Mercurial > hg > nginx

comparison src/stream/ngx_stream_proxy_module.c @ 7731:fd0b2226919b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Stream: proxy_ssl_conf_command directive. Similarly to ssl_conf_command, proxy_ssl_conf_command can be used to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later, when connecting to upstream servers with SSL. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 22 Oct 2020 18:00:27 +0300
parents d127837c714f
children 7ce28b4cc57e
comparison
equal deleted inserted replaced
7730:1a719ee45526 7731:fd0b2226919b
47 ngx_str_t ssl_trusted_certificate; 47 ngx_str_t ssl_trusted_certificate;
48 ngx_str_t ssl_crl; 48 ngx_str_t ssl_crl;
49 ngx_str_t ssl_certificate; 49 ngx_str_t ssl_certificate;
50 ngx_str_t ssl_certificate_key; 50 ngx_str_t ssl_certificate_key;
51 ngx_array_t *ssl_passwords; 51 ngx_array_t *ssl_passwords;
52 ngx_array_t *ssl_conf_commands;
52 53
53 ngx_ssl_t *ssl; 54 ngx_ssl_t *ssl;
54 #endif 55 #endif
55 56
56 ngx_stream_upstream_srv_conf_t *upstream; 57 ngx_stream_upstream_srv_conf_t *upstream;
92 #if (NGX_STREAM_SSL) 93 #if (NGX_STREAM_SSL)
93 94
94 static ngx_int_t ngx_stream_proxy_send_proxy_protocol(ngx_stream_session_t *s); 95 static ngx_int_t ngx_stream_proxy_send_proxy_protocol(ngx_stream_session_t *s);
95 static char *ngx_stream_proxy_ssl_password_file(ngx_conf_t *cf, 96 static char *ngx_stream_proxy_ssl_password_file(ngx_conf_t *cf,
96 ngx_command_t *cmd, void *conf); 97 ngx_command_t *cmd, void *conf);
98 static char *ngx_stream_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post,
99 void *data);
97 static void ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s); 100 static void ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s);
98 static void ngx_stream_proxy_ssl_handshake(ngx_connection_t *pc); 101 static void ngx_stream_proxy_ssl_handshake(ngx_connection_t *pc);
99 static void ngx_stream_proxy_ssl_save_session(ngx_connection_t *c); 102 static void ngx_stream_proxy_ssl_save_session(ngx_connection_t *c);
100 static ngx_int_t ngx_stream_proxy_ssl_name(ngx_stream_session_t *s); 103 static ngx_int_t ngx_stream_proxy_ssl_name(ngx_stream_session_t *s);
101 static ngx_int_t ngx_stream_proxy_set_ssl(ngx_conf_t *cf, 104 static ngx_int_t ngx_stream_proxy_set_ssl(ngx_conf_t *cf,
110 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 }, 113 { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
111 { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 }, 114 { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 },
112 { ngx_null_string, 0 } 115 { ngx_null_string, 0 }
113 }; 116 };
114 117
118 static ngx_conf_post_t ngx_stream_proxy_ssl_conf_command_post =
119 { ngx_stream_proxy_ssl_conf_command_check };
120
115 #endif 121 #endif
116 122
117 123
118 static ngx_conf_deprecated_t ngx_conf_deprecated_proxy_downstream_buffer = { 124 static ngx_conf_deprecated_t ngx_conf_deprecated_proxy_downstream_buffer = {
119 ngx_conf_deprecated, "proxy_downstream_buffer", "proxy_buffer_size" 125 ngx_conf_deprecated, "proxy_downstream_buffer", "proxy_buffer_size"
328 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1, 334 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
329 ngx_stream_proxy_ssl_password_file, 335 ngx_stream_proxy_ssl_password_file,
330 NGX_STREAM_SRV_CONF_OFFSET, 336 NGX_STREAM_SRV_CONF_OFFSET,
331 0, 337 0,
332 NULL }, 338 NULL },
339
340 { ngx_string("proxy_ssl_conf_command"),
341 NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE2,
342 ngx_conf_set_keyval_slot,
343 NGX_STREAM_SRV_CONF_OFFSET,
344 offsetof(ngx_stream_proxy_srv_conf_t, ssl_conf_commands),
345 &ngx_stream_proxy_ssl_conf_command_post },
333 346
334 #endif 347 #endif
335 348
336 ngx_null_command 349 ngx_null_command
337 }; 350 };
1001 pscf->ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]); 1014 pscf->ssl_passwords = ngx_ssl_read_password_file(cf, &value[1]);
1002 1015
1003 if (pscf->ssl_passwords == NULL) { 1016 if (pscf->ssl_passwords == NULL) {
1004 return NGX_CONF_ERROR; 1017 return NGX_CONF_ERROR;
1005 } 1018 }
1019
1020 return NGX_CONF_OK;
1021 }
1022
1023
1024 static char *
1025 ngx_stream_proxy_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
1026 {
1027 #ifndef SSL_CONF_FLAG_FILE
1028 return "is not supported on this platform";
1029 #endif
1006 1030
1007 return NGX_CONF_OK; 1031 return NGX_CONF_OK;
1008 } 1032 }
1009 1033
1010 1034
1983 conf->ssl_session_reuse = NGX_CONF_UNSET; 2007 conf->ssl_session_reuse = NGX_CONF_UNSET;
1984 conf->ssl_server_name = NGX_CONF_UNSET; 2008 conf->ssl_server_name = NGX_CONF_UNSET;
1985 conf->ssl_verify = NGX_CONF_UNSET; 2009 conf->ssl_verify = NGX_CONF_UNSET;
1986 conf->ssl_verify_depth = NGX_CONF_UNSET_UINT; 2010 conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
1987 conf->ssl_passwords = NGX_CONF_UNSET_PTR; 2011 conf->ssl_passwords = NGX_CONF_UNSET_PTR;
2012 conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
1988 #endif 2013 #endif
1989 2014
1990 return conf; 2015 return conf;
1991 } 2016 }
1992 2017
2069 2094
2070 ngx_conf_merge_str_value(conf->ssl_certificate_key, 2095 ngx_conf_merge_str_value(conf->ssl_certificate_key,
2071 prev->ssl_certificate_key, ""); 2096 prev->ssl_certificate_key, "");
2072 2097
2073 ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL); 2098 ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
2099
2100 ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
2101 prev->ssl_conf_commands, NULL);
2074 2102
2075 if (conf->ssl_enable && ngx_stream_proxy_set_ssl(cf, conf) != NGX_OK) { 2103 if (conf->ssl_enable && ngx_stream_proxy_set_ssl(cf, conf) != NGX_OK) {
2076 return NGX_CONF_ERROR; 2104 return NGX_CONF_ERROR;
2077 } 2105 }
2078 2106
2149 return NGX_ERROR; 2177 return NGX_ERROR;
2150 } 2178 }
2151 } 2179 }
2152 2180
2153 if (ngx_ssl_client_session_cache(cf, pscf->ssl, pscf->ssl_session_reuse) 2181 if (ngx_ssl_client_session_cache(cf, pscf->ssl, pscf->ssl_session_reuse)
2182 != NGX_OK)
2183 {
2184 return NGX_ERROR;
2185 }
2186
2187 if (ngx_ssl_conf_commands(cf, pscf->ssl, pscf->ssl_conf_commands)
2154 != NGX_OK) 2188 != NGX_OK)
2155 { 2189 {
2156 return NGX_ERROR; 2190 return NGX_ERROR;
2157 } 2191 }
2158 2192