One Level Up Top Level

src/http/modules/ngx_http_ssl_module.c - nginx

Global variables defined

Data types defined

Functions defined

Macros defined

Source code


  2. /*
  3. * Copyright (C) Igor Sysoev
  4. * Copyright (C) Nginx, Inc.
  5. */


  8. #include <ngx_config.h>
  9. #include <ngx_core.h>
  10. #include <ngx_http.h>

  12. #if (NGX_QUIC_OPENSSL_COMPAT)
  13. #include <ngx_event_quic_openssl_compat.h>
  14. #endif


  17. ‌typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
  18.     ngx_pool_t *pool, ngx_str_t *s);


  21. ‌#define NGX_DEFAULT_CIPHERS     "HIGH:!aNULL:!MD5"
  22. ‌#define NGX_DEFAULT_ECDH_CURVE  "auto"

  24. ‌#define NGX_HTTP_ALPN_PROTOS    "\x08http/1.1\x08http/1.0\x08http/0.9"


  27. #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
  28. static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
  29.     const unsigned char **out, unsigned char *outlen,
  30.     const unsigned char *in, unsigned int inlen, void *arg);
  31. #endif

  33. static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r,
  34.     ngx_http_variable_value_t *v, uintptr_t data);
  35. static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r,
  36.     ngx_http_variable_value_t *v, uintptr_t data);

  38. static ngx_int_t ngx_http_ssl_add_variables(ngx_conf_t *cf);
  39. static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf);
  40. static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf,
  41.     void *parent, void *child);

  43. static ngx_int_t ngx_http_ssl_compile_certificates(ngx_conf_t *cf,
  44.     ngx_http_ssl_srv_conf_t *conf);

  46. static char *ngx_http_ssl_certificate_cache(ngx_conf_t *cf, ngx_command_t *cmd,
  47.     void *conf);
  48. static char *ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd,
  49.     void *conf);
  50. static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
  51.     void *conf);
  52. static char *ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd,
  53.     void *conf);

  55. static char *ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post,
  56.     void *data);

  58. static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf);
  59. #if (NGX_QUIC_OPENSSL_COMPAT)
  60. static ngx_int_t ngx_http_ssl_quic_compat_init(ngx_conf_t *cf,
  61.     ngx_http_conf_addr_t *addr);
  62. #endif


  65. ‌static ngx_conf_bitmask_t  ngx_http_ssl_protocols[] = {
  66.     { ngx_string("SSLv2"), NGX_SSL_SSLv2 },
  67.     { ngx_string("SSLv3"), NGX_SSL_SSLv3 },
  68.     { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
  69.     { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
  70.     { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
  71.     { ngx_string("TLSv1.3"), NGX_SSL_TLSv1_3 },
  72.     { ngx_null_string, 0 }
  73. };


  76. ‌static ngx_conf_enum_t  ngx_http_ssl_verify[] = {
  77.     { ngx_string("off"), 0 },
  78.     { ngx_string("on"), 1 },
  79.     { ngx_string("optional"), 2 },
  80.     { ngx_string("optional_no_ca"), 3 },
  81.     { ngx_null_string, 0 }
  82. };


  85. ‌static ngx_conf_enum_t  ngx_http_ssl_ocsp[] = {
  86.     { ngx_string("off"), 0 },
  87.     { ngx_string("on"), 1 },
  88.     { ngx_string("leaf"), 2 },
  89.     { ngx_null_string, 0 }
  90. };


  93. ‌static ngx_conf_post_t  ngx_http_ssl_conf_command_post =
  94.     { ngx_http_ssl_conf_command_check };


  97. ‌static ngx_command_t  ngx_http_ssl_commands[] = {

  99.     { ngx_string("ssl_certificate"),
  100.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  101.       ngx_conf_set_str_array_slot,
  102.       NGX_HTTP_SRV_CONF_OFFSET,
  103.       offsetof(ngx_http_ssl_srv_conf_t, certificates),
  104.       NULL },

  106.     { ngx_string("ssl_certificate_key"),
  107.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  108.       ngx_conf_set_str_array_slot,
  109.       NGX_HTTP_SRV_CONF_OFFSET,
  110.       offsetof(ngx_http_ssl_srv_conf_t, certificate_keys),
  111.       NULL },

  113.     { ngx_string("ssl_certificate_cache"),
  114.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE123,
  115.       ngx_http_ssl_certificate_cache,
  116.       NGX_HTTP_SRV_CONF_OFFSET,
  117.       0,
  118.       NULL },

  120.     { ngx_string("ssl_ech_file"),
  121.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  122.       ngx_conf_set_str_array_slot,
  123.       NGX_HTTP_SRV_CONF_OFFSET,
  124.       offsetof(ngx_http_ssl_srv_conf_t, ech_files),
  125.       NULL },

  127.     { ngx_string("ssl_password_file"),
  128.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  129.       ngx_http_ssl_password_file,
  130.       NGX_HTTP_SRV_CONF_OFFSET,
  131.       0,
  132.       NULL },

  134.     { ngx_string("ssl_certificate_compression"),
  135.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  136.       ngx_conf_set_flag_slot,
  137.       NGX_HTTP_SRV_CONF_OFFSET,
  138.       offsetof(ngx_http_ssl_srv_conf_t, certificate_compression),
  139.       NULL },

  141.     { ngx_string("ssl_dhparam"),
  142.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  143.       ngx_conf_set_str_slot,
  144.       NGX_HTTP_SRV_CONF_OFFSET,
  145.       offsetof(ngx_http_ssl_srv_conf_t, dhparam),
  146.       NULL },

  148.     { ngx_string("ssl_ecdh_curve"),
  149.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  150.       ngx_conf_set_str_slot,
  151.       NGX_HTTP_SRV_CONF_OFFSET,
  152.       offsetof(ngx_http_ssl_srv_conf_t, ecdh_curve),
  153.       NULL },

  155.     { ngx_string("ssl_protocols"),
  156.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_1MORE,
  157.       ngx_conf_set_bitmask_slot,
  158.       NGX_HTTP_SRV_CONF_OFFSET,
  159.       offsetof(ngx_http_ssl_srv_conf_t, protocols),
  160.       &ngx_http_ssl_protocols },

  162.     { ngx_string("ssl_ciphers"),
  163.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  164.       ngx_conf_set_str_slot,
  165.       NGX_HTTP_SRV_CONF_OFFSET,
  166.       offsetof(ngx_http_ssl_srv_conf_t, ciphers),
  167.       NULL },

  169.     { ngx_string("ssl_buffer_size"),
  170.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  171.       ngx_conf_set_size_slot,
  172.       NGX_HTTP_SRV_CONF_OFFSET,
  173.       offsetof(ngx_http_ssl_srv_conf_t, buffer_size),
  174.       NULL },

  176.     { ngx_string("ssl_verify_client"),
  177.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  178.       ngx_conf_set_enum_slot,
  179.       NGX_HTTP_SRV_CONF_OFFSET,
  180.       offsetof(ngx_http_ssl_srv_conf_t, verify),
  181.       &ngx_http_ssl_verify },

  183.     { ngx_string("ssl_verify_depth"),
  184.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  185.       ngx_conf_set_num_slot,
  186.       NGX_HTTP_SRV_CONF_OFFSET,
  187.       offsetof(ngx_http_ssl_srv_conf_t, verify_depth),
  188.       NULL },

  190.     { ngx_string("ssl_client_certificate"),
  191.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  192.       ngx_conf_set_str_slot,
  193.       NGX_HTTP_SRV_CONF_OFFSET,
  194.       offsetof(ngx_http_ssl_srv_conf_t, client_certificate),
  195.       NULL },

  197.     { ngx_string("ssl_trusted_certificate"),
  198.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  199.       ngx_conf_set_str_slot,
  200.       NGX_HTTP_SRV_CONF_OFFSET,
  201.       offsetof(ngx_http_ssl_srv_conf_t, trusted_certificate),
  202.       NULL },

  204.     { ngx_string("ssl_prefer_server_ciphers"),
  205.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  206.       ngx_conf_set_flag_slot,
  207.       NGX_HTTP_SRV_CONF_OFFSET,
  208.       offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers),
  209.       NULL },

  211.     { ngx_string("ssl_session_cache"),
  212.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12,
  213.       ngx_http_ssl_session_cache,
  214.       NGX_HTTP_SRV_CONF_OFFSET,
  215.       0,
  216.       NULL },

  218.     { ngx_string("ssl_session_tickets"),
  219.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  220.       ngx_conf_set_flag_slot,
  221.       NGX_HTTP_SRV_CONF_OFFSET,
  222.       offsetof(ngx_http_ssl_srv_conf_t, session_tickets),
  223.       NULL },

  225.     { ngx_string("ssl_session_ticket_key"),
  226.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  227.       ngx_conf_set_str_array_slot,
  228.       NGX_HTTP_SRV_CONF_OFFSET,
  229.       offsetof(ngx_http_ssl_srv_conf_t, session_ticket_keys),
  230.       NULL },

  232.     { ngx_string("ssl_session_timeout"),
  233.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  234.       ngx_conf_set_sec_slot,
  235.       NGX_HTTP_SRV_CONF_OFFSET,
  236.       offsetof(ngx_http_ssl_srv_conf_t, session_timeout),
  237.       NULL },

  239.     { ngx_string("ssl_crl"),
  240.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  241.       ngx_conf_set_str_slot,
  242.       NGX_HTTP_SRV_CONF_OFFSET,
  243.       offsetof(ngx_http_ssl_srv_conf_t, crl),
  244.       NULL },

  246.     { ngx_string("ssl_ocsp"),
  247.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  248.       ngx_conf_set_enum_slot,
  249.       NGX_HTTP_SRV_CONF_OFFSET,
  250.       offsetof(ngx_http_ssl_srv_conf_t, ocsp),
  251.       &ngx_http_ssl_ocsp },

  253.     { ngx_string("ssl_ocsp_responder"),
  254.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  255.       ngx_conf_set_str_slot,
  256.       NGX_HTTP_SRV_CONF_OFFSET,
  257.       offsetof(ngx_http_ssl_srv_conf_t, ocsp_responder),
  258.       NULL },

  260.     { ngx_string("ssl_ocsp_cache"),
  261.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  262.       ngx_http_ssl_ocsp_cache,
  263.       NGX_HTTP_SRV_CONF_OFFSET,
  264.       0,
  265.       NULL },

  267.     { ngx_string("ssl_stapling"),
  268.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  269.       ngx_conf_set_flag_slot,
  270.       NGX_HTTP_SRV_CONF_OFFSET,
  271.       offsetof(ngx_http_ssl_srv_conf_t, stapling),
  272.       NULL },

  274.     { ngx_string("ssl_stapling_file"),
  275.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  276.       ngx_conf_set_str_slot,
  277.       NGX_HTTP_SRV_CONF_OFFSET,
  278.       offsetof(ngx_http_ssl_srv_conf_t, stapling_file),
  279.       NULL },

  281.     { ngx_string("ssl_stapling_responder"),
  282.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
  283.       ngx_conf_set_str_slot,
  284.       NGX_HTTP_SRV_CONF_OFFSET,
  285.       offsetof(ngx_http_ssl_srv_conf_t, stapling_responder),
  286.       NULL },

  288.     { ngx_string("ssl_stapling_verify"),
  289.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  290.       ngx_conf_set_flag_slot,
  291.       NGX_HTTP_SRV_CONF_OFFSET,
  292.       offsetof(ngx_http_ssl_srv_conf_t, stapling_verify),
  293.       NULL },

  295.     { ngx_string("ssl_early_data"),
  296.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  297.       ngx_conf_set_flag_slot,
  298.       NGX_HTTP_SRV_CONF_OFFSET,
  299.       offsetof(ngx_http_ssl_srv_conf_t, early_data),
  300.       NULL },

  302.     { ngx_string("ssl_conf_command"),
  303.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE2,
  304.       ngx_conf_set_keyval_slot,
  305.       NGX_HTTP_SRV_CONF_OFFSET,
  306.       offsetof(ngx_http_ssl_srv_conf_t, conf_commands),
  307.       &ngx_http_ssl_conf_command_post },

  309.     { ngx_string("ssl_reject_handshake"),
  310.       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
  311.       ngx_conf_set_flag_slot,
  312.       NGX_HTTP_SRV_CONF_OFFSET,
  313.       offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
  314.       NULL },

  316.       ngx_null_command
  317. };


  320. ‌static ngx_http_module_t  ngx_http_ssl_module_ctx = {
  321.     ngx_http_ssl_add_variables,            /* preconfiguration */
  322.     ngx_http_ssl_init,                     /* postconfiguration */

  324.     NULL,                                  /* create main configuration */
  325.     NULL,                                  /* init main configuration */

  327.     ngx_http_ssl_create_srv_conf,          /* create server configuration */
  328.     ngx_http_ssl_merge_srv_conf,           /* merge server configuration */

  330.     NULL,                                  /* create location configuration */
  331.     NULL                                   /* merge location configuration */
  332. };


  335. ‌ngx_module_t  ngx_http_ssl_module = {
  336.     NGX_MODULE_V1,
  337.     &ngx_http_ssl_module_ctx,              /* module context */
  338.     ngx_http_ssl_commands,                 /* module directives */
  339.     NGX_HTTP_MODULE,                       /* module type */
  340.     NULL,                                  /* init master */
  341.     NULL,                                  /* init module */
  342.     NULL,                                  /* init process */
  343.     NULL,                                  /* init thread */
  344.     NULL,                                  /* exit thread */
  345.     NULL,                                  /* exit process */
  346.     NULL,                                  /* exit master */
  347.     NGX_MODULE_V1_PADDING
  348. };


  351. ‌static ngx_http_variable_t  ngx_http_ssl_vars[] = {

  353.     { ngx_string("ssl_protocol"), NULL, ngx_http_ssl_static_variable,
  354.       (uintptr_t) ngx_ssl_get_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 },

  356.     { ngx_string("ssl_cipher"), NULL, ngx_http_ssl_static_variable,
  357.       (uintptr_t) ngx_ssl_get_cipher_name, NGX_HTTP_VAR_CHANGEABLE, 0 },

  359.     { ngx_string("ssl_ciphers"), NULL, ngx_http_ssl_variable,
  360.       (uintptr_t) ngx_ssl_get_ciphers, NGX_HTTP_VAR_CHANGEABLE, 0 },

  362.     { ngx_string("ssl_curve"), NULL, ngx_http_ssl_variable,
  363.       (uintptr_t) ngx_ssl_get_curve, NGX_HTTP_VAR_CHANGEABLE, 0 },

  365.     { ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable,
  366.       (uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 },

  368.     { ngx_string("ssl_sigalg"), NULL, ngx_http_ssl_variable,
  369.       (uintptr_t) ngx_ssl_get_sigalg, NGX_HTTP_VAR_CHANGEABLE, 0 },

  371.     { ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable,
  372.       (uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 },

  374.     { ngx_string("ssl_session_reused"), NULL, ngx_http_ssl_variable,
  375.       (uintptr_t) ngx_ssl_get_session_reused, NGX_HTTP_VAR_CHANGEABLE, 0 },

  377.     { ngx_string("ssl_early_data"), NULL, ngx_http_ssl_variable,
  378.       (uintptr_t) ngx_ssl_get_early_data,
  379.       NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 },

  381.     { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable,
  382.       (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 },

  384.     { ngx_string("ssl_alpn_protocol"), NULL, ngx_http_ssl_variable,
  385.       (uintptr_t) ngx_ssl_get_alpn_protocol, NGX_HTTP_VAR_CHANGEABLE, 0 },

  387.     { ngx_string("ssl_ech_status"), NULL, ngx_http_ssl_variable,
  388.       (uintptr_t) ngx_ssl_get_ech_status, NGX_HTTP_VAR_CHANGEABLE, 0 },

  390.     { ngx_string("ssl_ech_outer_server_name"), NULL, ngx_http_ssl_variable,
  391.       (uintptr_t) ngx_ssl_get_ech_outer_server_name,
  392.       NGX_HTTP_VAR_CHANGEABLE, 0 },

  394.     { ngx_string("ssl_client_cert"), NULL, ngx_http_ssl_variable,
  395.       (uintptr_t) ngx_ssl_get_certificate, NGX_HTTP_VAR_CHANGEABLE, 0 },

  397.     { ngx_string("ssl_client_raw_cert"), NULL, ngx_http_ssl_variable,
  398.       (uintptr_t) ngx_ssl_get_raw_certificate,
  399.       NGX_HTTP_VAR_CHANGEABLE, 0 },

  401.     { ngx_string("ssl_client_escaped_cert"), NULL, ngx_http_ssl_variable,
  402.       (uintptr_t) ngx_ssl_get_escaped_certificate,
  403.       NGX_HTTP_VAR_CHANGEABLE, 0 },

  405.     { ngx_string("ssl_client_s_dn"), NULL, ngx_http_ssl_variable,
  406.       (uintptr_t) ngx_ssl_get_subject_dn, NGX_HTTP_VAR_CHANGEABLE, 0 },

  408.     { ngx_string("ssl_client_i_dn"), NULL, ngx_http_ssl_variable,
  409.       (uintptr_t) ngx_ssl_get_issuer_dn, NGX_HTTP_VAR_CHANGEABLE, 0 },

  411.     { ngx_string("ssl_client_s_dn_legacy"), NULL, ngx_http_ssl_variable,
  412.       (uintptr_t) ngx_ssl_get_subject_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 },

  414.     { ngx_string("ssl_client_i_dn_legacy"), NULL, ngx_http_ssl_variable,
  415.       (uintptr_t) ngx_ssl_get_issuer_dn_legacy, NGX_HTTP_VAR_CHANGEABLE, 0 },

  417.     { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable,
  418.       (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 },

  420.     { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable,
  421.       (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 },

  423.     { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
  424.       (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 },

  426.     { ngx_string("ssl_client_v_start"), NULL, ngx_http_ssl_variable,
  427.       (uintptr_t) ngx_ssl_get_client_v_start, NGX_HTTP_VAR_CHANGEABLE, 0 },

  429.     { ngx_string("ssl_client_v_end"), NULL, ngx_http_ssl_variable,
  430.       (uintptr_t) ngx_ssl_get_client_v_end, NGX_HTTP_VAR_CHANGEABLE, 0 },

  432.     { ngx_string("ssl_client_v_remain"), NULL, ngx_http_ssl_variable,
  433.       (uintptr_t) ngx_ssl_get_client_v_remain, NGX_HTTP_VAR_CHANGEABLE, 0 },

  435.     { ngx_string("ssl_client_sigalg"), NULL, ngx_http_ssl_variable,
  436.       (uintptr_t) ngx_ssl_get_client_sigalg, NGX_HTTP_VAR_CHANGEABLE, 0 },

  438.       ngx_http_null_variable
  439. };


  442. ‌static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP");


  445. #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation

  447. static int
  448. ‌ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out,
  449.     unsigned char *outlen, const unsigned char *in, unsigned int inlen,
  450.     void *arg)
  451. {
  452.     unsigned int             srvlen;
  453.     unsigned char           *srv;
  454. #if (NGX_DEBUG)
  455.     unsigned int             i;
  456. #endif
  457. #if (NGX_HTTP_V2 || NGX_HTTP_V3)
  458.     ngx_http_connection_t   *hc;
  459. #endif
  460. #if (NGX_HTTP_V2)
  461.     ngx_http_v2_srv_conf_t  *h2scf;
  462. #endif
  463. #if (NGX_HTTP_V3)
  464.     ngx_http_v3_srv_conf_t  *h3scf;
  465. #endif
  466. #if (NGX_HTTP_V2 || NGX_HTTP_V3 || NGX_DEBUG)
  467.     ngx_connection_t        *c;

  469.     c = ngx_ssl_get_connection(ssl_conn);
  470. #endif

  472. #if (NGX_DEBUG)
  473.     for (i = 0; i < inlen; i += in[i] + 1) {
  474.         ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
  475.                        "SSL ALPN supported by client: %*s",
  476.                        (size_t) in[i], &in[i + 1]);
  477.     }
  478. #endif

  480. #if (NGX_HTTP_V2 || NGX_HTTP_V3)
  481.     hc = c->data;
  482. #endif

  484. #if (NGX_HTTP_V3)
  485.     if (hc->addr_conf->quic) {

  487.         h3scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v3_module);

  489.         if (h3scf->enable && h3scf->enable_hq) {
  490.             srv = (unsigned char *) NGX_HTTP_V3_ALPN_PROTO
  491.                                     NGX_HTTP_V3_HQ_ALPN_PROTO;
  492.             srvlen = sizeof(NGX_HTTP_V3_ALPN_PROTO NGX_HTTP_V3_HQ_ALPN_PROTO)
  493.                      - 1;

  495.         } else if (h3scf->enable_hq) {
  496.             srv = (unsigned char *) NGX_HTTP_V3_HQ_ALPN_PROTO;
  497.             srvlen = sizeof(NGX_HTTP_V3_HQ_ALPN_PROTO) - 1;

  499.         } else if (h3scf->enable) {
  500.             srv = (unsigned char *) NGX_HTTP_V3_ALPN_PROTO;
  501.             srvlen = sizeof(NGX_HTTP_V3_ALPN_PROTO) - 1;

  503.         } else {
  504.             return SSL_TLSEXT_ERR_ALERT_FATAL;
  505.         }

  507.     } else
  508. #endif
  509.     {
  510. #if (NGX_HTTP_V2)
  511.         h2scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v2_module);

  513.         if (h2scf->enable || hc->addr_conf->http2) {
  514.             srv = (unsigned char *) NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTOS;
  515.             srvlen = sizeof(NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTOS) - 1;

  517.         } else
  518. #endif
  519.         {
  520.             srv = (unsigned char *) NGX_HTTP_ALPN_PROTOS;
  521.             srvlen = sizeof(NGX_HTTP_ALPN_PROTOS) - 1;
  522.         }
  523.     }

  525.     if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen,
  526.                               in, inlen)
  527.         != OPENSSL_NPN_NEGOTIATED)
  528.     {
  529.         return SSL_TLSEXT_ERR_ALERT_FATAL;
  530.     }

  532.     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
  533.                    "SSL ALPN selected: %*s", (size_t) *outlen, *out);

  535.     return SSL_TLSEXT_ERR_OK;
  536. }

  538. #endif


  541. static ngx_int_t
  542. ‌ngx_http_ssl_static_variable(ngx_http_request_t *r,
  543.     ngx_http_variable_value_t *v, uintptr_t data)
  544. {
  545.     ngx_ssl_variable_handler_pt  handler = (ngx_ssl_variable_handler_pt) data;

  547.     size_t     len;
  548.     ngx_str_t  s;

  550.     if (r->connection->ssl) {

  552.         (void) handler(r->connection, NULL, &s);

  554.         v->data = s.data;

  556.         for (len = 0; v->data[len]; len++) { /* void */ }

  558.         v->len = len;
  559.         v->valid = 1;
  560.         v->no_cacheable = 0;
  561.         v->not_found = 0;

  563.         return NGX_OK;
  564.     }

  566.     v->not_found = 1;

  568.     return NGX_OK;
  569. }


  572. static ngx_int_t
  573. ‌ngx_http_ssl_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
  574.     uintptr_t data)
  575. {
  576.     ngx_ssl_variable_handler_pt  handler = (ngx_ssl_variable_handler_pt) data;

  578.     ngx_str_t  s;

  580.     if (r->connection->ssl) {

  582.         if (handler(r->connection, r->pool, &s) != NGX_OK) {
  583.             return NGX_ERROR;
  584.         }

  586.         v->len = s.len;
  587.         v->data = s.data;

  589.         if (v->len) {
  590.             v->valid = 1;
  591.             v->no_cacheable = 0;
  592.             v->not_found = 0;

  594.             return NGX_OK;
  595.         }
  596.     }

  598.     v->not_found = 1;

  600.     return NGX_OK;
  601. }


  604. static ngx_int_t
  605. ‌ngx_http_ssl_add_variables(ngx_conf_t *cf)
  606. {
  607.     ngx_http_variable_t  *var, *v;

  609.     for (v = ngx_http_ssl_vars; v->name.len; v++) {
  610.         var = ngx_http_add_variable(cf, &v->name, v->flags);
  611.         if (var == NULL) {
  612.             return NGX_ERROR;
  613.         }

  615.         var->get_handler = v->get_handler;
  616.         var->data = v->data;
  617.     }

  619.     return NGX_OK;
  620. }


  623. static void *
  624. ‌ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
  625. {
  626.     ngx_http_ssl_srv_conf_t  *sscf;

  628.     sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t));
  629.     if (sscf == NULL) {
  630.         return NULL;
  631.     }

  633.     /*
  634.      * set by ngx_pcalloc():
  635.      *
  636.      *     sscf->protocols = 0;
  637.      *     sscf->certificate_values = NULL;
  638.      *     sscf->dhparam = { 0, NULL };
  639.      *     sscf->ecdh_curve = { 0, NULL };
  640.      *     sscf->client_certificate = { 0, NULL };
  641.      *     sscf->trusted_certificate = { 0, NULL };
  642.      *     sscf->crl = { 0, NULL };
  643.      *     sscf->ciphers = { 0, NULL };
  644.      *     sscf->shm_zone = NULL;
  645.      *     sscf->ocsp_responder = { 0, NULL };
  646.      *     sscf->stapling_file = { 0, NULL };
  647.      *     sscf->stapling_responder = { 0, NULL };
  648.      */

  650.     sscf->prefer_server_ciphers = NGX_CONF_UNSET;
  651.     sscf->certificate_compression = NGX_CONF_UNSET;
  652.     sscf->early_data = NGX_CONF_UNSET;
  653.     sscf->reject_handshake = NGX_CONF_UNSET;
  654.     sscf->buffer_size = NGX_CONF_UNSET_SIZE;
  655.     sscf->verify = NGX_CONF_UNSET_UINT;
  656.     sscf->verify_depth = NGX_CONF_UNSET_UINT;
  657.     sscf->certificates = NGX_CONF_UNSET_PTR;
  658.     sscf->certificate_keys = NGX_CONF_UNSET_PTR;
  659.     sscf->certificate_cache = NGX_CONF_UNSET_PTR;
  660.     sscf->ech_files = NGX_CONF_UNSET_PTR;
  661.     sscf->passwords = NGX_CONF_UNSET_PTR;
  662.     sscf->conf_commands = NGX_CONF_UNSET_PTR;
  663.     sscf->builtin_session_cache = NGX_CONF_UNSET;
  664.     sscf->session_timeout = NGX_CONF_UNSET;
  665.     sscf->session_tickets = NGX_CONF_UNSET;
  666.     sscf->session_ticket_keys = NGX_CONF_UNSET_PTR;
  667.     sscf->ocsp = NGX_CONF_UNSET_UINT;
  668.     sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
  669.     sscf->stapling = NGX_CONF_UNSET;
  670.     sscf->stapling_verify = NGX_CONF_UNSET;

  672.     return sscf;
  673. }


  676. static char *
  677. ‌ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
  678. {
  679.     ngx_http_ssl_srv_conf_t *prev = parent;
  680.     ngx_http_ssl_srv_conf_t *conf = child;

  682.     ngx_pool_cleanup_t  *cln;

  684.     ngx_conf_merge_value(conf->session_timeout,
  685.                          prev->session_timeout, 300);

  687.     ngx_conf_merge_value(conf->prefer_server_ciphers,
  688.                          prev->prefer_server_ciphers, 0);

  690.     ngx_conf_merge_value(conf->certificate_compression,
  691.                          prev->certificate_compression, 0);

  693.     ngx_conf_merge_value(conf->early_data, prev->early_data, 0);
  694.     ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);

  696.     ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
  697.                          (NGX_CONF_BITMASK_SET|NGX_SSL_DEFAULT_PROTOCOLS));

  699.     ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
  700.                          NGX_SSL_BUFSIZE);

  702.     ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
  703.     ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);

  705.     ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL);
  706.     ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys,
  707.                          NULL);

  709.     ngx_conf_merge_ptr_value(conf->certificate_cache, prev->certificate_cache,
  710.                          NULL);

  712.     ngx_conf_merge_ptr_value(conf->ech_files, prev->ech_files, NULL);

  714.     ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL);

  716.     ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, "");

  718.     ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate,
  719.                          "");
  720.     ngx_conf_merge_str_value(conf->trusted_certificate,
  721.                          prev->trusted_certificate, "");
  722.     ngx_conf_merge_str_value(conf->crl, prev->crl, "");

  724.     ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve,
  725.                          NGX_DEFAULT_ECDH_CURVE);

  727.     ngx_conf_merge_str_value(conf->ciphers, prev->ciphers, NGX_DEFAULT_CIPHERS);

  729.     ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);

  731.     ngx_conf_merge_uint_value(conf->ocsp, prev->ocsp, 0);
  732.     ngx_conf_merge_str_value(conf->ocsp_responder, prev->ocsp_responder, "");
  733.     ngx_conf_merge_ptr_value(conf->ocsp_cache_zone,
  734.                          prev->ocsp_cache_zone, NULL);

  736.     ngx_conf_merge_value(conf->stapling, prev->stapling, 0);
  737.     ngx_conf_merge_value(conf->stapling_verify, prev->stapling_verify, 0);
  738.     ngx_conf_merge_str_value(conf->stapling_file, prev->stapling_file, "");
  739.     ngx_conf_merge_str_value(conf->stapling_responder,
  740.                          prev->stapling_responder, "");

  742.     conf->ssl.log = cf->log;

  744.     if (conf->certificates) {

  746.         if (conf->certificate_keys == NULL
  747.             || conf->certificate_keys->nelts < conf->certificates->nelts)
  748.         {
  749.             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  750.                           "no \"ssl_certificate_key\" is defined "
  751.                           "for certificate \"%V\"",
  752.                           ((ngx_str_t *) conf->certificates->elts)
  753.                           + conf->certificates->nelts - 1);
  754.             return NGX_CONF_ERROR;
  755.         }

  757.     } else if (!conf->reject_handshake) {
  758.         return NGX_CONF_OK;
  759.     }

  761.     if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) {
  762.         return NGX_CONF_ERROR;
  763.     }

  765.     cln = ngx_pool_cleanup_add(cf->pool, 0);
  766.     if (cln == NULL) {
  767.         ngx_ssl_cleanup_ctx(&conf->ssl);
  768.         return NGX_CONF_ERROR;
  769.     }

  771.     cln->handler = ngx_ssl_cleanup_ctx;
  772.     cln->data = &conf->ssl;

  774. #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
  775.     {
  776.     static ngx_ssl_client_hello_arg cb = { ngx_http_ssl_servername };

  778.     if (ngx_ssl_set_client_hello_callback(&conf->ssl, &cb) != NGX_OK) {
  779.         return NGX_CONF_ERROR;
  780.     }

  782.     if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
  783.                                                ngx_http_ssl_servername)
  784.         == 0)
  785.     {
  786.         ngx_log_error(NGX_LOG_WARN, cf->log, 0,
  787.             "nginx was built with SNI support, however, now it is linked "
  788.             "dynamically to an OpenSSL library which has no tlsext support, "
  789.             "therefore SNI is not available");
  790.     }
  791.     }
  792. #endif

  794. #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
  795.     SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL);
  796. #endif

  798.     if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
  799.                         conf->prefer_server_ciphers)
  800.         != NGX_OK)
  801.     {
  802.         return NGX_CONF_ERROR;
  803.     }

  805.     if (ngx_http_ssl_compile_certificates(cf, conf) != NGX_OK) {
  806.         return NGX_CONF_ERROR;
  807.     }

  809.     if (conf->certificate_values) {

  811. #ifdef SSL_R_CERT_CB_ERROR

  813.         /* install callback to lookup certificates */

  815.         SSL_CTX_set_cert_cb(conf->ssl.ctx, ngx_http_ssl_certificate, conf);

  817. #else
  818.         ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  819.                       "variables in "
  820.                       "\"ssl_certificate\" and \"ssl_certificate_key\" "
  821.                       "directives are not supported on this platform");
  822.         return NGX_CONF_ERROR;
  823. #endif

  825.     } else if (conf->certificates) {

  827.         /* configure certificates */

  829.         if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
  830.                                  conf->certificate_keys, conf->passwords)
  831.             != NGX_OK)
  832.         {
  833.             return NGX_CONF_ERROR;
  834.         }

  836.         if (ngx_ssl_certificate_compression(cf, &conf->ssl,
  837.                                             conf->certificate_compression)
  838.             != NGX_OK)
  839.         {
  840.             return NGX_CONF_ERROR;
  841.         }
  842.     }

  844.     conf->ssl.buffer_size = conf->buffer_size;

  846.     if (conf->verify) {

  848.         if (conf->verify != 3
  849.             && conf->client_certificate.len == 0
  850.             && conf->trusted_certificate.len == 0)
  851.         {
  852.             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  853.                           "no ssl_client_certificate or "
  854.                           "ssl_trusted_certificate for ssl_verify_client");
  855.             return NGX_CONF_ERROR;
  856.         }

  858.         if (ngx_ssl_client_certificate(cf, &conf->ssl,
  859.                                        &conf->client_certificate,
  860.                                        conf->verify_depth)
  861.             != NGX_OK)
  862.         {
  863.             return NGX_CONF_ERROR;
  864.         }
  865.     }

  867.     if (ngx_ssl_trusted_certificate(cf, &conf->ssl,
  868.                                     &conf->trusted_certificate,
  869.                                     conf->verify_depth)
  870.         != NGX_OK)
  871.     {
  872.         return NGX_CONF_ERROR;
  873.     }

  875.     if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) {
  876.         return NGX_CONF_ERROR;
  877.     }

  879.     if (conf->ocsp) {

  881.         if (conf->verify == 3) {
  882.             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  883.                           "\"ssl_ocsp\" is incompatible with "
  884.                           "\"ssl_verify_client optional_no_ca\"");
  885.             return NGX_CONF_ERROR;
  886.         }

  888.         if (ngx_ssl_ocsp(cf, &conf->ssl, &conf->ocsp_responder, conf->ocsp,
  889.                          conf->ocsp_cache_zone)
  890.             != NGX_OK)
  891.         {
  892.             return NGX_CONF_ERROR;
  893.         }
  894.     }

  896.     if (ngx_ssl_dhparam(cf, &conf->ssl, &conf->dhparam) != NGX_OK) {
  897.         return NGX_CONF_ERROR;
  898.     }

  900.     if (ngx_ssl_ech_files(cf, &conf->ssl, conf->ech_files) != NGX_OK) {
  901.         return NGX_CONF_ERROR;
  902.     }

  904.     if (ngx_ssl_ecdh_curve(cf, &conf->ssl, &conf->ecdh_curve) != NGX_OK) {
  905.         return NGX_CONF_ERROR;
  906.     }

  908.     ngx_conf_merge_value(conf->builtin_session_cache,
  909.                          prev->builtin_session_cache, NGX_SSL_NONE_SCACHE);

  911.     if (conf->shm_zone == NULL) {
  912.         conf->shm_zone = prev->shm_zone;
  913.     }

  915.     if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx,
  916.                               conf->certificates, conf->builtin_session_cache,
  917.                               conf->shm_zone, conf->session_timeout)
  918.         != NGX_OK)
  919.     {
  920.         return NGX_CONF_ERROR;
  921.     }

  923.     ngx_conf_merge_value(conf->session_tickets, prev->session_tickets, 1);

  925. #ifdef SSL_OP_NO_TICKET
  926.     if (!conf->session_tickets) {
  927.         SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_NO_TICKET);
  928.     }
  929. #endif

  931.     ngx_conf_merge_ptr_value(conf->session_ticket_keys,
  932.                          prev->session_ticket_keys, NULL);

  934.     if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, conf->session_ticket_keys)
  935.         != NGX_OK)
  936.     {
  937.         return NGX_CONF_ERROR;
  938.     }

  940.     if (conf->stapling) {

  942.         if (conf->certificate_compression) {
  943.             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  944.                           "\"ssl_stapling\" is incompatible with "
  945.                           "\"ssl_certificate_compression\"");
  946.             return NGX_CONF_ERROR;
  947.         }

  949.         if (ngx_ssl_stapling(cf, &conf->ssl, &conf->stapling_file,
  950.                              &conf->stapling_responder, conf->stapling_verify)
  951.             != NGX_OK)
  952.         {
  953.             return NGX_CONF_ERROR;
  954.         }
  955.     }

  957.     if (ngx_ssl_early_data(cf, &conf->ssl, conf->early_data) != NGX_OK) {
  958.         return NGX_CONF_ERROR;
  959.     }

  961.     if (ngx_ssl_conf_commands(cf, &conf->ssl, conf->conf_commands) != NGX_OK) {
  962.         return NGX_CONF_ERROR;
  963.     }

  965.     return NGX_CONF_OK;
  966. }


  969. static ngx_int_t
  970. ‌ngx_http_ssl_compile_certificates(ngx_conf_t *cf,
  971.     ngx_http_ssl_srv_conf_t *conf)
  972. {
  973.     ngx_str_t                         *cert, *key;
  974.     ngx_uint_t                         i, nelts;
  975.     ngx_http_complex_value_t          *cv;
  976.     ngx_http_compile_complex_value_t   ccv;

  978.     if (conf->certificates == NULL) {
  979.         return NGX_OK;
  980.     }

  982.     cert = conf->certificates->elts;
  983.     key = conf->certificate_keys->elts;
  984.     nelts = conf->certificates->nelts;

  986.     for (i = 0; i < nelts; i++) {

  988.         if (ngx_http_script_variables_count(&cert[i])) {
  989.             goto found;
  990.         }

  992.         if (ngx_http_script_variables_count(&key[i])) {
  993.             goto found;
  994.         }
  995.     }

  997.     return NGX_OK;

  999. found:

  1001.     conf->certificate_values = ngx_array_create(cf->pool, nelts,
  1002.                                              sizeof(ngx_http_complex_value_t));
  1003.     if (conf->certificate_values == NULL) {
  1004.         return NGX_ERROR;
  1005.     }

  1007.     conf->certificate_key_values = ngx_array_create(cf->pool, nelts,
  1008.                                              sizeof(ngx_http_complex_value_t));
  1009.     if (conf->certificate_key_values == NULL) {
  1010.         return NGX_ERROR;
  1011.     }

  1013.     for (i = 0; i < nelts; i++) {

  1015.         cv = ngx_array_push(conf->certificate_values);
  1016.         if (cv == NULL) {
  1017.             return NGX_ERROR;
  1018.         }

  1020.         ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));

  1022.         ccv.cf = cf;
  1023.         ccv.value = &cert[i];
  1024.         ccv.complex_value = cv;
  1025.         ccv.zero = 1;

  1027.         if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
  1028.             return NGX_ERROR;
  1029.         }

  1031.         cv = ngx_array_push(conf->certificate_key_values);
  1032.         if (cv == NULL) {
  1033.             return NGX_ERROR;
  1034.         }

  1036.         ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));

  1038.         ccv.cf = cf;
  1039.         ccv.value = &key[i];
  1040.         ccv.complex_value = cv;
  1041.         ccv.zero = 1;

  1043.         if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
  1044.             return NGX_ERROR;
  1045.         }
  1046.     }

  1048.     conf->passwords = ngx_ssl_preserve_passwords(cf, conf->passwords);
  1049.     if (conf->passwords == NULL) {
  1050.         return NGX_ERROR;
  1051.     }

  1053.     return NGX_OK;
  1054. }


  1057. static char *
  1058. ‌ngx_http_ssl_certificate_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
  1059. {
  1060.     ngx_http_ssl_srv_conf_t *sscf = conf;

  1062.     time_t       inactive, valid;
  1063.     ngx_str_t   *value, s;
  1064.     ngx_int_t    max;
  1065.     ngx_uint_t   i;

  1067.     if (sscf->certificate_cache != NGX_CONF_UNSET_PTR) {
  1068.         return "is duplicate";
  1069.     }

  1071.     value = cf->args->elts;

  1073.     max = 0;
  1074.     inactive = 10;
  1075.     valid = 60;

  1077.     for (i = 1; i < cf->args->nelts; i++) {

  1079.         if (ngx_strncmp(value[i].data, "max=", 4) == 0) {

  1081.             max = ngx_atoi(value[i].data + 4, value[i].len - 4);
  1082.             if (max <= 0) {
  1083.                 goto failed;
  1084.             }

  1086.             continue;
  1087.         }

  1089.         if (ngx_strncmp(value[i].data, "inactive=", 9) == 0) {

  1091.             s.len = value[i].len - 9;
  1092.             s.data = value[i].data + 9;

  1094.             inactive = ngx_parse_time(&s, 1);
  1095.             if (inactive == (time_t) NGX_ERROR) {
  1096.                 goto failed;
  1097.             }

  1099.             continue;
  1100.         }

  1102.         if (ngx_strncmp(value[i].data, "valid=", 6) == 0) {

  1104.             s.len = value[i].len - 6;
  1105.             s.data = value[i].data + 6;

  1107.             valid = ngx_parse_time(&s, 1);
  1108.             if (valid == (time_t) NGX_ERROR) {
  1109.                 goto failed;
  1110.             }

  1112.             continue;
  1113.         }

  1115.         if (ngx_strcmp(value[i].data, "off") == 0) {

  1117.             sscf->certificate_cache = NULL;

  1119.             continue;
  1120.         }

  1122.     failed:

  1124.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1125.                            "invalid parameter \"%V\"", &value[i]);
  1126.         return NGX_CONF_ERROR;
  1127.     }

  1129.     if (sscf->certificate_cache == NULL) {
  1130.         return NGX_CONF_OK;
  1131.     }

  1133.     if (max == 0) {
  1134.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1135.                            "\"ssl_certificate_cache\" must have "
  1136.                            "the \"max\" parameter");
  1137.         return NGX_CONF_ERROR;
  1138.     }

  1140.     sscf->certificate_cache = ngx_ssl_cache_init(cf->pool, max, valid,
  1141.                                                  inactive);
  1142.     if (sscf->certificate_cache == NULL) {
  1143.         return NGX_CONF_ERROR;
  1144.     }

  1146.     return NGX_CONF_OK;
  1147. }


  1150. static char *
  1151. ‌ngx_http_ssl_password_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
  1152. {
  1153.     ngx_http_ssl_srv_conf_t *sscf = conf;

  1155.     ngx_str_t  *value;

  1157.     if (sscf->passwords != NGX_CONF_UNSET_PTR) {
  1158.         return "is duplicate";
  1159.     }

  1161.     value = cf->args->elts;

  1163.     sscf->passwords = ngx_ssl_read_password_file(cf, &value[1]);

  1165.     if (sscf->passwords == NULL) {
  1166.         return NGX_CONF_ERROR;
  1167.     }

  1169.     return NGX_CONF_OK;
  1170. }


  1173. static char *
  1174. ‌ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
  1175. {
  1176.     ngx_http_ssl_srv_conf_t *sscf = conf;

  1178.     size_t       len;
  1179.     ngx_str_t   *value, name, size;
  1180.     ngx_int_t    n;
  1181.     ngx_uint_t   i, j;

  1183.     value = cf->args->elts;

  1185.     for (i = 1; i < cf->args->nelts; i++) {

  1187.         if (ngx_strcmp(value[i].data, "off") == 0) {
  1188.             sscf->builtin_session_cache = NGX_SSL_NO_SCACHE;
  1189.             continue;
  1190.         }

  1192.         if (ngx_strcmp(value[i].data, "none") == 0) {
  1193.             sscf->builtin_session_cache = NGX_SSL_NONE_SCACHE;
  1194.             continue;
  1195.         }

  1197.         if (ngx_strcmp(value[i].data, "builtin") == 0) {
  1198.             sscf->builtin_session_cache = NGX_SSL_DFLT_BUILTIN_SCACHE;
  1199.             continue;
  1200.         }

  1202.         if (value[i].len > sizeof("builtin:") - 1
  1203.             && ngx_strncmp(value[i].data, "builtin:", sizeof("builtin:") - 1)
  1204.                == 0)
  1205.         {
  1206.             n = ngx_atoi(value[i].data + sizeof("builtin:") - 1,
  1207.                          value[i].len - (sizeof("builtin:") - 1));

  1209.             if (n == NGX_ERROR) {
  1210.                 goto invalid;
  1211.             }

  1213.             sscf->builtin_session_cache = n;

  1215.             continue;
  1216.         }

  1218.         if (value[i].len > sizeof("shared:") - 1
  1219.             && ngx_strncmp(value[i].data, "shared:", sizeof("shared:") - 1)
  1220.                == 0)
  1221.         {
  1222.             len = 0;

  1224.             for (j = sizeof("shared:") - 1; j < value[i].len; j++) {
  1225.                 if (value[i].data[j] == ':') {
  1226.                     break;
  1227.                 }

  1229.                 len++;
  1230.             }

  1232.             if (len == 0 || j == value[i].len) {
  1233.                 goto invalid;
  1234.             }

  1236.             name.len = len;
  1237.             name.data = value[i].data + sizeof("shared:") - 1;

  1239.             size.len = value[i].len - j - 1;
  1240.             size.data = name.data + len + 1;

  1242.             n = ngx_parse_size(&size);

  1244.             if (n == NGX_ERROR) {
  1245.                 goto invalid;
  1246.             }

  1248.             if (n < (ngx_int_t) (8 * ngx_pagesize)) {
  1249.                 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1250.                                    "session cache \"%V\" is too small",
  1251.                                    &value[i]);

  1253.                 return NGX_CONF_ERROR;
  1254.             }

  1256.             sscf->shm_zone = ngx_shared_memory_add(cf, &name, n,
  1257.                                                    &ngx_http_ssl_module);
  1258.             if (sscf->shm_zone == NULL) {
  1259.                 return NGX_CONF_ERROR;
  1260.             }

  1262.             sscf->shm_zone->init = ngx_ssl_session_cache_init;

  1264.             continue;
  1265.         }

  1267.         goto invalid;
  1268.     }

  1270.     if (sscf->shm_zone && sscf->builtin_session_cache == NGX_CONF_UNSET) {
  1271.         sscf->builtin_session_cache = NGX_SSL_NO_BUILTIN_SCACHE;
  1272.     }

  1274.     return NGX_CONF_OK;

  1276. invalid:

  1278.     ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1279.                        "invalid session cache \"%V\"", &value[i]);

  1281.     return NGX_CONF_ERROR;
  1282. }


  1285. static char *
  1286. ‌ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
  1287. {
  1288.     ngx_http_ssl_srv_conf_t *sscf = conf;

  1290.     size_t       len;
  1291.     ngx_int_t    n;
  1292.     ngx_str_t   *value, name, size;
  1293.     ngx_uint_t   j;

  1295.     if (sscf->ocsp_cache_zone != NGX_CONF_UNSET_PTR) {
  1296.         return "is duplicate";
  1297.     }

  1299.     value = cf->args->elts;

  1301.     if (ngx_strcmp(value[1].data, "off") == 0) {
  1302.         sscf->ocsp_cache_zone = NULL;
  1303.         return NGX_CONF_OK;
  1304.     }

  1306.     if (value[1].len <= sizeof("shared:") - 1
  1307.         || ngx_strncmp(value[1].data, "shared:", sizeof("shared:") - 1) != 0)
  1308.     {
  1309.         goto invalid;
  1310.     }

  1312.     len = 0;

  1314.     for (j = sizeof("shared:") - 1; j < value[1].len; j++) {
  1315.         if (value[1].data[j] == ':') {
  1316.             break;
  1317.         }

  1319.         len++;
  1320.     }

  1322.     if (len == 0 || j == value[1].len) {
  1323.         goto invalid;
  1324.     }

  1326.     name.len = len;
  1327.     name.data = value[1].data + sizeof("shared:") - 1;

  1329.     size.len = value[1].len - j - 1;
  1330.     size.data = name.data + len + 1;

  1332.     n = ngx_parse_size(&size);

  1334.     if (n == NGX_ERROR) {
  1335.         goto invalid;
  1336.     }

  1338.     if (n < (ngx_int_t) (8 * ngx_pagesize)) {
  1339.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1340.                            "OCSP cache \"%V\" is too small", &value[1]);

  1342.         return NGX_CONF_ERROR;
  1343.     }

  1345.     sscf->ocsp_cache_zone = ngx_shared_memory_add(cf, &name, n,
  1346.                                                   &ngx_http_ssl_module_ctx);
  1347.     if (sscf->ocsp_cache_zone == NULL) {
  1348.         return NGX_CONF_ERROR;
  1349.     }

  1351.     sscf->ocsp_cache_zone->init = ngx_ssl_ocsp_cache_init;

  1353.     return NGX_CONF_OK;

  1355. invalid:

  1357.     ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
  1358.                        "invalid OCSP cache \"%V\"", &value[1]);

  1360.     return NGX_CONF_ERROR;
  1361. }


  1364. static char *
  1365. ‌ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
  1366. {
  1367. #ifndef SSL_CONF_FLAG_FILE
  1368.     return "is not supported on this platform";
  1369. #else
  1370.     return NGX_CONF_OK;
  1371. #endif
  1372. }


  1375. static ngx_int_t
  1376. ‌ngx_http_ssl_init(ngx_conf_t *cf)
  1377. {
  1378.     ngx_uint_t                   a, p, s;
  1379.     const char                  *name;
  1380.     ngx_http_conf_addr_t        *addr;
  1381.     ngx_http_conf_port_t        *port;
  1382.     ngx_http_ssl_srv_conf_t     *sscf;
  1383.     ngx_http_core_loc_conf_t    *clcf;
  1384.     ngx_http_core_srv_conf_t   **cscfp, *cscf;
  1385.     ngx_http_core_main_conf_t   *cmcf;

  1387.     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
  1388.     cscfp = cmcf->servers.elts;

  1390.     for (s = 0; s < cmcf->servers.nelts; s++) {

  1392.         sscf = cscfp[s]->ctx->srv_conf[ngx_http_ssl_module.ctx_index];

  1394.         if (sscf->ssl.ctx == NULL) {
  1395.             continue;
  1396.         }

  1398.         clcf = cscfp[s]->ctx->loc_conf[ngx_http_core_module.ctx_index];

  1400.         if (sscf->stapling) {
  1401.             if (ngx_ssl_stapling_resolver(cf, &sscf->ssl, clcf->resolver,
  1402.                                           clcf->resolver_timeout)
  1403.                 != NGX_OK)
  1404.             {
  1405.                 return NGX_ERROR;
  1406.             }
  1407.         }

  1409.         if (sscf->ocsp) {
  1410.             if (ngx_ssl_ocsp_resolver(cf, &sscf->ssl, clcf->resolver,
  1411.                                       clcf->resolver_timeout)
  1412.                 != NGX_OK)
  1413.             {
  1414.                 return NGX_ERROR;
  1415.             }
  1416.         }
  1417.     }

  1419.     if (cmcf->ports == NULL) {
  1420.         return NGX_OK;
  1421.     }

  1423.     port = cmcf->ports->elts;
  1424.     for (p = 0; p < cmcf->ports->nelts; p++) {

  1426.         addr = port[p].addrs.elts;
  1427.         for (a = 0; a < port[p].addrs.nelts; a++) {

  1429.             if (!addr[a].opt.ssl && !addr[a].opt.quic) {
  1430.                 continue;
  1431.             }

  1433.             if (addr[a].opt.quic) {
  1434.                 name = "quic";

  1436. #if (NGX_QUIC_OPENSSL_COMPAT)
  1437.                 if (ngx_http_ssl_quic_compat_init(cf, &addr[a]) != NGX_OK) {
  1438.                     return NGX_ERROR;
  1439.                 }
  1440. #endif

  1442.             } else {
  1443.                 name = "ssl";
  1444.             }

  1446.             cscf = addr[a].default_server;
  1447.             sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];

  1449.             if (sscf->certificates) {

  1451.                 if (addr[a].opt.quic && !(sscf->protocols & NGX_SSL_TLSv1_3)) {
  1452.                     ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  1453.                                   "\"ssl_protocols\" must enable TLSv1.3 for "
  1454.                                   "the \"listen ... %s\" directive in %s:%ui",
  1455.                                   name, cscf->file_name, cscf->line);
  1456.                     return NGX_ERROR;
  1457.                 }

  1459.                 continue;
  1460.             }

  1462.             if (!sscf->reject_handshake) {
  1463.                 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  1464.                               "no \"ssl_certificate\" is defined for "
  1465.                               "the \"listen ... %s\" directive in %s:%ui",
  1466.                               name, cscf->file_name, cscf->line);
  1467.                 return NGX_ERROR;
  1468.             }

  1470.             /*
  1471.              * if no certificates are defined in the default server,
  1472.              * check all non-default server blocks
  1473.              */

  1475.             cscfp = addr[a].servers.elts;
  1476.             for (s = 0; s < addr[a].servers.nelts; s++) {

  1478.                 cscf = cscfp[s];
  1479.                 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];

  1481.                 if (sscf->certificates || sscf->reject_handshake) {
  1482.                     continue;
  1483.                 }

  1485.                 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
  1486.                               "no \"ssl_certificate\" is defined for "
  1487.                               "the \"listen ... %s\" directive in %s:%ui",
  1488.                               name, cscf->file_name, cscf->line);
  1489.                 return NGX_ERROR;
  1490.             }
  1491.         }
  1492.     }

  1494.     return NGX_OK;
  1495. }


  1498. #if (NGX_QUIC_OPENSSL_COMPAT)

  1500. static ngx_int_t
  1501. ‌ngx_http_ssl_quic_compat_init(ngx_conf_t *cf, ngx_http_conf_addr_t *addr)
  1502. {
  1503.     ngx_uint_t                  s;
  1504.     ngx_http_ssl_srv_conf_t    *sscf;
  1505.     ngx_http_core_srv_conf_t  **cscfp, *cscf;

  1507.     cscfp = addr->servers.elts;
  1508.     for (s = 0; s < addr->servers.nelts; s++) {

  1510.         cscf = cscfp[s];
  1511.         sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];

  1513.         if (sscf->certificates || sscf->reject_handshake) {
  1514.             if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) {
  1515.                 return NGX_ERROR;
  1516.             }
  1517.         }
  1518.     }

  1520.     return NGX_OK;
  1521. }

  1523. #endif

One Level Up Top Level