summaryrefslogtreecommitdiffhomepage
path: root/src/stream
diff options
context:
space:
mode:
Diffstat (limited to 'src/stream')
-rw-r--r--src/stream/ngx_stream.c4
-rw-r--r--src/stream/ngx_stream.h3
-rw-r--r--src/stream/ngx_stream_core_module.c25
-rw-r--r--src/stream/ngx_stream_proxy_module.c120
-rw-r--r--src/stream/ngx_stream_script.c40
-rw-r--r--src/stream/ngx_stream_script.h2
6 files changed, 164 insertions, 30 deletions
diff --git a/src/stream/ngx_stream.c b/src/stream/ngx_stream.c
index 1ef689c17..a1a82f95a 100644
--- a/src/stream/ngx_stream.c
+++ b/src/stream/ngx_stream.c
@@ -510,6 +510,10 @@ ngx_stream_optimize_servers(ngx_conf_t *cf, ngx_array_t *ports)
ls->ipv6only = addr[i].opt.ipv6only;
#endif
+#if (NGX_HAVE_TCP_FASTOPEN)
+ ls->fastopen = addr[i].opt.fastopen;
+#endif
+
#if (NGX_HAVE_REUSEPORT)
ls->reuseport = addr[i].opt.reuseport;
#endif
diff --git a/src/stream/ngx_stream.h b/src/stream/ngx_stream.h
index 6cf5eee09..8cc95a3ab 100644
--- a/src/stream/ngx_stream.h
+++ b/src/stream/ngx_stream.h
@@ -70,6 +70,9 @@ typedef struct {
int backlog;
int rcvbuf;
int sndbuf;
+#if (NGX_HAVE_TCP_FASTOPEN)
+ int fastopen;
+#endif
int type;
} ngx_stream_listen_t;
diff --git a/src/stream/ngx_stream_core_module.c b/src/stream/ngx_stream_core_module.c
index 5f4fe13a0..a31242190 100644
--- a/src/stream/ngx_stream_core_module.c
+++ b/src/stream/ngx_stream_core_module.c
@@ -618,6 +618,10 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
ls->type = SOCK_STREAM;
ls->ctx = cf->ctx;
+#if (NGX_HAVE_TCP_FASTOPEN)
+ ls->fastopen = -1;
+#endif
+
#if (NGX_HAVE_INET6)
ls->ipv6only = 1;
#endif
@@ -638,6 +642,21 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
continue;
}
+#if (NGX_HAVE_TCP_FASTOPEN)
+ if (ngx_strncmp(value[i].data, "fastopen=", 9) == 0) {
+ ls->fastopen = ngx_atoi(value[i].data + 9, value[i].len - 9);
+ ls->bind = 1;
+
+ if (ls->fastopen == NGX_ERROR) {
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "invalid fastopen \"%V\"", &value[i]);
+ return NGX_CONF_ERROR;
+ }
+
+ continue;
+ }
+#endif
+
if (ngx_strncmp(value[i].data, "backlog=", 8) == 0) {
ls->backlog = ngx_atoi(value[i].data + 8, value[i].len - 8);
ls->bind = 1;
@@ -891,6 +910,12 @@ ngx_stream_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
if (ls->proxy_protocol) {
return "\"proxy_protocol\" parameter is incompatible with \"udp\"";
}
+
+#if (NGX_HAVE_TCP_FASTOPEN)
+ if (ls->fastopen != -1) {
+ return "\"fastopen\" parameter is incompatible with \"udp\"";
+ }
+#endif
}
als = cmcf->listen.elts;
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index 01cda7a36..8c686ab20 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -46,8 +46,8 @@ typedef struct {
ngx_uint_t ssl_verify_depth;
ngx_str_t ssl_trusted_certificate;
ngx_str_t ssl_crl;
- ngx_str_t ssl_certificate;
- ngx_str_t ssl_certificate_key;
+ ngx_stream_complex_value_t *ssl_certificate;
+ ngx_stream_complex_value_t *ssl_certificate_key;
ngx_array_t *ssl_passwords;
ngx_array_t *ssl_conf_commands;
@@ -101,6 +101,7 @@ static void ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s);
static void ngx_stream_proxy_ssl_handshake(ngx_connection_t *pc);
static void ngx_stream_proxy_ssl_save_session(ngx_connection_t *c);
static ngx_int_t ngx_stream_proxy_ssl_name(ngx_stream_session_t *s);
+static ngx_int_t ngx_stream_proxy_ssl_certificate(ngx_stream_session_t *s);
static ngx_int_t ngx_stream_proxy_set_ssl(ngx_conf_t *cf,
ngx_stream_proxy_srv_conf_t *pscf);
@@ -318,14 +319,14 @@ static ngx_command_t ngx_stream_proxy_commands[] = {
{ ngx_string("proxy_ssl_certificate"),
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
- ngx_conf_set_str_slot,
+ ngx_stream_set_complex_value_zero_slot,
NGX_STREAM_SRV_CONF_OFFSET,
offsetof(ngx_stream_proxy_srv_conf_t, ssl_certificate),
NULL },
{ ngx_string("proxy_ssl_certificate_key"),
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
- ngx_conf_set_str_slot,
+ ngx_stream_set_complex_value_zero_slot,
NGX_STREAM_SRV_CONF_OFFSET,
offsetof(ngx_stream_proxy_srv_conf_t, ssl_certificate_key),
NULL },
@@ -1060,6 +1061,15 @@ ngx_stream_proxy_ssl_init_connection(ngx_stream_session_t *s)
}
}
+ if (pscf->ssl_certificate && (pscf->ssl_certificate->lengths
+ || pscf->ssl_certificate_key->lengths))
+ {
+ if (ngx_stream_proxy_ssl_certificate(s) != NGX_OK) {
+ ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
+ return;
+ }
+ }
+
if (pscf->ssl_session_reuse) {
pc->ssl->save_session = ngx_stream_proxy_ssl_save_session;
@@ -1247,6 +1257,50 @@ done:
return NGX_OK;
}
+
+static ngx_int_t
+ngx_stream_proxy_ssl_certificate(ngx_stream_session_t *s)
+{
+ ngx_str_t cert, key;
+ ngx_connection_t *c;
+ ngx_stream_proxy_srv_conf_t *pscf;
+
+ c = s->upstream->peer.connection;
+
+ pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
+
+ if (ngx_stream_complex_value(s, pscf->ssl_certificate, &cert)
+ != NGX_OK)
+ {
+ return NGX_ERROR;
+ }
+
+ ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0,
+ "stream upstream ssl cert: \"%s\"", cert.data);
+
+ if (*cert.data == '\0') {
+ return NGX_OK;
+ }
+
+ if (ngx_stream_complex_value(s, pscf->ssl_certificate_key, &key)
+ != NGX_OK)
+ {
+ return NGX_ERROR;
+ }
+
+ ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0,
+ "stream upstream ssl key: \"%s\"", key.data);
+
+ if (ngx_ssl_connection_certificate(c, c->pool, &cert, &key,
+ pscf->ssl_passwords)
+ != NGX_OK)
+ {
+ return NGX_ERROR;
+ }
+
+ return NGX_OK;
+}
+
#endif
@@ -1977,14 +2031,9 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
*
* conf->ssl_protocols = 0;
* conf->ssl_ciphers = { 0, NULL };
- * conf->ssl_name = NULL;
* conf->ssl_trusted_certificate = { 0, NULL };
* conf->ssl_crl = { 0, NULL };
- * conf->ssl_certificate = { 0, NULL };
- * conf->ssl_certificate_key = { 0, NULL };
*
- * conf->upload_rate = NULL;
- * conf->download_rate = NULL;
* conf->ssl = NULL;
* conf->upstream = NULL;
* conf->upstream_value = NULL;
@@ -1994,6 +2043,8 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
conf->timeout = NGX_CONF_UNSET_MSEC;
conf->next_upstream_timeout = NGX_CONF_UNSET_MSEC;
conf->buffer_size = NGX_CONF_UNSET_SIZE;
+ conf->upload_rate = NGX_CONF_UNSET_PTR;
+ conf->download_rate = NGX_CONF_UNSET_PTR;
conf->requests = NGX_CONF_UNSET_UINT;
conf->responses = NGX_CONF_UNSET_UINT;
conf->next_upstream_tries = NGX_CONF_UNSET_UINT;
@@ -2005,9 +2056,12 @@ ngx_stream_proxy_create_srv_conf(ngx_conf_t *cf)
#if (NGX_STREAM_SSL)
conf->ssl_enable = NGX_CONF_UNSET;
conf->ssl_session_reuse = NGX_CONF_UNSET;
+ conf->ssl_name = NGX_CONF_UNSET_PTR;
conf->ssl_server_name = NGX_CONF_UNSET;
conf->ssl_verify = NGX_CONF_UNSET;
conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
+ conf->ssl_certificate = NGX_CONF_UNSET_PTR;
+ conf->ssl_certificate_key = NGX_CONF_UNSET_PTR;
conf->ssl_passwords = NGX_CONF_UNSET_PTR;
conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
#endif
@@ -2034,13 +2088,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_size_value(conf->buffer_size,
prev->buffer_size, 16384);
- if (conf->upload_rate == NULL) {
- conf->upload_rate = prev->upload_rate;
- }
+ ngx_conf_merge_ptr_value(conf->upload_rate, prev->upload_rate, NULL);
- if (conf->download_rate == NULL) {
- conf->download_rate = prev->download_rate;
- }
+ ngx_conf_merge_ptr_value(conf->download_rate, prev->download_rate, NULL);
ngx_conf_merge_uint_value(conf->requests,
prev->requests, 0);
@@ -2073,9 +2123,7 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
- if (conf->ssl_name == NULL) {
- conf->ssl_name = prev->ssl_name;
- }
+ ngx_conf_merge_ptr_value(conf->ssl_name, prev->ssl_name, NULL);
ngx_conf_merge_value(conf->ssl_server_name, prev->ssl_server_name, 0);
@@ -2089,11 +2137,11 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
- ngx_conf_merge_str_value(conf->ssl_certificate,
- prev->ssl_certificate, "");
+ ngx_conf_merge_ptr_value(conf->ssl_certificate,
+ prev->ssl_certificate, NULL);
- ngx_conf_merge_str_value(conf->ssl_certificate_key,
- prev->ssl_certificate_key, "");
+ ngx_conf_merge_ptr_value(conf->ssl_certificate_key,
+ prev->ssl_certificate_key, NULL);
ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);
@@ -2137,20 +2185,34 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
cln->handler = ngx_ssl_cleanup_ctx;
cln->data = pscf->ssl;
- if (pscf->ssl_certificate.len) {
+ if (pscf->ssl_certificate) {
- if (pscf->ssl_certificate_key.len == 0) {
+ if (pscf->ssl_certificate_key == NULL) {
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
"no \"proxy_ssl_certificate_key\" is defined "
- "for certificate \"%V\"", &pscf->ssl_certificate);
+ "for certificate \"%V\"",
+ &pscf->ssl_certificate->value);
return NGX_ERROR;
}
- if (ngx_ssl_certificate(cf, pscf->ssl, &pscf->ssl_certificate,
- &pscf->ssl_certificate_key, pscf->ssl_passwords)
- != NGX_OK)
+ if (pscf->ssl_certificate->lengths
+ || pscf->ssl_certificate_key->lengths)
{
- return NGX_ERROR;
+ pscf->ssl_passwords =
+ ngx_ssl_preserve_passwords(cf, pscf->ssl_passwords);
+ if (pscf->ssl_passwords == NULL) {
+ return NGX_ERROR;
+ }
+
+ } else {
+ if (ngx_ssl_certificate(cf, pscf->ssl,
+ &pscf->ssl_certificate->value,
+ &pscf->ssl_certificate_key->value,
+ pscf->ssl_passwords)
+ != NGX_OK)
+ {
+ return NGX_ERROR;
+ }
}
}
diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c
index a15f772b5..c447e152f 100644
--- a/src/stream/ngx_stream_script.c
+++ b/src/stream/ngx_stream_script.c
@@ -252,7 +252,7 @@ ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
cv = (ngx_stream_complex_value_t **) (p + cmd->offset);
- if (*cv != NULL) {
+ if (*cv != NGX_CONF_UNSET_PTR && *cv != NULL) {
return "is duplicate";
}
@@ -278,6 +278,44 @@ ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
char *
+ngx_stream_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+ void *conf)
+{
+ char *p = conf;
+
+ ngx_str_t *value;
+ ngx_stream_complex_value_t **cv;
+ ngx_stream_compile_complex_value_t ccv;
+
+ cv = (ngx_stream_complex_value_t **) (p + cmd->offset);
+
+ if (*cv != NGX_CONF_UNSET_PTR) {
+ return "is duplicate";
+ }
+
+ *cv = ngx_palloc(cf->pool, sizeof(ngx_stream_complex_value_t));
+ if (*cv == NULL) {
+ return NGX_CONF_ERROR;
+ }
+
+ value = cf->args->elts;
+
+ ngx_memzero(&ccv, sizeof(ngx_stream_compile_complex_value_t));
+
+ ccv.cf = cf;
+ ccv.value = &value[1];
+ ccv.complex_value = *cv;
+ ccv.zero = 1;
+
+ if (ngx_stream_compile_complex_value(&ccv) != NGX_OK) {
+ return NGX_CONF_ERROR;
+ }
+
+ return NGX_CONF_OK;
+}
+
+
+char *
ngx_stream_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf)
{
diff --git a/src/stream/ngx_stream_script.h b/src/stream/ngx_stream_script.h
index a481ca3ab..d8f374047 100644
--- a/src/stream/ngx_stream_script.h
+++ b/src/stream/ngx_stream_script.h
@@ -112,6 +112,8 @@ ngx_int_t ngx_stream_compile_complex_value(
ngx_stream_compile_complex_value_t *ccv);
char *ngx_stream_set_complex_value_slot(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
+char *ngx_stream_set_complex_value_zero_slot(ngx_conf_t *cf, ngx_command_t *cmd,
+ void *conf);
char *ngx_stream_set_complex_value_size_slot(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
generated by cgit (git 2.34.1) at 2026-01-01 00:33:48 +0000