mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-07 17:52:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

SSL: allow configuring providers with "ssl_provider ...".

Browse Source
This commit is contained in:
Aleksei Bavshin 2024-12-16 18:46:02 -08:00
parent 3d5889a3ee
commit 605cb206bc
2 changed files with 89 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
src/event/ngx_event_openssl.c
View File

@ -82,6 +82,7 @@ static time_t ngx_ssl_parse_time(
static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
static char *ngx_openssl_provider(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
static void ngx_openssl_exit(ngx_cycle_t *cycle);
@ -94,6 +95,13 @@ static ngx_command_t ngx_openssl_commands[] = {
0,
NULL },
{ ngx_string("ssl_provider"),
NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_1MORE,
ngx_openssl_provider,
0,
0,
NULL },
ngx_null_command
};
@ -5982,6 +5990,84 @@ ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
}
static char *
ngx_openssl_provider(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
#if (OPENSSL_VERSION_NUMBER >= 0x30200000L)
u_char *p;
ngx_uint_t i;
ngx_str_t *value;
OSSL_PARAM *param;
ngx_array_t params;
if (cf->cycle->modules_used) {
return "is specified too late";
}
value = cf->args->elts;
if (OSSL_PROVIDER_available(NULL, (char *) value[1].data)) {
ngx_conf_log_error(NGX_LOG_INFO, cf, 0,
"ssl_provider \"%V\" is already loaded", &value[1]);
return NGX_CONF_OK;
}
if (ngx_array_init(&params, cf->pool, cf->args->nelts - 1,
sizeof(OSSL_PARAM))
!= NGX_OK)
{
return NGX_CONF_ERROR;
}
ngx_memzero(params.elts, (cf->args->nelts - 1) * sizeof(OSSL_PARAM));
for (i = 2; i < cf->args->nelts; i++) {
p = (u_char *) ngx_strchr(value[i].data, '=');
if (p == NULL) {
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
"invalid parameter \"%V\"", &value[i]);
return NGX_CONF_ERROR;
}
param = ngx_array_push(&params);
if (param == NULL) {
return NGX_CONF_ERROR;
}
*p++ = '\0';
param->key = (char *) value[i].data;
param->data_type = OSSL_PARAM_UTF8_STRING;
param->data = p;
param->data_size = value[i].data + value[i].len - p;
}
param = ngx_array_push(&params);
if (param == NULL) {
return NGX_CONF_ERROR;
}
if (OSSL_PROVIDER_load_ex(NULL, (char* ) value[1].data,
(params.nelts > 1) ? params.elts : NULL)
== NULL)
{
ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
"OSSL_PROVIDER_load_ex(\"%V\") failed", &value[1]);
return NGX_CONF_ERROR;
}
return NGX_CONF_OK;
#else
return "is not supported";
#endif
}
static void
ngx_openssl_exit(ngx_cycle_t *cycle)
{

3
src/event/ngx_event_openssl.h
View File

@ -38,6 +38,9 @@
#ifndef OPENSSL_NO_OCSP
#include <openssl/ocsp.h>
#endif
#if (OPENSSL_VERSION_NUMBER >= 0x30200000L)
#include <openssl/provider.h>
#endif
#include <openssl/rand.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>