Hakase/nginx-esni
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity
Files
89b3ddfd5a81b173c9177687b9c0b631a20426a6
nginx-esni/esni.patch
T
Hakase 89b3ddfd5a Add esni patch test file.
2019-02-17 19:30:18 +09:00

282 lines
10 KiB
Diff
Raw Blame History

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 394a8c8..60991ec 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1085,6 +1085,49 @@ ngx_ssl_passwords_cleanup(void *data)
}
+ngx_int_t
+ngx_ssl_esni(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *esnipub, ngx_str_t *esnikey)
+{
+ BIO *bio;
+
+ if (esnikey->len == 0 || esnipub->len == 0) {
+ return NGX_OK;
+ }
+
+ if (ngx_conf_full_name(cf->cycle, esnikey, 1) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ if (ngx_conf_full_name(cf->cycle, esnipub, 1) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ bio = BIO_new_file((char *) esnikey->data, "r");
+ if (bio == NULL) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "BIO_new_file(\"%s\") failed", esnikey->data);
+ return NGX_ERROR;
+ }
+
+ bio = BIO_new_file((char *) esnipub->data, "r");
+ if (bio == NULL) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "BIO_new_file(\"%s\") failed", esnikey->data);
+ return NGX_ERROR;
+ }
+
+ if (SSL_esni_server_enable(ssl->ctx, (char *)esnikey->data, (char *)esnipub->data) != 1) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "ESNI error");
+ return NGX_ERROR;
+ }
+
+ BIO_free(bio);
+
+ return NGX_OK;
+}
+
+
ngx_int_t
ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
{
@@ -4003,6 +4046,37 @@ ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
}
+ngx_int_t
+ngx_ssl_get_esni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
+{
+ s->len = 0;
+ char *hidden=NULL;
+ char *cover=NULL;
+ int esnirv=SSL_get_esni_status(c->ssl->connection, &hidden, &cover);
+ if (esnirv) {
+ }
+ switch (esnirv) {
+ case SSL_ESNI_STATUS_NOT_TRIED:
+ ngx_str_set(s, "not attemped");
+ break;
+ case SSL_ESNI_STATUS_FAILED:
+ ngx_str_set(s, "tried but failed");
+ break;
+ case SSL_ESNI_STATUS_BAD_NAME:
+ ngx_str_set(s, "bad name");
+ break;
+ case SSL_ESNI_STATUS_SUCCESS:
+ ngx_str_set(s, "success");
+ break;
+ default:
+ ngx_str_set(s, "esni error");
+break;
+ }
+ //s->data = (u_char *) esnis;
+ return NGX_OK;
+}
+
+
ngx_int_t
ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 31d0923..7d08e16 100644
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -30,6 +30,7 @@
#include <openssl/rsa.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+#include <openssl/esni.h>
#define NGX_SSL_NAME "OpenSSL"
@@ -178,6 +179,8 @@ ngx_int_t ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords);
ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
+ngx_int_t ngx_ssl_esni(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *esnipub,
+ ngx_str_t *esnikey);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
@@ -205,6 +208,7 @@ ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data);
ngx_int_t ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c,
ngx_uint_t flags);
+ngx_int_t ngx_ssl_get_esni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s);
void ngx_ssl_remove_cached_session(SSL_CTX *ssl, ngx_ssl_session_t *sess);
ngx_int_t ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session);
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index c5ed248..3c88b07 100644
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -176,6 +176,27 @@ static ngx_command_t ngx_http_ssl_commands[] = {
offsetof(ngx_http_ssl_srv_conf_t, prefer_server_ciphers),
NULL },
+ { ngx_string("ssl_esni"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_SRV_CONF_OFFSET,
+ offsetof(ngx_http_ssl_srv_conf_t, esni),
+ NULL },
+
+ { ngx_string("ssl_esnipub"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_str_slot,
+ NGX_HTTP_SRV_CONF_OFFSET,
+ offsetof(ngx_http_ssl_srv_conf_t, esnipub),
+ NULL },
+
+ { ngx_string("ssl_esnikey"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_str_slot,
+ NGX_HTTP_SRV_CONF_OFFSET,
+ offsetof(ngx_http_ssl_srv_conf_t, esnikey),
+ NULL },
+
{ ngx_string("ssl_session_cache"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE12,
ngx_http_ssl_session_cache,
@@ -330,6 +351,9 @@ static ngx_http_variable_t ngx_http_ssl_vars[] = {
{ ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable,
(uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 },
+ { ngx_string("ssl_esni_data"), NULL, ngx_http_ssl_variable,
+ (uintptr_t) ngx_ssl_get_esni, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
{ ngx_string("ssl_session_id"), NULL, ngx_http_ssl_variable,
(uintptr_t) ngx_ssl_get_session_id, NGX_HTTP_VAR_CHANGEABLE, 0 },
@@ -599,11 +623,14 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
sscf->enable = NGX_CONF_UNSET;
sscf->prefer_server_ciphers = NGX_CONF_UNSET;
sscf->early_data = NGX_CONF_UNSET;
+ sscf->esni = NGX_CONF_UNSET;
sscf->buffer_size = NGX_CONF_UNSET_SIZE;
sscf->verify = NGX_CONF_UNSET_UINT;
sscf->verify_depth = NGX_CONF_UNSET_UINT;
sscf->certificates = NGX_CONF_UNSET_PTR;
sscf->certificate_keys = NGX_CONF_UNSET_PTR;
+ //sscf->esnipub = NGX_CONF_UNSET;
+ //sscf->esnikey = NGX_CONF_UNSET;
sscf->passwords = NGX_CONF_UNSET_PTR;
sscf->builtin_session_cache = NGX_CONF_UNSET;
sscf->session_timeout = NGX_CONF_UNSET;
@@ -647,6 +674,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
prev->prefer_server_ciphers, 1);
ngx_conf_merge_value(conf->early_data, prev->early_data, 1);
+ ngx_conf_merge_value(conf->esni, prev->esni, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
@@ -661,6 +689,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_ptr_value(conf->certificates, prev->certificates, NULL);
ngx_conf_merge_ptr_value(conf->certificate_keys, prev->certificate_keys,
NULL);
+ ngx_conf_merge_str_value(conf->esnipub, prev->esnipub,
+ NULL);
+ ngx_conf_merge_str_value(conf->esnikey, prev->esnikey,
+ NULL);
ngx_conf_merge_ptr_value(conf->passwords, prev->passwords, NULL);
@@ -761,7 +793,6 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
"dynamically to an OpenSSL library which has no tlsext support, "
"therefore SNI is not available");
}
-
#endif
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
@@ -788,6 +819,15 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
return NGX_CONF_ERROR;
}
+ if (conf->esni) {
+ if (ngx_ssl_esni(cf, &conf->ssl, &conf->esnipub,
+ &conf->esnikey)
+ != NGX_OK)
+ {
+ return NGX_CONF_ERROR;
+ }
+ }
+
if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
conf->prefer_server_ciphers)
!= NGX_OK)
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
index deeadc3..f71cec7 100644
--- a/src/http/modules/ngx_http_ssl_module.h
+++ b/src/http/modules/ngx_http_ssl_module.h
@@ -21,6 +21,7 @@ typedef struct {
ngx_flag_t prefer_server_ciphers;
ngx_flag_t early_data;
+ ngx_flag_t esni;
ngx_uint_t protocols;
@@ -36,6 +37,8 @@ typedef struct {
ngx_array_t *certificates;
ngx_array_t *certificate_keys;
+ ngx_str_t esnipub;
+ ngx_str_t esnikey;
ngx_str_t dhparam;
ngx_str_t ecdh_curve;
ngx_str_t client_certificate;
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 1901129..ec42395 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -852,8 +852,25 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
clcf = ngx_http_get_module_loc_conf(hc->conf_ctx, ngx_http_core_module);
+ sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
+
+ if (sscf->esni) {
+ if (SSL_esni_server_enable(sscf->ssl.ctx, sscf->esnikey, sscf->esnipub) != 1) {
+ ngx_ssl_error(NGX_LOG_INFO, c->log, 0,
+ "ESNI error");
+ return NGX_ERROR;
+ }
+ }
+
servername = SSL_get_servername(ssl_conn, TLSEXT_NAMETYPE_host_name);
+ char *hidden=NULL;
+ char *cover=NULL;
+
+ SSL_get_esni_status(ssl_conn,&hidden,&cover);
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
+ "esni cover : %s, hidden: %s, servername: %s", (cover==NULL?"none":cover), (hidden==NULL?"none":hidden), (servername==NULL?"none":servername));
+
if (servername == NULL) {
return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK;
}
@@ -895,8 +912,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
ngx_set_connection_log(c, clcf->error_log);
- sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
-
c->ssl->buffer_size = sscf->buffer_size;
if (sscf->ssl.ctx) {
Reference in New Issue View Git Blame Copy Permalink