Mercurial > hg > nginx
changeset 2224:109849282793
*) listen ssl
*) no default ssl_cetificate and ssl_cetificate_key
| author | Igor Sysoev <igor@sysoev.ru> |
|---|---|
| date | Mon, 01 Sep 2008 14:19:01 +0000 |
| parents | 005fc65f7ce7 |
| children | 207827f7bf71 |
| files | src/http/modules/ngx_http_ssl_module.c src/http/modules/ngx_http_ssl_module.h src/http/ngx_http.c src/http/ngx_http_core_module.c src/http/ngx_http_core_module.h src/http/ngx_http_request.c src/mail/ngx_mail.c src/mail/ngx_mail.h src/mail/ngx_mail_core_module.c src/mail/ngx_mail_handler.c src/mail/ngx_mail_ssl_module.c src/mail/ngx_mail_ssl_module.h |
| diffstat | 12 files changed, 276 insertions(+), 40 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -13,8 +13,6 @@ typedef ngx_int_t (*ngx_ssl_variable_han ngx_pool_t *pool, ngx_str_t *s); -#define NGX_DEFAULT_CERTIFICATE "cert.pem" -#define NGX_DEFAULT_CERTIFICATE_KEY "cert.pem" #define NGX_DEFAULT_CIPHERS "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" @@ -28,6 +26,8 @@ static void *ngx_http_ssl_create_srv_con static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child); +static char *ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, + void *conf); static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); @@ -61,7 +61,7 @@ static ngx_command_t ngx_http_ssl_comma { ngx_string("ssl"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, - ngx_conf_set_flag_slot, + ngx_http_ssl_enable, NGX_HTTP_SRV_CONF_OFFSET, offsetof(ngx_http_ssl_srv_conf_t, enable), NULL }, @@ -339,10 +339,6 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * ngx_conf_merge_value(conf->enable, prev->enable, 0); - if (conf->enable == 0) { - return NGX_CONF_OK; - } - ngx_conf_merge_value(conf->session_timeout, prev->session_timeout, 300); @@ -356,11 +352,8 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); - ngx_conf_merge_str_value(conf->certificate, prev->certificate, - NGX_DEFAULT_CERTIFICATE); - - ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, - NGX_DEFAULT_CERTIFICATE_KEY); + ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); + ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); @@ -372,6 +365,38 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * conf->ssl.log = cf->log; + if (conf->enable) { + + if (conf->certificate.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate\" is defined for " + "the \"ssl\" directive in %s:%ui", + conf->file, conf->line); + return NGX_CONF_ERROR; + } + + if (conf->certificate_key.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate_key\" is defined for " + "the \"ssl\" directive in %s:%ui", + conf->file, conf->line); + return NGX_CONF_ERROR; + } + + } else { + + if (conf->certificate.len == 0) { + return NGX_CONF_OK; + } + + if (conf->certificate_key.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate_key\" is defined " + "for certificate \"%V\"", &conf->certificate); + return NGX_CONF_ERROR; + } + } + if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) { return NGX_CONF_ERROR; } @@ -467,6 +492,26 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * static char * +ngx_http_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) +{ + ngx_http_ssl_srv_conf_t *sscf = conf; + + char *rv; + + rv = ngx_conf_set_flag_slot(cf, cmd, conf); + + if (rv != NGX_CONF_OK) { + return rv; + } + + sscf->file = cf->conf_file->file.name.data; + sscf->line = cf->conf_file->line; + + return NGX_CONF_OK; +} + + +static char * ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) { ngx_http_ssl_srv_conf_t *sscf = conf;
--- a/src/http/modules/ngx_http_ssl_module.h +++ b/src/http/modules/ngx_http_ssl_module.h @@ -37,6 +37,9 @@ typedef struct { ngx_str_t ciphers; ngx_shm_zone_t *shm_zone; + + u_char *file; + ngx_uint_t line; } ngx_http_ssl_srv_conf_t;
--- a/src/http/ngx_http.c +++ b/src/http/ngx_http.c @@ -1158,6 +1158,9 @@ ngx_http_init_server_lists(ngx_conf_t *c in_addr[a].core_srv_conf = cscfp[s]; in_addr[a].default_server = 1; +#if (NGX_HTTP_SSL) + in_addr[a].ssl = listen[l].conf.ssl; +#endif in_addr[a].listen_conf = &listen[l].conf; } @@ -1242,6 +1245,9 @@ ngx_http_add_address(ngx_conf_t *cf, ngx in_addr->core_srv_conf = cscf; in_addr->default_server = listen->conf.default_server; in_addr->bind = listen->conf.bind; +#if (NGX_HTTP_SSL) + in_addr->ssl = listen->conf.ssl; +#endif in_addr->listen_conf = &listen->conf; return ngx_http_add_names(cf, cscf, in_addr); @@ -1648,6 +1654,10 @@ ngx_http_init_listening(ngx_conf_t *cf, hip->addrs[i].addr = in_addr[i].addr; hip->addrs[i].core_srv_conf = in_addr[i].core_srv_conf; +#if (NGX_HTTP_SSL) + hip->addrs[i].ssl = in_addr[i].ssl; +#endif + if (in_addr[i].hash.buckets == NULL && (in_addr[i].wc_head == NULL || in_addr[i].wc_head->hash.buckets == NULL)
--- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -3081,6 +3081,18 @@ ngx_http_core_listen(ngx_conf_t *cf, ngx continue; } + if (ngx_strcmp(value[n].data, "ssl") == 0) { +#if (NGX_HTTP_SSL) + ls->conf.ssl = 1; + continue; +#else + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "the \"ssl\" parameter requires " + "ngx_http_ssl_module"); + return NGX_CONF_ERROR; +#endif + } + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "the invalid \"%V\" parameter", &value[n]); return NGX_CONF_ERROR;
--- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -35,6 +35,9 @@ typedef struct ngx_http_core_loc_conf_s typedef struct { unsigned default_server:1; unsigned bind:1; +#if (NGX_HTTP_SSL) + unsigned ssl:1; +#endif int backlog; int rcvbuf; @@ -167,6 +170,10 @@ typedef struct { ngx_http_core_srv_conf_t *core_srv_conf; ngx_http_virtual_names_t *virtual_names; + +#if (NGX_HTTP_SSL) + ngx_uint_t ssl; /* unsigned ssl:1; */ +#endif } ngx_http_in_addr_t; @@ -203,6 +210,9 @@ typedef struct { unsigned default_server:1; unsigned bind:1; +#if (NGX_HTTP_SSL) + unsigned ssl:1; +#endif ngx_http_listen_conf_t *listen_conf; } ngx_http_conf_in_addr_t;
--- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -357,9 +357,20 @@ ngx_http_init_request(ngx_event_t *rev) ngx_http_ssl_srv_conf_t *sscf; sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module); - if (sscf->enable) { + if (sscf->enable || hia[i].ssl) { if (c->ssl == NULL) { + + c->log->action = "SSL handshaking"; + + if (hia[i].ssl && sscf->ssl.ctx == NULL) { + ngx_log_error(NGX_LOG_ERR, c->log, 0, + "no \"ssl_certificate\" is defined " + "in server listening on SSL port"); + ngx_http_close_connection(c); + return; + } + if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER) == NGX_ERROR) { @@ -529,6 +540,8 @@ ngx_http_ssl_handshake(ngx_event_t *rev) } } + c->log->action = "reading client request line"; + rev->handler = ngx_http_process_request_line; ngx_http_process_request_line(rev); }
--- a/src/mail/ngx_mail.c +++ b/src/mail/ngx_mail.c @@ -261,6 +261,9 @@ ngx_mail_block(ngx_conf_t *cf, ngx_comma in_addr->addr = imls[l].addr; in_addr->ctx = imls[l].ctx; in_addr->bind = imls[l].bind; +#if (NGX_MAIL_SSL) + in_addr->ssl = imls[l].ssl; +#endif } /* optimize the lists of ports and addresses */ @@ -370,6 +373,10 @@ ngx_mail_block(ngx_conf_t *cf, ngx_comma imip->addrs[i].addr_text.len = len; imip->addrs[i].addr_text.data = text; + +#if (NGX_MAIL_SSL) + imip->addrs[i].ssl = in_addr[i].ssl; +#endif } if (done) {
--- a/src/mail/ngx_mail.h +++ b/src/mail/ngx_mail.h @@ -34,6 +34,9 @@ typedef struct { ngx_mail_conf_ctx_t *ctx; unsigned bind:1; +#if (NGX_MAIL_SSL) + unsigned ssl:1; +#endif } ngx_mail_listen_t; @@ -41,6 +44,9 @@ typedef struct { in_addr_t addr; ngx_mail_conf_ctx_t *ctx; ngx_str_t addr_text; +#if (NGX_MAIL_SSL) + ngx_uint_t ssl; /* unsigned ssl:1; */ +#endif } ngx_mail_in_addr_t; @@ -60,6 +66,9 @@ typedef struct { in_addr_t addr; ngx_mail_conf_ctx_t *ctx; unsigned bind:1; +#if (NGX_MAIL_SSL) + unsigned ssl:1; +#endif } ngx_mail_conf_in_addr_t;
--- a/src/mail/ngx_mail_core_module.c +++ b/src/mail/ngx_mail_core_module.c @@ -351,18 +351,31 @@ ngx_mail_core_listen(ngx_conf_t *cf, ngx } } - if (cf->args->nelts == 2) { - return NGX_CONF_OK; + for (i = 2; i < cf->args->nelts; i++) { + + if (ngx_strcmp(value[i].data, "bind") == 0) { + imls->bind = 1; + continue; + } + + if (ngx_strcmp(value[i].data, "ssl") == 0) { +#if (NGX_MAIL_SSL) + imls->ssl = 1; + continue; +#else + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "the \"ssl\" parameter requires " + "ngx_mail_ssl_module"); + return NGX_CONF_ERROR; +#endif + } + + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "the invalid \"%V\" parameter", &value[i]); + return NGX_CONF_ERROR; } - if (ngx_strcmp(value[2].data, "bind") == 0) { - imls->bind = 1; - return NGX_CONF_OK; - } - - ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "the invalid \"%V\" parameter", &value[2]); - return NGX_CONF_ERROR; + return NGX_CONF_OK; }
--- a/src/mail/ngx_mail_handler.c +++ b/src/mail/ngx_mail_handler.c @@ -118,9 +118,28 @@ ngx_mail_init_connection(ngx_connection_ sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module); if (sslcf->enable) { + c->log->action = "SSL handshaking"; + ngx_mail_ssl_init_connection(&sslcf->ssl, c); return; } + + if (imia[i].ssl) { + + c->log->action = "SSL handshaking"; + + if (sslcf->ssl.ctx == NULL) { + ngx_log_error(NGX_LOG_ERR, c->log, 0, + "no \"ssl_certificate\" is defined " + "in server listening on SSL port"); + ngx_mail_close_connection(c); + return; + } + + ngx_mail_ssl_init_connection(&sslcf->ssl, c); + return; + } + } #endif
--- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c @@ -9,13 +9,16 @@ #include <ngx_mail.h> -#define NGX_DEFAULT_CERTIFICATE "cert.pem" -#define NGX_DEFAULT_CERTIFICATE_KEY "cert.pem" #define NGX_DEFAULT_CIPHERS "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" static void *ngx_mail_ssl_create_conf(ngx_conf_t *cf); static char *ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child); + +static char *ngx_mail_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, + void *conf); +static char *ngx_mail_ssl_starttls(ngx_conf_t *cf, ngx_command_t *cmd, + void *conf); static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); @@ -50,14 +53,14 @@ static ngx_command_t ngx_mail_ssl_comma { ngx_string("ssl"), NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG, - ngx_conf_set_flag_slot, + ngx_mail_ssl_enable, NGX_MAIL_SRV_CONF_OFFSET, offsetof(ngx_mail_ssl_conf_t, enable), NULL }, { ngx_string("starttls"), NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, - ngx_conf_set_enum_slot, + ngx_mail_ssl_starttls, NGX_MAIL_SRV_CONF_OFFSET, offsetof(ngx_mail_ssl_conf_t, starttls), ngx_http_starttls_state }, @@ -194,14 +197,12 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, ngx_mail_ssl_conf_t *prev = parent; ngx_mail_ssl_conf_t *conf = child; + char *mode; ngx_pool_cleanup_t *cln; ngx_conf_merge_value(conf->enable, prev->enable, 0); - ngx_conf_merge_value(conf->starttls, prev->starttls, NGX_MAIL_STARTTLS_OFF); - - if (conf->enable == 0 && conf->starttls == NGX_MAIL_STARTTLS_OFF) { - return NGX_CONF_OK; - } + ngx_conf_merge_uint_value(conf->starttls, prev->starttls, + NGX_MAIL_STARTTLS_OFF); ngx_conf_merge_value(conf->session_timeout, prev->session_timeout, 300); @@ -213,11 +214,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, (NGX_CONF_BITMASK_SET |NGX_SSL_SSLv2|NGX_SSL_SSLv3|NGX_SSL_TLSv1)); - ngx_conf_merge_str_value(conf->certificate, prev->certificate, - NGX_DEFAULT_CERTIFICATE); - - ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, - NGX_DEFAULT_CERTIFICATE_KEY); + ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); + ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); @@ -226,6 +224,49 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, conf->ssl.log = cf->log; + if (conf->enable) { + mode = "ssl"; + + } else if (conf->starttls != NGX_MAIL_STARTTLS_OFF) { + mode = "starttls"; + + } else { + mode = ""; + } + + if (*mode) { + + if (conf->certificate.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate\" is defined for " + "the \"%s\" directive in %s:%ui", + mode, conf->file, conf->line); + return NGX_CONF_ERROR; + } + + if (conf->certificate_key.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate_key\" is defined for " + "the \"%s\" directive in %s:%ui", + mode, conf->file, conf->line); + return NGX_CONF_ERROR; + } + + } else { + + if (conf->certificate.len == 0) { + return NGX_CONF_OK; + } + + if (conf->certificate_key.len == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no \"ssl_certificate_key\" is defined " + "for certificate \"%V\"", + &conf->certificate); + return NGX_CONF_ERROR; + } + } + if (ngx_ssl_create(&conf->ssl, conf->protocols, NULL) != NGX_OK) { return NGX_CONF_ERROR; } @@ -292,6 +333,58 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, static char * +ngx_mail_ssl_enable(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) +{ + ngx_mail_ssl_conf_t *scf = conf; + + char *rv; + + rv = ngx_conf_set_flag_slot(cf, cmd, conf); + + if (rv != NGX_CONF_OK) { + return rv; + } + + if (scf->enable && (ngx_int_t) scf->starttls > NGX_MAIL_STARTTLS_OFF) { + ngx_conf_log_error(NGX_LOG_WARN, cf, 0, + "\"starttls\" directive conflicts with \"ssl on\""); + return NGX_CONF_ERROR; + } + + scf->file = cf->conf_file->file.name.data; + scf->line = cf->conf_file->line; + + return NGX_CONF_OK; +} + + +static char * +ngx_mail_ssl_starttls(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) +{ + ngx_mail_ssl_conf_t *scf = conf; + + char *rv; + + rv = ngx_conf_set_enum_slot(cf, cmd, conf); + + if (rv != NGX_CONF_OK) { + return rv; + } + + if (scf->enable == 1 && (ngx_int_t) scf->starttls > NGX_MAIL_STARTTLS_OFF) { + ngx_conf_log_error(NGX_LOG_WARN, cf, 0, + "\"ssl\" directive conflicts with \"starttls\""); + return NGX_CONF_ERROR; + } + + scf->file = cf->conf_file->file.name.data; + scf->line = cf->conf_file->line; + + return NGX_CONF_OK; +} + + +static char * ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) { ngx_mail_ssl_conf_t *scf = conf;
--- a/src/mail/ngx_mail_ssl_module.h +++ b/src/mail/ngx_mail_ssl_module.h @@ -20,12 +20,11 @@ typedef struct { ngx_flag_t enable; + ngx_flag_t prefer_server_ciphers; ngx_ssl_t ssl; - ngx_flag_t prefer_server_ciphers; - ngx_flag_t starttls; - + ngx_uint_t starttls; ngx_uint_t protocols; ssize_t builtin_session_cache; @@ -39,6 +38,9 @@ typedef struct { ngx_str_t ciphers; ngx_shm_zone_t *shm_zone; + + u_char *file; + ngx_uint_t line; } ngx_mail_ssl_conf_t;