From 755694565542b227c6966e8ba78425c84cf6e009 Mon Sep 17 00:00:00 2001 From: Igor Sysoev Date: Thu, 8 Jul 2004 15:17:47 +0000 Subject: [PATCH] nginx-0.0.7-2004-07-08-19:17:47 import --- auto/modules | 8 + auto/options | 4 +- auto/sources | 4 + src/core/ngx_conf_file.h | 8 +- src/event/modules/ngx_kqueue_module.c | 2 + src/http/modules/ngx_http_ssl_filter.c | 248 +++++++++++++++++++++++++ src/http/modules/ngx_http_ssl_filter.h | 13 ++ src/http/ngx_http.h | 14 +- src/http/ngx_http_request.c | 4 + src/os/unix/ngx_thread.h | 1 + 10 files changed, 296 insertions(+), 10 deletions(-) create mode 100644 src/http/modules/ngx_http_ssl_filter.c create mode 100644 src/http/modules/ngx_http_ssl_filter.h diff --git a/auto/modules b/auto/modules index 55e10a7c4..705f0287d 100644 --- a/auto/modules +++ b/auto/modules @@ -58,6 +58,14 @@ if [ $HTTP_GZIP = YES ]; then HTTP_SRCS="$HTTP_SRCS $HTTP_GZIP_SRCS" fi +if [ $HTTP_SSL = YES ]; then + have=NGX_HTTP_SSL . auto/have + HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSL_FILTER_MODULE" + HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS" + # STUB: move to auto/libs/ssl + CORE_LIBS="$CORE_LIBS -lssl -lcrypto" +fi + if [ $HTTP_SSI = YES ]; then have=NGX_HTTP_SSI . auto/have HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSI_FILTER_MODULE" diff --git a/auto/options b/auto/options index a2e01a2b7..c506062de 100644 --- a/auto/options +++ b/auto/options @@ -31,6 +31,7 @@ USE_THREADS=NO HTTP_CHARSET=YES HTTP_GZIP=YES +HTTP_SSL=NO HTTP_SSI=YES HTTP_ACCESS=YES HTTP_STATUS=YES @@ -83,9 +84,10 @@ do --with-threads=*) USE_THREADS="$value" ;; --with-threads) USE_THREADS="pthreads" ;; + --with-http_ssl_module) HTTP_SSL=YES ;; --without-http_charset_module) HTTP_CHARSET=NO ;; - --without-http_ssi_module) HTTP_SSI=NO ;; --without-http_gzip_module) HTTP_GZIP=NO ;; + --without-http_ssi_module) HTTP_SSI=NO ;; --without-http_access_module) HTTP_ACCESS=NO ;; --without-http_status_module) HTTP_STATUS=NO ;; --without-http_rewrite_module) HTTP_REWRITE=NO ;; diff --git a/auto/sources b/auto/sources index 041b23daf..34f61a3c3 100644 --- a/auto/sources +++ b/auto/sources @@ -249,6 +249,10 @@ HTTP_GZIP_FILTER_MODULE=ngx_http_gzip_filter_module HTTP_GZIP_SRCS=src/http/modules/ngx_http_gzip_filter.c +HTTP_SSL_FILTER_MODULE=ngx_http_ssl_filter_module +HTTP_SSL_SRCS=src/http/modules/ngx_http_ssl_filter.c + + HTTP_SSI_FILTER_MODULE=ngx_http_ssi_filter_module HTTP_SSI_SRCS=src/http/modules/ngx_http_ssi_filter.c diff --git a/src/core/ngx_conf_file.h b/src/core/ngx_conf_file.h index ec61e94cf..c09ee552b 100644 --- a/src/core/ngx_conf_file.h +++ b/src/core/ngx_conf_file.h @@ -45,6 +45,7 @@ #define NGX_CONF_UNSET -1 #define NGX_CONF_UNSET_UINT (ngx_uint_t) -1 +#define NGX_CONF_UNSET_PTR (void *) -1 #define NGX_CONF_UNSET_SIZE (size_t) -1 #define NGX_CONF_UNSET_MSEC (ngx_msec_t) -1 @@ -181,7 +182,7 @@ char *ngx_conf_check_num_bounds(ngx_conf_t *cf, void *post, void *data); } #define ngx_conf_init_ptr_value(conf, default) \ - if (conf == (void *) NGX_CONF_UNSET) { \ + if (conf == NGX_CONF_UNSET_PTR) { \ conf = default; \ } @@ -205,6 +206,11 @@ char *ngx_conf_check_num_bounds(ngx_conf_t *cf, void *post, void *data); conf = (prev == NGX_CONF_UNSET) ? default : prev; \ } +#define ngx_conf_merge_ptr_value(conf, prev, default) \ + if (conf == NULL) { \ + conf = (prev == NULL) ? default : prev; \ + } + #define ngx_conf_merge_unsigned_value(conf, prev, default) \ if (conf == NGX_CONF_UNSET_UINT) { \ conf = (prev == NGX_CONF_UNSET_UINT) ? default : prev; \ diff --git a/src/event/modules/ngx_kqueue_module.c b/src/event/modules/ngx_kqueue_module.c index 99fffefee..9bc0a604c 100644 --- a/src/event/modules/ngx_kqueue_module.c +++ b/src/event/modules/ngx_kqueue_module.c @@ -205,7 +205,9 @@ static void ngx_kqueue_done(ngx_cycle_t *cycle) ngx_kqueue = -1; +#if (NGX_THREADS) ngx_mutex_destroy(ngx_kqueue_mutex); +#endif ngx_free(change_list1); ngx_free(change_list0); diff --git a/src/http/modules/ngx_http_ssl_filter.c b/src/http/modules/ngx_http_ssl_filter.c new file mode 100644 index 000000000..c9f21db32 --- /dev/null +++ b/src/http/modules/ngx_http_ssl_filter.c @@ -0,0 +1,248 @@ + +#include +#include +#include + +#include +#include + + +#define NGX_DEFLAUT_CERTIFICATE "cert.pem" +#define NGX_DEFLAUT_CERTIFICATE_KEY "cert.pem" + + +typedef struct { + ngx_flag_t enable; + ngx_str_t certificate; + ngx_str_t certificate_key; +} ngx_http_ssl_srv_conf_t; + + +typedef struct { + SSL *ssl; + SSL_CTX *ssl_ctx; + + unsigned accepted; +} ngx_http_ssl_ctx_t; + + +static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r); +static void ngx_http_ssl_error(ngx_uint_t level, ngx_log_t *log, int err, + char *fmt, ...); +static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf); +static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, + void *parent, void *child); +static ngx_int_t ngx_http_ssl_filter_init(ngx_cycle_t *cycle); + + +static ngx_command_t ngx_http_charset_filter_commands[] = { + + { ngx_string("ssl_"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, enable), + NULL }, + + { ngx_string("ssl_certificate"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, certificate), + NULL }, + + { ngx_string("ssl_certificate_key"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, certificate_key), + NULL }, + + ngx_null_command +}; + + +static ngx_http_module_t ngx_http_ssl_filter_module_ctx = { + NULL, /* pre conf */ + + NULL, /* create main configuration */ + NULL, /* init main configuration */ + + ngx_http_ssl_create_srv_conf, /* create server configuration */ + ngx_http_ssl_merge_srv_conf, /* merge server configuration */ + + NULL, /* create location configuration */ + NULL, /* merge location configuration */ +}; + + +ngx_module_t ngx_http_ssl_filter_module = { + NGX_MODULE, + &ngx_http_ssl_filter_module_ctx, /* module context */ + NULL, /* module directives */ + NGX_HTTP_MODULE, /* module type */ + ngx_http_ssl_filter_init, /* init module */ + NULL /* init process */ +}; + + +ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r) +{ + int rc; + ngx_http_ssl_ctx_t *ctx; + + ctx = ngx_http_get_module_ctx(r, ngx_http_ssl_filter_module); + + if (ctx == NULL) { + ctx = ngx_http_ssl_create_ctx(r); + + if (ctx == NULL) { + return NGX_HTTP_INTERNAL_SERVER_ERROR; + } + } + + if (!ctx->accepted) { + rc = SSL_accept(ctx->ssl); + + if (rc != 1) { + rc = SSL_get_error(ctx->ssl, rc); + + if (rc == SSL_ERROR_WANT_READ || rc == SSL_ERROR_WANT_WRITE) { + return NGX_AGAIN; + } + + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, rc, + "SSL_accept() failed"); + return NGX_ERROR; + } + + ctx->accepted = 1; + } + + return NGX_OK; +} + + +static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r) +{ + ngx_http_ssl_ctx_t *ctx; + ngx_http_ssl_srv_conf_t *scf; + + ngx_http_create_ctx(r, ctx, ngx_http_ssl_filter_module, + sizeof(ngx_http_ssl_ctx_t), NULL); + + /* TODO: configure methods */ + ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method()); + + if (ctx->ssl_ctx == NULL) { + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, + "SSL_CTX_new() failed"); + return NULL; + } + + scf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_filter_module); + + if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, scf->certificate.data, + SSL_FILETYPE_PEM) == 0) { + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, + "SSL_CTX_use_certificate_file() failed"); + return NULL; + } + + if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, scf->certificate_key.data, + SSL_FILETYPE_PEM) == 0) { + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, + "SSL_CTX_use_PrivateKey_file() failed"); + return NULL; + } + + ctx->ssl = SSL_new(ctx->ssl_ctx); + + if (ctx->ssl == NULL) { + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, + "SSL_new() failed"); + return NULL; + } + + if (SSL_set_fd(ctx->ssl, r->connection->fd) == 0) { + ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0, + "SSL_set_fd() failed"); + return NULL; + } + + return ctx; +} + + +static void ngx_http_ssl_error(ngx_uint_t level, ngx_log_t *log, int err, + char *fmt, ...) +{ + int len; + char errstr[NGX_MAX_CONF_ERRSTR]; + va_list args; + + va_start(args, fmt); + len = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args); + va_end(args); + + errstr[len++] = ' '; + errstr[len++] = '('; + errstr[len++] = 'S'; + errstr[len++] = 'S'; + errstr[len++] = 'L'; + errstr[len++] = ':'; + errstr[len++] = ' '; + + ERR_error_string_n(ERR_get_error(), errstr + len, sizeof(errstr) - len - 1); + + ngx_log_error(level, log, 0, "%s)", errstr); +} + + +static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) +{ + ngx_http_ssl_srv_conf_t *scf; + + if (!(scf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)))) { + return NGX_CONF_ERROR; + } + + scf->enable = NGX_CONF_UNSET; + + return scf; +} + + +static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, + void *parent, void *child) +{ + ngx_http_ssl_srv_conf_t *prev = parent; + ngx_http_ssl_srv_conf_t *conf = child; + + ngx_conf_merge_value(conf->enable, prev->enable, 0); + + ngx_conf_merge_str_value(conf->certificate, prev->certificate, + NGX_DEFLAUT_CERTIFICATE); + + ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, + NGX_DEFLAUT_CERTIFICATE_KEY); + + return NGX_CONF_OK; +} + + +static ngx_int_t ngx_http_ssl_filter_init(ngx_cycle_t *cycle) +{ + SSL_library_init(); + SSL_load_error_strings(); + +#if 0 + ngx_http_next_header_filter = ngx_http_top_header_filter; + ngx_http_top_header_filter = ngx_http_ssl_header_filter; + + ngx_http_next_body_filter = ngx_http_top_body_filter; + ngx_http_top_body_filter = ngx_http_ssl_body_filter; +#endif + + return NGX_OK; +} diff --git a/src/http/modules/ngx_http_ssl_filter.h b/src/http/modules/ngx_http_ssl_filter.h new file mode 100644 index 000000000..26704b5c3 --- /dev/null +++ b/src/http/modules/ngx_http_ssl_filter.h @@ -0,0 +1,13 @@ +#ifndef _NGX_HTTP_SSL_FILTER_H_INCLUDED_ +#define _NGX_HTTP_SSL_FILTER_H_INCLUDED_ + + +#include +#include +#include + + +ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r); + + +#endif /* _NGX_HTTP_SSL_FILTER_H_INCLUDED_ */ diff --git a/src/http/ngx_http.h b/src/http/ngx_http.h index 33d6f3414..2a4ce03ca 100644 --- a/src/http/ngx_http.h +++ b/src/http/ngx_http.h @@ -10,7 +10,9 @@ typedef struct ngx_http_request_s ngx_http_request_t; typedef struct ngx_http_cleanup_s ngx_http_cleanup_t; #if (NGX_HTTP_CACHE) +#include #endif +/* STUB */ #include #include @@ -19,6 +21,10 @@ typedef struct ngx_http_cleanup_s ngx_http_cleanup_t; #include #include +#if (NGX_HTTP_SSL) +#include +#endif + typedef struct { u_int connection; @@ -49,14 +55,6 @@ typedef struct { r->ctx[module.ctx_index] = NULL; -/* STUB */ -#define NGX_INDEX "index.html" - - -/* STUB */ -int ngx_http_init(ngx_pool_t *pool, ngx_log_t *log); -/**/ - void ngx_http_init_connection(ngx_connection_t *c); ngx_int_t ngx_http_parse_request_line(ngx_http_request_t *r); diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 1857f59e9..9e2cb89d6 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -815,8 +815,12 @@ static ssize_t ngx_http_read_request_header(ngx_http_request_t *r) return NGX_AGAIN; } +#if 1 + ngx_http_ssl_read(r); +#else n = ngx_recv(r->connection, r->header_in->last, r->header_in->end - r->header_in->last); +#endif if (n == NGX_AGAIN) { if (!r->header_timeout_set) { diff --git a/src/os/unix/ngx_thread.h b/src/os/unix/ngx_thread.h index b779de060..69d3c348d 100644 --- a/src/os/unix/ngx_thread.h +++ b/src/os/unix/ngx_thread.h @@ -107,6 +107,7 @@ ngx_int_t ngx_cond_signal(ngx_cond_t *cv); #define ngx_log_tid 0 #define TID_T_FMT "%d" +#define ngx_mutex_trylock(m) NGX_OK #define ngx_mutex_lock(m) NGX_OK #define ngx_mutex_unlock(m)