From 2af1ec8d002b2821bb2b4df064091ca3b62019c9 Mon Sep 17 00:00:00 2001 From: Hakase Date: Sun, 7 Oct 2018 21:57:00 +0900 Subject: [PATCH] Compatibility patch between nginx strict sni and BoringSSL. --- src/event/ngx_event_openssl.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index e6e3199..e390124 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -1460,6 +1460,14 @@ ngx_ssl_handshake(ngx_connection_t *c) c->read->error = 1; +#if (!defined SSL_R_CALLBACK_FAILED || !defined SSL_F_FINAL_SERVER_NAME) + if (sslerr == SSL_ERROR_SSL) { + ERR_peek_error(); + ERR_clear_error(); + return NGX_ERROR; + } +#endif + ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed"); return NGX_ERROR; @@ -1573,6 +1581,14 @@ ngx_ssl_try_early_data(ngx_connection_t *c) c->read->error = 1; +#if (!defined SSL_R_CALLBACK_FAILED || !defined SSL_F_FINAL_SERVER_NAME) + if (sslerr == SSL_ERROR_SSL) { + ERR_peek_error(); + ERR_clear_error(); + return NGX_ERROR; + } +#endif + ngx_ssl_connection_error(c, sslerr, err, "SSL_read_early_data() failed"); return NGX_ERROR; @@ -2590,7 +2606,9 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err, char *text) { int n; +#if (defined SSL_R_CALLBACK_FAILED && defined SSL_F_FINAL_SERVER_NAME) int f; +#endif ngx_uint_t level; level = NGX_LOG_CRIT; @@ -2630,6 +2648,7 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err, /* Strict SNI Error Patch * https://github.com/hakasenyang/openssl-patch/issues/1#issuecomment-427040319 */ +#if (defined SSL_R_CALLBACK_FAILED && defined SSL_F_FINAL_SERVER_NAME) if (n == SSL_R_CALLBACK_FAILED) { f = ERR_GET_FUNC(ERR_peek_error()); if (f == SSL_F_FINAL_SERVER_NAME) { @@ -2638,6 +2657,7 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err, return; } } +#endif /* handshake failures */ if (n == SSL_R_BAD_CHANGE_CIPHER_SPEC /* 103 */