nginx: src/http/ngx_http_request.c comparison

comparison src/http/ngx_http_request.c @ 5091:d3e256c67d6d

SSL: do not treat SSL handshake as request. The request object will not be created until SSL handshake is complete. This simplifies adding another connection handler that does not need request object right after handshake (e.g., SPDY). There are also a few more intentional effects: - the "client_header_buffer_size" directive will be taken from the server configuration that was negotiated by SNI; - SSL handshake errors and timeouts are not logged into access log as bad requests; - ngx_ssl_create_connection() is not called until the first byte of ClientHello message was received. This also decreases memory consumption if plain HTTP request is sent to SSL socket.

author	Valentin Bartenev <vbart@nginx.com>
date	Wed, 27 Feb 2013 17:21:21 +0000
parents	9db95b275755
children	c4d3310574e0

comparison

equal deleted inserted replaced

-:9db95b275755
+:d3e256c67d6d
 rev = c->read;
 rev->handler = ngx_http_init_request;
 c->write->handler = ngx_http_empty_handler;
+#if (NGX_HTTP_SSL)
+{
+ngx_http_ssl_srv_conf_t  *sscf;
+sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
+if (sscf->enable || hc->addr_conf->ssl) {
+c->log->action = "SSL handshaking";
+if (hc->addr_conf->ssl && sscf->ssl.ctx == NULL) {
+ngx_log_error(NGX_LOG_ERR, c->log, 0,
+"no \"ssl_certificate\" is defined "
+"in server listening on SSL port");
+ngx_http_close_connection(c);
+return;
+}
+hc->ssl = 1;
+rev->handler = ngx_http_ssl_handshake;
+}
+}
+#endif
 if (rev->ready) {
 /* the deferred accept(), rtsig, aio, iocp */
 if (ngx_use_accept_mutex) {
 ngx_post_event(rev, &ngx_posted_events);
 return;
 }
-ngx_http_init_request(rev);
+rev->handler(rev);
 return;
 }
 ngx_add_timer(rev, c->listening->post_accept_timeout);
 r->main_conf = hc->conf_ctx->main_conf;
 r->srv_conf = hc->conf_ctx->srv_conf;
 r->loc_conf = hc->conf_ctx->loc_conf;
-rev->handler = ngx_http_process_request_line;
 r->read_event_handler = ngx_http_block_reading;
-#if (NGX_HTTP_SSL)
-{
-ngx_http_ssl_srv_conf_t  *sscf;
-sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
-if (sscf->enable || hc->addr_conf->ssl) {
-if (c->ssl == NULL) {
-c->log->action = "SSL handshaking";
-if (hc->addr_conf->ssl && sscf->ssl.ctx == NULL) {
-ngx_log_error(NGX_LOG_ERR, c->log, 0,
-"no \"ssl_certificate\" is defined "
-"in server listening on SSL port");
-ngx_http_close_connection(c);
-return;
-}
-if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER)
-!= NGX_OK)
-{
-ngx_http_close_connection(c);
-return;
-}
-rev->handler = ngx_http_ssl_handshake;
-}
-r->main_filter_need_in_memory = 1;
-}
-}
-#endif
 clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 ngx_http_set_connection_log(r->connection, clcf->error_log);
 }
 c->single_connection = 1;
 c->destroyed = 0;
+#if (NGX_HTTP_SSL)
+if (c->ssl) {
+r->main_filter_need_in_memory = 1;
+}
+#endif
 r->main = r;
 r->count = 1;
 tp = ngx_timeofday();
 r->start_sec = tp->sec;
 (void) ngx_atomic_fetch_add(ngx_stat_reading, 1);
 r->stat_reading = 1;
 (void) ngx_atomic_fetch_add(ngx_stat_requests, 1);
 #endif
-rev->handler(rev);
+rev->handler = ngx_http_process_request_line;
+ngx_http_process_request_line(rev);
 }
 #if (NGX_HTTP_SSL)
 static void
 ngx_http_ssl_handshake(ngx_event_t *rev)
 {
-u_char               buf[1];
+u_char                    buf[1];
-ssize_t              n;
+ssize_t                   n;
-ngx_int_t            rc;
+ngx_err_t                 err;
-ngx_connection_t    *c;
+ngx_int_t                 rc;
-ngx_http_request_t  *r;
+ngx_connection_t         *c;
+ngx_http_connection_t    *hc;
+ngx_http_ssl_srv_conf_t  *sscf;
 c = rev->data;
-r = c->data;
 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0,
 "http check ssl handshake");
 if (rev->timedout) {
 ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");
-c->timedout = 1;
+ngx_http_close_connection(c);
-ngx_http_close_request(r, NGX_HTTP_REQUEST_TIME_OUT);
 return;
 }
 n = recv(c->fd, (char *) buf, 1, MSG_PEEK);
-if (n == -1 && ngx_socket_errno == NGX_EAGAIN) {
+err = ngx_socket_errno;
-if (!rev->timer_set) {
+ngx_log_debug1(NGX_LOG_DEBUG_HTTP, rev->log, 0, "http recv(): %d", n);
-ngx_add_timer(rev, c->listening->post_accept_timeout);
-}
+if (n == -1) {
+if (err == NGX_EAGAIN) {
-if (ngx_handle_read_event(rev, 0) != NGX_OK) {
-ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+if (!rev->timer_set) {
-}
+ngx_add_timer(rev, c->listening->post_accept_timeout);
+}
+if (ngx_handle_read_event(rev, 0) != NGX_OK) {
+ngx_http_close_connection(c);
+}
+return;
+}
+ngx_connection_error(c, err, "recv() failed");
+ngx_http_close_connection(c);
 return;
 }
 if (n == 1) {
 if (buf[0] & 0x80 /* SSLv2 */ || buf[0] == 0x16 /* SSLv3/TLSv1 */) {
 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, rev->log, 0,
 "https ssl handshake: 0x%02Xd", buf[0]);
+hc = c->data;
+sscf = ngx_http_get_module_srv_conf(hc->conf_ctx,
+ngx_http_ssl_module);
+if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER)
+!= NGX_OK)
+{
+ngx_http_close_connection(c);
+return;
+}
 rc = ngx_ssl_handshake(c);
 if (rc == NGX_AGAIN) {
 if (!rev->timer_set) {
 }
 ngx_http_ssl_handshake_handler(c);
 return;
+}
-} else {
-ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0,
+ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0, "plain http");
-"plain http");
+c->log->action = "reading client request line";
-r->plain_http = 1;
-}
+rev->handler = ngx_http_init_request;
-}
+ngx_http_init_request(rev);
-c->log->action = "reading client request line";
+return;
+}
-rev->handler = ngx_http_process_request_line;
-ngx_http_process_request_line(rev);
+ngx_log_error(NGX_LOG_INFO, c->log, 0, "client closed connection");
+ngx_http_close_connection(c);
 }
 static void
 ngx_http_ssl_handshake_handler(ngx_connection_t *c)
 {
-ngx_http_request_t  *r;
 if (c->ssl->handshaked) {
 /*
 * The majority of browsers do not send the "close notify" alert.
 * Among them are MSIE, old Mozilla, Netscape 4, Konqueror,
 c->ssl->no_wait_shutdown = 1;
 c->log->action = "reading client request line";
-c->read->handler = ngx_http_process_request_line;
+c->read->handler = ngx_http_init_request;
 /* STUB: epoll edge */ c->write->handler = ngx_http_empty_handler;
-ngx_http_process_request_line(c->read);
+ngx_http_init_request(c->read);
 return;
 }
-r = c->data;
+if (c->read->timedout) {
+ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");
-ngx_http_close_request(r, NGX_HTTP_BAD_REQUEST);
+}
-return;
+ngx_http_close_connection(c);
 }
 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
 int
 ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
 {
 ngx_str_t                  host;
 const char                *servername;
 ngx_connection_t          *c;
-ngx_http_request_t        *r;
 ngx_http_connection_t     *hc;
 ngx_http_ssl_srv_conf_t   *sscf;
 ngx_http_core_loc_conf_t  *clcf;
 ngx_http_core_srv_conf_t  *cscf;
 if (host.len == 0) {
 return SSL_TLSEXT_ERR_NOACK;
 }
-r = c->data;
 host.data = (u_char *) servername;
-if (ngx_http_validate_host(&host, r->pool, 1) != NGX_OK) {
+if (ngx_http_validate_host(&host, c->pool, 1) != NGX_OK) {
 return SSL_TLSEXT_ERR_NOACK;
 }
-hc = r->http_connection;
+hc = c->data;
 if (ngx_http_find_virtual_server(c, hc->addr_conf->virtual_names, &host,
 NULL, &cscf)
 != NGX_OK)
 {
 return SSL_TLSEXT_ERR_NOACK;
 }
 hc->conf_ctx = cscf->ctx;
-r->srv_conf = cscf->ctx->srv_conf;
+clcf = ngx_http_get_module_loc_conf(hc->conf_ctx, ngx_http_core_module);
-r->loc_conf = cscf->ctx->loc_conf;
-clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 ngx_http_set_connection_log(c, clcf->error_log);
-sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
+sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
 if (sscf->ssl.ctx) {
 SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx);
 /*
 {
 ngx_connection_t  *c;
 c = r->connection;
-if (r->plain_http) {
-ngx_log_error(NGX_LOG_INFO, c->log, 0,
-"client sent plain HTTP request to HTTPS port");
-ngx_http_finalize_request(r, NGX_HTTP_TO_HTTPS);
-return;
-}
 #if (NGX_HTTP_SSL)
-if (c->ssl) {
+if (r->http_connection->ssl) {
 long                      rc;
 X509                     *cert;
 ngx_http_ssl_srv_conf_t  *sscf;
+if (c->ssl == NULL) {
+ngx_log_error(NGX_LOG_INFO, c->log, 0,
+"client sent plain HTTP request to HTTPS port");
+ngx_http_finalize_request(r, NGX_HTTP_TO_HTTPS);
+return;
+}
 sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
 if (sscf->verify) {
 rc = SSL_get_verify_result(c->ssl->connection);

Mercurial > hg > nginx

comparison src/http/ngx_http_request.c @ 5091:d3e256c67d6d