Lines Matching refs:hctx
169 handler_ctx_free (handler_ctx *hctx) in handler_ctx_free() argument
171 gnutls_deinit(hctx->ssl); in handler_ctx_free()
172 if (hctx->acme_tls_1_cred) in handler_ctx_free()
173 gnutls_certificate_free_credentials(hctx->acme_tls_1_cred); in handler_ctx_free()
174 free(hctx); in handler_ctx_free()
767 mod_gnutls_verify_set_tlist (handler_ctx *hctx, int req) in mod_gnutls_verify_set_tlist() argument
781 if (hctx->conf.pc->trust_inited) return GNUTLS_E_SUCCESS; in mod_gnutls_verify_set_tlist()
789 d = req && hctx->conf.ssl_ca_dn_file in mod_gnutls_verify_set_tlist()
790 ? hctx->conf.ssl_ca_dn_file in mod_gnutls_verify_set_tlist()
791 : hctx->conf.ssl_ca_file; in mod_gnutls_verify_set_tlist()
793 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_gnutls_verify_set_tlist()
796 hctx->r->uri.authority.ptr); /*(might not be set yet if no SNI)*/ in mod_gnutls_verify_set_tlist()
803 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_verify_set_tlist()
811 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_verify_set_tlist()
817 d = hctx->conf.ssl_ca_crl_file; in mod_gnutls_verify_set_tlist()
818 if (NULL != d && req && hctx->conf.ssl_ca_dn_file) { in mod_gnutls_verify_set_tlist()
824 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_verify_set_tlist()
833 gnutls_certificate_credentials_t ssl_cred = hctx->conf.pc->ssl_cred; in mod_gnutls_verify_set_tlist()
837 if (NULL == hctx->conf.ssl_ca_dn_file) in mod_gnutls_verify_set_tlist()
838 hctx->conf.pc->trust_inited = 1; in mod_gnutls_verify_set_tlist()
847 handler_ctx * const hctx = gnutls_session_get_ptr(ssl); in mod_gnutls_verify_cb() local
848 if (!hctx->conf.ssl_verifyclient) return 0; in mod_gnutls_verify_cb()
857 if (hctx->conf.ssl_ca_dn_file) { in mod_gnutls_verify_cb()
858 rc = mod_gnutls_verify_set_tlist(hctx, 0); /* for client cert verify */ in mod_gnutls_verify_cb()
876 rc = gnutls_certificate_verify_peers2(ssl, &hctx->verify_status); in mod_gnutls_verify_cb()
879 if (hctx->verify_status == 0 && hctx->conf.ssl_ca_dn_file) { in mod_gnutls_verify_cb()
883 (gnutls_x509_crt_t *)(void *)hctx->conf.ssl_ca_dn_file->data; in mod_gnutls_verify_cb()
884 unsigned int len = hctx->conf.ssl_ca_dn_file->size; in mod_gnutls_verify_cb()
902 hctx->verify_status |= GNUTLS_CERT_SIGNER_NOT_CA; in mod_gnutls_verify_cb()
906 if (hctx->verify_status != 0 && hctx->conf.ssl_verifyclient_enforce) { in mod_gnutls_verify_cb()
1270 mod_gnutls_acme_tls_1 (handler_ctx *hctx) in mod_gnutls_acme_tls_1() argument
1272 buffer * const b = hctx->tmp_buf; in mod_gnutls_acme_tls_1()
1273 const buffer * const name = &hctx->r->uri.authority; in mod_gnutls_acme_tls_1()
1274 log_error_st * const errh = hctx->r->conf.errh; in mod_gnutls_acme_tls_1()
1278 if (!hctx->conf.ssl_acme_tls_1) in mod_gnutls_acme_tls_1()
1288 if (0 != http_request_host_policy(name, hctx->r->conf.http_parseopts, 443)) in mod_gnutls_acme_tls_1()
1291 buffer_copy_path_len2(b, BUF_PTR_LEN(hctx->conf.ssl_acme_tls_1), in mod_gnutls_acme_tls_1()
1360 hctx->acme_tls_1_cred = ssl_cred; /*(save ptr and free later)*/ in mod_gnutls_acme_tls_1()
1362 gnutls_credentials_clear(hctx->ssl); in mod_gnutls_acme_tls_1()
1363 rc = gnutls_credentials_set(hctx->ssl, GNUTLS_CRD_CERTIFICATE, ssl_cred); in mod_gnutls_acme_tls_1()
1365 elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_acme_tls_1()
1367 hctx->r->uri.authority.ptr); in mod_gnutls_acme_tls_1()
1372 gnutls_certificate_server_set_request(hctx->ssl, GNUTLS_CERT_IGNORE); in mod_gnutls_acme_tls_1()
1379 mod_gnutls_alpn_h2_policy (handler_ctx * const hctx) in mod_gnutls_alpn_h2_policy() argument
1383 if (buffer_is_blank(&hctx->r->uri.authority)) { in mod_gnutls_alpn_h2_policy()
1384 log_error(hctx->errh, __FILE__, __LINE__, in mod_gnutls_alpn_h2_policy()
1389 if (gnutls_protocol_get_version(hctx->ssl) < GNUTLS_TLS1_2) { in mod_gnutls_alpn_h2_policy()
1391 log_error(hctx->errh, __FILE__, __LINE__, in mod_gnutls_alpn_h2_policy()
1410 mod_gnutls_ALPN (handler_ctx * const hctx, const unsigned char * const in, const unsigned int inlen) in mod_gnutls_ALPN() argument
1420 if (!hctx->r->conf.h2proto) continue; in mod_gnutls_ALPN()
1421 hctx->alpn = MOD_GNUTLS_ALPN_H2; in mod_gnutls_ALPN()
1422 if (hctx->r->handler_module == NULL)/*(e.g. not mod_sockproxy)*/ in mod_gnutls_ALPN()
1423 hctx->r->http_version = HTTP_VERSION_2; in mod_gnutls_ALPN()
1430 hctx->alpn = MOD_GNUTLS_ALPN_HTTP11; in mod_gnutls_ALPN()
1434 hctx->alpn = MOD_GNUTLS_ALPN_HTTP10; in mod_gnutls_ALPN()
1441 int rc = mod_gnutls_acme_tls_1(hctx); in mod_gnutls_ALPN()
1443 hctx->alpn = MOD_GNUTLS_ALPN_ACME_TLS_1; in mod_gnutls_ALPN()
1461 mod_gnutls_SNI(handler_ctx * const hctx, in mod_gnutls_SNI() argument
1471 request_st * const r = hctx->r; in mod_gnutls_SNI()
1493 mod_gnutls_patch_config(r, &hctx->conf); in mod_gnutls_SNI()
1534 handler_ctx * const hctx = gnutls_session_get_ptr(ssl); in mod_gnutls_client_hello_hook() local
1538 if (hctx->alpn == MOD_GNUTLS_ALPN_ACME_TLS_1) in mod_gnutls_client_hello_hook()
1547 int rc = gnutls_ext_raw_parse(hctx, mod_gnutls_client_hello_ext_cb, msg, in mod_gnutls_client_hello_hook()
1550 log_error_st *errh = hctx->r->conf.errh; in mod_gnutls_client_hello_hook()
1563 unsigned int n = hctx->conf.ssl_acme_tls_1 ? 4 : 3; in mod_gnutls_client_hello_hook()
1565 if (!hctx->r->conf.h2proto) { in mod_gnutls_client_hello_hook()
1570 rc = gnutls_alpn_set_protocols(hctx->ssl, alpn_protos, n, 0); in mod_gnutls_client_hello_hook()
1572 log_error_st *errh = hctx->r->conf.errh; in mod_gnutls_client_hello_hook()
1578 if (hctx->alpn == MOD_GNUTLS_ALPN_ACME_TLS_1) in mod_gnutls_client_hello_hook()
1586 if (hctx->ssl_session_ticket && session_ticket_key.size) { in mod_gnutls_client_hello_hook()
1591 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_client_hello_hook()
1598 if (NULL == hctx->conf.pc->ssl_cred) { in mod_gnutls_client_hello_hook()
1599 rc = mod_gnutls_construct_crt_chain(hctx->conf.pc, in mod_gnutls_client_hello_hook()
1600 hctx->conf.ssl_ca_file, in mod_gnutls_client_hello_hook()
1601 hctx->r->conf.errh); in mod_gnutls_client_hello_hook()
1605 gnutls_certificate_credentials_t ssl_cred = hctx->conf.pc->ssl_cred; in mod_gnutls_client_hello_hook()
1607 hctx->verify_status = ~0u; in mod_gnutls_client_hello_hook()
1609 if (hctx->conf.ssl_verifyclient) { in mod_gnutls_client_hello_hook()
1612 req = hctx->conf.ssl_verifyclient_enforce in mod_gnutls_client_hello_hook()
1617 hctx->conf.ssl_verifyclient_depth); in mod_gnutls_client_hello_hook()
1618 rc = mod_gnutls_verify_set_tlist(hctx, 1); /* for client cert request */ in mod_gnutls_client_hello_hook()
1624 if (hctx->conf.dh_params) in mod_gnutls_client_hello_hook()
1625 gnutls_certificate_set_dh_params(ssl_cred, hctx->conf.dh_params); in mod_gnutls_client_hello_hook()
1634 elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_client_hello_hook()
1636 hctx->r->uri.authority.ptr); in mod_gnutls_client_hello_hook()
2275 mod_gnutls_write_err(connection *con, handler_ctx *hctx, int wr, size_t wr_len) in mod_gnutls_write_err() argument
2280 if (gnutls_record_get_direction(hctx->ssl)) in mod_gnutls_write_err()
2288 if (hctx->conf.ssl_log_noise) in mod_gnutls_write_err()
2289 elog(hctx->r->conf.errh, __FILE__, __LINE__, wr, __func__); in mod_gnutls_write_err()
2291 elog(hctx->r->conf.errh, __FILE__, __LINE__, wr, __func__); in mod_gnutls_write_err()
2296 hctx->pending_write = wr_len; in mod_gnutls_write_err()
2304 mod_gnutls_read_err(connection *con, handler_ctx *hctx, int rc) in mod_gnutls_read_err() argument
2309 if (gnutls_record_get_direction(hctx->ssl)) in mod_gnutls_read_err()
2318 return (hctx->handshake ? -2 : -1); /*(-1 error if during handshake)*/ in mod_gnutls_read_err()
2321 if (!hctx->handshake) return -1; /*(not expected during handshake)*/ in mod_gnutls_read_err()
2323 if (gnutls_safe_renegotiation_status(hctx->ssl)) { in mod_gnutls_read_err()
2324 hctx->handshake = 0; in mod_gnutls_read_err()
2334 gnutls_alert_description_t alert = gnutls_alert_get(hctx->ssl); in mod_gnutls_read_err()
2343 if (!hctx->conf.ssl_log_noise) return -1; in mod_gnutls_read_err()
2347 elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_read_err()
2355 if (!hctx->conf.ssl_log_noise) return -1; in mod_gnutls_read_err()
2360 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, __func__); in mod_gnutls_read_err()
2367 mod_gnutls_close_notify(handler_ctx *hctx);
2373 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl() local
2374 gnutls_session_t const ssl = hctx->ssl; in connection_write_cq_ssl()
2375 if (!hctx->handshake) return 0; in connection_write_cq_ssl()
2377 if (hctx->pending_write) { in connection_write_cq_ssl()
2380 return mod_gnutls_write_err(con, hctx, wr, hctx->pending_write); in connection_write_cq_ssl()
2382 hctx->pending_write = 0; in connection_write_cq_ssl()
2386 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl()
2387 return mod_gnutls_close_notify(hctx); in connection_write_cq_ssl()
2401 log_error_st * const errh = hctx->errh; in connection_write_cq_ssl()
2435 return mod_gnutls_write_err(con, hctx, wr, wr_len); in connection_write_cq_ssl()
2459 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl_ktls() local
2460 if (!hctx->handshake) return 0; in connection_write_cq_ssl_ktls()
2462 if (hctx->pending_write) { in connection_write_cq_ssl_ktls()
2463 int wr = gnutls_record_send(hctx->ssl, NULL, 0); in connection_write_cq_ssl_ktls()
2465 return mod_gnutls_write_err(con, hctx, wr, hctx->pending_write); in connection_write_cq_ssl_ktls()
2467 hctx->pending_write = 0; in connection_write_cq_ssl_ktls()
2471 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl_ktls()
2472 return mod_gnutls_close_notify(hctx); in connection_write_cq_ssl_ktls()
2484 if (-1 == c->file.fd && 0 != chunkqueue_open_file_chunk(cq, hctx->errh)) in connection_write_cq_ssl_ktls()
2488 gnutls_record_send_file(hctx->ssl, c->file.fd, &c->offset, (size_t)len); in connection_write_cq_ssl_ktls()
2490 return mod_gnutls_write_err(con, hctx, (int)wr, 0); in connection_write_cq_ssl_ktls()
2506 mod_gnutls_ssl_handshake (handler_ctx *hctx) in mod_gnutls_ssl_handshake() argument
2508 int rc = gnutls_handshake(hctx->ssl); in mod_gnutls_ssl_handshake()
2510 return mod_gnutls_read_err(hctx->con, hctx, rc); in mod_gnutls_ssl_handshake()
2514 hctx->handshake = 1; in mod_gnutls_ssl_handshake()
2517 gnutls_transport_is_ktls_enabled(hctx->ssl); in mod_gnutls_ssl_handshake()
2519 hctx->con->network_write = connection_write_cq_ssl_ktls; in mod_gnutls_ssl_handshake()
2522 if (hctx->alpn == MOD_GNUTLS_ALPN_H2) { in mod_gnutls_ssl_handshake()
2523 if (0 != mod_gnutls_alpn_h2_policy(hctx)) in mod_gnutls_ssl_handshake()
2528 hctx->con->network_write = connection_write_cq_ssl; in mod_gnutls_ssl_handshake()
2531 else if (hctx->alpn == MOD_GNUTLS_ALPN_ACME_TLS_1) { in mod_gnutls_ssl_handshake()
2536 hctx->alpn = 0; in mod_gnutls_ssl_handshake()
2545 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_read_cq_ssl() local
2549 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_read_cq_ssl()
2550 return mod_gnutls_close_notify(hctx); in connection_read_cq_ssl()
2552 if (!hctx->handshake) { in connection_read_cq_ssl()
2553 int rc = mod_gnutls_ssl_handshake(hctx); in connection_read_cq_ssl()
2557 gnutls_session_t ssl = hctx->ssl; in connection_read_cq_ssl()
2572 return mod_gnutls_read_err(con, hctx, (int)len); in connection_read_cq_ssl()
2599 handler_ctx * const hctx = handler_ctx_init(); in CONNECTION_FUNC() local
2601 hctx->r = r; in CONNECTION_FUNC()
2602 hctx->con = con; in CONNECTION_FUNC()
2603 hctx->tmp_buf = con->srv->tmp_buf; in CONNECTION_FUNC()
2604 hctx->errh = r->conf.errh; in CONNECTION_FUNC()
2605 con->plugin_ctx[p->id] = hctx; in CONNECTION_FUNC()
2609 hctx->ssl_session_ticket = s->ssl_session_ticket; in CONNECTION_FUNC()
2612 int rc = gnutls_init(&hctx->ssl, flags); in CONNECTION_FUNC()
2618 rc = gnutls_priority_set(hctx->ssl, s->priority_cache); in CONNECTION_FUNC()
2625 gnutls_handshake_set_hook_function(hctx->ssl, GNUTLS_HANDSHAKE_CLIENT_HELLO, in CONNECTION_FUNC()
2629 gnutls_session_set_ptr(hctx->ssl, hctx); in CONNECTION_FUNC()
2630 gnutls_transport_set_int(hctx->ssl, con->fd); in CONNECTION_FUNC()
2635 mod_gnutls_patch_config(r, &hctx->conf); in CONNECTION_FUNC()
2638 hctx->conf.dh_params = s->dh_params; in CONNECTION_FUNC()
2645 if (hctx->conf.ssl_log_noise) {/* volume level for debug message callback */ in CONNECTION_FUNC()
2647 gnutls_global_set_log_level(hctx->conf.ssl_log_noise); in CONNECTION_FUNC()
2652 if (hctx->ssl_session_ticket && session_ticket_key.size) { in CONNECTION_FUNC()
2653 rc = gnutls_session_ticket_enable_server(hctx->ssl,&session_ticket_key); in CONNECTION_FUNC()
2666 mod_gnutls_detach(handler_ctx *hctx) in mod_gnutls_detach() argument
2671 hctx->con->is_ssl_sock = 0; in mod_gnutls_detach()
2673 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); in mod_gnutls_detach()
2674 hctx->close_notify = 1; in mod_gnutls_detach()
2681 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2682 if (NULL == hctx) return HANDLER_GO_ON; in CONNECTION_FUNC()
2684 hctx->close_notify = -2; in CONNECTION_FUNC()
2685 if (hctx->handshake) { in CONNECTION_FUNC()
2686 mod_gnutls_close_notify(hctx); in CONNECTION_FUNC()
2689 mod_gnutls_detach(hctx); in CONNECTION_FUNC()
2697 mod_gnutls_close_notify (handler_ctx *hctx) in mod_gnutls_close_notify() argument
2699 if (1 == hctx->close_notify) return -2; in mod_gnutls_close_notify()
2701 int rc = gnutls_bye(hctx->ssl, GNUTLS_SHUT_WR); in mod_gnutls_close_notify()
2704 mod_gnutls_detach(hctx); in mod_gnutls_close_notify()
2710 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_gnutls_close_notify()
2714 mod_gnutls_detach(hctx); in mod_gnutls_close_notify()
2723 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2724 if (NULL != hctx) { in CONNECTION_FUNC()
2726 if (1 != hctx->close_notify) in CONNECTION_FUNC()
2727 mod_gnutls_close_notify(hctx); /*(one final try)*/ in CONNECTION_FUNC()
2728 handler_ctx_free(hctx); in CONNECTION_FUNC()
2821 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) in https_add_ssl_client_entries() argument
2823 gnutls_session_t ssl = hctx->ssl; in https_add_ssl_client_entries()
2828 if (hctx->verify_status != ~0u) in https_add_ssl_client_entries()
2835 else if (0 != hctx->verify_status) { in https_add_ssl_client_entries()
2837 https_add_ssl_client_verify_err(vb, hctx->verify_status); in https_add_ssl_client_entries()
2880 if (hctx->conf.ssl_verifyclient_username) { in https_add_ssl_client_entries()
2886 const buffer *varname = hctx->conf.ssl_verifyclient_username; in https_add_ssl_client_entries()
2899 if (hctx->conf.ssl_verifyclient_export_cert && NULL != crt) in https_add_ssl_client_entries()
2907 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) in http_cgi_ssl_env() argument
2909 gnutls_session_t ssl = hctx->ssl; in http_cgi_ssl_env()
2943 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2944 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2947 http_cgi_ssl_env(r, hctx); in REQUEST_FUNC()
2948 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
2949 https_add_ssl_client_entries(r, hctx); in REQUEST_FUNC()
2966 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2967 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2969 mod_gnutls_patch_config(r, &hctx->conf); in REQUEST_FUNC()
2970 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()