diff options
author | Igor Sysoev <igor@sysoev.ru> | 2004-07-16 21:11:43 +0400 |
---|---|---|
committer | Igor Sysoev <igor@sysoev.ru> | 2004-07-16 21:11:43 +0400 |
commit | f38e046a0a2e7437f8232ef2a99cead69c4b9ebb (patch) | |
tree | 5d9a68d757f7994506cdb497ce43d4ddd63c7eaa | |
parent | 0ad253766fb8d62f257c446410a632a596ac5783 (diff) |
nginx-0.0.7-2004-07-16-21:11:43 import
-rw-r--r-- | auto/modules | 26 | ||||
-rw-r--r-- | auto/sources | 10 | ||||
-rw-r--r-- | src/core/ngx_buf.h | 1 | ||||
-rw-r--r-- | src/core/ngx_core.h | 3 | ||||
-rw-r--r-- | src/core/ngx_output_chain.c | 2 | ||||
-rw-r--r-- | src/event/ngx_event.h | 5 | ||||
-rw-r--r-- | src/event/ngx_event_openssl.c | 194 | ||||
-rw-r--r-- | src/event/ngx_event_openssl.h | 19 | ||||
-rw-r--r-- | src/http/modules/ngx_http_ssl_module.c (renamed from src/http/modules/ngx_http_ssl_filter.c) | 25 | ||||
-rw-r--r-- | src/http/modules/ngx_http_ssl_module.h (renamed from src/http/modules/ngx_http_ssl_filter.h) | 8 | ||||
-rw-r--r-- | src/http/modules/proxy/ngx_http_proxy_handler.h | 2 | ||||
-rw-r--r-- | src/http/ngx_http.h | 4 | ||||
-rw-r--r-- | src/http/ngx_http_config.h | 7 | ||||
-rw-r--r-- | src/http/ngx_http_core_module.c | 7 | ||||
-rw-r--r-- | src/http/ngx_http_core_module.h | 3 | ||||
-rw-r--r-- | src/http/ngx_http_request.c | 88 | ||||
-rw-r--r-- | src/http/ngx_http_request.h | 7 | ||||
-rw-r--r-- | src/http/ngx_http_write_filter.c | 19 | ||||
-rw-r--r-- | src/os/win32/ngx_os.h | 14 |
19 files changed, 328 insertions, 116 deletions
diff --git a/auto/modules b/auto/modules index d2e2b01bc..6a5becd10 100644 --- a/auto/modules +++ b/auto/modules @@ -60,19 +60,6 @@ HTTP_FILTER_MODULES="$HTTP_WRITE_FILTER_MODULE \ $HTTP_CHUNKED_FILTER_MODULE \ $HTTP_RANGE_HEADER_FILTER_MODULE" -if [ $HTTP_SSL = YES ]; then - HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSL_FILTER_MODULE" - HTTP_DEPS="$HTTP_DEPS $HTTP_SSL_DEPS" - HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS" - - # STUB: move to auto/libs/ssl after md5 - have=NGX_HTTP_SSL . auto/have - have=NGX_OPENSSL . auto/have - CORE_DEPS="$CORE_DEPS $OPENSSL_DEPS" - CORE_SRCS="$CORE_SRCS $OPENSSL_SRCS" - CORE_LIBS="$CORE_LIBS -lssl -lcrypto" -fi - if [ $HTTP_GZIP = YES ]; then have=NGX_HTTP_GZIP . auto/have USE_ZLIB=YES @@ -113,6 +100,19 @@ if [ $HTTP_REWRITE = YES -a $USE_PCRE != DISABLED ]; then HTTP_SRCS="$HTTP_SRCS $HTTP_REWRITE_SRCS" fi +if [ $HTTP_SSL = YES ]; then + HTTP_MODULES="$HTTP_MODULES $HTTP_SSL_MODULE" + HTTP_DEPS="$HTTP_DEPS $HTTP_SSL_DEPS" + HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS" + + # STUB: move to auto/libs/ssl after md5 + have=NGX_HTTP_SSL . auto/have + have=NGX_OPENSSL . auto/have + CORE_DEPS="$CORE_DEPS $OPENSSL_DEPS" + CORE_SRCS="$CORE_SRCS $OPENSSL_SRCS" + CORE_LIBS="$CORE_LIBS -lssl -lcrypto" +fi + if [ $HTTP_PROXY = YES ]; then have=NGX_HTTP_PROXY . auto/have USE_MD5=YES diff --git a/auto/sources b/auto/sources index 7c8b7b33f..6b66e51b1 100644 --- a/auto/sources +++ b/auto/sources @@ -253,11 +253,6 @@ HTTP_GZIP_FILTER_MODULE=ngx_http_gzip_filter_module HTTP_GZIP_SRCS=src/http/modules/ngx_http_gzip_filter.c -HTTP_SSL_FILTER_MODULE=ngx_http_ssl_filter_module -HTTP_SSL_DEPS=src/http/modules/ngx_http_ssl_filter.h -HTTP_SSL_SRCS=src/http/modules/ngx_http_ssl_filter.c - - HTTP_SSI_FILTER_MODULE=ngx_http_ssi_filter_module HTTP_SSI_SRCS=src/http/modules/ngx_http_ssi_filter.c @@ -274,6 +269,11 @@ HTTP_REWRITE_MODULE=ngx_http_rewrite_module HTTP_REWRITE_SRCS=src/http/modules/ngx_http_rewrite_handler.c +HTTP_SSL_MODULE=ngx_http_ssl_module +HTTP_SSL_DEPS=src/http/modules/ngx_http_ssl_module.h +HTTP_SSL_SRCS=src/http/modules/ngx_http_ssl_module.c + + HTTP_PROXY_MODULE=ngx_http_proxy_module HTTP_PROXY_INCS="src/http/modules/proxy" HTTP_PROXY_DEPS=src/http/modules/proxy/ngx_http_proxy_handler.h diff --git a/src/core/ngx_buf.h b/src/core/ngx_buf.h index 1927ed415..feaad4c96 100644 --- a/src/core/ngx_buf.h +++ b/src/core/ngx_buf.h @@ -132,6 +132,7 @@ typedef struct { #define NGX_CHAIN_ERROR (ngx_chain_t *) NGX_ERROR +#define NGX_CHAIN_AGAIN (ngx_chain_t *) NGX_AGAIN #define ngx_buf_in_memory(b) (b->temporary || b->memory || b->mmap) diff --git a/src/core/ngx_core.h b/src/core/ngx_core.h index 575717f10..4c2712cfa 100644 --- a/src/core/ngx_core.h +++ b/src/core/ngx_core.h @@ -14,6 +14,9 @@ typedef struct ngx_file_s ngx_file_t; typedef struct ngx_event_s ngx_event_t; typedef struct ngx_connection_s ngx_connection_t; +typedef void (*ngx_event_handler_pt)(ngx_event_t *ev); + + #define NGX_OK 0 #define NGX_ERROR -1 diff --git a/src/core/ngx_output_chain.c b/src/core/ngx_output_chain.c index aea6219da..02d780f37 100644 --- a/src/core/ngx_output_chain.c +++ b/src/core/ngx_output_chain.c @@ -274,7 +274,7 @@ ngx_int_t ngx_chain_writer(void *data, ngx_chain_t *in) ngx_log_debug1(NGX_LOG_DEBUG_CORE, ctx->connection->log, 0, "WRITER0: %X", ctx->out); - ctx->out = ngx_write_chain(ctx->connection, ctx->out, ctx->limit); + ctx->out = ngx_send_chain(ctx->connection, ctx->out, ctx->limit); ngx_log_debug1(NGX_LOG_DEBUG_CORE, ctx->connection->log, 0, "WRITER1: %X", ctx->out); diff --git a/src/event/ngx_event.h b/src/event/ngx_event.h index 935151d73..b4933daf8 100644 --- a/src/event/ngx_event.h +++ b/src/event/ngx_event.h @@ -6,9 +6,6 @@ #include <ngx_core.h> -typedef void (*ngx_event_handler_pt)(ngx_event_t *ev); - - #define NGX_INVALID_INDEX 0xd0d0d0d0 @@ -391,7 +388,7 @@ extern ngx_event_actions_t ngx_event_actions; #define ngx_recv ngx_io.recv #define ngx_recv_chain ngx_io.recv_chain -#define ngx_write_chain ngx_io.send_chain +#define ngx_send_chain ngx_io.send_chain diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index 4f523cfb4..89ef7031c 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -13,23 +13,34 @@ ngx_int_t ngx_ssl_init(ngx_log_t *log) } -ngx_int_t ngx_ssl_create_session(ngx_ssl_ctx_t *ssl_ctx, ngx_connection_t *c) +ngx_int_t ngx_ssl_create_session(ngx_ssl_ctx_t *ssl_ctx, ngx_connection_t *c, + ngx_uint_t flags) { ngx_ssl_t *ssl; - ssl = SSL_new(ssl_ctx); + if (!(ssl = ngx_pcalloc(c->pool, sizeof(ngx_ssl_t)))) { + return NGX_ERROR; + } - if (ssl == NULL) { - ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_new() failed"); + if (flags & NGX_SSL_BUFFER) { + if (!(ssl->buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE))) { + return NGX_ERROR; + } + } + + ssl->ssl = SSL_new(ssl_ctx); + + if (ssl->ssl == NULL) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed"); return NGX_ERROR; } - if (SSL_set_fd(ssl, c->fd) == 0) { - ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_set_fd() failed"); + if (SSL_set_fd(ssl->ssl, c->fd) == 0) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed"); return NGX_ERROR; } - SSL_set_accept_state(ssl); + SSL_set_accept_state(ssl->ssl); c->ssl = ssl; @@ -39,10 +50,11 @@ ngx_int_t ngx_ssl_create_session(ngx_ssl_ctx_t *ssl_ctx, ngx_connection_t *c) ngx_int_t ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size) { - int n; + int n, sslerr; + ngx_err_t err; char *handshake; - n = SSL_read(c->ssl, buf, size); + n = SSL_read(c->ssl->ssl, buf, size); ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n); @@ -50,48 +62,42 @@ ngx_int_t ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size) return n; } - n = SSL_get_error(c->ssl, n); + sslerr = SSL_get_error(c->ssl->ssl, n); + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); - ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", n); + err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; - if (n == SSL_ERROR_WANT_READ) { + if (sslerr == SSL_ERROR_WANT_READ) { return NGX_AGAIN; } #if 0 - if (n == SSL_ERROR_WANT_WRITE) { + if (sslerr == SSL_ERROR_WANT_WRITE) { return NGX_AGAIN; } #endif - if (!SSL_is_init_finished(c->ssl)) { + if (!SSL_is_init_finished(c->ssl->ssl)) { handshake = "in SSL handshake"; } else { handshake = ""; } - if (n == SSL_ERROR_ZERO_RETURN) { - ngx_log_error(NGX_LOG_INFO, c->log, 0, + if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) { + ngx_log_error(NGX_LOG_INFO, c->log, err, "client closed connection%s", handshake); - SSL_set_shutdown(c->ssl, SSL_RECEIVED_SHUTDOWN); + SSL_set_shutdown(c->ssl->ssl, SSL_RECEIVED_SHUTDOWN); return NGX_ERROR; } - if (ERR_GET_REASON(ERR_peek_error()) == SSL_R_HTTP_REQUEST) { - ngx_log_error(NGX_LOG_ERR, c->log, 0, - "client sent plain HTTP request to HTTPS port"); + ngx_ssl_error(NGX_LOG_ALERT, c->log, err, + "SSL_read() failed%s", handshake); - SSL_set_shutdown(c->ssl, SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN); - - return NGX_SSL_HTTP_ERROR; - } - - ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_read() failed%s", handshake); - - SSL_set_shutdown(c->ssl, SSL_RECEIVED_SHUTDOWN); + SSL_set_shutdown(c->ssl->ssl, SSL_RECEIVED_SHUTDOWN); return NGX_ERROR; } @@ -100,11 +106,112 @@ ngx_int_t ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size) ngx_chain_t *ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit) { - int n; - ssize_t send, size; + int n; + ssize_t send, size; + ngx_buf_t *buf; send = 0; + buf = c->ssl->buf; + +#if 0 + + if (buf) { + + for ( ;; ) { + + for ( /* void */ ; in && buf->last < buf->end; in = in->next) { + if (ngx_buf_special(in->buf)) { + continue; + } + + size = in->buf->last - in->buf->pos; + + if (size > buf->end - buf->last) { + size = buf->end - buf->last; + } + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "SSL buf copy: %d", size); + + ngx_memcpy(buf->last, in->buf->pos, size); + + buf->last += size; + in->buf->pos += size; + } + + size = buf->last - buf->pos; + + if (send + size > limit) { + size = limit - send; + } + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "SSL to write: %d", size); + + n = SSL_write(c->ssl->ssl, buf->pos, size); + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "SSL_write: %d", n); + + if (n > 0) { + buf->pos += n; + send += n; + + if (n < size) { + break; + } + + if (send < limit) { + if (buf->pos == buf->last) { + buf->pos = buf->start; + buf->last = buf->start; + } + + if (in == NULL) { + break; + } + + continue; + } + } + + n = SSL_get_error(c->ssl->ssl, n); + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "SSL_get_error: %d", n); + + if (n == SSL_ERROR_WANT_WRITE) { + break; + } + +#if 0 + if (n == SSL_ERROR_WANT_READ) { + break; + } +#endif + + ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_write() failed"); + + return NGX_CHAIN_ERROR; + } + + if (in) { + c->write->ready = 0; + return in; + } + + if (buf->pos == buf->last) { + return NULL; + + } else { + c->write->ready = 0; + return NGX_CHAIN_AGAIN; + } + } + +#endif + for (/* void */; in; in = in->next) { if (ngx_buf_special(in->buf)) { continue; @@ -119,7 +226,7 @@ ngx_chain_t *ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size); - n = SSL_write(c->ssl, in->buf->pos, size); + n = SSL_write(c->ssl->ssl, in->buf->pos, size); ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n); @@ -139,7 +246,7 @@ ngx_chain_t *ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, return in; } - n = SSL_get_error(c->ssl, n); + n = SSL_get_error(c->ssl->ssl, n); ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", n); @@ -154,7 +261,7 @@ ngx_chain_t *ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, } #endif - ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_write() failed"); + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_write() failed"); return NGX_CHAIN_ERROR; } @@ -176,13 +283,13 @@ ngx_int_t ngx_ssl_shutdown(ngx_connection_t *c) #endif #if 0 - SSL_set_shutdown(c->ssl, SSL_RECEIVED_SHUTDOWN); + SSL_set_shutdown(c->ssl->ssl, SSL_RECEIVED_SHUTDOWN); #endif again = 0; for ( ;; ) { - n = SSL_shutdown(c->ssl); + n = SSL_shutdown(c->ssl->ssl); ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n); @@ -192,7 +299,7 @@ ngx_int_t ngx_ssl_shutdown(ngx_connection_t *c) } if (n == 1) { - SSL_free(c->ssl); + SSL_free(c->ssl->ssl); c->ssl = NULL; return NGX_OK; } @@ -201,7 +308,7 @@ ngx_int_t ngx_ssl_shutdown(ngx_connection_t *c) } if (!again) { - n = SSL_get_error(c->ssl, n); + n = SSL_get_error(c->ssl->ssl, n); ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", n); } @@ -226,17 +333,18 @@ ngx_int_t ngx_ssl_shutdown(ngx_connection_t *c) return NGX_AGAIN; } - ngx_ssl_error(NGX_LOG_ALERT, c->log, "SSL_shutdown() failed"); + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_shutdown() failed"); return NGX_ERROR; } -void ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, char *fmt, ...) +void ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, + char *fmt, ...) { - int len; - char errstr[NGX_MAX_CONF_ERRSTR]; - va_list args; + int len; + char errstr[NGX_MAX_CONF_ERRSTR]; + va_list args; va_start(args, fmt); len = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args); @@ -252,5 +360,5 @@ void ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, char *fmt, ...) ERR_error_string_n(ERR_get_error(), errstr + len, sizeof(errstr) - len - 1); - ngx_log_error(level, log, 0, "%s)", errstr); + ngx_log_error(level, log, err, "%s)", errstr); } diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h index 5674328dc..7d098f6d6 100644 --- a/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h @@ -9,20 +9,31 @@ #include <openssl/err.h> -typedef SSL ngx_ssl_t; +typedef struct { + SSL *ssl; + ngx_buf_t *buf; + ngx_event_handler_pt saved_handler; +} ngx_ssl_t; + + typedef SSL_CTX ngx_ssl_ctx_t; -#define NGX_SSL_HTTP_ERROR -10 +#define NGX_SSL_BUFFER 1 + + +#define NGX_SSL_BUFSIZE 16384 ngx_int_t ngx_ssl_init(ngx_log_t *log); -ngx_int_t ngx_ssl_create_session(ngx_ssl_ctx_t *ctx, ngx_connection_t *c); +ngx_int_t ngx_ssl_create_session(ngx_ssl_ctx_t *ctx, ngx_connection_t *c, + ngx_uint_t flags); ngx_int_t ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size); ngx_chain_t *ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit); ngx_int_t ngx_ssl_shutdown(ngx_connection_t *c); -void ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, char *fmt, ...); +void ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, + char *fmt, ...); #endif /* _NGX_EVENT_OPENSSL_H_INCLUDED_ */ diff --git a/src/http/modules/ngx_http_ssl_filter.c b/src/http/modules/ngx_http_ssl_module.c index 1d370be2d..3a8b863a2 100644 --- a/src/http/modules/ngx_http_ssl_filter.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -11,10 +11,9 @@ static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child); -static ngx_int_t ngx_http_ssl_init_process(ngx_cycle_t *cycle); -static ngx_command_t ngx_http_charset_filter_commands[] = { +static ngx_command_t ngx_http_ssl_commands[] = { { ngx_string("ssl"), NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, @@ -41,7 +40,7 @@ static ngx_command_t ngx_http_charset_filter_commands[] = { }; -static ngx_http_module_t ngx_http_ssl_filter_module_ctx = { +static ngx_http_module_t ngx_http_ssl_module_ctx = { NULL, /* pre conf */ NULL, /* create main configuration */ @@ -55,13 +54,13 @@ static ngx_http_module_t ngx_http_ssl_filter_module_ctx = { }; -ngx_module_t ngx_http_ssl_filter_module = { +ngx_module_t ngx_http_ssl_module = { NGX_MODULE, - &ngx_http_ssl_filter_module_ctx, /* module context */ - ngx_http_charset_filter_commands, /* module directives */ + &ngx_http_ssl_module_ctx, /* module context */ + ngx_http_ssl_commands, /* module directives */ NGX_HTTP_MODULE, /* module type */ NULL, /* init module */ - ngx_http_ssl_init_process /* init process */ + NULL /* init process */ }; @@ -102,13 +101,13 @@ static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, conf->ssl_ctx = SSL_CTX_new(SSLv23_server_method()); if (conf->ssl_ctx == NULL) { - ngx_ssl_error(NGX_LOG_EMERG, cf->log, "SSL_CTX_new() failed"); + ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0, "SSL_CTX_new() failed"); return NGX_CONF_ERROR; } if (SSL_CTX_use_certificate_file(conf->ssl_ctx, conf->certificate.data, SSL_FILETYPE_PEM) == 0) { - ngx_ssl_error(NGX_LOG_EMERG, cf->log, + ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0, "SSL_CTX_use_certificate_file(\"%s\") failed", conf->certificate.data); return NGX_CONF_ERROR; @@ -116,7 +115,7 @@ static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, if (SSL_CTX_use_PrivateKey_file(conf->ssl_ctx, conf->certificate_key.data, SSL_FILETYPE_PEM) == 0) { - ngx_ssl_error(NGX_LOG_EMERG, cf->log, + ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0, "SSL_CTX_use_PrivateKey_file(\"%s\") failed", conf->certificate_key.data); return NGX_CONF_ERROR; @@ -126,6 +125,8 @@ static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, } +#if 0 + static ngx_int_t ngx_http_ssl_init_process(ngx_cycle_t *cycle) { ngx_uint_t i; @@ -138,7 +139,7 @@ static ngx_int_t ngx_http_ssl_init_process(ngx_cycle_t *cycle) cscfp = cmcf->servers.elts; for (i = 0; i < cmcf->servers.nelts; i++) { - sscf = cscfp[i]->ctx->srv_conf[ngx_http_ssl_filter_module.ctx_index]; + sscf = cscfp[i]->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; if (sscf->enable) { cscfp[i]->recv = ngx_ssl_recv; @@ -148,3 +149,5 @@ static ngx_int_t ngx_http_ssl_init_process(ngx_cycle_t *cycle) return NGX_OK; } + +#endif diff --git a/src/http/modules/ngx_http_ssl_filter.h b/src/http/modules/ngx_http_ssl_module.h index a42ee9135..2bb1fe1fe 100644 --- a/src/http/modules/ngx_http_ssl_filter.h +++ b/src/http/modules/ngx_http_ssl_module.h @@ -1,5 +1,5 @@ -#ifndef _NGX_HTTP_SSL_FILTER_H_INCLUDED_ -#define _NGX_HTTP_SSL_FILTER_H_INCLUDED_ +#ifndef _NGX_HTTP_SSL_H_INCLUDED_ +#define _NGX_HTTP_SSL_H_INCLUDED_ #include <ngx_config.h> @@ -24,7 +24,7 @@ ngx_chain_t *ngx_http_ssl_write(ngx_connection_t *c, ngx_chain_t *in, void ngx_http_ssl_close_connection(SSL *ssl, ngx_log_t *log); -extern ngx_module_t ngx_http_ssl_filter_module; +extern ngx_module_t ngx_http_ssl_module; -#endif /* _NGX_HTTP_SSL_FILTER_H_INCLUDED_ */ +#endif /* _NGX_HTTP_SSL_H_INCLUDED_ */ diff --git a/src/http/modules/proxy/ngx_http_proxy_handler.h b/src/http/modules/proxy/ngx_http_proxy_handler.h index c89e971dc..fa8698231 100644 --- a/src/http/modules/proxy/ngx_http_proxy_handler.h +++ b/src/http/modules/proxy/ngx_http_proxy_handler.h @@ -203,7 +203,7 @@ typedef struct { } ngx_http_proxy_log_ctx_t; -#define NGX_HTTP_PROXY_PARSE_NO_HEADER 20 +#define NGX_HTTP_PROXY_PARSE_NO_HEADER 30 #define NGX_HTTP_PROXY_FT_ERROR 0x02 diff --git a/src/http/ngx_http.h b/src/http/ngx_http.h index 44edd1529..145082fa0 100644 --- a/src/http/ngx_http.h +++ b/src/http/ngx_http.h @@ -21,8 +21,8 @@ typedef struct ngx_http_cleanup_s ngx_http_cleanup_t; #include <ngx_http_log_handler.h> #include <ngx_http_core_module.h> -#if (NGX_OPENSSL) -#include <ngx_http_ssl_filter.h> +#if (NGX_HTTP_SSL) +#include <ngx_http_ssl_module.h> #endif diff --git a/src/http/ngx_http_config.h b/src/http/ngx_http_config.h index 647566aab..d2fb8a9ff 100644 --- a/src/http/ngx_http_config.h +++ b/src/http/ngx_http_config.h @@ -45,8 +45,11 @@ typedef struct { #define ngx_http_conf_get_module_main_conf(cf, module) \ ((ngx_http_conf_ctx_t *) cf->ctx)->main_conf[module.ctx_index] -#define ngx_http_conf_get_module_srv_conf(cf, module) \ - ngx_http_conf_get_module_srv_conf_could_not_be_implemented() +/* + * ngx_http_conf_get_module_srv_conf() and ngx_http_conf_get_module_loc_conf() + * could not be correctly implemented because at the merge phase cf->ctx + * points to http{}'s ctx + */ #define ngx_http_cycle_get_module_main_conf(cycle, module) \ ((ngx_http_conf_ctx_t *) \ diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index dc6e8736b..911a5aaeb 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -18,7 +18,6 @@ static void *ngx_http_core_create_loc_conf(ngx_conf_t *cf); static char *ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child); -static ngx_int_t ngx_http_core_init_process(ngx_cycle_t *cycle); static char *ngx_server_block(ngx_conf_t *cf, ngx_command_t *cmd, void *dummy); static int ngx_cmp_locations(const void *first, const void *second); static char *ngx_location_block(ngx_conf_t *cf, ngx_command_t *cmd, @@ -304,7 +303,7 @@ ngx_module_t ngx_http_core_module = { ngx_http_core_commands, /* module directives */ NGX_HTTP_MODULE, /* module type */ NULL, /* init module */ - ngx_http_core_init_process /* init process */ + NULL /* init process */ }; @@ -822,6 +821,8 @@ int ngx_http_delay_handler(ngx_http_request_t *r) #endif +#if 0 + static ngx_int_t ngx_http_core_init_process(ngx_cycle_t *cycle) { ngx_uint_t i; @@ -853,6 +854,8 @@ static ngx_int_t ngx_http_core_init_process(ngx_cycle_t *cycle) return NGX_OK; } +#endif + static char *ngx_server_block(ngx_conf_t *cf, ngx_command_t *cmd, void *dummy) { diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h index 98e020b1f..b71979b57 100644 --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -47,9 +47,6 @@ typedef struct { typedef struct { - ngx_recv_pt recv; - ngx_send_chain_pt send_chain; - /* * array of ngx_http_core_loc_conf_t, used in the translation handler * and in the merge phase diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 302b92497..e1463bafd 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -6,6 +6,9 @@ static void ngx_http_init_request(ngx_event_t *ev); +#if (NGX_HTTP_SSL) +static void ngx_http_check_ssl_handshake(ngx_event_t *rev); +#endif static void ngx_http_process_request_line(ngx_event_t *rev); static void ngx_http_process_request_headers(ngx_event_t *rev); static ssize_t ngx_http_read_request_header(ngx_http_request_t *r); @@ -40,6 +43,7 @@ static char *client_header_errors[] = { "client %s sent HTTP/1.1 request without \"Host\" header, URL: %s", "client %s sent invalid \"Content-Length\" header, URL: %s", "client %s sent POST method without \"Content-Length\" header, URL: %s", + "client %s sent plain HTTP request to HTTPS port, URL: %s", "client %s sent invalid \"Host\" header \"%s\", URL: %s" }; @@ -232,16 +236,24 @@ static void ngx_http_init_request(ngx_event_t *rev) r->srv_conf = cscf->ctx->srv_conf; r->loc_conf = cscf->ctx->loc_conf; + rev->event_handler = ngx_http_process_request_line; + + r->recv = ngx_recv; + r->send_chain = ngx_send_chain; + #if (NGX_HTTP_SSL) - sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_filter_module); + sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module); if (sscf->enable) { - if (ngx_ssl_create_session(sscf->ssl_ctx, c) == NGX_ERROR) { + if (ngx_ssl_create_session(sscf->ssl_ctx, c, NGX_SSL_BUFFER) + == NGX_ERROR) + { ngx_http_close_connection(c); return; } r->filter_need_in_memory = 1; + rev->event_handler = ngx_http_check_ssl_handshake; } #endif @@ -321,10 +333,58 @@ static void ngx_http_init_request(ngx_event_t *rev) r->http_state = NGX_HTTP_READING_REQUEST_STATE; + rev->event_handler(rev); +} + + +#if (NGX_HTTP_SSL) + +static void ngx_http_check_ssl_handshake(ngx_event_t *rev) +{ + int n; + u_char buf[1]; + ngx_connection_t *c; + ngx_http_request_t *r; + + c = rev->data; + r = c->data; + + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0, + "http check ssl handshake"); + + if (rev->timedout) { + ngx_http_client_error(r, 0, NGX_HTTP_REQUEST_TIME_OUT); + return; + } + + n = recv(c->fd, buf, 1, MSG_PEEK); + + if (n == -1 && ngx_socket_errno == NGX_EAGAIN) { + return; + } + + if (n == 1) { + if (buf[0] == 0x80 /* SSLv2 */ || buf[0] == 0x16 /* SSLv3/TLSv1 */) { + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, rev->log, 0, + "https ssl handshake: 0x%X", buf[0]); + + r->recv = ngx_ssl_recv; + r->send_chain = ngx_ssl_send_chain; + + } else { + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0, + "plain http"); + + r->plain_http = 1; + } + } + rev->event_handler = ngx_http_process_request_line; ngx_http_process_request_line(rev); } +#endif + static void ngx_http_process_request_line(ngx_event_t *rev) { @@ -832,13 +892,12 @@ static ssize_t ngx_http_read_request_header(ngx_http_request_t *r) return NGX_AGAIN; } - cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); - - n = cscf->recv(r->connection, r->header_in->last, - r->header_in->end - r->header_in->last); + n = r->recv(r->connection, r->header_in->last, + r->header_in->end - r->header_in->last); if (n == NGX_AGAIN) { if (!r->header_timeout_set) { + cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); ngx_add_timer(rev, cscf->client_header_timeout); r->header_timeout_set = 1; } @@ -939,6 +998,10 @@ static ngx_int_t ngx_http_process_request_header(ngx_http_request_t *r) return NGX_HTTP_PARSE_POST_WO_CL_HEADER; } + if (r->plain_http) { + return NGX_HTTP_PARSE_HTTP_TO_HTTPS; + } + if (r->headers_in.connection) { if (r->headers_in.connection->value.len == 5 && ngx_strcasecmp(r->headers_in.connection->value.data, "close") @@ -1873,7 +1936,9 @@ static void ngx_http_client_error(ngx_http_request_t *r, r->connection->log->handler = NULL; if (ctx->url) { - if (client_error == NGX_HTTP_PARSE_INVALID_HOST) { + switch (client_error) { + + case NGX_HTTP_PARSE_INVALID_HOST: ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, client_header_errors[client_error - NGX_HTTP_CLIENT_ERROR], ctx->client, r->headers_in.host->value.data, ctx->url); @@ -1888,7 +1953,14 @@ static void ngx_http_client_error(ngx_http_request_t *r, return; } - } else { + break; + + case NGX_HTTP_PARSE_HTTP_TO_HTTPS: + error = NGX_HTTP_TO_HTTPS; + + /* fall through */ + + default: ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, client_header_errors[client_error - NGX_HTTP_CLIENT_ERROR], ctx->client, ctx->url); diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h index 7abd57f80..a80e0a57d 100644 --- a/src/http/ngx_http_request.h +++ b/src/http/ngx_http_request.h @@ -31,7 +31,8 @@ #define NGX_HTTP_PARSE_NO_HOST_HEADER 16 #define NGX_HTTP_PARSE_INVALID_CL_HEADER 17 #define NGX_HTTP_PARSE_POST_WO_CL_HEADER 18 -#define NGX_HTTP_PARSE_INVALID_HOST 19 +#define NGX_HTTP_PARSE_HTTP_TO_HTTPS 19 +#define NGX_HTTP_PARSE_INVALID_HOST 20 #define NGX_HTTP_OK 200 @@ -217,6 +218,9 @@ struct ngx_http_request_s { ngx_connection_t *connection; + ngx_recv_pt recv; + ngx_send_chain_pt send_chain; + void **ctx; void **main_conf; void **srv_conf; @@ -292,6 +296,7 @@ struct ngx_http_request_s { /* can we use sendfile ? */ unsigned sendfile:1; + unsigned plain_http:1; unsigned chunked:1; unsigned header_only:1; unsigned keepalive:1; diff --git a/src/http/ngx_http_write_filter.c b/src/http/ngx_http_write_filter.c index 5d45f37e5..8b1447a44 100644 --- a/src/http/ngx_http_write_filter.c +++ b/src/http/ngx_http_write_filter.c @@ -7,6 +7,9 @@ typedef struct { ngx_chain_t *out; + + /* unsigned flush:1; */ + ngx_uint_t flush; } ngx_http_write_filter_ctx_t; @@ -42,7 +45,6 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) int last; off_t size, flush, sent; ngx_chain_t *cl, *ln, **ll, *chain; - ngx_http_core_srv_conf_t *cscf; ngx_http_core_loc_conf_t *clcf; ngx_http_write_filter_ctx_t *ctx; @@ -114,7 +116,7 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) return NGX_AGAIN; } - if (size == 0) { + if (size == 0 && !ctx->flush) { if (!last) { ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, "the http output chain is empty"); @@ -124,11 +126,8 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) sent = r->connection->sent; - cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); - - chain = cscf->send_chain(r->connection, ctx->out, - clcf->limit_rate ? clcf->limit_rate: - OFF_T_MAX_VALUE); + chain = r->send_chain(r->connection, ctx->out, + clcf->limit_rate ? clcf->limit_rate: OFF_T_MAX_VALUE); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http write filter %X", chain); @@ -144,6 +143,12 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) return NGX_ERROR; } + if (chain == NGX_CHAIN_AGAIN) { + ctx->out = NULL; + ctx->flush = 1; + return NGX_AGAIN; + } + ctx->out = chain; if (chain == NULL) { diff --git a/src/os/win32/ngx_os.h b/src/os/win32/ngx_os.h index 84b81a1c4..a9ce3ff62 100644 --- a/src/os/win32/ngx_os.h +++ b/src/os/win32/ngx_os.h @@ -21,13 +21,17 @@ #endif +typedef ssize_t (*ngx_recv_pt)(ngx_connection_t *c, u_char *buf, size_t size); +typedef ssize_t (*ngx_recv_chain_pt)(ngx_connection_t *c, ngx_chain_t *in); +typedef ssize_t (*ngx_send_pt)(ngx_connection_t *c, u_char *buf, size_t size); +typedef ngx_chain_t *(*ngx_send_chain_pt)(ngx_connection_t *c, ngx_chain_t *in, + off_t limit); typedef struct { - ssize_t (*recv)(ngx_connection_t *c, u_char *buf, size_t size); - ssize_t (*recv_chain)(ngx_connection_t *c, ngx_chain_t *in); - ssize_t (*send)(ngx_connection_t *c, u_char *buf, size_t size); - ngx_chain_t *(*send_chain)(ngx_connection_t *c, ngx_chain_t *in, - off_t limit); + ngx_recv_pt recv; + ngx_recv_chain_pt recv_chain; + ngx_send_pt send; + ngx_send_chain_pt send_chain; int flags; } ngx_os_io_t; |