Groonga 3.0.9 Source Code Document
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
ngx_event_openssl.c
Go to the documentation of this file.
1 
2 /*
3  * Copyright (C) Igor Sysoev
4  * Copyright (C) Nginx, Inc.
5  */
6 
7 
8 #include <ngx_config.h>
9 #include <ngx_core.h>
10 #include <ngx_event.h>
11 
12 
13 typedef struct {
14  ngx_uint_t engine; /* unsigned engine:1; */
15 } ngx_openssl_conf_t;
16 
17 
18 static int ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
19 static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
20  int ret);
21 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
22 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
23 static void ngx_ssl_write_handler(ngx_event_t *wev);
24 static void ngx_ssl_read_handler(ngx_event_t *rev);
25 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
26 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
27  ngx_err_t err, char *text);
28 static void ngx_ssl_clear_error(ngx_log_t *log);
29 
30 ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data);
31 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
32  ngx_ssl_session_t *sess);
33 static ngx_ssl_session_t *ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
34  u_char *id, int len, int *copy);
35 static void ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess);
36 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
37  ngx_slab_pool_t *shpool, ngx_uint_t n);
38 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
39  ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
40 
41 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
42 static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
43 static void ngx_openssl_exit(ngx_cycle_t *cycle);
44 
45 
46 static ngx_command_t ngx_openssl_commands[] = {
47 
48  { ngx_string("ssl_engine"),
49  NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
50  ngx_openssl_engine,
51  0,
52  0,
53  NULL },
54 
55  ngx_null_command
56 };
57 
58 
59 static ngx_core_module_t ngx_openssl_module_ctx = {
60  ngx_string("openssl"),
61  ngx_openssl_create_conf,
62  NULL
63 };
64 
65 
66 ngx_module_t ngx_openssl_module = {
67  NGX_MODULE_V1,
68  &ngx_openssl_module_ctx, /* module context */
69  ngx_openssl_commands, /* module directives */
70  NGX_CORE_MODULE, /* module type */
71  NULL, /* init master */
72  NULL, /* init module */
73  NULL, /* init process */
74  NULL, /* init thread */
75  NULL, /* exit thread */
76  NULL, /* exit process */
77  ngx_openssl_exit, /* exit master */
78  NGX_MODULE_V1_PADDING
79 };
80 
81 
82 int ngx_ssl_connection_index;
83 int ngx_ssl_server_conf_index;
84 int ngx_ssl_session_cache_index;
85 int ngx_ssl_certificate_index;
86 int ngx_ssl_stapling_index;
87 
88 
89 ngx_int_t
90 ngx_ssl_init(ngx_log_t *log)
91 {
92  OPENSSL_config(NULL);
93 
94  SSL_library_init();
95  SSL_load_error_strings();
96 
97  OpenSSL_add_all_algorithms();
98 
99 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
100 #ifndef SSL_OP_NO_COMPRESSION
101  {
102  /*
103  * Disable gzip compression in OpenSSL prior to 1.0.0 version,
104  * this saves about 522K per connection.
105  */
106  int n;
107  STACK_OF(SSL_COMP) *ssl_comp_methods;
108 
109  ssl_comp_methods = SSL_COMP_get_compression_methods();
110  n = sk_SSL_COMP_num(ssl_comp_methods);
111 
112  while (n--) {
113  (void) sk_SSL_COMP_pop(ssl_comp_methods);
114  }
115  }
116 #endif
117 #endif
118 
119  ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
120 
121  if (ngx_ssl_connection_index == -1) {
122  ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
123  return NGX_ERROR;
124  }
125 
126  ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
127  NULL);
128  if (ngx_ssl_server_conf_index == -1) {
129  ngx_ssl_error(NGX_LOG_ALERT, log, 0,
130  "SSL_CTX_get_ex_new_index() failed");
131  return NGX_ERROR;
132  }
133 
134  ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
135  NULL);
136  if (ngx_ssl_session_cache_index == -1) {
137  ngx_ssl_error(NGX_LOG_ALERT, log, 0,
138  "SSL_CTX_get_ex_new_index() failed");
139  return NGX_ERROR;
140  }
141 
142  ngx_ssl_certificate_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
143  NULL);
144  if (ngx_ssl_certificate_index == -1) {
145  ngx_ssl_error(NGX_LOG_ALERT, log, 0,
146  "SSL_CTX_get_ex_new_index() failed");
147  return NGX_ERROR;
148  }
149 
150  ngx_ssl_stapling_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
151  NULL);
152  if (ngx_ssl_stapling_index == -1) {
153  ngx_ssl_error(NGX_LOG_ALERT, log, 0,
154  "SSL_CTX_get_ex_new_index() failed");
155  return NGX_ERROR;
156  }
157 
158  return NGX_OK;
159 }
160 
161 
162 ngx_int_t
163 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
164 {
165  ssl->ctx = SSL_CTX_new(SSLv23_method());
166 
167  if (ssl->ctx == NULL) {
168  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
169  return NGX_ERROR;
170  }
171 
172  if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
173  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
174  "SSL_CTX_set_ex_data() failed");
175  return NGX_ERROR;
176  }
177 
178  /* client side options */
179 
180  SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
181  SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
182 
183  /* server side options */
184 
185  SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
186  SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
187 
188  /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
189  SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
190 
191  SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
192  SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
193  SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
194 
195  SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
196 
197  SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
198 
199  if (!(protocols & NGX_SSL_SSLv2)) {
200  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
201  }
202  if (!(protocols & NGX_SSL_SSLv3)) {
203  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
204  }
205  if (!(protocols & NGX_SSL_TLSv1)) {
206  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
207  }
208 #ifdef SSL_OP_NO_TLSv1_1
209  if (!(protocols & NGX_SSL_TLSv1_1)) {
210  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
211  }
212 #endif
213 #ifdef SSL_OP_NO_TLSv1_2
214  if (!(protocols & NGX_SSL_TLSv1_2)) {
215  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
216  }
217 #endif
218 
219 #ifdef SSL_OP_NO_COMPRESSION
220  SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
221 #endif
222 
223 #ifdef SSL_MODE_RELEASE_BUFFERS
224  SSL_CTX_set_mode(ssl->ctx, SSL_MODE_RELEASE_BUFFERS);
225 #endif
226 
227  SSL_CTX_set_read_ahead(ssl->ctx, 1);
228 
229  SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
230 
231  return NGX_OK;
232 }
233 
234 
235 ngx_int_t
236 ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
237  ngx_str_t *key)
238 {
239  BIO *bio;
240  X509 *x509;
241  u_long n;
242 
243  if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
244  return NGX_ERROR;
245  }
246 
247  /*
248  * we can't use SSL_CTX_use_certificate_chain_file() as it doesn't
249  * allow to access certificate later from SSL_CTX, so we reimplement
250  * it here
251  */
252 
253  bio = BIO_new_file((char *) cert->data, "r");
254  if (bio == NULL) {
255  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
256  "BIO_new_file(\"%s\") failed", cert->data);
257  return NGX_ERROR;
258  }
259 
260  x509 = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
261  if (x509 == NULL) {
262  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
263  "PEM_read_bio_X509_AUX(\"%s\") failed", cert->data);
264  BIO_free(bio);
265  return NGX_ERROR;
266  }
267 
268  if (SSL_CTX_use_certificate(ssl->ctx, x509) == 0) {
269  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
270  "SSL_CTX_use_certificate(\"%s\") failed", cert->data);
271  X509_free(x509);
272  BIO_free(bio);
273  return NGX_ERROR;
274  }
275 
276  if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_certificate_index, x509)
277  == 0)
278  {
279  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
280  "SSL_CTX_set_ex_data() failed");
281  return NGX_ERROR;
282  }
283 
284  X509_free(x509);
285 
286  /* read rest of the chain */
287 
288  for ( ;; ) {
289 
290  x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
291  if (x509 == NULL) {
292  n = ERR_peek_last_error();
293 
294  if (ERR_GET_LIB(n) == ERR_LIB_PEM
295  && ERR_GET_REASON(n) == PEM_R_NO_START_LINE)
296  {
297  /* end of file */
298  ERR_clear_error();
299  break;
300  }
301 
302  /* some real error */
303 
304  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
305  "PEM_read_bio_X509(\"%s\") failed", cert->data);
306  BIO_free(bio);
307  return NGX_ERROR;
308  }
309 
310  if (SSL_CTX_add_extra_chain_cert(ssl->ctx, x509) == 0) {
311  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
312  "SSL_CTX_add_extra_chain_cert(\"%s\") failed",
313  cert->data);
314  X509_free(x509);
315  BIO_free(bio);
316  return NGX_ERROR;
317  }
318  }
319 
320  BIO_free(bio);
321 
322  if (ngx_conf_full_name(cf->cycle, key, 1) != NGX_OK) {
323  return NGX_ERROR;
324  }
325 
326  if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data,
327  SSL_FILETYPE_PEM)
328  == 0)
329  {
330  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
331  "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data);
332  return NGX_ERROR;
333  }
334 
335  return NGX_OK;
336 }
337 
338 
339 ngx_int_t
340 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
341  ngx_int_t depth)
342 {
343  STACK_OF(X509_NAME) *list;
344 
345  SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_http_ssl_verify_callback);
346 
347  SSL_CTX_set_verify_depth(ssl->ctx, depth);
348 
349  if (cert->len == 0) {
350  return NGX_OK;
351  }
352 
353  if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
354  return NGX_ERROR;
355  }
356 
357  if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
358  == 0)
359  {
360  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
361  "SSL_CTX_load_verify_locations(\"%s\") failed",
362  cert->data);
363  return NGX_ERROR;
364  }
365 
366  list = SSL_load_client_CA_file((char *) cert->data);
367 
368  if (list == NULL) {
369  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
370  "SSL_load_client_CA_file(\"%s\") failed", cert->data);
371  return NGX_ERROR;
372  }
373 
374  /*
375  * before 0.9.7h and 0.9.8 SSL_load_client_CA_file()
376  * always leaved an error in the error queue
377  */
378 
379  ERR_clear_error();
380 
381  SSL_CTX_set_client_CA_list(ssl->ctx, list);
382 
383  return NGX_OK;
384 }
385 
386 
387 ngx_int_t
388 ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
389  ngx_int_t depth)
390 {
391  SSL_CTX_set_verify_depth(ssl->ctx, depth);
392 
393  if (cert->len == 0) {
394  return NGX_OK;
395  }
396 
397  if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
398  return NGX_ERROR;
399  }
400 
401  if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
402  == 0)
403  {
404  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
405  "SSL_CTX_load_verify_locations(\"%s\") failed",
406  cert->data);
407  return NGX_ERROR;
408  }
409 
410  return NGX_OK;
411 }
412 
413 
414 ngx_int_t
415 ngx_ssl_crl(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *crl)
416 {
417  X509_STORE *store;
418  X509_LOOKUP *lookup;
419 
420  if (crl->len == 0) {
421  return NGX_OK;
422  }
423 
424  if (ngx_conf_full_name(cf->cycle, crl, 1) != NGX_OK) {
425  return NGX_ERROR;
426  }
427 
428  store = SSL_CTX_get_cert_store(ssl->ctx);
429 
430  if (store == NULL) {
431  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
432  "SSL_CTX_get_cert_store() failed");
433  return NGX_ERROR;
434  }
435 
436  lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
437 
438  if (lookup == NULL) {
439  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
440  "X509_STORE_add_lookup() failed");
441  return NGX_ERROR;
442  }
443 
444  if (X509_LOOKUP_load_file(lookup, (char *) crl->data, X509_FILETYPE_PEM)
445  == 0)
446  {
447  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
448  "X509_LOOKUP_load_file(\"%s\") failed", crl->data);
449  return NGX_ERROR;
450  }
451 
452  X509_STORE_set_flags(store,
453  X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
454 
455  return NGX_OK;
456 }
457 
458 
459 static int
460 ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
461 {
462 #if (NGX_DEBUG)
463  char *subject, *issuer;
464  int err, depth;
465  X509 *cert;
466  X509_NAME *sname, *iname;
467  ngx_connection_t *c;
468  ngx_ssl_conn_t *ssl_conn;
469 
470  ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
471  SSL_get_ex_data_X509_STORE_CTX_idx());
472 
473  c = ngx_ssl_get_connection(ssl_conn);
474 
475  cert = X509_STORE_CTX_get_current_cert(x509_store);
476  err = X509_STORE_CTX_get_error(x509_store);
477  depth = X509_STORE_CTX_get_error_depth(x509_store);
478 
479  sname = X509_get_subject_name(cert);
480  subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
481 
482  iname = X509_get_issuer_name(cert);
483  issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
484 
485  ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
486  "verify:%d, error:%d, depth:%d, "
487  "subject:\"%s\",issuer: \"%s\"",
488  ok, err, depth, subject, issuer);
489 
490  if (sname) {
491  OPENSSL_free(subject);
492  }
493 
494  if (iname) {
495  OPENSSL_free(issuer);
496  }
497 #endif
498 
499  return 1;
500 }
501 
502 
503 static void
504 ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
505 {
506  ngx_connection_t *c;
507 
508  if (where & SSL_CB_HANDSHAKE_START) {
509  c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);
510 
511  if (c->ssl->handshaked) {
512  c->ssl->renegotiation = 1;
513  ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL renegotiation");
514  }
515  }
516 }
517 
518 
519 RSA *
520 ngx_ssl_rsa512_key_callback(SSL *ssl, int is_export, int key_length)
521 {
522  static RSA *key;
523 
524  if (key_length == 512) {
525  if (key == NULL) {
526  key = RSA_generate_key(512, RSA_F4, NULL, NULL);
527  }
528  }
529 
530  return key;
531 }
532 
533 
534 ngx_int_t
535 ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
536 {
537  DH *dh;
538  BIO *bio;
539 
540  /*
541  * -----BEGIN DH PARAMETERS-----
542  * MIGHAoGBALu8LcrYRnSQfEP89YDpz9vZWKP1aLQtSwju1OsPs1BMbAMCducQgAxc
543  * y7qokiYUxb7spWWl/fHSh6K8BJvmd4Bg6RqSp1fjBI9osHb302zI8pul34HcLKcl
544  * 7OZicMyaUDXYzs7vnqAnSmOrHlj6/UmI0PZdFGdX2gcd8EXP4WubAgEC
545  * -----END DH PARAMETERS-----
546  */
547 
548  static unsigned char dh1024_p[] = {
549  0xBB, 0xBC, 0x2D, 0xCA, 0xD8, 0x46, 0x74, 0x90, 0x7C, 0x43, 0xFC, 0xF5,
550  0x80, 0xE9, 0xCF, 0xDB, 0xD9, 0x58, 0xA3, 0xF5, 0x68, 0xB4, 0x2D, 0x4B,
551  0x08, 0xEE, 0xD4, 0xEB, 0x0F, 0xB3, 0x50, 0x4C, 0x6C, 0x03, 0x02, 0x76,
552  0xE7, 0x10, 0x80, 0x0C, 0x5C, 0xCB, 0xBA, 0xA8, 0x92, 0x26, 0x14, 0xC5,
553  0xBE, 0xEC, 0xA5, 0x65, 0xA5, 0xFD, 0xF1, 0xD2, 0x87, 0xA2, 0xBC, 0x04,
554  0x9B, 0xE6, 0x77, 0x80, 0x60, 0xE9, 0x1A, 0x92, 0xA7, 0x57, 0xE3, 0x04,
555  0x8F, 0x68, 0xB0, 0x76, 0xF7, 0xD3, 0x6C, 0xC8, 0xF2, 0x9B, 0xA5, 0xDF,
556  0x81, 0xDC, 0x2C, 0xA7, 0x25, 0xEC, 0xE6, 0x62, 0x70, 0xCC, 0x9A, 0x50,
557  0x35, 0xD8, 0xCE, 0xCE, 0xEF, 0x9E, 0xA0, 0x27, 0x4A, 0x63, 0xAB, 0x1E,
558  0x58, 0xFA, 0xFD, 0x49, 0x88, 0xD0, 0xF6, 0x5D, 0x14, 0x67, 0x57, 0xDA,
559  0x07, 0x1D, 0xF0, 0x45, 0xCF, 0xE1, 0x6B, 0x9B
560  };
561 
562  static unsigned char dh1024_g[] = { 0x02 };
563 
564 
565  if (file->len == 0) {
566 
567  dh = DH_new();
568  if (dh == NULL) {
569  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "DH_new() failed");
570  return NGX_ERROR;
571  }
572 
573  dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
574  dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
575 
576  if (dh->p == NULL || dh->g == NULL) {
577  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "BN_bin2bn() failed");
578  DH_free(dh);
579  return NGX_ERROR;
580  }
581 
582  SSL_CTX_set_tmp_dh(ssl->ctx, dh);
583 
584  DH_free(dh);
585 
586  return NGX_OK;
587  }
588 
589  if (ngx_conf_full_name(cf->cycle, file, 1) != NGX_OK) {
590  return NGX_ERROR;
591  }
592 
593  bio = BIO_new_file((char *) file->data, "r");
594  if (bio == NULL) {
595  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
596  "BIO_new_file(\"%s\") failed", file->data);
597  return NGX_ERROR;
598  }
599 
600  dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
601  if (dh == NULL) {
602  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
603  "PEM_read_bio_DHparams(\"%s\") failed", file->data);
604  BIO_free(bio);
605  return NGX_ERROR;
606  }
607 
608  SSL_CTX_set_tmp_dh(ssl->ctx, dh);
609 
610  DH_free(dh);
611  BIO_free(bio);
612 
613  return NGX_OK;
614 }
615 
616 
617 ngx_int_t
618 ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name)
619 {
620 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
621 #ifndef OPENSSL_NO_ECDH
622  int nid;
623  EC_KEY *ecdh;
624 
625  /*
626  * Elliptic-Curve Diffie-Hellman parameters are either "named curves"
627  * from RFC 4492 section 5.1.1, or explicitly described curves over
628  * binary fields. OpenSSL only supports the "named curves", which provide
629  * maximum interoperability.
630  */
631 
632  nid = OBJ_sn2nid((const char *) name->data);
633  if (nid == 0) {
634  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
635  "Unknown curve name \"%s\"", name->data);
636  return NGX_ERROR;
637  }
638 
639  ecdh = EC_KEY_new_by_curve_name(nid);
640  if (ecdh == NULL) {
641  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
642  "Unable to create curve \"%s\"", name->data);
643  return NGX_ERROR;
644  }
645 
646  SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
647 
648  SSL_CTX_set_tmp_ecdh(ssl->ctx, ecdh);
649 
650  EC_KEY_free(ecdh);
651 #endif
652 #endif
653 
654  return NGX_OK;
655 }
656 
657 
658 ngx_int_t
659 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
660 {
661  ngx_ssl_connection_t *sc;
662 
663  sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
664  if (sc == NULL) {
665  return NGX_ERROR;
666  }
667 
668  sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
669 
670  sc->connection = SSL_new(ssl->ctx);
671 
672  if (sc->connection == NULL) {
673  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
674  return NGX_ERROR;
675  }
676 
677  if (SSL_set_fd(sc->connection, c->fd) == 0) {
678  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
679  return NGX_ERROR;
680  }
681 
682  if (flags & NGX_SSL_CLIENT) {
683  SSL_set_connect_state(sc->connection);
684 
685  } else {
686  SSL_set_accept_state(sc->connection);
687  }
688 
689  if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
690  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
691  return NGX_ERROR;
692  }
693 
694  c->ssl = sc;
695 
696  return NGX_OK;
697 }
698 
699 
700 ngx_int_t
701 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session)
702 {
703  if (session) {
704  if (SSL_set_session(c->ssl->connection, session) == 0) {
705  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
706  return NGX_ERROR;
707  }
708  }
709 
710  return NGX_OK;
711 }
712 
713 
714 ngx_int_t
715 ngx_ssl_handshake(ngx_connection_t *c)
716 {
717  int n, sslerr;
718  ngx_err_t err;
719 
720  ngx_ssl_clear_error(c->log);
721 
722  n = SSL_do_handshake(c->ssl->connection);
723 
724  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
725 
726  if (n == 1) {
727 
728  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
729  return NGX_ERROR;
730  }
731 
732  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
733  return NGX_ERROR;
734  }
735 
736 #if (NGX_DEBUG)
737  {
738  char buf[129], *s, *d;
739 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
740  const
741 #endif
742  SSL_CIPHER *cipher;
743 
744  cipher = SSL_get_current_cipher(c->ssl->connection);
745 
746  if (cipher) {
747  SSL_CIPHER_description(cipher, &buf[1], 128);
748 
749  for (s = &buf[1], d = buf; *s; s++) {
750  if (*s == ' ' && *d == ' ') {
751  continue;
752  }
753 
754  if (*s == LF || *s == CR) {
755  continue;
756  }
757 
758  *++d = *s;
759  }
760 
761  if (*d != ' ') {
762  d++;
763  }
764 
765  *d = '\0';
766 
767  ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
768  "SSL: %s, cipher: \"%s\"",
769  SSL_get_version(c->ssl->connection), &buf[1]);
770 
771  if (SSL_session_reused(c->ssl->connection)) {
772  ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
773  "SSL reused session");
774  }
775 
776  } else {
777  ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
778  "SSL no shared ciphers");
779  }
780  }
781 #endif
782 
783  c->ssl->handshaked = 1;
784 
785  c->recv = ngx_ssl_recv;
786  c->send = ngx_ssl_write;
787  c->recv_chain = ngx_ssl_recv_chain;
788  c->send_chain = ngx_ssl_send_chain;
789 
790  /* initial handshake done, disable renegotiation (CVE-2009-3555) */
791  if (c->ssl->connection->s3) {
792  c->ssl->connection->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
793  }
794 
795  return NGX_OK;
796  }
797 
798  sslerr = SSL_get_error(c->ssl->connection, n);
799 
800  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
801 
802  if (sslerr == SSL_ERROR_WANT_READ) {
803  c->read->ready = 0;
804  c->read->handler = ngx_ssl_handshake_handler;
805  c->write->handler = ngx_ssl_handshake_handler;
806 
807  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
808  return NGX_ERROR;
809  }
810 
811  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
812  return NGX_ERROR;
813  }
814 
815  return NGX_AGAIN;
816  }
817 
818  if (sslerr == SSL_ERROR_WANT_WRITE) {
819  c->write->ready = 0;
820  c->read->handler = ngx_ssl_handshake_handler;
821  c->write->handler = ngx_ssl_handshake_handler;
822 
823  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
824  return NGX_ERROR;
825  }
826 
827  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
828  return NGX_ERROR;
829  }
830 
831  return NGX_AGAIN;
832  }
833 
834  err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
835 
836  c->ssl->no_wait_shutdown = 1;
837  c->ssl->no_send_shutdown = 1;
838  c->read->eof = 1;
839 
840  if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
841  ngx_log_error(NGX_LOG_INFO, c->log, err,
842  "peer closed connection in SSL handshake");
843 
844  return NGX_ERROR;
845  }
846 
847  c->read->error = 1;
848 
849  ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
850 
851  return NGX_ERROR;
852 }
853 
854 
855 static void
856 ngx_ssl_handshake_handler(ngx_event_t *ev)
857 {
858  ngx_connection_t *c;
859 
860  c = ev->data;
861 
862  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
863  "SSL handshake handler: %d", ev->write);
864 
865  if (ev->timedout) {
866  c->ssl->handler(c);
867  return;
868  }
869 
870  if (ngx_ssl_handshake(c) == NGX_AGAIN) {
871  return;
872  }
873 
874  c->ssl->handler(c);
875 }
876 
877 
878 ssize_t
879 ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl)
880 {
881  u_char *last;
882  ssize_t n, bytes;
883  ngx_buf_t *b;
884 
885  bytes = 0;
886 
887  b = cl->buf;
888  last = b->last;
889 
890  for ( ;; ) {
891 
892  n = ngx_ssl_recv(c, last, b->end - last);
893 
894  if (n > 0) {
895  last += n;
896  bytes += n;
897 
898  if (last == b->end) {
899  cl = cl->next;
900 
901  if (cl == NULL) {
902  return bytes;
903  }
904 
905  b = cl->buf;
906  last = b->last;
907  }
908 
909  continue;
910  }
911 
912  if (bytes) {
913 
914  if (n == 0 || n == NGX_ERROR) {
915  c->read->ready = 1;
916  }
917 
918  return bytes;
919  }
920 
921  return n;
922  }
923 }
924 
925 
926 ssize_t
927 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
928 {
929  int n, bytes;
930 
931  if (c->ssl->last == NGX_ERROR) {
932  c->read->error = 1;
933  return NGX_ERROR;
934  }
935 
936  if (c->ssl->last == NGX_DONE) {
937  c->read->ready = 0;
938  c->read->eof = 1;
939  return 0;
940  }
941 
942  bytes = 0;
943 
944  ngx_ssl_clear_error(c->log);
945 
946  /*
947  * SSL_read() may return data in parts, so try to read
948  * until SSL_read() would return no data
949  */
950 
951  for ( ;; ) {
952 
953  n = SSL_read(c->ssl->connection, buf, size);
954 
955  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
956 
957  if (n > 0) {
958  bytes += n;
959  }
960 
961  c->ssl->last = ngx_ssl_handle_recv(c, n);
962 
963  if (c->ssl->last == NGX_OK) {
964 
965  size -= n;
966 
967  if (size == 0) {
968  return bytes;
969  }
970 
971  buf += n;
972 
973  continue;
974  }
975 
976  if (bytes) {
977  return bytes;
978  }
979 
980  switch (c->ssl->last) {
981 
982  case NGX_DONE:
983  c->read->ready = 0;
984  c->read->eof = 1;
985  return 0;
986 
987  case NGX_ERROR:
988  c->read->error = 1;
989 
990  /* fall through */
991 
992  case NGX_AGAIN:
993  return c->ssl->last;
994  }
995  }
996 }
997 
998 
999 static ngx_int_t
1000 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
1001 {
1002  int sslerr;
1003  ngx_err_t err;
1004 
1005  if (c->ssl->renegotiation) {
1006  /*
1007  * disable renegotiation (CVE-2009-3555):
1008  * OpenSSL (at least up to 0.9.8l) does not handle disabled
1009  * renegotiation gracefully, so drop connection here
1010  */
1011 
1012  ngx_log_error(NGX_LOG_NOTICE, c->log, 0, "SSL renegotiation disabled");
1013 
1014  while (ERR_peek_error()) {
1015  ngx_ssl_error(NGX_LOG_DEBUG, c->log, 0,
1016  "ignoring stale global SSL error");
1017  }
1018 
1019  ERR_clear_error();
1020 
1021  c->ssl->no_wait_shutdown = 1;
1022  c->ssl->no_send_shutdown = 1;
1023 
1024  return NGX_ERROR;
1025  }
1026 
1027  if (n > 0) {
1028 
1029  if (c->ssl->saved_write_handler) {
1030 
1031  c->write->handler = c->ssl->saved_write_handler;
1032  c->ssl->saved_write_handler = NULL;
1033  c->write->ready = 1;
1034 
1035  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
1036  return NGX_ERROR;
1037  }
1038 
1039  ngx_post_event(c->write, &ngx_posted_events);
1040  }
1041 
1042  return NGX_OK;
1043  }
1044 
1045  sslerr = SSL_get_error(c->ssl->connection, n);
1046 
1047  err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
1048 
1049  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
1050 
1051  if (sslerr == SSL_ERROR_WANT_READ) {
1052  c->read->ready = 0;
1053  return NGX_AGAIN;
1054  }
1055 
1056  if (sslerr == SSL_ERROR_WANT_WRITE) {
1057 
1058  ngx_log_error(NGX_LOG_INFO, c->log, 0,
1059  "peer started SSL renegotiation");
1060 
1061  c->write->ready = 0;
1062 
1063  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
1064  return NGX_ERROR;
1065  }
1066 
1067  /*
1068  * we do not set the timer because there is already the read event timer
1069  */
1070 
1071  if (c->ssl->saved_write_handler == NULL) {
1072  c->ssl->saved_write_handler = c->write->handler;
1073  c->write->handler = ngx_ssl_write_handler;
1074  }
1075 
1076  return NGX_AGAIN;
1077  }
1078 
1079  c->ssl->no_wait_shutdown = 1;
1080  c->ssl->no_send_shutdown = 1;
1081 
1082  if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
1083  ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
1084  "peer shutdown SSL cleanly");
1085  return NGX_DONE;
1086  }
1087 
1088  ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
1089 
1090  return NGX_ERROR;
1091 }
1092 
1093 
1094 static void
1095 ngx_ssl_write_handler(ngx_event_t *wev)
1096 {
1097  ngx_connection_t *c;
1098 
1099  c = wev->data;
1100 
1101  c->read->handler(c->read);
1102 }
1103 
1104 
1105 /*
1106  * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
1107  * before the SSL_write() call to decrease a SSL overhead.
1108  *
1109  * Besides for protocols such as HTTP it is possible to always buffer
1110  * the output to decrease a SSL overhead some more.
1111  */
1112 
1113 ngx_chain_t *
1114 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
1115 {
1116  int n;
1117  ngx_uint_t flush;
1118  ssize_t send, size;
1119  ngx_buf_t *buf;
1120 
1121  if (!c->ssl->buffer) {
1122 
1123  while (in) {
1124  if (ngx_buf_special(in->buf)) {
1125  in = in->next;
1126  continue;
1127  }
1128 
1129  n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
1130 
1131  if (n == NGX_ERROR) {
1132  return NGX_CHAIN_ERROR;
1133  }
1134 
1135  if (n == NGX_AGAIN) {
1136  return in;
1137  }
1138 
1139  in->buf->pos += n;
1140  c->sent += n;
1141 
1142  if (in->buf->pos == in->buf->last) {
1143  in = in->next;
1144  }
1145  }
1146 
1147  return in;
1148  }
1149 
1150 
1151  /* the maximum limit size is the maximum int32_t value - the page size */
1152 
1153  if (limit == 0 || limit > (off_t) (NGX_MAX_INT32_VALUE - ngx_pagesize)) {
1154  limit = NGX_MAX_INT32_VALUE - ngx_pagesize;
1155  }
1156 
1157  buf = c->ssl->buf;
1158 
1159  if (buf == NULL) {
1160  buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE);
1161  if (buf == NULL) {
1162  return NGX_CHAIN_ERROR;
1163  }
1164 
1165  c->ssl->buf = buf;
1166  }
1167 
1168  if (buf->start == NULL) {
1169  buf->start = ngx_palloc(c->pool, NGX_SSL_BUFSIZE);
1170  if (buf->start == NULL) {
1171  return NGX_CHAIN_ERROR;
1172  }
1173 
1174  buf->pos = buf->start;
1175  buf->last = buf->start;
1176  buf->end = buf->start + NGX_SSL_BUFSIZE;
1177  }
1178 
1179  send = buf->last - buf->pos;
1180  flush = (in == NULL) ? 1 : buf->flush;
1181 
1182  for ( ;; ) {
1183 
1184  while (in && buf->last < buf->end && send < limit) {
1185  if (in->buf->last_buf || in->buf->flush) {
1186  flush = 1;
1187  }
1188 
1189  if (ngx_buf_special(in->buf)) {
1190  in = in->next;
1191  continue;
1192  }
1193 
1194  size = in->buf->last - in->buf->pos;
1195 
1196  if (size > buf->end - buf->last) {
1197  size = buf->end - buf->last;
1198  }
1199 
1200  if (send + size > limit) {
1201  size = (ssize_t) (limit - send);
1202  }
1203 
1204  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1205  "SSL buf copy: %d", size);
1206 
1207  ngx_memcpy(buf->last, in->buf->pos, size);
1208 
1209  buf->last += size;
1210  in->buf->pos += size;
1211  send += size;
1212 
1213  if (in->buf->pos == in->buf->last) {
1214  in = in->next;
1215  }
1216  }
1217 
1218  if (!flush && send < limit && buf->last < buf->end) {
1219  break;
1220  }
1221 
1222  size = buf->last - buf->pos;
1223 
1224  if (size == 0) {
1225  buf->flush = 0;
1226  c->buffered &= ~NGX_SSL_BUFFERED;
1227  return in;
1228  }
1229 
1230  n = ngx_ssl_write(c, buf->pos, size);
1231 
1232  if (n == NGX_ERROR) {
1233  return NGX_CHAIN_ERROR;
1234  }
1235 
1236  if (n == NGX_AGAIN) {
1237  break;
1238  }
1239 
1240  buf->pos += n;
1241  c->sent += n;
1242 
1243  if (n < size) {
1244  break;
1245  }
1246 
1247  flush = 0;
1248 
1249  buf->pos = buf->start;
1250  buf->last = buf->start;
1251 
1252  if (in == NULL || send == limit) {
1253  break;
1254  }
1255  }
1256 
1257  buf->flush = flush;
1258 
1259  if (buf->pos < buf->last) {
1260  c->buffered |= NGX_SSL_BUFFERED;
1261 
1262  } else {
1263  c->buffered &= ~NGX_SSL_BUFFERED;
1264  }
1265 
1266  return in;
1267 }
1268 
1269 
1270 ssize_t
1271 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
1272 {
1273  int n, sslerr;
1274  ngx_err_t err;
1275 
1276  ngx_ssl_clear_error(c->log);
1277 
1278  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size);
1279 
1280  n = SSL_write(c->ssl->connection, data, size);
1281 
1282  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
1283 
1284  if (n > 0) {
1285 
1286  if (c->ssl->saved_read_handler) {
1287 
1288  c->read->handler = c->ssl->saved_read_handler;
1289  c->ssl->saved_read_handler = NULL;
1290  c->read->ready = 1;
1291 
1292  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
1293  return NGX_ERROR;
1294  }
1295 
1296  ngx_post_event(c->read, &ngx_posted_events);
1297  }
1298 
1299  return n;
1300  }
1301 
1302  sslerr = SSL_get_error(c->ssl->connection, n);
1303 
1304  err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
1305 
1306  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
1307 
1308  if (sslerr == SSL_ERROR_WANT_WRITE) {
1309  c->write->ready = 0;
1310  return NGX_AGAIN;
1311  }
1312 
1313  if (sslerr == SSL_ERROR_WANT_READ) {
1314 
1315  ngx_log_error(NGX_LOG_INFO, c->log, 0,
1316  "peer started SSL renegotiation");
1317 
1318  c->read->ready = 0;
1319 
1320  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
1321  return NGX_ERROR;
1322  }
1323 
1324  /*
1325  * we do not set the timer because there is already
1326  * the write event timer
1327  */
1328 
1329  if (c->ssl->saved_read_handler == NULL) {
1330  c->ssl->saved_read_handler = c->read->handler;
1331  c->read->handler = ngx_ssl_read_handler;
1332  }
1333 
1334  return NGX_AGAIN;
1335  }
1336 
1337  c->ssl->no_wait_shutdown = 1;
1338  c->ssl->no_send_shutdown = 1;
1339  c->write->error = 1;
1340 
1341  ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
1342 
1343  return NGX_ERROR;
1344 }
1345 
1346 
1347 static void
1348 ngx_ssl_read_handler(ngx_event_t *rev)
1349 {
1350  ngx_connection_t *c;
1351 
1352  c = rev->data;
1353 
1354  c->write->handler(c->write);
1355 }
1356 
1357 
1358 void
1359 ngx_ssl_free_buffer(ngx_connection_t *c)
1360 {
1361  if (c->ssl->buf && c->ssl->buf->start) {
1362  if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) {
1363  c->ssl->buf->start = NULL;
1364  }
1365  }
1366 }
1367 
1368 
1369 ngx_int_t
1370 ngx_ssl_shutdown(ngx_connection_t *c)
1371 {
1372  int n, sslerr, mode;
1373  ngx_err_t err;
1374 
1375  if (c->timedout) {
1376  mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
1377  SSL_set_quiet_shutdown(c->ssl->connection, 1);
1378 
1379  } else {
1380  mode = SSL_get_shutdown(c->ssl->connection);
1381 
1382  if (c->ssl->no_wait_shutdown) {
1383  mode |= SSL_RECEIVED_SHUTDOWN;
1384  }
1385 
1386  if (c->ssl->no_send_shutdown) {
1387  mode |= SSL_SENT_SHUTDOWN;
1388  }
1389 
1390  if (c->ssl->no_wait_shutdown && c->ssl->no_send_shutdown) {
1391  SSL_set_quiet_shutdown(c->ssl->connection, 1);
1392  }
1393  }
1394 
1395  SSL_set_shutdown(c->ssl->connection, mode);
1396 
1397  ngx_ssl_clear_error(c->log);
1398 
1399  n = SSL_shutdown(c->ssl->connection);
1400 
1401  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
1402 
1403  sslerr = 0;
1404 
1405  /* SSL_shutdown() never returns -1, on error it returns 0 */
1406 
1407  if (n != 1 && ERR_peek_error()) {
1408  sslerr = SSL_get_error(c->ssl->connection, n);
1409 
1410  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
1411  "SSL_get_error: %d", sslerr);
1412  }
1413 
1414  if (n == 1 || sslerr == 0 || sslerr == SSL_ERROR_ZERO_RETURN) {
1415  SSL_free(c->ssl->connection);
1416  c->ssl = NULL;
1417 
1418  return NGX_OK;
1419  }
1420 
1421  if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) {
1422  c->read->handler = ngx_ssl_shutdown_handler;
1423  c->write->handler = ngx_ssl_shutdown_handler;
1424 
1425  if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
1426  return NGX_ERROR;
1427  }
1428 
1429  if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
1430  return NGX_ERROR;
1431  }
1432 
1433  if (sslerr == SSL_ERROR_WANT_READ) {
1434  ngx_add_timer(c->read, 30000);
1435  }
1436 
1437  return NGX_AGAIN;
1438  }
1439 
1440  err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
1441 
1442  ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
1443 
1444  SSL_free(c->ssl->connection);
1445  c->ssl = NULL;
1446 
1447  return NGX_ERROR;
1448 }
1449 
1450 
1451 static void
1452 ngx_ssl_shutdown_handler(ngx_event_t *ev)
1453 {
1454  ngx_connection_t *c;
1455  ngx_connection_handler_pt handler;
1456 
1457  c = ev->data;
1458  handler = c->ssl->handler;
1459 
1460  if (ev->timedout) {
1461  c->timedout = 1;
1462  }
1463 
1464  ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
1465 
1466  if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
1467  return;
1468  }
1469 
1470  handler(c);
1471 }
1472 
1473 
1474 static void
1475 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
1476  char *text)
1477 {
1478  int n;
1479  ngx_uint_t level;
1480 
1481  level = NGX_LOG_CRIT;
1482 
1483  if (sslerr == SSL_ERROR_SYSCALL) {
1484 
1485  if (err == NGX_ECONNRESET
1486  || err == NGX_EPIPE
1487  || err == NGX_ENOTCONN
1488  || err == NGX_ETIMEDOUT
1489  || err == NGX_ECONNREFUSED
1490  || err == NGX_ENETDOWN
1491  || err == NGX_ENETUNREACH
1492  || err == NGX_EHOSTDOWN
1493  || err == NGX_EHOSTUNREACH)
1494  {
1495  switch (c->log_error) {
1496 
1497  case NGX_ERROR_IGNORE_ECONNRESET:
1498  case NGX_ERROR_INFO:
1499  level = NGX_LOG_INFO;
1500  break;
1501 
1502  case NGX_ERROR_ERR:
1503  level = NGX_LOG_ERR;
1504  break;
1505 
1506  default:
1507  break;
1508  }
1509  }
1510 
1511  } else if (sslerr == SSL_ERROR_SSL) {
1512 
1513  n = ERR_GET_REASON(ERR_peek_error());
1514 
1515  /* handshake failures */
1516  if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */
1517  || n == SSL_R_BLOCK_CIPHER_PAD_IS_WRONG /* 129 */
1518  || n == SSL_R_DIGEST_CHECK_FAILED /* 149 */
1519  || n == SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST /* 151 */
1520  || n == SSL_R_EXCESSIVE_MESSAGE_SIZE /* 152 */
1521  || n == SSL_R_LENGTH_MISMATCH /* 159 */
1522  || n == SSL_R_NO_CIPHERS_PASSED /* 182 */
1523  || n == SSL_R_NO_CIPHERS_SPECIFIED /* 183 */
1524  || n == SSL_R_NO_COMPRESSION_SPECIFIED /* 187 */
1525  || n == SSL_R_NO_SHARED_CIPHER /* 193 */
1526  || n == SSL_R_RECORD_LENGTH_MISMATCH /* 213 */
1527 #ifdef SSL_R_PARSE_TLSEXT
1528  || n == SSL_R_PARSE_TLSEXT /* 227 */
1529 #endif
1530  || n == SSL_R_UNEXPECTED_MESSAGE /* 244 */
1531  || n == SSL_R_UNEXPECTED_RECORD /* 245 */
1532  || n == SSL_R_UNKNOWN_ALERT_TYPE /* 246 */
1533  || n == SSL_R_UNKNOWN_PROTOCOL /* 252 */
1534  || n == SSL_R_WRONG_VERSION_NUMBER /* 267 */
1535  || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC /* 281 */
1536 #ifdef SSL_R_RENEGOTIATE_EXT_TOO_LONG
1537  || n == SSL_R_RENEGOTIATE_EXT_TOO_LONG /* 335 */
1538  || n == SSL_R_RENEGOTIATION_ENCODING_ERR /* 336 */
1539  || n == SSL_R_RENEGOTIATION_MISMATCH /* 337 */
1540 #endif
1541 #ifdef SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
1542  || n == SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED /* 338 */
1543 #endif
1544 #ifdef SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING
1545  || n == SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING /* 345 */
1546 #endif
1547  || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
1548  || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE /* 1010 */
1549  || n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC /* 1020 */
1550  || n == SSL_R_TLSV1_ALERT_DECRYPTION_FAILED /* 1021 */
1551  || n == SSL_R_TLSV1_ALERT_RECORD_OVERFLOW /* 1022 */
1552  || n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE /* 1030 */
1553  || n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE /* 1040 */
1554  || n == SSL_R_SSLV3_ALERT_NO_CERTIFICATE /* 1041 */
1555  || n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE /* 1042 */
1556  || n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE /* 1043 */
1557  || n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED /* 1044 */
1558  || n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED /* 1045 */
1559  || n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN /* 1046 */
1560  || n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER /* 1047 */
1561  || n == SSL_R_TLSV1_ALERT_UNKNOWN_CA /* 1048 */
1562  || n == SSL_R_TLSV1_ALERT_ACCESS_DENIED /* 1049 */
1563  || n == SSL_R_TLSV1_ALERT_DECODE_ERROR /* 1050 */
1564  || n == SSL_R_TLSV1_ALERT_DECRYPT_ERROR /* 1051 */
1565  || n == SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION /* 1060 */
1566  || n == SSL_R_TLSV1_ALERT_PROTOCOL_VERSION /* 1070 */
1567  || n == SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY /* 1071 */
1568  || n == SSL_R_TLSV1_ALERT_INTERNAL_ERROR /* 1080 */
1569  || n == SSL_R_TLSV1_ALERT_USER_CANCELLED /* 1090 */
1570  || n == SSL_R_TLSV1_ALERT_NO_RENEGOTIATION) /* 1100 */
1571  {
1572  switch (c->log_error) {
1573 
1574  case NGX_ERROR_IGNORE_ECONNRESET:
1575  case NGX_ERROR_INFO:
1576  level = NGX_LOG_INFO;
1577  break;
1578 
1579  case NGX_ERROR_ERR:
1580  level = NGX_LOG_ERR;
1581  break;
1582 
1583  default:
1584  break;
1585  }
1586  }
1587  }
1588 
1589  ngx_ssl_error(level, c->log, err, text);
1590 }
1591 
1592 
1593 static void
1594 ngx_ssl_clear_error(ngx_log_t *log)
1595 {
1596  while (ERR_peek_error()) {
1597  ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error");
1598  }
1599 
1600  ERR_clear_error();
1601 }
1602 
1603 
1604 void ngx_cdecl
1605 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
1606 {
1607  int flags;
1608  u_long n;
1609  va_list args;
1610  u_char *p, *last;
1611  u_char errstr[NGX_MAX_CONF_ERRSTR];
1612  const char *data;
1613 
1614  last = errstr + NGX_MAX_CONF_ERRSTR;
1615 
1616  va_start(args, fmt);
1617  p = ngx_vslprintf(errstr, last - 1, fmt, args);
1618  va_end(args);
1619 
1620  p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
1621 
1622  for ( ;; ) {
1623 
1624  n = ERR_peek_error_line_data(NULL, NULL, &data, &flags);
1625 
1626  if (n == 0) {
1627  break;
1628  }
1629 
1630  if (p >= last) {
1631  goto next;
1632  }
1633 
1634  *p++ = ' ';
1635 
1636  ERR_error_string_n(n, (char *) p, last - p);
1637 
1638  while (p < last && *p) {
1639  p++;
1640  }
1641 
1642  if (p < last && *data && (flags & ERR_TXT_STRING)) {
1643  *p++ = ':';
1644  p = ngx_cpystrn(p, (u_char *) data, last - p);
1645  }
1646 
1647  next:
1648 
1649  (void) ERR_get_error();
1650  }
1651 
1652  ngx_log_error(level, log, err, "%s)", errstr);
1653 }
1654 
1655 
1656 ngx_int_t
1657 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
1658  ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout)
1659 {
1660  long cache_mode;
1661 
1662  if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
1663  SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
1664  return NGX_OK;
1665  }
1666 
1667  SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
1668 
1669  if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
1670 
1671  /*
1672  * If the server explicitly says that it does not support
1673  * session reuse (see SSL_SESS_CACHE_OFF above), then
1674  * Outlook Express fails to upload a sent email to
1675  * the Sent Items folder on the IMAP server via a separate IMAP
1676  * connection in the background. Therefore we have a special
1677  * mode (SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_STORE)
1678  * where the server pretends that it supports session reuse,
1679  * but it does not actually store any session.
1680  */
1681 
1682  SSL_CTX_set_session_cache_mode(ssl->ctx,
1683  SSL_SESS_CACHE_SERVER
1684  |SSL_SESS_CACHE_NO_AUTO_CLEAR
1685  |SSL_SESS_CACHE_NO_INTERNAL_STORE);
1686 
1687  SSL_CTX_sess_set_cache_size(ssl->ctx, 1);
1688 
1689  return NGX_OK;
1690  }
1691 
1692  cache_mode = SSL_SESS_CACHE_SERVER;
1693 
1694  if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
1695  cache_mode |= SSL_SESS_CACHE_NO_INTERNAL;
1696  }
1697 
1698  SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
1699 
1700  if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
1701 
1702  if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
1703  SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
1704  }
1705  }
1706 
1707  SSL_CTX_set_timeout(ssl->ctx, (long) timeout);
1708 
1709  if (shm_zone) {
1710  SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
1711  SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
1712  SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
1713 
1714  if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
1715  == 0)
1716  {
1717  ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
1718  "SSL_CTX_set_ex_data() failed");
1719  return NGX_ERROR;
1720  }
1721  }
1722 
1723  return NGX_OK;
1724 }
1725 
1726 
1727 ngx_int_t
1728 ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data)
1729 {
1730  size_t len;
1731  ngx_slab_pool_t *shpool;
1732  ngx_ssl_session_cache_t *cache;
1733 
1734  if (data) {
1735  shm_zone->data = data;
1736  return NGX_OK;
1737  }
1738 
1739  if (shm_zone->shm.exists) {
1740  shm_zone->data = data;
1741  return NGX_OK;
1742  }
1743 
1744  shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
1745 
1746  cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
1747  if (cache == NULL) {
1748  return NGX_ERROR;
1749  }
1750 
1751  shpool->data = cache;
1752  shm_zone->data = cache;
1753 
1754  ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel,
1755  ngx_ssl_session_rbtree_insert_value);
1756 
1757  ngx_queue_init(&cache->expire_queue);
1758 
1759  len = sizeof(" in SSL session shared cache \"\"") + shm_zone->shm.name.len;
1760 
1761  shpool->log_ctx = ngx_slab_alloc(shpool, len);
1762  if (shpool->log_ctx == NULL) {
1763  return NGX_ERROR;
1764  }
1765 
1766  ngx_sprintf(shpool->log_ctx, " in SSL session shared cache \"%V\"%Z",
1767  &shm_zone->shm.name);
1768 
1769  return NGX_OK;
1770 }
1771 
1772 
1773 /*
1774  * The length of the session id is 16 bytes for SSLv2 sessions and
1775  * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
1776  * It seems that the typical length of the external ASN1 representation
1777  * of a session is 118 or 119 bytes for SSLv3/TSLv1.
1778  *
1779  * Thus on 32-bit platforms we allocate separately an rbtree node,
1780  * a session id, and an ASN1 representation, they take accordingly
1781  * 64, 32, and 128 bytes.
1782  *
1783  * On 64-bit platforms we allocate separately an rbtree node + session_id,
1784  * and an ASN1 representation, they take accordingly 128 and 128 bytes.
1785  *
1786  * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
1787  * so they are outside the code locked by shared pool mutex
1788  */
1789 
1790 static int
1791 ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
1792 {
1793  int len;
1794  u_char *p, *id, *cached_sess;
1795  uint32_t hash;
1796  SSL_CTX *ssl_ctx;
1797  ngx_shm_zone_t *shm_zone;
1798  ngx_connection_t *c;
1799  ngx_slab_pool_t *shpool;
1800  ngx_ssl_sess_id_t *sess_id;
1801  ngx_ssl_session_cache_t *cache;
1802  u_char buf[NGX_SSL_MAX_SESSION_SIZE];
1803 
1804  len = i2d_SSL_SESSION(sess, NULL);
1805 
1806  /* do not cache too big session */
1807 
1808  if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
1809  return 0;
1810  }
1811 
1812  p = buf;
1813  i2d_SSL_SESSION(sess, &p);
1814 
1815  c = ngx_ssl_get_connection(ssl_conn);
1816 
1817  ssl_ctx = SSL_get_SSL_CTX(ssl_conn);
1818  shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
1819 
1820  cache = shm_zone->data;
1821  shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
1822 
1823  ngx_shmtx_lock(&shpool->mutex);
1824 
1825  /* drop one or two expired sessions */
1826  ngx_ssl_expire_sessions(cache, shpool, 1);
1827 
1828  cached_sess = ngx_slab_alloc_locked(shpool, len);
1829 
1830  if (cached_sess == NULL) {
1831 
1832  /* drop the oldest non-expired session and try once more */
1833 
1834  ngx_ssl_expire_sessions(cache, shpool, 0);
1835 
1836  cached_sess = ngx_slab_alloc_locked(shpool, len);
1837 
1838  if (cached_sess == NULL) {
1839  sess_id = NULL;
1840  goto failed;
1841  }
1842  }
1843 
1844  sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
1845 
1846  if (sess_id == NULL) {
1847 
1848  /* drop the oldest non-expired session and try once more */
1849 
1850  ngx_ssl_expire_sessions(cache, shpool, 0);
1851 
1852  sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
1853 
1854  if (sess_id == NULL) {
1855  goto failed;
1856  }
1857  }
1858 
1859 #if (NGX_PTR_SIZE == 8)
1860 
1861  id = sess_id->sess_id;
1862 
1863 #else
1864 
1865  id = ngx_slab_alloc_locked(shpool, sess->session_id_length);
1866 
1867  if (id == NULL) {
1868 
1869  /* drop the oldest non-expired session and try once more */
1870 
1871  ngx_ssl_expire_sessions(cache, shpool, 0);
1872 
1873  id = ngx_slab_alloc_locked(shpool, sess->session_id_length);
1874 
1875  if (id == NULL) {
1876  goto failed;
1877  }
1878  }
1879 
1880 #endif
1881 
1882  ngx_memcpy(cached_sess, buf, len);
1883 
1884  ngx_memcpy(id, sess->session_id, sess->session_id_length);
1885 
1886  hash = ngx_crc32_short(sess->session_id, sess->session_id_length);
1887 
1888  ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
1889  "ssl new session: %08XD:%d:%d",
1890  hash, sess->session_id_length, len);
1891 
1892  sess_id->node.key = hash;
1893  sess_id->node.data = (u_char) sess->session_id_length;
1894  sess_id->id = id;
1895  sess_id->len = len;
1896  sess_id->session = cached_sess;
1897 
1898  sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx);
1899 
1900  ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue);
1901 
1902  ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node);
1903 
1904  ngx_shmtx_unlock(&shpool->mutex);
1905 
1906  return 0;
1907 
1908 failed:
1909 
1910  if (cached_sess) {
1911  ngx_slab_free_locked(shpool, cached_sess);
1912  }
1913 
1914  if (sess_id) {
1915  ngx_slab_free_locked(shpool, sess_id);
1916  }
1917 
1918  ngx_shmtx_unlock(&shpool->mutex);
1919 
1920  ngx_log_error(NGX_LOG_ALERT, c->log, 0,
1921  "could not add new SSL session to the session cache");
1922 
1923  return 0;
1924 }
1925 
1926 
1927 static ngx_ssl_session_t *
1928 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn, u_char *id, int len,
1929  int *copy)
1930 {
1931 #if OPENSSL_VERSION_NUMBER >= 0x0090707fL
1932  const
1933 #endif
1934  u_char *p;
1935  uint32_t hash;
1936  ngx_int_t rc;
1937  ngx_shm_zone_t *shm_zone;
1938  ngx_slab_pool_t *shpool;
1939  ngx_rbtree_node_t *node, *sentinel;
1940  ngx_ssl_session_t *sess;
1941  ngx_ssl_sess_id_t *sess_id;
1942  ngx_ssl_session_cache_t *cache;
1943  u_char buf[NGX_SSL_MAX_SESSION_SIZE];
1944 #if (NGX_DEBUG)
1945  ngx_connection_t *c;
1946 #endif
1947 
1948  hash = ngx_crc32_short(id, (size_t) len);
1949  *copy = 0;
1950 
1951 #if (NGX_DEBUG)
1952  c = ngx_ssl_get_connection(ssl_conn);
1953 
1954  ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
1955  "ssl get session: %08XD:%d", hash, len);
1956 #endif
1957 
1958  shm_zone = SSL_CTX_get_ex_data(SSL_get_SSL_CTX(ssl_conn),
1959  ngx_ssl_session_cache_index);
1960 
1961  cache = shm_zone->data;
1962 
1963  sess = NULL;
1964 
1965  shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
1966 
1967  ngx_shmtx_lock(&shpool->mutex);
1968 
1969  node = cache->session_rbtree.root;
1970  sentinel = cache->session_rbtree.sentinel;
1971 
1972  while (node != sentinel) {
1973 
1974  if (hash < node->key) {
1975  node = node->left;
1976  continue;
1977  }
1978 
1979  if (hash > node->key) {
1980  node = node->right;
1981  continue;
1982  }
1983 
1984  /* hash == node->key */
1985 
1986  sess_id = (ngx_ssl_sess_id_t *) node;
1987 
1988  rc = ngx_memn2cmp(id, sess_id->id, (size_t) len, (size_t) node->data);
1989 
1990  if (rc == 0) {
1991 
1992  if (sess_id->expire > ngx_time()) {
1993  ngx_memcpy(buf, sess_id->session, sess_id->len);
1994 
1995  ngx_shmtx_unlock(&shpool->mutex);
1996 
1997  p = buf;
1998  sess = d2i_SSL_SESSION(NULL, &p, sess_id->len);
1999 
2000  return sess;
2001  }
2002 
2003  ngx_queue_remove(&sess_id->queue);
2004 
2005  ngx_rbtree_delete(&cache->session_rbtree, node);
2006 
2007  ngx_slab_free_locked(shpool, sess_id->session);
2008 #if (NGX_PTR_SIZE == 4)
2009  ngx_slab_free_locked(shpool, sess_id->id);
2010 #endif
2011  ngx_slab_free_locked(shpool, sess_id);
2012 
2013  sess = NULL;
2014 
2015  goto done;
2016  }
2017 
2018  node = (rc < 0) ? node->left : node->right;
2019  }
2020 
2021 done:
2022 
2023  ngx_shmtx_unlock(&shpool->mutex);
2024 
2025  return sess;
2026 }
2027 
2028 
2029 void
2030 ngx_ssl_remove_cached_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
2031 {
2032  SSL_CTX_remove_session(ssl, sess);
2033 
2034  ngx_ssl_remove_session(ssl, sess);
2035 }
2036 
2037 
2038 static void
2039 ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
2040 {
2041  size_t len;
2042  u_char *id;
2043  uint32_t hash;
2044  ngx_int_t rc;
2045  ngx_shm_zone_t *shm_zone;
2046  ngx_slab_pool_t *shpool;
2047  ngx_rbtree_node_t *node, *sentinel;
2048  ngx_ssl_sess_id_t *sess_id;
2049  ngx_ssl_session_cache_t *cache;
2050 
2051  shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
2052 
2053  if (shm_zone == NULL) {
2054  return;
2055  }
2056 
2057  cache = shm_zone->data;
2058 
2059  id = sess->session_id;
2060  len = (size_t) sess->session_id_length;
2061 
2062  hash = ngx_crc32_short(id, len);
2063 
2064  ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
2065  "ssl remove session: %08XD:%uz", hash, len);
2066 
2067  shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
2068 
2069  ngx_shmtx_lock(&shpool->mutex);
2070 
2071  node = cache->session_rbtree.root;
2072  sentinel = cache->session_rbtree.sentinel;
2073 
2074  while (node != sentinel) {
2075 
2076  if (hash < node->key) {
2077  node = node->left;
2078  continue;
2079  }
2080 
2081  if (hash > node->key) {
2082  node = node->right;
2083  continue;
2084  }
2085 
2086  /* hash == node->key */
2087 
2088  sess_id = (ngx_ssl_sess_id_t *) node;
2089 
2090  rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
2091 
2092  if (rc == 0) {
2093 
2094  ngx_queue_remove(&sess_id->queue);
2095 
2096  ngx_rbtree_delete(&cache->session_rbtree, node);
2097 
2098  ngx_slab_free_locked(shpool, sess_id->session);
2099 #if (NGX_PTR_SIZE == 4)
2100  ngx_slab_free_locked(shpool, sess_id->id);
2101 #endif
2102  ngx_slab_free_locked(shpool, sess_id);
2103 
2104  goto done;
2105  }
2106 
2107  node = (rc < 0) ? node->left : node->right;
2108  }
2109 
2110 done:
2111 
2112  ngx_shmtx_unlock(&shpool->mutex);
2113 }
2114 
2115 
2116 static void
2117 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
2118  ngx_slab_pool_t *shpool, ngx_uint_t n)
2119 {
2120  time_t now;
2121  ngx_queue_t *q;
2122  ngx_ssl_sess_id_t *sess_id;
2123 
2124  now = ngx_time();
2125 
2126  while (n < 3) {
2127 
2128  if (ngx_queue_empty(&cache->expire_queue)) {
2129  return;
2130  }
2131 
2132  q = ngx_queue_last(&cache->expire_queue);
2133 
2134  sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue);
2135 
2136  if (n++ != 0 && sess_id->expire > now) {
2137  return;
2138  }
2139 
2140  ngx_queue_remove(q);
2141 
2142  ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
2143  "expire session: %08Xi", sess_id->node.key);
2144 
2145  ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
2146 
2147  ngx_slab_free_locked(shpool, sess_id->session);
2148 #if (NGX_PTR_SIZE == 4)
2149  ngx_slab_free_locked(shpool, sess_id->id);
2150 #endif
2151  ngx_slab_free_locked(shpool, sess_id);
2152  }
2153 }
2154 
2155 
2156 static void
2157 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
2158  ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
2159 {
2160  ngx_rbtree_node_t **p;
2161  ngx_ssl_sess_id_t *sess_id, *sess_id_temp;
2162 
2163  for ( ;; ) {
2164 
2165  if (node->key < temp->key) {
2166 
2167  p = &temp->left;
2168 
2169  } else if (node->key > temp->key) {
2170 
2171  p = &temp->right;
2172 
2173  } else { /* node->key == temp->key */
2174 
2175  sess_id = (ngx_ssl_sess_id_t *) node;
2176  sess_id_temp = (ngx_ssl_sess_id_t *) temp;
2177 
2178  p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
2179  (size_t) node->data, (size_t) temp->data)
2180  < 0) ? &temp->left : &temp->right;
2181  }
2182 
2183  if (*p == sentinel) {
2184  break;
2185  }
2186 
2187  temp = *p;
2188  }
2189 
2190  *p = node;
2191  node->parent = temp;
2192  node->left = sentinel;
2193  node->right = sentinel;
2194  ngx_rbt_red(node);
2195 }
2196 
2197 
2198 void
2199 ngx_ssl_cleanup_ctx(void *data)
2200 {
2201  ngx_ssl_t *ssl = data;
2202 
2203  SSL_CTX_free(ssl->ctx);
2204 }
2205 
2206 
2207 ngx_int_t
2208 ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2209 {
2210  s->data = (u_char *) SSL_get_version(c->ssl->connection);
2211  return NGX_OK;
2212 }
2213 
2214 
2215 ngx_int_t
2216 ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2217 {
2218  s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
2219  return NGX_OK;
2220 }
2221 
2222 
2223 ngx_int_t
2224 ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2225 {
2226  int len;
2227  u_char *p, *buf;
2228  SSL_SESSION *sess;
2229 
2230  sess = SSL_get0_session(c->ssl->connection);
2231 
2232  len = i2d_SSL_SESSION(sess, NULL);
2233 
2234  buf = ngx_alloc(len, c->log);
2235  if (buf == NULL) {
2236  return NGX_ERROR;
2237  }
2238 
2239  s->len = 2 * len;
2240  s->data = ngx_pnalloc(pool, 2 * len);
2241  if (s->data == NULL) {
2242  ngx_free(buf);
2243  return NGX_ERROR;
2244  }
2245 
2246  p = buf;
2247  i2d_SSL_SESSION(sess, &p);
2248 
2249  ngx_hex_dump(s->data, buf, len);
2250 
2251  ngx_free(buf);
2252 
2253  return NGX_OK;
2254 }
2255 
2256 
2257 ngx_int_t
2258 ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2259 {
2260  size_t len;
2261  BIO *bio;
2262  X509 *cert;
2263 
2264  s->len = 0;
2265 
2266  cert = SSL_get_peer_certificate(c->ssl->connection);
2267  if (cert == NULL) {
2268  return NGX_OK;
2269  }
2270 
2271  bio = BIO_new(BIO_s_mem());
2272  if (bio == NULL) {
2273  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
2274  X509_free(cert);
2275  return NGX_ERROR;
2276  }
2277 
2278  if (PEM_write_bio_X509(bio, cert) == 0) {
2279  ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed");
2280  goto failed;
2281  }
2282 
2283  len = BIO_pending(bio);
2284  s->len = len;
2285 
2286  s->data = ngx_pnalloc(pool, len);
2287  if (s->data == NULL) {
2288  goto failed;
2289  }
2290 
2291  BIO_read(bio, s->data, len);
2292 
2293  BIO_free(bio);
2294  X509_free(cert);
2295 
2296  return NGX_OK;
2297 
2298 failed:
2299 
2300  BIO_free(bio);
2301  X509_free(cert);
2302 
2303  return NGX_ERROR;
2304 }
2305 
2306 
2307 ngx_int_t
2308 ngx_ssl_get_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2309 {
2310  u_char *p;
2311  size_t len;
2312  ngx_uint_t i;
2313  ngx_str_t cert;
2314 
2315  if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
2316  return NGX_ERROR;
2317  }
2318 
2319  if (cert.len == 0) {
2320  s->len = 0;
2321  return NGX_OK;
2322  }
2323 
2324  len = cert.len - 1;
2325 
2326  for (i = 0; i < cert.len - 1; i++) {
2327  if (cert.data[i] == LF) {
2328  len++;
2329  }
2330  }
2331 
2332  s->len = len;
2333  s->data = ngx_pnalloc(pool, len);
2334  if (s->data == NULL) {
2335  return NGX_ERROR;
2336  }
2337 
2338  p = s->data;
2339 
2340  for (i = 0; i < cert.len - 1; i++) {
2341  *p++ = cert.data[i];
2342  if (cert.data[i] == LF) {
2343  *p++ = '\t';
2344  }
2345  }
2346 
2347  return NGX_OK;
2348 }
2349 
2350 
2351 ngx_int_t
2352 ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2353 {
2354  char *p;
2355  size_t len;
2356  X509 *cert;
2357  X509_NAME *name;
2358 
2359  s->len = 0;
2360 
2361  cert = SSL_get_peer_certificate(c->ssl->connection);
2362  if (cert == NULL) {
2363  return NGX_OK;
2364  }
2365 
2366  name = X509_get_subject_name(cert);
2367  if (name == NULL) {
2368  X509_free(cert);
2369  return NGX_ERROR;
2370  }
2371 
2372  p = X509_NAME_oneline(name, NULL, 0);
2373 
2374  for (len = 0; p[len]; len++) { /* void */ }
2375 
2376  s->len = len;
2377  s->data = ngx_pnalloc(pool, len);
2378  if (s->data == NULL) {
2379  OPENSSL_free(p);
2380  X509_free(cert);
2381  return NGX_ERROR;
2382  }
2383 
2384  ngx_memcpy(s->data, p, len);
2385 
2386  OPENSSL_free(p);
2387  X509_free(cert);
2388 
2389  return NGX_OK;
2390 }
2391 
2392 
2393 ngx_int_t
2394 ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2395 {
2396  char *p;
2397  size_t len;
2398  X509 *cert;
2399  X509_NAME *name;
2400 
2401  s->len = 0;
2402 
2403  cert = SSL_get_peer_certificate(c->ssl->connection);
2404  if (cert == NULL) {
2405  return NGX_OK;
2406  }
2407 
2408  name = X509_get_issuer_name(cert);
2409  if (name == NULL) {
2410  X509_free(cert);
2411  return NGX_ERROR;
2412  }
2413 
2414  p = X509_NAME_oneline(name, NULL, 0);
2415 
2416  for (len = 0; p[len]; len++) { /* void */ }
2417 
2418  s->len = len;
2419  s->data = ngx_pnalloc(pool, len);
2420  if (s->data == NULL) {
2421  OPENSSL_free(p);
2422  X509_free(cert);
2423  return NGX_ERROR;
2424  }
2425 
2426  ngx_memcpy(s->data, p, len);
2427 
2428  OPENSSL_free(p);
2429  X509_free(cert);
2430 
2431  return NGX_OK;
2432 }
2433 
2434 
2435 ngx_int_t
2436 ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2437 {
2438  size_t len;
2439  X509 *cert;
2440  BIO *bio;
2441 
2442  s->len = 0;
2443 
2444  cert = SSL_get_peer_certificate(c->ssl->connection);
2445  if (cert == NULL) {
2446  return NGX_OK;
2447  }
2448 
2449  bio = BIO_new(BIO_s_mem());
2450  if (bio == NULL) {
2451  X509_free(cert);
2452  return NGX_ERROR;
2453  }
2454 
2455  i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
2456  len = BIO_pending(bio);
2457 
2458  s->len = len;
2459  s->data = ngx_pnalloc(pool, len);
2460  if (s->data == NULL) {
2461  BIO_free(bio);
2462  X509_free(cert);
2463  return NGX_ERROR;
2464  }
2465 
2466  BIO_read(bio, s->data, len);
2467  BIO_free(bio);
2468  X509_free(cert);
2469 
2470  return NGX_OK;
2471 }
2472 
2473 
2474 ngx_int_t
2475 ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2476 {
2477  X509 *cert;
2478 
2479  if (SSL_get_verify_result(c->ssl->connection) != X509_V_OK) {
2480  ngx_str_set(s, "FAILED");
2481  return NGX_OK;
2482  }
2483 
2484  cert = SSL_get_peer_certificate(c->ssl->connection);
2485 
2486  if (cert) {
2487  ngx_str_set(s, "SUCCESS");
2488 
2489  } else {
2490  ngx_str_set(s, "NONE");
2491  }
2492 
2493  X509_free(cert);
2494 
2495  return NGX_OK;
2496 }
2497 
2498 
2499 static void *
2500 ngx_openssl_create_conf(ngx_cycle_t *cycle)
2501 {
2502  ngx_openssl_conf_t *oscf;
2503 
2504  oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
2505  if (oscf == NULL) {
2506  return NULL;
2507  }
2508 
2509  /*
2510  * set by ngx_pcalloc():
2511  *
2512  * oscf->engine = 0;
2513  */
2514 
2515  return oscf;
2516 }
2517 
2518 
2519 static char *
2520 ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
2521 {
2522  ngx_openssl_conf_t *oscf = conf;
2523 
2524  ENGINE *engine;
2525  ngx_str_t *value;
2526 
2527  if (oscf->engine) {
2528  return "is duplicate";
2529  }
2530 
2531  oscf->engine = 1;
2532 
2533  value = cf->args->elts;
2534 
2535  engine = ENGINE_by_id((const char *) value[1].data);
2536 
2537  if (engine == NULL) {
2538  ngx_ssl_error(NGX_LOG_WARN, cf->log, 0,
2539  "ENGINE_by_id(\"%V\") failed", &value[1]);
2540  return NGX_CONF_ERROR;
2541  }
2542 
2543  if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
2544  ngx_ssl_error(NGX_LOG_WARN, cf->log, 0,
2545  "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
2546  &value[1]);
2547 
2548  ENGINE_free(engine);
2549 
2550  return NGX_CONF_ERROR;
2551  }
2552 
2553  ENGINE_free(engine);
2554 
2555  return NGX_CONF_OK;
2556 }
2557 
2558 
2559 static void
2560 ngx_openssl_exit(ngx_cycle_t *cycle)
2561 {
2562  EVP_cleanup();
2563  ENGINE_cleanup();
2564 }
Generated on Sun Nov 10 2013 09:49:07 for Groonga 3.0.9 Source Code Document by   doxygen 1.8.1.2