ludra/nginx-build
1
0 Fork 0
forked from Hakase/nginx-build
Code Issues Pull Requests Releases Wiki Activity

Compatibility patch between nginx strict sni and BoringSSL.

Browse Source
This commit is contained in:
Hakase
2018-10-07 21:57:00 +09:00
parent e5ed8553e2
commit 2af1ec8d00
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/event/ngx_event_openssl.c
+20
View File
@@ -1460,6 +1460,14 @@ ngx_ssl_handshake(ngx_connection_t *c)
c->read->error = 1;
#if (!defined SSL_R_CALLBACK_FAILED || !defined SSL_F_FINAL_SERVER_NAME)
if (sslerr == SSL_ERROR_SSL) {
ERR_peek_error();
ERR_clear_error();
return NGX_ERROR;
}
#endif
ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
return NGX_ERROR;
@@ -1573,6 +1581,14 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
c->read->error = 1;
#if (!defined SSL_R_CALLBACK_FAILED || !defined SSL_F_FINAL_SERVER_NAME)
if (sslerr == SSL_ERROR_SSL) {
ERR_peek_error();
ERR_clear_error();
return NGX_ERROR;
}
#endif
ngx_ssl_connection_error(c, sslerr, err, "SSL_read_early_data() failed");
return NGX_ERROR;
@@ -2590,7 +2606,9 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
char *text)
{
int n;
#if (defined SSL_R_CALLBACK_FAILED && defined SSL_F_FINAL_SERVER_NAME)
int f;
#endif
ngx_uint_t level;
level = NGX_LOG_CRIT;
@@ -2630,6 +2648,7 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
/* Strict SNI Error Patch
* https://github.com/hakasenyang/openssl-patch/issues/1#issuecomment-427040319
*/
#if (defined SSL_R_CALLBACK_FAILED && defined SSL_F_FINAL_SERVER_NAME)
if (n == SSL_R_CALLBACK_FAILED) {
f = ERR_GET_FUNC(ERR_peek_error());
if (f == SSL_F_FINAL_SERVER_NAME) {
@@ -2638,6 +2657,7 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
return;
}
}
#endif
/* handshake failures */
if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */