diff options
-rw-r--r-- | auto/modules | 14 | ||||
-rw-r--r-- | src/core/ngx_connection.h | 4 | ||||
-rw-r--r-- | src/core/ngx_core.h | 4 | ||||
-rw-r--r-- | src/http/modules/ngx_http_ssl_filter.c | 188 | ||||
-rw-r--r-- | src/http/modules/ngx_http_ssl_filter.h | 8 | ||||
-rw-r--r-- | src/http/ngx_http.h | 2 | ||||
-rw-r--r-- | src/http/ngx_http_request.c | 22 | ||||
-rw-r--r-- | src/http/ngx_http_request.h | 1 | ||||
-rw-r--r-- | src/http/ngx_http_write_filter.c | 23 |
9 files changed, 153 insertions, 113 deletions
diff --git a/auto/modules b/auto/modules index e03bd20ff..9447780f3 100644 --- a/auto/modules +++ b/auto/modules @@ -43,10 +43,10 @@ fi # the filter order is important # ngx_http_write_filter -# ngx_http_ssl_filter # ngx_http_header_filter # ngx_http_chunked_filter # ngx_http_range_header_filter +# ngx_http_ssl_filter # ngx_http_gzip_filter # ngx_http_charset_filter # ngx_http_ssi_filter @@ -55,10 +55,13 @@ fi # ngx_http_range_body_filter # ngx_http_not_modified_filter -HTTP_FILTER_MODULES="$HTTP_WRITE_FILTER_MODULE" +HTTP_FILTER_MODULES="$HTTP_WRITE_FILTER_MODULE \ + $HTTP_HEADER_FILTER_MODULE \ + $HTTP_CHUNKED_FILTER_MODULE \ + $HTTP_RANGE_HEADER_FILTER_MODULE" if [ $HTTP_SSL = YES ]; then - have=NGX_HTTP_SSL . auto/have + have=NGX_OPENSSL . auto/have HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSL_FILTER_MODULE" HTTP_DEPS="$HTTP_DEPS $HTTP_SSL_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS" @@ -66,11 +69,6 @@ if [ $HTTP_SSL = YES ]; then CORE_LIBS="$CORE_LIBS -lssl -lcrypto" fi -HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES \ - $HTTP_HEADER_FILTER_MODULE \ - $HTTP_CHUNKED_FILTER_MODULE \ - $HTTP_RANGE_HEADER_FILTER_MODULE" - if [ $HTTP_GZIP = YES ]; then have=NGX_HTTP_GZIP . auto/have USE_ZLIB=YES diff --git a/src/core/ngx_connection.h b/src/core/ngx_connection.h index 9646f26a9..ea69790a0 100644 --- a/src/core/ngx_connection.h +++ b/src/core/ngx_connection.h @@ -90,6 +90,10 @@ struct ngx_connection_s { socklen_t socklen; ngx_str_t addr_text; +#if (NGX_OPENSSL) + SSL *ssl; +#endif + #if (HAVE_IOCP) struct sockaddr *local_sockaddr; socklen_t local_socklen; diff --git a/src/core/ngx_core.h b/src/core/ngx_core.h index 58b1d1238..8f30f2f01 100644 --- a/src/core/ngx_core.h +++ b/src/core/ngx_core.h @@ -55,6 +55,10 @@ typedef struct ngx_connection_s ngx_connection_t; #include <ngx_process_cycle.h> #include <ngx_conf_file.h> #include <ngx_os.h> +#if (NGX_OPENSSL) +#include <openssl/ssl.h> +#include <openssl/err.h> +#endif #include <ngx_connection.h> diff --git a/src/http/modules/ngx_http_ssl_filter.c b/src/http/modules/ngx_http_ssl_filter.c index 344577b64..297f5c7b6 100644 --- a/src/http/modules/ngx_http_ssl_filter.c +++ b/src/http/modules/ngx_http_ssl_filter.c @@ -3,9 +3,6 @@ #include <ngx_core.h> #include <ngx_http.h> -#include <openssl/ssl.h> -#include <openssl/err.h> - #define NGX_DEFLAUT_CERTIFICATE "cert.pem" #define NGX_DEFLAUT_CERTIFICATE_KEY "cert.pem" @@ -25,9 +22,7 @@ typedef struct { } ngx_http_ssl_ctx_t; -static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r); -static ngx_chain_t *ngx_http_ssl_write(ngx_http_request_t *r, ngx_chain_t *in, - off_t limit); +static ngx_int_t ngx_http_ssl_create_ssl(ngx_http_request_t *r); static void ngx_http_ssl_error(ngx_uint_t level, ngx_log_t *log, int err, char *fmt, ...); static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); @@ -87,56 +82,55 @@ ngx_module_t ngx_http_ssl_filter_module = { }; -ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r, u_char *buf, size_t n) +ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r, u_char *buf, size_t size) { - int rc; + int n; + SSL *ssl; ngx_http_ssl_ctx_t *ctx; ngx_http_log_ctx_t *log_ctx; - ctx = ngx_http_get_module_ctx(r, ngx_http_ssl_filter_module); - - if (ctx == NULL) { - ctx = ngx_http_ssl_create_ctx(r); - - if (ctx == NULL) { + if (r->connection->ssl == NULL) { + if (ngx_http_ssl_create_ssl(r) == NGX_ERROR) { return NGX_HTTP_INTERNAL_SERVER_ERROR; } } - rc = SSL_read(ctx->ssl, buf, n); + ssl = r->connection->ssl; + + n = SSL_read(ssl, buf, size); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "SSL_read: %d", rc); + "SSL_read: %d", n); - if (rc > 0) { - return rc; + if (n > 0) { + return n; } - rc = SSL_get_error(ctx->ssl, rc); + n = SSL_get_error(ssl, n); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "SSL_get_error: %d", rc); + "SSL_get_error: %d", n); - if (rc == SSL_ERROR_WANT_READ) { + if (n == SSL_ERROR_WANT_READ) { return NGX_AGAIN; } #if 0 - if (rc == SSL_ERROR_WANT_WRITE) { + if (n == SSL_ERROR_WANT_WRITE) { return NGX_AGAIN; } #endif - if (!SSL_is_init_finished(ctx->ssl)) { + if (!SSL_is_init_finished(ssl)) { log_ctx = (ngx_http_log_ctx_t *) r->connection->log->data; log_ctx->action = "SSL handshake"; } - if (rc == SSL_ERROR_ZERO_RETURN) { + if (n == SSL_ERROR_ZERO_RETURN) { ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, "client closed connection"); - SSL_set_shutdown(ctx->ssl, SSL_RECEIVED_SHUTDOWN); + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); return NGX_SSL_ERROR; } @@ -145,131 +139,143 @@ ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r, u_char *buf, size_t n) ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "client sent plain HTTP request to HTTPS port"); - SSL_set_shutdown(ctx->ssl, - SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN); + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN); return NGX_SSL_HTTP_ERROR; } - ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, rc, + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, n, "SSL_read() failed"); - SSL_set_shutdown(ctx->ssl, SSL_RECEIVED_SHUTDOWN); + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); return NGX_SSL_ERROR; } -ngx_int_t ngx_http_ssl_writer(ngx_http_request_t *r, ngx_chain_t *in) +ngx_chain_t *ngx_http_ssl_write(ngx_connection_t *c, ngx_chain_t *in, + off_t limit) { - ngx_http_ssl_ctx_t *ctx; + int n; + ssize_t send, size; - ctx = ngx_http_get_module_ctx(r, ngx_http_ssl_filter_module); + send = 0; - if (in == NULL) { - rc = SSL_shutdown(ctx->ssl); + for (/* void */; in; in = in->next) { + if (ngx_buf_special(in->buf)) { + continue; + } - ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "SSL_shutdown: %d", rc); + size = in->buf->last - in->buf->pos; - if (rc == 0) { - return NGX_AGAIN; + if (send + size > limit) { + size = limit - send; } - if (rc == 1) { - SSL_free(ctx->ssl); - return NGX_OK; + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL to write: %d", size); + + n = SSL_write(c->ssl, in->buf->pos, size); + + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL_write: %d", n); + + if (n > 0) { + in->buf->pos += n; + send += n; + + if (n == size) { + if (send < limit) { + continue; + } + + return in; + } + + c->write->ready = 0; + return in; } - rc = SSL_get_error(ctx->ssl, rc); + n = SSL_get_error(c->ssl, n); - ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "SSL_get_error: %d", rc); + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL_get_error: %d", n); - if (rc == SSL_ERROR_WANT_WRITE) { - return NGX_AGAIN; + if (n == SSL_ERROR_WANT_WRITE) { + c->write->ready = 0; + return in; } - ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, rc, - "SSL_shutdown() failed"); + ngx_http_ssl_error(NGX_LOG_ALERT, c->log, n, "SSL_write() failed"); - return NGX_ERROR; + return NGX_CHAIN_ERROR; } - ch = ngx_http_ssl_write(r, ctx, in, 0); - - return NGX_OK; + return in; } -static ngx_chain_t *ngx_http_ssl_write(ngx_http_request_t *r, - ngx_http_ssl_ctx_t *ctx, - ngx_chain_t *in, - off_t limit) +ngx_int_t ngx_http_ssl_shutdown(ngx_http_request_t *r) { - int rc; - size_t send, size; + int n; + SSL *ssl; - ctx = ngx_http_get_module_ctx(r, ngx_http_ssl_filter_module); + ssl = r->connection->ssl; - send = 0; + n = SSL_shutdown(ssl); - for (/* void */; in; in = in->next) { - if (ngx_buf_special(in->buf)) { - continue; - } - - size = in->buf->last - in->buf->pos; + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "SSL_shutdown: %d", n); - if (send + size > limit) { - size = limit - send; - } + if (n == 0) { + return NGX_AGAIN; + } - rc = SSL_write(ctx->ssl, in->buf->pos, size); + if (n == 1) { + SSL_free(ssl); + r->connection->ssl = NULL; + return NGX_OK; + } - if (rc > 0) { - in->buf->pos += rc; + n = SSL_get_error(ssl, n); - if (rc == size) { - continue; - } + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "SSL_get_error: %d", n); - r->connection->write->ready = 0; - return in; - } + if (n == SSL_ERROR_WANT_WRITE) { + return NGX_AGAIN; } - return in; + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, n, + "SSL_shutdown() failed"); + + return NGX_ERROR; } -static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r) +static ngx_int_t ngx_http_ssl_create_ssl(ngx_http_request_t *r) { - ngx_http_ssl_ctx_t *ctx; + SSL *ssl; ngx_http_ssl_srv_conf_t *scf; - ngx_http_create_ctx(r, ctx, ngx_http_ssl_filter_module, - sizeof(ngx_http_ssl_ctx_t), NULL); - scf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_filter_module); - ctx->ssl = SSL_new(scf->ssl_ctx); + ssl = SSL_new(scf->ssl_ctx); - if (ctx->ssl == NULL) { + if (ssl == NULL) { ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, "SSL_new() failed"); - return NULL; + return NGX_ERROR; } - if (SSL_set_fd(ctx->ssl, r->connection->fd) == 0) { + if (SSL_set_fd(ssl, r->connection->fd) == 0) { ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, "SSL_set_fd() failed"); - return NULL; + return NGX_ERROR; } - SSL_set_accept_state(ctx->ssl); + SSL_set_accept_state(ssl); + + r->connection->ssl = ssl; - return ctx; + return NGX_OK; } diff --git a/src/http/modules/ngx_http_ssl_filter.h b/src/http/modules/ngx_http_ssl_filter.h index 9bbe65a4f..a96a26781 100644 --- a/src/http/modules/ngx_http_ssl_filter.h +++ b/src/http/modules/ngx_http_ssl_filter.h @@ -6,15 +6,15 @@ #include <ngx_core.h> #include <ngx_http.h> -#include <openssl/ssl.h> - #define NGX_SSL_ERROR -10 #define NGX_SSL_HTTP_ERROR -11 -ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r, u_char *buf, size_t n); -ngx_int_t ngx_http_ssl_writer(ngx_http_request_t *r, ngx_chain_t *in); +ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r, u_char *buf, size_t size); +ngx_int_t ngx_http_ssl_shutdown(ngx_http_request_t *r); +ngx_chain_t *ngx_http_ssl_write(ngx_connection_t *c, ngx_chain_t *in, + off_t limit); void ngx_http_ssl_close_connection(SSL *ssl, ngx_log_t *log); diff --git a/src/http/ngx_http.h b/src/http/ngx_http.h index 2a4ce03ca..44edd1529 100644 --- a/src/http/ngx_http.h +++ b/src/http/ngx_http.h @@ -21,7 +21,7 @@ typedef struct ngx_http_cleanup_s ngx_http_cleanup_t; #include <ngx_http_log_handler.h> #include <ngx_http_core_module.h> -#if (NGX_HTTP_SSL) +#if (NGX_OPENSSL) #include <ngx_http_ssl_filter.h> #endif diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 65b024d75..d0c92edcc 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -229,6 +229,11 @@ static void ngx_http_init_request(ngx_event_t *rev) r->srv_conf = cscf->ctx->srv_conf; r->loc_conf = cscf->ctx->loc_conf; +#if 1 + r->ssl = 1; + r->filter_need_in_memory = 1; +#endif + server_name = cscf->server_names.elts; r->server_name = &server_name->name; @@ -815,12 +820,17 @@ static ssize_t ngx_http_read_request_header(ngx_http_request_t *r) return NGX_AGAIN; } -#if 0 - n = ngx_http_ssl_read(r, r->header_in->last, - r->header_in->end - r->header_in->last); -#else - n = ngx_recv(r->connection, r->header_in->last, - r->header_in->end - r->header_in->last); +/* STUB */ +#if (NGX_OPENSSL) + if (r->ssl) { + n = ngx_http_ssl_read(r, r->header_in->last, + r->header_in->end - r->header_in->last); + } else { +#endif + n = ngx_recv(r->connection, r->header_in->last, + r->header_in->end - r->header_in->last); +#if (NGX_OPENSSL) + } #endif if (n == NGX_AGAIN) { diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h index 7abd57f80..c315add03 100644 --- a/src/http/ngx_http_request.h +++ b/src/http/ngx_http_request.h @@ -280,6 +280,7 @@ struct ngx_http_request_s { unsigned complex_uri:1; unsigned header_timeout_set:1; + unsigned ssl:1; unsigned proxy:1; unsigned bypass_cache:1; unsigned no_cache:1; diff --git a/src/http/ngx_http_write_filter.c b/src/http/ngx_http_write_filter.c index 2d4c1ef1c..b0a82f531 100644 --- a/src/http/ngx_http_write_filter.c +++ b/src/http/ngx_http_write_filter.c @@ -53,6 +53,12 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) sizeof(ngx_http_write_filter_ctx_t), NGX_ERROR); } +#if (NGX_OPENSSL) + if (r->ssl && in == NULL && ctx->out == NULL) { + return ngx_http_ssl_shutdown(r); + } +#endif + size = 0; flush = 0; last = 0; @@ -123,9 +129,20 @@ ngx_int_t ngx_http_write_filter(ngx_http_request_t *r, ngx_chain_t *in) sent = r->connection->sent; - chain = ngx_write_chain(r->connection, ctx->out, - clcf->limit_rate ? clcf->limit_rate: - OFF_T_MAX_VALUE); +/* STUB */ +#if (NGX_OPENSSL) + if (r->ssl) { + chain = ngx_http_ssl_write(r->connection, ctx->out, + clcf->limit_rate ? clcf->limit_rate: + OFF_T_MAX_VALUE); + } else { +#endif + chain = ngx_write_chain(r->connection, ctx->out, + clcf->limit_rate ? clcf->limit_rate: + OFF_T_MAX_VALUE); +#if (NGX_OPENSSL) + } +#endif ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http write filter %X", chain); |