Lines Matching refs:hctx
217 handler_ctx_free (handler_ctx *hctx) in handler_ctx_free() argument
219 mbedtls_ssl_free(&hctx->ssl); in handler_ctx_free()
220 if (hctx->acme_tls_1_pkey) { in handler_ctx_free()
221 mbedtls_pk_free(hctx->acme_tls_1_pkey); in handler_ctx_free()
222 free(hctx->acme_tls_1_pkey); in handler_ctx_free()
224 if (hctx->acme_tls_1_x509) { in handler_ctx_free()
225 mbedtls_x509_crt_free(hctx->acme_tls_1_x509); in handler_ctx_free()
226 free(hctx->acme_tls_1_x509); in handler_ctx_free()
228 free(hctx); in handler_ctx_free()
663 handler_ctx * const hctx = (handler_ctx *)arg; in mod_mbedtls_verify_cb() local
665 if (depth > hctx->conf.ssl_verifyclient_depth) { in mod_mbedtls_verify_cb()
666 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_mbedtls_verify_cb()
670 else if (0 == depth && NULL != hctx->conf.ssl_ca_dn_file) { in mod_mbedtls_verify_cb()
675 mbedtls_x509_crt *chain = hctx->conf.ssl_ca_dn_file; in mod_mbedtls_verify_cb()
691 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_mbedtls_verify_cb()
710 mod_mbedtls_acme_tls_1 (handler_ctx *hctx);
726 handler_ctx * const hctx = (handler_ctx *) arg; in mod_mbedtls_SNI() local
727 request_st * const r = hctx->r; in mod_mbedtls_SNI()
746 const buffer * const ssl_pemfile = hctx->conf.pc->ssl_pemfile; in mod_mbedtls_SNI()
751 mod_mbedtls_patch_config(r, &hctx->conf); in mod_mbedtls_SNI()
759 if (hctx->alpn == MOD_MBEDTLS_ALPN_ACME_TLS_1) in mod_mbedtls_SNI()
760 return mod_mbedtls_acme_tls_1(hctx); in mod_mbedtls_SNI()
765 if (!buffer_is_equal(hctx->conf.pc->ssl_pemfile, ssl_pemfile)) { in mod_mbedtls_SNI()
767 if (hctx->conf.pc->need_chain) { in mod_mbedtls_SNI()
768 hctx->conf.pc->need_chain = 0; /*(attempt once to complete chain)*/ in mod_mbedtls_SNI()
769 mbedtls_x509_crt *ssl_cred = &hctx->conf.pc->ssl_pemfile_x509; in mod_mbedtls_SNI()
770 mbedtls_x509_crt *store = hctx->conf.ssl_ca_file; in mod_mbedtls_SNI()
778 &hctx->conf.pc->ssl_pemfile_x509, in mod_mbedtls_SNI()
779 &hctx->conf.pc->ssl_pemfile_pkey); in mod_mbedtls_SNI()
794 mod_mbedtls_conf_verify (handler_ctx *hctx) in mod_mbedtls_conf_verify() argument
796 if (NULL == hctx->conf.ssl_ca_file) { in mod_mbedtls_conf_verify()
797 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_mbedtls_conf_verify()
800 hctx->r->uri.authority.ptr); in mod_mbedtls_conf_verify()
804 mbedtls_ssl_context * const ssl = &hctx->ssl; in mod_mbedtls_conf_verify()
807 int mode = (hctx->conf.ssl_verifyclient_enforce) in mod_mbedtls_conf_verify()
811 mbedtls_ssl_set_hs_ca_chain(ssl, hctx->conf.ssl_ca_file, in mod_mbedtls_conf_verify()
812 hctx->conf.ssl_ca_crl_file); in mod_mbedtls_conf_verify()
813 if (hctx->conf.ssl_ca_dn_file) in mod_mbedtls_conf_verify()
814 mbedtls_ssl_set_hs_dn_hints(ssl, hctx->conf.ssl_ca_dn_file); in mod_mbedtls_conf_verify()
818 mbedtls_x509_crt *ca_certs = hctx->conf.ssl_ca_dn_file in mod_mbedtls_conf_verify()
819 ? hctx->conf.ssl_ca_dn_file in mod_mbedtls_conf_verify()
820 : hctx->conf.ssl_ca_file; in mod_mbedtls_conf_verify()
821 mbedtls_ssl_set_hs_ca_chain(ssl, ca_certs, hctx->conf.ssl_ca_crl_file); in mod_mbedtls_conf_verify()
824 mbedtls_ssl_set_verify(ssl, mod_mbedtls_verify_cb, hctx); in mod_mbedtls_conf_verify()
830 mbedtls_ssl_conf_verify(hctx->ssl_ctx, mod_mbedtls_verify_cb, hctx); in mod_mbedtls_conf_verify()
1073 mod_mbedtls_acme_tls_1 (handler_ctx *hctx) in mod_mbedtls_acme_tls_1() argument
1075 buffer * const b = hctx->tmp_buf; in mod_mbedtls_acme_tls_1()
1076 const buffer * const name = &hctx->r->uri.authority; in mod_mbedtls_acme_tls_1()
1077 log_error_st * const errh = hctx->r->conf.errh; in mod_mbedtls_acme_tls_1()
1084 if (!hctx->conf.ssl_acme_tls_1) in mod_mbedtls_acme_tls_1()
1094 if (0 != http_request_host_policy(name,hctx->r->conf.http_parseopts,443)) in mod_mbedtls_acme_tls_1()
1097 buffer_copy_path_len2(b, BUF_PTR_LEN(hctx->conf.ssl_acme_tls_1), in mod_mbedtls_acme_tls_1()
1127 rc = mbedtls_ssl_set_hs_own_cert(&hctx->ssl, in mod_mbedtls_acme_tls_1()
1136 hctx->acme_tls_1_pkey = ssl_pemfile_pkey; /* save ptr and free later */ in mod_mbedtls_acme_tls_1()
1137 hctx->acme_tls_1_x509 = ssl_pemfile_x509; /* save ptr and free later */ in mod_mbedtls_acme_tls_1()
1157 mod_mbedtls_alpn_h2_policy (handler_ctx * const hctx) in mod_mbedtls_alpn_h2_policy() argument
1161 if (buffer_is_blank(&hctx->r->uri.authority)) { in mod_mbedtls_alpn_h2_policy()
1162 log_error(hctx->errh, __FILE__, __LINE__, in mod_mbedtls_alpn_h2_policy()
1168 if (hctx->ssl.major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 in mod_mbedtls_alpn_h2_policy()
1169 && hctx->ssl.minor_ver < MBEDTLS_SSL_MINOR_VERSION_3) { in mod_mbedtls_alpn_h2_policy()
1170 log_error(hctx->errh, __FILE__, __LINE__, in mod_mbedtls_alpn_h2_policy()
1175 UNUSED(hctx); in mod_mbedtls_alpn_h2_policy()
1183 mod_mbedtls_alpn_selected (handler_ctx * const hctx, const char * const in) in mod_mbedtls_alpn_selected() argument
1193 if (hctx->r->handler_module == NULL)/*(e.g. not mod_sockproxy)*/ in mod_mbedtls_alpn_selected()
1194 hctx->r->http_version = HTTP_VERSION_2; in mod_mbedtls_alpn_selected()
1220 hctx->alpn = proto; in mod_mbedtls_alpn_selected()
1228 mod_mbedtls_alpn_select_cb (handler_ctx *hctx, const unsigned char *in, const unsigned int inlen) in mod_mbedtls_alpn_select_cb() argument
1237 if (!hctx->r->conf.h2proto) continue; in mod_mbedtls_alpn_select_cb()
1238 hctx->alpn = MOD_MBEDTLS_ALPN_H2; in mod_mbedtls_alpn_select_cb()
1239 if (hctx->r->handler_module == NULL)/*(e.g. not mod_sockproxy)*/ in mod_mbedtls_alpn_select_cb()
1240 hctx->r->http_version = HTTP_VERSION_2; in mod_mbedtls_alpn_select_cb()
1247 hctx->alpn = MOD_MBEDTLS_ALPN_HTTP11; in mod_mbedtls_alpn_select_cb()
1251 hctx->alpn = MOD_MBEDTLS_ALPN_HTTP10; in mod_mbedtls_alpn_select_cb()
1258 hctx->alpn = MOD_MBEDTLS_ALPN_ACME_TLS_1; in mod_mbedtls_alpn_select_cb()
1279 handler_ctx * const hctx = mbedtls_ssl_get_user_data_p(ssl); in mod_mbedtls_cert_cb() local
1283 const char *alpn = mbedtls_ssl_get_alpn_protocol(&hctx->ssl); in mod_mbedtls_cert_cb()
1285 rc = mod_mbedtls_alpn_selected(hctx, alpn); in mod_mbedtls_cert_cb()
1294 rc = mod_mbedtls_SNI(hctx, ssl, servername, len); in mod_mbedtls_cert_cb()
1298 else if (hctx->alpn == MOD_MBEDTLS_ALPN_ACME_TLS_1) in mod_mbedtls_cert_cb()
1303 if (hctx->conf.ssl_verifyclient in mod_mbedtls_cert_cb()
1304 && hctx->alpn != MOD_MBEDTLS_ALPN_ACME_TLS_1) { /*(not "acme-tls/1")*/ in mod_mbedtls_cert_cb()
1305 rc = mod_mbedtls_conf_verify(hctx); in mod_mbedtls_cert_cb()
1988 mod_mbedtls_ssl_write_err(connection *con, handler_ctx *hctx, int wr, size_t wr_len) in mod_mbedtls_ssl_write_err() argument
2001 if (hctx->conf.ssl_log_noise) in mod_mbedtls_ssl_write_err()
2002 elog(hctx->r->conf.errh, __FILE__, __LINE__, wr, in mod_mbedtls_ssl_write_err()
2006 elog(hctx->r->conf.errh, __FILE__, __LINE__, wr, __func__); in mod_mbedtls_ssl_write_err()
2011 if (0 != hctx->ssl.out_left) /* partial write; save attempted wr_len */ in mod_mbedtls_ssl_write_err()
2013 hctx->pending_write = wr_len; in mod_mbedtls_ssl_write_err()
2020 mod_mbedtls_close_notify(handler_ctx *hctx);
2026 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl() local
2027 mbedtls_ssl_context * const ssl = &hctx->ssl; in connection_write_cq_ssl()
2029 if (hctx->pending_write) { in connection_write_cq_ssl()
2030 int wr = (int)hctx->pending_write; in connection_write_cq_ssl()
2036 size_t data_len = hctx->pending_write; in connection_write_cq_ssl()
2039 return mod_mbedtls_ssl_write_err(con, hctx, wr, data_len); in connection_write_cq_ssl()
2042 hctx->pending_write = 0; in connection_write_cq_ssl()
2046 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl()
2047 return mod_mbedtls_close_notify(hctx); in connection_write_cq_ssl()
2050 if (lim < 0) return mod_mbedtls_ssl_write_err(con, hctx, lim, 0); in connection_write_cq_ssl()
2052 log_error_st * const errh = hctx->errh; in connection_write_cq_ssl()
2092 return mod_mbedtls_ssl_write_err(con, hctx, wr, wr_len); in connection_write_cq_ssl()
2112 static int ssl_parse_client_hello( mbedtls_ssl_context *ssl, handler_ctx *hctx );
2119 mod_mbedtls_ssl_handshake (handler_ctx *hctx) in mod_mbedtls_ssl_handshake() argument
2125 rc = mbedtls_ssl_handshake(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2134 mbedtls_ssl_conf_sni(hctx->ssl_ctx, mod_mbedtls_SNI, hctx); in mod_mbedtls_ssl_handshake()
2137 if (handshake_state(&hctx->ssl) < MBEDTLS_SSL_SERVER_HELLO) { in mod_mbedtls_ssl_handshake()
2138 while (handshake_state(&hctx->ssl) != MBEDTLS_SSL_SERVER_HELLO in mod_mbedtls_ssl_handshake()
2139 && handshake_state(&hctx->ssl) != MBEDTLS_SSL_HANDSHAKE_OVER) { in mod_mbedtls_ssl_handshake()
2147 if (hctx->conf.ssl_acme_tls_1) { in mod_mbedtls_ssl_handshake()
2148 rc = ssl_parse_client_hello(&hctx->ssl, hctx); in mod_mbedtls_ssl_handshake()
2154 rc = mbedtls_ssl_handshake_step(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2158 && handshake_state(&hctx->ssl) == MBEDTLS_SSL_SERVER_HELLO) { in mod_mbedtls_ssl_handshake()
2160 const char *alpn = mbedtls_ssl_get_alpn_protocol(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2162 rc = mod_mbedtls_alpn_selected(hctx, alpn); in mod_mbedtls_ssl_handshake()
2167 if (0 == rc && hctx->conf.ssl_verifyclient /*(after SNI and ALPN)*/ in mod_mbedtls_ssl_handshake()
2168 && handshake_state(&hctx->ssl) >= MBEDTLS_SSL_SERVER_HELLO in mod_mbedtls_ssl_handshake()
2169 && handshake_state(&hctx->ssl) <= MBEDTLS_SSL_SERVER_HELLO_DONE in mod_mbedtls_ssl_handshake()
2170 && hctx->alpn != MOD_MBEDTLS_ALPN_ACME_TLS_1) { /*(not "acme-tls/1")*/ in mod_mbedtls_ssl_handshake()
2171 int mode = (hctx->conf.ssl_verifyclient_enforce) in mod_mbedtls_ssl_handshake()
2174 mbedtls_ssl_set_hs_authmode(&hctx->ssl, mode); in mod_mbedtls_ssl_handshake()
2175 while (handshake_state(&hctx->ssl) != MBEDTLS_SSL_CERTIFICATE_REQUEST in mod_mbedtls_ssl_handshake()
2176 && handshake_state(&hctx->ssl) != MBEDTLS_SSL_HANDSHAKE_OVER) { in mod_mbedtls_ssl_handshake()
2177 rc = mbedtls_ssl_handshake_step(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2181 && handshake_state(&hctx->ssl) == MBEDTLS_SSL_CERTIFICATE_REQUEST) { in mod_mbedtls_ssl_handshake()
2182 rc = mod_mbedtls_conf_verify(hctx); in mod_mbedtls_ssl_handshake()
2184 rc = mbedtls_ssl_handshake_step(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2188 if (0 == rc && hctx->conf.ssl_ca_dn_file in mod_mbedtls_ssl_handshake()
2189 && handshake_state(&hctx->ssl)==MBEDTLS_SSL_SERVER_HELLO_DONE) { in mod_mbedtls_ssl_handshake()
2190 mbedtls_ssl_context * const ssl = &hctx->ssl; in mod_mbedtls_ssl_handshake()
2191 mbedtls_x509_crt *ca_certs = hctx->conf.ssl_ca_file; in mod_mbedtls_ssl_handshake()
2192 mbedtls_x509_crl *ca_crl = hctx->conf.ssl_ca_crl_file; in mod_mbedtls_ssl_handshake()
2198 if (0 == rc && handshake_state(&hctx->ssl) != MBEDTLS_SSL_HANDSHAKE_OVER) { in mod_mbedtls_ssl_handshake()
2199 rc = mbedtls_ssl_handshake(&hctx->ssl); in mod_mbedtls_ssl_handshake()
2206 hctx->handshake_done = 1; in mod_mbedtls_ssl_handshake()
2208 if (hctx->alpn == MOD_MBEDTLS_ALPN_H2) { in mod_mbedtls_ssl_handshake()
2209 if (0 != mod_mbedtls_alpn_h2_policy(hctx)) in mod_mbedtls_ssl_handshake()
2212 else if (hctx->alpn == MOD_MBEDTLS_ALPN_ACME_TLS_1) { in mod_mbedtls_ssl_handshake()
2217 hctx->alpn = 0; in mod_mbedtls_ssl_handshake()
2221 hctx->con->is_writable = -1; in mod_mbedtls_ssl_handshake()
2224 hctx->con->is_readable = 0; in mod_mbedtls_ssl_handshake()
2233 if (!hctx->conf.ssl_log_noise) return -1; in mod_mbedtls_ssl_handshake()
2236 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, __func__); in mod_mbedtls_ssl_handshake()
2245 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_read_cq_ssl() local
2252 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_read_cq_ssl()
2253 return mod_mbedtls_close_notify(hctx); in connection_read_cq_ssl()
2255 if (!hctx->handshake_done) { in connection_read_cq_ssl()
2256 int rc = mod_mbedtls_ssl_handshake(hctx); in connection_read_cq_ssl()
2261 len = mbedtls_ssl_get_bytes_avail(&hctx->ssl); in connection_read_cq_ssl()
2266 len = mbedtls_ssl_read(&hctx->ssl, (unsigned char *)mem, mem_len); in connection_read_cq_ssl()
2269 && mbedtls_ssl_check_pending(&hctx->ssl)); in connection_read_cq_ssl()
2293 if (!hctx->conf.ssl_log_noise) return -1; in connection_read_cq_ssl()
2296 elog(hctx->errh, __FILE__, __LINE__, rc, "Reading mbedtls"); in connection_read_cq_ssl()
2326 handler_ctx * const hctx = handler_ctx_init(); in CONNECTION_FUNC() local
2328 hctx->r = r; in CONNECTION_FUNC()
2329 hctx->con = con; in CONNECTION_FUNC()
2330 hctx->tmp_buf = con->srv->tmp_buf; in CONNECTION_FUNC()
2331 hctx->errh = r->conf.errh; in CONNECTION_FUNC()
2332 con->plugin_ctx[p->id] = hctx; in CONNECTION_FUNC()
2335 hctx->ssl_ctx = p->ssl_ctxs[srv_sock->sidx].ssl_ctx; in CONNECTION_FUNC()
2336 mbedtls_ssl_init(&hctx->ssl); in CONNECTION_FUNC()
2337 int rc = mbedtls_ssl_setup(&hctx->ssl, hctx->ssl_ctx); in CONNECTION_FUNC()
2342 mod_mbedtls_patch_config(r, &hctx->conf); in CONNECTION_FUNC()
2350 mbedtls_ssl_set_user_data_p(&hctx->ssl, hctx); in CONNECTION_FUNC()
2353 mbedtls_ssl_set_bio(&hctx->ssl, (mbedtls_net_context *)&con->fd, in CONNECTION_FUNC()
2359 if (hctx->conf.ssl_log_noise) {/* volume level for debug message callback */ in CONNECTION_FUNC()
2361 mbedtls_debug_set_threshold(hctx->conf.ssl_log_noise); in CONNECTION_FUNC()
2363 mbedtls_ssl_conf_dbg(hctx->ssl_ctx, mod_mbedtls_debug_cb, in CONNECTION_FUNC()
2364 (void *)(intptr_t)hctx->conf.ssl_log_noise); in CONNECTION_FUNC()
2372 mod_mbedtls_detach(handler_ctx *hctx) in mod_mbedtls_detach() argument
2377 hctx->con->is_ssl_sock = 0; in mod_mbedtls_detach()
2379 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); in mod_mbedtls_detach()
2380 hctx->close_notify = 1; in mod_mbedtls_detach()
2387 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2388 if (NULL == hctx) return HANDLER_GO_ON; in CONNECTION_FUNC()
2390 hctx->close_notify = -2; in CONNECTION_FUNC()
2391 if (hctx->handshake_done) { in CONNECTION_FUNC()
2392 mod_mbedtls_close_notify(hctx); in CONNECTION_FUNC()
2395 mod_mbedtls_detach(hctx); in CONNECTION_FUNC()
2403 mod_mbedtls_close_notify (handler_ctx *hctx) in mod_mbedtls_close_notify() argument
2405 if (1 == hctx->close_notify) return -2; in mod_mbedtls_close_notify()
2407 int rc = mbedtls_ssl_close_notify(&hctx->ssl); in mod_mbedtls_close_notify()
2410 mod_mbedtls_detach(hctx); in mod_mbedtls_close_notify()
2416 elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, in mod_mbedtls_close_notify()
2420 mbedtls_ssl_session_reset(&hctx->ssl); in mod_mbedtls_close_notify()
2421 mod_mbedtls_detach(hctx); in mod_mbedtls_close_notify()
2430 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2431 if (NULL != hctx) { in CONNECTION_FUNC()
2433 if (1 != hctx->close_notify) in CONNECTION_FUNC()
2434 mod_mbedtls_close_notify(hctx); /*(one final try)*/ in CONNECTION_FUNC()
2435 handler_ctx_free(hctx); in CONNECTION_FUNC()
2535 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) in https_add_ssl_client_entries() argument
2542 const mbedtls_x509_crt *crt = mbedtls_ssl_get_peer_cert(&hctx->ssl); in https_add_ssl_client_entries()
2546 ? mbedtls_ssl_get_verify_result(&hctx->ssl) in https_add_ssl_client_entries()
2572 if (hctx->conf.ssl_verifyclient_username) { in https_add_ssl_client_entries()
2578 const buffer *varname = hctx->conf.ssl_verifyclient_username; in https_add_ssl_client_entries()
2592 if (hctx->conf.ssl_verifyclient_export_cert) in https_add_ssl_client_entries()
2606 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) in http_cgi_ssl_env() argument
2610 s = mbedtls_ssl_get_version(&hctx->ssl); in http_cgi_ssl_env()
2614 mbedtls_ssl_get_ciphersuite_id_from_ssl(&hctx->ssl); in http_cgi_ssl_env()
2644 hctx->ssl.transform->cipher_ctx_enc.key_bitlen; in http_cgi_ssl_env()
2647 hctx->ssl.transform->cipher_ctx_enc.cipher_info->key_bitlen; in http_cgi_ssl_env()
2666 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2667 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2670 http_cgi_ssl_env(r, hctx); in REQUEST_FUNC()
2671 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
2672 https_add_ssl_client_entries(r, hctx); in REQUEST_FUNC()
2689 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2690 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2692 mod_mbedtls_patch_config(r, &hctx->conf); in REQUEST_FUNC()
2693 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
4224 static int ssl_parse_client_hello( mbedtls_ssl_context *ssl, handler_ctx *hctx ) in ssl_parse_client_hello() argument
4449 ret = mod_mbedtls_alpn_select_cb(hctx, ext + 4, ext_size); in ssl_parse_client_hello()