Latest update - 9029

src/event/ngx_event_openssl.c

@@ -33,9 +33,6 @@ static int ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn,
 #ifdef SSL_READ_EARLY_DATA_SUCCESS
 static ngx_int_t ngx_ssl_try_early_data(ngx_connection_t *c);
 #endif
-#if (NGX_DEBUG)
-static void ngx_ssl_handshake_log(ngx_connection_t *c);
-#endif
 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
 #ifdef SSL_READ_EARLY_DATA_SUCCESS
 static ssize_t ngx_ssl_recv_early(ngx_connection_t *c, u_char *buf,
@@ -2053,7 +2050,7 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
 
 #if (NGX_DEBUG)
 
-static void
+void
 ngx_ssl_handshake_log(ngx_connection_t *c)
 {
     char         buf[129], *s, *d;

src/event/ngx_event_openssl.h

@@ -323,6 +323,9 @@ ngx_int_t ngx_ssl_get_client_v_remain(ngx_connection_t *c, ngx_pool_t *pool,
 
 
 ngx_int_t ngx_ssl_handshake(ngx_connection_t *c);
+#if (NGX_DEBUG)
+void ngx_ssl_handshake_log(ngx_connection_t *c);
+#endif
 ssize_t ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size);
 ssize_t ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size);
 ssize_t ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl, off_t limit);

src/event/quic/ngx_event_quic_output.c

@@ -644,7 +644,7 @@ ngx_quic_output_packet(ngx_connection_t *c, ngx_quic_send_ctx_t *ctx,
     if (len < min_payload) {
         ngx_memset(p, NGX_QUIC_FT_PADDING, min_payload - len);
         len = min_payload;
-     }
+    }
 
     pkt.payload.data = src;
     pkt.payload.len = len;
@@ -1254,7 +1254,7 @@ ngx_quic_frame_sendto(ngx_connection_t *c, ngx_quic_frame_t *frame,
     if (len < (ssize_t) min_payload) {
         ngx_memset(src + len, NGX_QUIC_FT_PADDING, min_payload - len);
         len = min_payload;
-     }
+    }
 
     pkt.payload.data = src;
     pkt.payload.len = len;

src/event/quic/ngx_event_quic_ssl.c

@@ -190,7 +190,7 @@ ngx_quic_add_handshake_data(ngx_ssl_conn_t *ssl_conn,
         SSL_get0_alpn_selected(ssl_conn, &alpn_data, &alpn_len);
 
         if (alpn_len == 0) {
-            qc->error = 0x100 + SSL_AD_NO_APPLICATION_PROTOCOL;
+            qc->error = NGX_QUIC_ERR_CRYPTO(SSL_AD_NO_APPLICATION_PROTOCOL);
             qc->error_reason = "unsupported protocol in ALPN extension";
 
             ngx_log_error(NGX_LOG_INFO, c->log, 0,
@@ -301,6 +301,7 @@ ngx_quic_send_alert(ngx_ssl_conn_t *ssl_conn, enum ssl_encryption_level_t level,
     }
 
     qc->error = NGX_QUIC_ERR_CRYPTO(alert);
+    qc->error_reason = "handshake failed";
 
     return 1;
 }
@@ -422,8 +423,15 @@ ngx_quic_crypto_input(ngx_connection_t *c, ngx_chain_t *data)
                        sslerr);
 
         if (sslerr != SSL_ERROR_WANT_READ) {
+
+            if (c->ssl->handshake_rejected) {
+                ngx_connection_error(c, 0, "handshake rejected");
+                ERR_clear_error();
+
+                return NGX_ERROR;
+            }
+
             ngx_ssl_error(NGX_LOG_ERR, c->log, 0, "SSL_do_handshake() failed");
-            qc->error_reason = "handshake failed";
             return NGX_ERROR;
         }
     }
@@ -440,11 +448,9 @@ ngx_quic_crypto_input(ngx_connection_t *c, ngx_chain_t *data)
         return NGX_OK;
     }
 
-    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                   "quic ssl cipher:%s", SSL_get_cipher(ssl_conn));
-
-    ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                   "quic handshake completed successfully");
+#if (NGX_DEBUG)
+    ngx_ssl_handshake_log(c);
+#endif
 
     c->ssl->handshaked = 1;
 

src/event/quic/ngx_event_quic_streams.c

@@ -1162,7 +1162,7 @@ ngx_quic_can_shutdown(ngx_connection_t *c)
                 return NGX_DECLINED;
             }
         }
-     }
+    }
 
     return NGX_OK;
 }