Mercurial > hg > nginx
comparison src/event/ngx_event_openssl.c @ 3583:d513f9d30208 stable-0.7
merge r3456, r3458, r3465:
SSL fixes:
*) decrease SSL handshake error level to info
*) Set SSL session context for "ssl_session_cache none".
This fixes a bug when client certficate is used and nginx closes connection
with the message: "SSL_GET_PREV_SESSION:session id context uninitialized".
*) add OpenSSL_add_all_algorithms(), this fixes the error
"ASN1_item_verify:unknown message digest algorithm" occurred if
client certificate is signed using sha256WithRSAEncryption
author | Igor Sysoev <igor@sysoev.ru> |
---|---|
date | Mon, 07 Jun 2010 10:09:14 +0000 |
parents | 90d746a95258 |
children | 8a5106c2a377 |
comparison
equal
deleted
inserted
replaced
3582:24e7bf1abbe5 | 3583:d513f9d30208 |
---|---|
104 SSL_library_init(); | 104 SSL_library_init(); |
105 SSL_load_error_strings(); | 105 SSL_load_error_strings(); |
106 | 106 |
107 ENGINE_load_builtin_engines(); | 107 ENGINE_load_builtin_engines(); |
108 | 108 |
109 OpenSSL_add_all_algorithms(); | |
110 | |
109 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL); | 111 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL); |
110 | 112 |
111 if (ngx_ssl_connection_index == -1) { | 113 if (ngx_ssl_connection_index == -1) { |
112 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed"); | 114 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed"); |
113 return NGX_ERROR; | 115 return NGX_ERROR; |
1306 | 1308 |
1307 n = ERR_GET_REASON(ERR_peek_error()); | 1309 n = ERR_GET_REASON(ERR_peek_error()); |
1308 | 1310 |
1309 /* handshake failures */ | 1311 /* handshake failures */ |
1310 if (n == SSL_R_DIGEST_CHECK_FAILED /* 149 */ | 1312 if (n == SSL_R_DIGEST_CHECK_FAILED /* 149 */ |
1313 || n == SSL_R_LENGTH_MISMATCH /* 159 */ | |
1311 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */ | 1314 || n == SSL_R_NO_CIPHERS_PASSED /* 182 */ |
1315 || n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */ | |
1312 || n == SSL_R_NO_SHARED_CIPHER /* 193 */ | 1316 || n == SSL_R_NO_SHARED_CIPHER /* 193 */ |
1317 || n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */ | |
1313 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */ | 1318 || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */ |
1314 || n == SSL_R_UNEXPECTED_RECORD /* 245 */ | 1319 || n == SSL_R_UNEXPECTED_RECORD /* 245 */ |
1320 || n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */ | |
1315 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */ | 1321 || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */ |
1316 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */ | 1322 || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */ |
1317 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */ | 1323 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */ |
1318 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */ | 1324 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */ |
1319 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */ | 1325 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */ |
1422 if (builtin_session_cache == NGX_SSL_NO_SCACHE) { | 1428 if (builtin_session_cache == NGX_SSL_NO_SCACHE) { |
1423 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF); | 1429 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF); |
1424 return NGX_OK; | 1430 return NGX_OK; |
1425 } | 1431 } |
1426 | 1432 |
1433 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len); | |
1434 | |
1427 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) { | 1435 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) { |
1428 | 1436 |
1429 /* | 1437 /* |
1430 * If the server explicitly says that it does not support | 1438 * If the server explicitly says that it does not support |
1431 * session reuse (see SSL_SESS_CACHE_OFF above), then | 1439 * session reuse (see SSL_SESS_CACHE_OFF above), then |
1452 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) { | 1460 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) { |
1453 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL; | 1461 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL; |
1454 } | 1462 } |
1455 | 1463 |
1456 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode); | 1464 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode); |
1457 | |
1458 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len); | |
1459 | 1465 |
1460 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) { | 1466 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) { |
1461 | 1467 |
1462 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) { | 1468 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) { |
1463 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache); | 1469 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache); |
2309 | 2315 |
2310 | 2316 |
2311 static void | 2317 static void |
2312 ngx_openssl_exit(ngx_cycle_t *cycle) | 2318 ngx_openssl_exit(ngx_cycle_t *cycle) |
2313 { | 2319 { |
2320 EVP_cleanup(); | |
2314 ENGINE_cleanup(); | 2321 ENGINE_cleanup(); |
2315 } | 2322 } |