Lines Matching refs:hctx
213 handler_ctx_free (handler_ctx *hctx) in handler_ctx_free() argument
215 mod_nss_io_dtor(hctx->ssl); in handler_ctx_free()
216 free(hctx); in handler_ctx_free()
979 handler_ctx * const hctx = arg; in mod_nss_verify_cb() local
980 if (!hctx->conf.ssl_verifyclient) return SECSuccess; in mod_nss_verify_cb()
1010 hctx->verify_status = PORT_GetError(); in mod_nss_verify_cb()
1011 if (0 == hctx->verify_status) in mod_nss_verify_cb()
1012 hctx->verify_status = SEC_ERROR_UNTRUSTED_CERT; in mod_nss_verify_cb()
1015 if (hctx->verify_status == 0 && hctx->conf.ssl_ca_dn_file) { in mod_nss_verify_cb()
1020 CERTCertList * const certList = hctx->conf.ssl_ca_dn_file; in mod_nss_verify_cb()
1029 hctx->verify_status = SEC_ERROR_UNTRUSTED_CERT; in mod_nss_verify_cb()
1035 if (hctx->verify_status != 0 && hctx->conf.ssl_verifyclient_enforce) { in mod_nss_verify_cb()
1225 mod_nss_acme_tls_1 (handler_ctx *hctx) in mod_nss_acme_tls_1() argument
1227 buffer * const b = hctx->tmp_buf; in mod_nss_acme_tls_1()
1228 const buffer * const name = &hctx->r->uri.authority; in mod_nss_acme_tls_1()
1229 log_error_st * const errh = hctx->r->conf.errh; in mod_nss_acme_tls_1()
1232 if (!hctx->conf.ssl_acme_tls_1) in mod_nss_acme_tls_1()
1242 if (0 != http_request_host_policy(name, hctx->r->conf.http_parseopts, 443)) in mod_nss_acme_tls_1()
1245 buffer_copy_path_len2(b, BUF_PTR_LEN(hctx->conf.ssl_acme_tls_1), in mod_nss_acme_tls_1()
1273 if (hctx->conf.pc) { in mod_nss_acme_tls_1()
1275 NSS_FindCertKEAType(hctx->conf.pc->ssl_pemfile_x509); in mod_nss_acme_tls_1()
1276 SSL_ConfigSecureServerWithCertChain(hctx->ssl,NULL,NULL,NULL,certType); in mod_nss_acme_tls_1()
1289 SSL_ConfigServerCert(hctx->ssl, ssl_pemfile_x509, pkey, data, dlen); in mod_nss_acme_tls_1()
1295 if (hctx->conf.ssl_verifyclient) { in mod_nss_acme_tls_1()
1297 hctx->conf.ssl_verifyclient = 0; in mod_nss_acme_tls_1()
1298 SSL_OptionSet(hctx->ssl, SSL_REQUEST_CERTIFICATE, PR_FALSE); in mod_nss_acme_tls_1()
1299 SSL_OptionSet(hctx->ssl, SSL_REQUIRE_CERTIFICATE, SSL_REQUIRE_NEVER); in mod_nss_acme_tls_1()
1307 mod_nss_alpn_h2_policy (handler_ctx * const hctx) in mod_nss_alpn_h2_policy() argument
1309 UNUSED(hctx); in mod_nss_alpn_h2_policy()
1312 if (buffer_is_blank(&hctx->r->uri.authority)) { in mod_nss_alpn_h2_policy()
1313 log_error(hctx->errh, __FILE__, __LINE__, in mod_nss_alpn_h2_policy()
1326 log_error(hctx->errh, __FILE__, __LINE__, in mod_nss_alpn_h2_policy()
1369 handler_ctx *hctx = arg; in mod_nss_alpn_select_cb() local
1372 if (!hctx->r->conf.h2proto) continue; in mod_nss_alpn_select_cb()
1373 hctx->alpn = MOD_NSS_ALPN_H2; in mod_nss_alpn_select_cb()
1374 if (hctx->r->handler_module == NULL)/*(not mod_sockproxy)*/ in mod_nss_alpn_select_cb()
1375 hctx->r->http_version = HTTP_VERSION_2; in mod_nss_alpn_select_cb()
1378 hctx->alpn = MOD_NSS_ALPN_HTTP11; in mod_nss_alpn_select_cb()
1381 hctx->alpn = MOD_NSS_ALPN_HTTP10; in mod_nss_alpn_select_cb()
1384 if (!hctx->conf.ssl_acme_tls_1) in mod_nss_alpn_select_cb()
1386 hctx->alpn = MOD_NSS_ALPN_ACME_TLS_1; in mod_nss_alpn_select_cb()
1410 handler_ctx * const hctx = (handler_ctx *)arg; in mod_nss_SNI() local
1411 request_st * const r = hctx->r; in mod_nss_SNI()
1435 plugin_cert *pc = hctx->conf.pc; in mod_nss_SNI()
1437 mod_nss_patch_config(r, &hctx->conf); in mod_nss_SNI()
1445 if (hctx->alpn == MOD_NSS_ALPN_ACME_TLS_1) { in mod_nss_SNI()
1446 if (0 == mod_nss_acme_tls_1(hctx)) in mod_nss_SNI()
1449 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_nss_SNI()
1451 " server name %s", hctx->r->uri.authority.ptr); in mod_nss_SNI()
1456 if (pc == hctx->conf.pc) in mod_nss_SNI()
1463 NSS_FindCertKEAType(hctx->conf.pc->ssl_pemfile_x509); in mod_nss_SNI()
1466 SSL_ConfigServerCert(ssl, hctx->conf.pc->ssl_pemfile_x509, in mod_nss_SNI()
1467 hctx->conf.pc->ssl_pemfile_pkey, in mod_nss_SNI()
1468 &hctx->conf.pc->ssl_credex, in mod_nss_SNI()
1469 sizeof(hctx->conf.pc->ssl_credex)); in mod_nss_SNI()
1477 if (hctx->conf.ssl_verifyclient) { in mod_nss_SNI()
1479 if (SSL_AuthCertificateHook(ssl, mod_nss_verify_cb, hctx) < 0) { in mod_nss_SNI()
1483 CERTCertList * const certList = hctx->conf.ssl_ca_dn_file in mod_nss_SNI()
1484 ? hctx->conf.ssl_ca_dn_file in mod_nss_SNI()
1485 : hctx->conf.ssl_ca_file; in mod_nss_SNI()
1487 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_nss_SNI()
1490 hctx->r->uri.authority.ptr); /*(might not be set yet if no SNI)*/ in mod_nss_SNI()
1497 hctx->conf.ssl_verifyclient_enforce in mod_nss_SNI()
2123 mod_nss_write_err(connection *con, handler_ctx *hctx, size_t wr_len) in mod_nss_write_err() argument
2133 if (!hctx->conf.ssl_log_noise) return -1; in mod_nss_write_err()
2136 elog(hctx->r->conf.errh, __FILE__, __LINE__, __func__); in mod_nss_write_err()
2141 hctx->pending_write = wr_len; in mod_nss_write_err()
2149 mod_nss_read_err(connection *con, handler_ctx *hctx) in mod_nss_read_err() argument
2161 if (!hctx->conf.ssl_log_noise) return -1; in mod_nss_read_err()
2164 elog(hctx->errh, __FILE__, __LINE__, __func__); in mod_nss_read_err()
2171 mod_nss_close_notify(handler_ctx *hctx);
2177 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl() local
2178 PRFileDesc * const ssl = hctx->ssl; in connection_write_cq_ssl()
2179 log_error_st * const errh = hctx->errh; in connection_write_cq_ssl()
2181 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl()
2182 return mod_nss_close_notify(hctx); in connection_write_cq_ssl()
2204 size_t lim = hctx->pending_write; in connection_write_cq_ssl()
2206 hctx->pending_write = 0; in connection_write_cq_ssl()
2218 return mod_nss_write_err(con, hctx, wr_len); in connection_write_cq_ssl()
2235 handler_ctx *hctx = arg; in mod_nss_SSLHandshakeCallback() local
2236 hctx->handshake = 1; in mod_nss_SSLHandshakeCallback()
2243 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_read_cq_ssl() local
2247 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_read_cq_ssl()
2248 return mod_nss_close_notify(hctx); in connection_read_cq_ssl()
2250 PRFileDesc * const ssl = hctx->ssl; in connection_read_cq_ssl()
2268 if (hctx->alpn && hctx->handshake) { in connection_read_cq_ssl()
2269 if (hctx->alpn == MOD_NSS_ALPN_H2) { in connection_read_cq_ssl()
2270 if (0 != mod_nss_alpn_h2_policy(hctx)) in connection_read_cq_ssl()
2273 else if (hctx->alpn == MOD_NSS_ALPN_ACME_TLS_1) { in connection_read_cq_ssl()
2278 hctx->alpn = 0; in connection_read_cq_ssl()
2282 return mod_nss_read_err(con, hctx); in connection_read_cq_ssl()
2302 handler_ctx * const hctx = handler_ctx_init(); in CONNECTION_FUNC() local
2304 hctx->r = r; in CONNECTION_FUNC()
2305 hctx->con = con; in CONNECTION_FUNC()
2306 hctx->tmp_buf = con->srv->tmp_buf; in CONNECTION_FUNC()
2307 hctx->errh = r->conf.errh; in CONNECTION_FUNC()
2308 con->plugin_ctx[p->id] = hctx; in CONNECTION_FUNC()
2312 hctx->ssl_session_ticket = s->ssl_session_ticket; in CONNECTION_FUNC()
2317 mod_nss_patch_config(r, &hctx->conf); in CONNECTION_FUNC()
2319 hctx->ssl = mod_nss_io_ctor(con->fd, s->model, r->conf.errh); in CONNECTION_FUNC()
2320 if (NULL == hctx->ssl) in CONNECTION_FUNC()
2326 if (SSL_ResetHandshake(hctx->ssl, PR_TRUE) < 0) { in CONNECTION_FUNC()
2331 if (SSL_HandshakeCallback(hctx->ssl, mod_nss_SSLHandshakeCallback, hctx)<0){ in CONNECTION_FUNC()
2336 if (SSL_SNISocketConfigHook(hctx->ssl, mod_nss_SNI, hctx) < 0) { in CONNECTION_FUNC()
2341 if (SSL_SetNextProtoCallback(hctx->ssl, mod_nss_alpn_select_cb, hctx) < 0) { in CONNECTION_FUNC()
2346 hctx->verify_status = -1; in CONNECTION_FUNC()
2347 if (hctx->conf.ssl_verifyclient) { in CONNECTION_FUNC()
2348 if (SSL_AuthCertificateHook(hctx->ssl, mod_nss_verify_cb, hctx) < 0) { in CONNECTION_FUNC()
2352 CERTCertList * const certList = hctx->conf.ssl_ca_dn_file in CONNECTION_FUNC()
2353 ? hctx->conf.ssl_ca_dn_file in CONNECTION_FUNC()
2354 : hctx->conf.ssl_ca_file; in CONNECTION_FUNC()
2356 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in CONNECTION_FUNC()
2359 hctx->r->uri.authority.ptr); /*(might not be set yet if no SNI)*/ in CONNECTION_FUNC()
2360 return hctx->conf.ssl_verifyclient_enforce in CONNECTION_FUNC()
2364 if (SSL_SetTrustAnchors(hctx->ssl, certList) < 0) { in CONNECTION_FUNC()
2368 SSL_OptionSet(hctx->ssl, SSL_REQUEST_CERTIFICATE, PR_TRUE); in CONNECTION_FUNC()
2369 SSL_OptionSet(hctx->ssl, SSL_REQUIRE_CERTIFICATE, in CONNECTION_FUNC()
2370 hctx->conf.ssl_verifyclient_enforce in CONNECTION_FUNC()
2375 SSL_OptionSet(hctx->ssl, SSL_REQUEST_CERTIFICATE, PR_FALSE); in CONNECTION_FUNC()
2376 SSL_OptionSet(hctx->ssl, SSL_REQUIRE_CERTIFICATE, SSL_REQUIRE_NEVER); in CONNECTION_FUNC()
2384 mod_nss_detach(handler_ctx *hctx) in mod_nss_detach() argument
2390 mod_nss_io_detach(hctx->ssl); in mod_nss_detach()
2391 hctx->con->is_ssl_sock = 0; in mod_nss_detach()
2393 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); in mod_nss_detach()
2394 hctx->close_notify = 1; in mod_nss_detach()
2401 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2402 if (NULL == hctx) return HANDLER_GO_ON; in CONNECTION_FUNC()
2404 hctx->close_notify = -2; in CONNECTION_FUNC()
2405 if (hctx->handshake) { in CONNECTION_FUNC()
2406 mod_nss_close_notify(hctx); in CONNECTION_FUNC()
2409 mod_nss_detach(hctx); in CONNECTION_FUNC()
2417 mod_nss_close_notify (handler_ctx *hctx) in mod_nss_close_notify() argument
2419 if (1 == hctx->close_notify) return -2; in mod_nss_close_notify()
2422 switch (PR_Shutdown(hctx->ssl, PR_SHUTDOWN_SEND)) { in mod_nss_close_notify()
2424 mod_nss_detach(hctx); in mod_nss_close_notify()
2429 elog(hctx->r->conf.errh, __FILE__, __LINE__, "PR_Shutdown()"); in mod_nss_close_notify()
2430 mod_nss_detach(hctx); in mod_nss_close_notify()
2439 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
2440 if (NULL != hctx) { in CONNECTION_FUNC()
2442 if (1 != hctx->close_notify) in CONNECTION_FUNC()
2443 mod_nss_close_notify(hctx); /*(one final try)*/ in CONNECTION_FUNC()
2444 handler_ctx_free(hctx); in CONNECTION_FUNC()
2526 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) in https_add_ssl_client_entries() argument
2528 PRFileDesc *ssl = hctx->ssl; in https_add_ssl_client_entries()
2532 if (hctx->verify_status != -1) in https_add_ssl_client_entries()
2539 else if (0 != hctx->verify_status) { in https_add_ssl_client_entries()
2541 https_add_ssl_client_verify_err(vb, hctx->verify_status); in https_add_ssl_client_entries()
2567 if (hctx->conf.ssl_verifyclient_username) { in https_add_ssl_client_entries()
2573 const buffer *varname = hctx->conf.ssl_verifyclient_username; in https_add_ssl_client_entries()
2585 if (hctx->conf.ssl_verifyclient_export_cert) in https_add_ssl_client_entries()
2593 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) in http_cgi_ssl_env() argument
2595 PRFileDesc *ssl = hctx->ssl; in http_cgi_ssl_env()
2642 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2643 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2646 http_cgi_ssl_env(r, hctx); in REQUEST_FUNC()
2647 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
2648 https_add_ssl_client_entries(r, hctx); in REQUEST_FUNC()
2665 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
2666 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
2668 mod_nss_patch_config(r, &hctx->conf); in REQUEST_FUNC()
2669 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()