Hakase/nginx-quic
1
0 Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add dynamic tls record patch

Browse Source
This commit is contained in:
Hakase
2022-11-12 03:58:05 +09:00
parent 629e17fd5a
commit 8896c8d2ab
4 changed files with 135 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/http/modules/ngx_http_ssl_module.c
+76
View File
@@ -296,6 +296,41 @@ static ngx_command_t ngx_http_ssl_commands[] = {
offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
NULL },
{ ngx_string("ssl_dyn_rec_enable"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_flag_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_enable),
NULL },
{ ngx_string("ssl_dyn_rec_timeout"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_msec_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_timeout),
NULL },
{ ngx_string("ssl_dyn_rec_size_lo"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_size_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_size_lo),
NULL },
{ ngx_string("ssl_dyn_rec_size_hi"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_size_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_size_hi),
NULL },
{ ngx_string("ssl_dyn_rec_threshold"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_num_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, dyn_rec_threshold),
NULL },
ngx_null_command
};
@@ -621,6 +656,11 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
sscf->stapling = NGX_CONF_UNSET;
sscf->stapling_verify = NGX_CONF_UNSET;
sscf->dyn_rec_enable = NGX_CONF_UNSET;
sscf->dyn_rec_timeout = NGX_CONF_UNSET_MSEC;
sscf->dyn_rec_size_lo = NGX_CONF_UNSET_SIZE;
sscf->dyn_rec_size_hi = NGX_CONF_UNSET_SIZE;
sscf->dyn_rec_threshold = NGX_CONF_UNSET_UINT;
return sscf;
}
@@ -695,6 +735,20 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_str_value(conf->stapling_responder,
prev->stapling_responder, "");
ngx_conf_merge_value(conf->dyn_rec_enable, prev->dyn_rec_enable, 0);
ngx_conf_merge_msec_value(conf->dyn_rec_timeout, prev->dyn_rec_timeout,
1000);
/* Default sizes for the dynamic record sizes are defined to fit maximal
TLS + IPv6 overhead in a single TCP segment for lo and 3 segments for hi:
1369 = 1500 - 40 (IP) - 20 (TCP) - 10 (Time) - 61 (Max TLS overhead) */
ngx_conf_merge_size_value(conf->dyn_rec_size_lo, prev->dyn_rec_size_lo,
1369);
/* 4229 = (1500 - 40 - 20 - 10) * 3 - 61 */
ngx_conf_merge_size_value(conf->dyn_rec_size_hi, prev->dyn_rec_size_hi,
4229);
ngx_conf_merge_uint_value(conf->dyn_rec_threshold, prev->dyn_rec_threshold,
40);
conf->ssl.log = cf->log;
if (conf->enable) {
@@ -921,6 +975,28 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
return NGX_CONF_ERROR;
}
if (conf->dyn_rec_enable) {
conf->ssl.dyn_rec.timeout = conf->dyn_rec_timeout;
conf->ssl.dyn_rec.threshold = conf->dyn_rec_threshold;
if (conf->buffer_size > conf->dyn_rec_size_lo) {
conf->ssl.dyn_rec.size_lo = conf->dyn_rec_size_lo;
} else {
conf->ssl.dyn_rec.size_lo = conf->buffer_size;
}
if (conf->buffer_size > conf->dyn_rec_size_hi) {
conf->ssl.dyn_rec.size_hi = conf->dyn_rec_size_hi;
} else {
conf->ssl.dyn_rec.size_hi = conf->buffer_size;
}
} else {
conf->ssl.dyn_rec.timeout = 0;
}
return NGX_CONF_OK;
}
src/http/modules/ngx_http_ssl_module.h
+6
View File
@@ -67,6 +67,12 @@ typedef struct {
u_char *file;
ngx_uint_t line;
ngx_flag_t dyn_rec_enable;
ngx_msec_t dyn_rec_timeout;
size_t dyn_rec_size_lo;
size_t dyn_rec_size_hi;
ngx_uint_t dyn_rec_threshold;
} ngx_http_ssl_srv_conf_t;