Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 3583:d513f9d30208 stable-0.7

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
merge r3456, r3458, r3465: SSL fixes: *) decrease SSL handshake error level to info *) Set SSL session context for "ssl_session_cache none". This fixes a bug when client certficate is used and nginx closes connection with the message: "SSL_GET_PREV_SESSION:session id context uninitialized". *) add OpenSSL_add_all_algorithms(), this fixes the error "ASN1_item_verify:unknown message digest algorithm" occurred if client certificate is signed using sha256WithRSAEncryption
author Igor Sysoev <igor@sysoev.ru>
date Mon, 07 Jun 2010 10:09:14 +0000
parents 90d746a95258
children 8a5106c2a377
comparison
equal deleted inserted replaced
3582:24e7bf1abbe5 3583:d513f9d30208
104 SSL_library_init(); 104 SSL_library_init();
105 SSL_load_error_strings(); 105 SSL_load_error_strings();
106 106
107 ENGINE_load_builtin_engines(); 107 ENGINE_load_builtin_engines();
108 108
109 OpenSSL_add_all_algorithms();
110
109 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL); 111 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
110 112
111 if (ngx_ssl_connection_index == -1) { 113 if (ngx_ssl_connection_index == -1) {
112 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed"); 114 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
113 return NGX_ERROR; 115 return NGX_ERROR;
1306 1308
1307 n = ERR_GET_REASON(ERR_peek_error()); 1309 n = ERR_GET_REASON(ERR_peek_error());
1308 1310
1309 /* handshake failures */ 1311 /* handshake failures */
1310 if (n == SSL_R_DIGEST_CHECK_FAILED /* 149 */ 1312 if (n == SSL_R_DIGEST_CHECK_FAILED /* 149 */
1313 || n == SSL_R_LENGTH_MISMATCH /* 159 */
1311 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */ 1314 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */
1315 || n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */
1312 || n == SSL_R_NO_SHARED_CIPHER /* 193 */ 1316 || n == SSL_R_NO_SHARED_CIPHER /* 193 */
1317 || n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */
1313 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */ 1318 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */
1314 || n == SSL_R_UNEXPECTED_RECORD /* 245 */ 1319 || n == SSL_R_UNEXPECTED_RECORD /* 245 */
1320 || n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */
1315 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */ 1321 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */
1316 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */ 1322 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */
1317 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */ 1323 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */
1318 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */ 1324 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
1319 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */ 1325 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */
1422 if (builtin_session_cache == NGX_SSL_NO_SCACHE) { 1428 if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
1423 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF); 1429 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
1424 return NGX_OK; 1430 return NGX_OK;
1425 } 1431 }
1426 1432
1433 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
1434
1427 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) { 1435 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
1428 1436
1429 /* 1437 /*
1430 * If the server explicitly says that it does not support 1438 * If the server explicitly says that it does not support
1431 * session reuse (see SSL_SESS_CACHE_OFF above), then 1439 * session reuse (see SSL_SESS_CACHE_OFF above), then
1452 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) { 1460 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
1453 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL; 1461 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL;
1454 } 1462 }
1455 1463
1456 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode); 1464 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
1457
1458 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
1459 1465
1460 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) { 1466 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
1461 1467
1462 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) { 1468 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
1463 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache); 1469 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
2309 2315
2310 2316
2311 static void 2317 static void
2312 ngx_openssl_exit(ngx_cycle_t *cycle) 2318 ngx_openssl_exit(ngx_cycle_t *cycle)
2313 { 2319 {
2320 EVP_cleanup();
2314 ENGINE_cleanup(); 2321 ENGINE_cleanup();
2315 } 2322 }