;
148 } 164 }
165
166 OPENSSL_INIT_free(init);
149 167
150 /* 168 /*
151 * OPENSSL_init_ssl() may leave errors in the error queue 169 * OPENSSL_init_ssl() may leave errors in the error queue
152 * while returning success 170 * while returning success
153 */ 171 */
154 172
155 ERR_clear_error(); 173 ERR_clear_error();
156 174
157 #else 175 #else
158 176
159 OPENSSL_config(NULL); 177 OPENSSL_config("nginx");
160 178
161 SSL_library_init(); 179 SSL_library_init();
162 SSL_load_error_strings(); 180 SSL_load_error_strings();
163 181
164 OpenSSL_add_all_algorithms(); 182 OpenSSL_add_all_algorithms();