Lines Matching refs:hctx
194 handler_ctx_free (handler_ctx *hctx) in handler_ctx_free() argument
196 if (hctx->ssl) SSL_free(hctx->ssl); in handler_ctx_free()
197 free(hctx); in handler_ctx_free()
318 EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc) in ssl_tlsext_ticket_key_cb() argument
326 EVP_MAC_CTX *hctx, int enc) in ssl_tlsext_ticket_key_cb()
339 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), in ssl_tlsext_ticket_key_cb()
349 EVP_MAC_CTX_set_params(hctx, params); in ssl_tlsext_ticket_key_cb()
359 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), in ssl_tlsext_ticket_key_cb()
369 EVP_MAC_CTX_set_params(hctx, params); in ssl_tlsext_ticket_key_cb()
470 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_tlsext_status_cb() local
471 if (NULL == hctx->conf.pc) return SSL_TLSEXT_ERR_NOACK;/*should not happen*/ in ssl_tlsext_status_cb()
472 buffer *ssl_stapling = hctx->conf.pc->ssl_stapling; in ssl_tlsext_status_cb()
485 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in ssl_tlsext_status_cb()
487 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in ssl_tlsext_status_cb()
945 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_info_callback() local
946 if (hctx->renegotiations >= 0) ++hctx->renegotiations; in ssl_info_callback()
956 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_info_callback() local
957 hctx->renegotiations = -1; in ssl_info_callback()
971 handler_ctx *hctx; in verify_callback() local
981 hctx = (handler_ctx *) SSL_get_app_data(ssl); in verify_callback()
992 if (depth > hctx->conf.ssl_verifyclient_depth) { in verify_callback()
998 if (preverify_ok && 0 == depth && NULL != hctx->conf.ssl_ca_dn_file) { in verify_callback()
1001 STACK_OF(X509_NAME) * const cert_names = hctx->conf.ssl_ca_dn_file; in verify_callback()
1008 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1034 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1036 log_error_st *errh = hctx->r->conf.errh; in verify_callback()
1051 return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1064 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in mod_openssl_cert_cb() local
1065 plugin_cert *pc = hctx->conf.pc; in mod_openssl_cert_cb()
1067 if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) return 1; in mod_openssl_cert_cb()
1072 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1075 hctx->r->uri.authority.ptr); in mod_openssl_cert_cb()
1082 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1084 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in mod_openssl_cert_cb()
1096 else if (hctx->conf.ssl_ca_file && !pc->self_issued) { in mod_openssl_cert_cb()
1101 SSL_set1_chain_cert_store(ssl, hctx->conf.ssl_ca_file->certs); in mod_openssl_cert_cb()
1107 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1109 hctx->r->uri.authority.ptr, in mod_openssl_cert_cb()
1124 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1126 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in mod_openssl_cert_cb()
1136 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1138 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in mod_openssl_cert_cb()
1144 if (hctx->conf.ssl_verifyclient) { in mod_openssl_cert_cb()
1145 if (NULL == hctx->conf.ssl_ca_file) { in mod_openssl_cert_cb()
1146 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1148 "for TLS server name %s", hctx->r->uri.authority.ptr); in mod_openssl_cert_cb()
1153 SSL_set1_verify_cert_store(ssl, hctx->conf.ssl_ca_file->certs); in mod_openssl_cert_cb()
1160 STACK_OF(X509_NAME) * const cert_names = hctx->conf.ssl_ca_dn_file in mod_openssl_cert_cb()
1161 ? hctx->conf.ssl_ca_dn_file in mod_openssl_cert_cb()
1162 : hctx->conf.ssl_ca_file->names; in mod_openssl_cert_cb()
1165 if (hctx->conf.ssl_verifyclient_enforce) in mod_openssl_cert_cb()
1168 SSL_set_verify_depth(ssl, hctx->conf.ssl_verifyclient_depth + 1); in mod_openssl_cert_cb()
1179 mod_openssl_SNI (handler_ctx *hctx, const char *servername, size_t len) in mod_openssl_SNI() argument
1181 request_st * const r = hctx->r; in mod_openssl_SNI()
1200 mod_openssl_patch_config(r, &hctx->conf); in mod_openssl_SNI()
1210 return (mod_openssl_cert_cb(hctx->ssl, NULL) == 1) in mod_openssl_SNI()
1220 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in mod_openssl_client_hello_cb() local
1221 buffer_copy_string_len(&hctx->r->uri.scheme, CONST_STR_LEN("https")); in mod_openssl_client_hello_cb()
1235 int read_ahead = hctx->conf.ssl_read_ahead; in mod_openssl_client_hello_cb()
1236 int rc = mod_openssl_SNI(hctx, (const char *)name+5, slen); in mod_openssl_client_hello_cb()
1237 if (!read_ahead && hctx->conf.ssl_read_ahead) in mod_openssl_client_hello_cb()
1238 SSL_set_read_ahead(ssl, hctx->conf.ssl_read_ahead); in mod_openssl_client_hello_cb()
1250 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in network_ssl_servername_callback() local
1251 buffer_copy_string_len(&hctx->r->uri.scheme, CONST_STR_LEN("https")); in network_ssl_servername_callback()
1259 int read_ahead = hctx->conf.ssl_read_ahead; in network_ssl_servername_callback()
1260 int rc = mod_openssl_SNI(hctx, servername, len); in network_ssl_servername_callback()
1261 if (!read_ahead && hctx->conf.ssl_read_ahead) in network_ssl_servername_callback()
1262 SSL_set_read_ahead(ssl, hctx->conf.ssl_read_ahead); in network_ssl_servername_callback()
1761 mod_openssl_acme_tls_1 (SSL *ssl, handler_ctx *hctx) in mod_openssl_acme_tls_1() argument
1763 buffer * const b = hctx->tmp_buf; in mod_openssl_acme_tls_1()
1764 const buffer * const name = &hctx->r->uri.authority; in mod_openssl_acme_tls_1()
1765 log_error_st * const errh = hctx->r->conf.errh; in mod_openssl_acme_tls_1()
1773 if (!hctx->conf.ssl_acme_tls_1) in mod_openssl_acme_tls_1()
1783 if (0 != http_request_host_policy(name,hctx->r->conf.http_parseopts,443)) in mod_openssl_acme_tls_1()
1786 buffer_copy_path_len2(b, BUF_PTR_LEN(hctx->conf.ssl_acme_tls_1), in mod_openssl_acme_tls_1()
1840 hctx->conf.ssl_verifyclient_enforce = 0; in mod_openssl_acme_tls_1()
1854 mod_openssl_alpn_h2_policy (handler_ctx * const hctx) in mod_openssl_alpn_h2_policy() argument
1858 if (buffer_is_blank(&hctx->r->uri.authority)) { in mod_openssl_alpn_h2_policy()
1859 log_error(hctx->errh, __FILE__, __LINE__, in mod_openssl_alpn_h2_policy()
1864 if (SSL_version(hctx->ssl) < TLS1_2_VERSION) { in mod_openssl_alpn_h2_policy()
1865 log_error(hctx->errh, __FILE__, __LINE__, in mod_openssl_alpn_h2_policy()
1877 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in mod_openssl_alpn_select_cb() local
1887 if (!hctx->r->conf.h2proto) continue; in mod_openssl_alpn_select_cb()
1889 if (hctx->r->handler_module == NULL)/*(e.g. not mod_sockproxy)*/ in mod_openssl_alpn_select_cb()
1890 hctx->r->http_version = HTTP_VERSION_2; in mod_openssl_alpn_select_cb()
1908 int rc = mod_openssl_acme_tls_1(ssl, hctx); in mod_openssl_alpn_select_cb()
1922 hctx->alpn = proto; in mod_openssl_alpn_select_cb()
1931 return hctx->r->handler_module /*(e.g. mod_sockproxy)*/ in mod_openssl_alpn_select_cb()
3027 mod_openssl_close_notify(handler_ctx *hctx);
3033 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl() local
3034 SSL * const ssl = hctx->ssl; in connection_write_cq_ssl()
3035 log_error_st * const errh = hctx->errh; in connection_write_cq_ssl()
3037 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl()
3038 return mod_openssl_close_notify(hctx); in connection_write_cq_ssl()
3065 if (__builtin_expect( (hctx->renegotiations > 1), 0)) { in connection_write_cq_ssl()
3088 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl_ktls() local
3090 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl_ktls()
3091 return mod_openssl_close_notify(hctx); in connection_write_cq_ssl_ktls()
3103 if (-1 == c->file.fd && 0 != chunkqueue_open_file_chunk(cq, hctx->errh)) in connection_write_cq_ssl_ktls()
3107 SSL_sendfile(hctx->ssl, c->file.fd, c->offset, (size_t)len, 0); in connection_write_cq_ssl_ktls()
3109 return mod_openssl_write_err(hctx->ssl, (int)wr, con, hctx->errh); in connection_write_cq_ssl_ktls()
3125 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_read_cq_ssl() local
3132 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_read_cq_ssl()
3133 return mod_openssl_close_notify(hctx); in connection_read_cq_ssl()
3137 len = SSL_pending(hctx->ssl); in connection_read_cq_ssl()
3142 len = SSL_read(hctx->ssl, mem, mem_len); in connection_read_cq_ssl()
3145 if (hctx->renegotiations > 1) { in connection_read_cq_ssl()
3146 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
3155 if (hctx->r->http_version < HTTP_VERSION_2 in connection_read_cq_ssl()
3156 && BIO_get_ktls_send(SSL_get_wbio(hctx->ssl)) > 0) in connection_read_cq_ssl()
3160 if (hctx->alpn) { in connection_read_cq_ssl()
3161 if (hctx->alpn == MOD_OPENSSL_ALPN_H2) { in connection_read_cq_ssl()
3162 if (0 != mod_openssl_alpn_h2_policy(hctx)) in connection_read_cq_ssl()
3170 else if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) { in connection_read_cq_ssl()
3175 if (1 == SSL_do_handshake(hctx->ssl)) return -1; in connection_read_cq_ssl()
3179 hctx->alpn = 0; in connection_read_cq_ssl()
3183 && (hctx->conf.ssl_read_ahead || SSL_pending(hctx->ssl) > 0)); in connection_read_cq_ssl()
3188 switch ((rc = SSL_get_error(hctx->ssl, len))) { in connection_read_cq_ssl()
3217 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
3223 if (!hctx->conf.ssl_log_noise) break; in connection_read_cq_ssl()
3231 if (0==oerrno && 0==cq->bytes_in && !hctx->conf.ssl_log_noise) in connection_read_cq_ssl()
3235 log_perror(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
3269 if (!hctx->conf.ssl_log_noise) continue; in connection_read_cq_ssl()
3275 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
3299 handler_ctx * const hctx = handler_ctx_init(); in CONNECTION_FUNC() local
3301 hctx->r = r; in CONNECTION_FUNC()
3302 hctx->con = con; in CONNECTION_FUNC()
3303 hctx->tmp_buf = con->srv->tmp_buf; in CONNECTION_FUNC()
3304 hctx->errh = r->conf.errh; in CONNECTION_FUNC()
3305 con->plugin_ctx[p->id] = hctx; in CONNECTION_FUNC()
3309 hctx->ssl = SSL_new(s->ssl_ctx); in CONNECTION_FUNC()
3310 if (NULL != hctx->ssl in CONNECTION_FUNC()
3311 && SSL_set_app_data(hctx->ssl, hctx) in CONNECTION_FUNC()
3312 && SSL_set_fd(hctx->ssl, con->fd)) { in CONNECTION_FUNC()
3313 SSL_set_accept_state(hctx->ssl); in CONNECTION_FUNC()
3317 mod_openssl_patch_config(r, &hctx->conf); in CONNECTION_FUNC()
3329 mod_openssl_detach(handler_ctx *hctx) in mod_openssl_detach() argument
3334 hctx->con->is_ssl_sock = 0; in mod_openssl_detach()
3336 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); in mod_openssl_detach()
3337 hctx->close_notify = 1; in mod_openssl_detach()
3344 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
3345 if (NULL == hctx) return HANDLER_GO_ON; in CONNECTION_FUNC()
3347 hctx->close_notify = -2; in CONNECTION_FUNC()
3348 if (SSL_is_init_finished(hctx->ssl)) { in CONNECTION_FUNC()
3349 mod_openssl_close_notify(hctx); in CONNECTION_FUNC()
3352 mod_openssl_detach(hctx); in CONNECTION_FUNC()
3360 mod_openssl_close_notify(handler_ctx *hctx) in mod_openssl_close_notify() argument
3366 if (1 == hctx->close_notify) return -2; in mod_openssl_close_notify()
3369 switch ((ret = SSL_shutdown(hctx->ssl))) { in mod_openssl_close_notify()
3371 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3395 ssl_r = SSL_pending(hctx->ssl); in mod_openssl_close_notify()
3399 ret = SSL_read(hctx->ssl, buf, (int)sizeof(buf)); in mod_openssl_close_notify()
3400 } while (ret > 0 && (hctx->conf.ssl_read_ahead||(ssl_r-=ret))); in mod_openssl_close_notify()
3404 switch ((ret = SSL_shutdown(hctx->ssl))) { in mod_openssl_close_notify()
3406 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3409 hctx->close_notify = -1; in mod_openssl_close_notify()
3418 if (!SSL_is_init_finished(hctx->ssl)) { in mod_openssl_close_notify()
3419 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3423 switch ((ssl_r = SSL_get_error(hctx->ssl, ret))) { in mod_openssl_close_notify()
3427 hctx->close_notify = -1; in mod_openssl_close_notify()
3435 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3438 log_perror(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_close_notify()
3446 errh = hctx->r->conf.errh; in mod_openssl_close_notify()
3456 hctx->close_notify = -1; in mod_openssl_close_notify()
3464 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
3465 if (NULL != hctx) { in CONNECTION_FUNC()
3467 handler_ctx_free(hctx); in CONNECTION_FUNC()
3513 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) in https_add_ssl_client_entries() argument
3519 long vr = SSL_get_verify_result(hctx->ssl); in https_add_ssl_client_entries()
3524 } else if (!(xs = SSL_get_peer_certificate(hctx->ssl))) { in https_add_ssl_client_entries()
3556 if (hctx->conf.ssl_verifyclient_username) { in https_add_ssl_client_entries()
3562 const buffer *varname = hctx->conf.ssl_verifyclient_username; in https_add_ssl_client_entries()
3574 if (hctx->conf.ssl_verifyclient_export_cert) { in https_add_ssl_client_entries()
3591 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) in http_cgi_ssl_env() argument
3596 s = SSL_get_version(hctx->ssl); in http_cgi_ssl_env()
3599 if ((cipher = SSL_get_current_cipher(hctx->ssl))) { in http_cgi_ssl_env()
3619 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
3620 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
3623 http_cgi_ssl_env(r, hctx); in REQUEST_FUNC()
3624 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
3625 https_add_ssl_client_entries(r, hctx); in REQUEST_FUNC()
3642 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
3643 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
3645 mod_openssl_patch_config(r, &hctx->conf); in REQUEST_FUNC()
3646 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()