mirror
/
nginx
mirror of https://github.com/nginx/nginx
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SSL: ngx_ssl_set_client_hello_callback() error handling. 

The function interface is changed to follow a common approach
to other functions used to setup SSL_CTX, with an exception of
"ngx_conf_t *cf" since it is not bound to nginx configuration.

This is required to report and propagate SSL_CTX_set_ex_data()
errors, as reminded by Coverity (CID 1668589).
This commit is contained in:
Sergey Kandaurov 2025-11-06 17:30:41 +04:00 committed by Sergey Kandaurov
parent ac99f2808b
commit 38a701d88b
4 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/event/ngx_event_openssl.c
View File

@ -1872,21 +1872,34 @@ ngx_ssl_new_client_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
} }
void ngx_int_t
ngx_ssl_set_client_hello_callback(SSL_CTX *ssl_ctx, ngx_ssl_set_client_hello_callback(ngx_ssl_t *ssl, ngx_ssl_client_hello_arg *cb)
ngx_ssl_client_hello_arg *cb)
{ {
#ifdef SSL_CLIENT_HELLO_SUCCESS #ifdef SSL_CLIENT_HELLO_SUCCESS
SSL_CTX_set_client_hello_cb(ssl_ctx, ngx_ssl_client_hello_callback, NULL); SSL_CTX_set_client_hello_cb(ssl->ctx, ngx_ssl_client_hello_callback, NULL);
SSL_CTX_set_ex_data(ssl_ctx, ngx_ssl_client_hello_arg_index, cb);
if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_client_hello_arg_index, cb) == 0)
{
ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
"SSL_CTX_set_ex_data() failed");
return NGX_ERROR;
}
#elif defined OPENSSL_IS_BORINGSSL #elif defined OPENSSL_IS_BORINGSSL
SSL_CTX_set_select_certificate_cb(ssl_ctx, ngx_ssl_select_certificate); SSL_CTX_set_select_certificate_cb(ssl_ctx, ngx_ssl_select_certificate);
SSL_CTX_set_ex_data(ssl_ctx, ngx_ssl_client_hello_arg_index, cb);
if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_client_hello_arg_index, cb) == 0)
{
ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
"SSL_CTX_set_ex_data() failed");
return NGX_ERROR;
}
#endif #endif
return NGX_OK;
} }

2
src/event/ngx_event_openssl.h
View File

@ -286,7 +286,7 @@ ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_array_t *paths); ngx_array_t *paths);
ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data); ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data);
void ngx_ssl_set_client_hello_callback(SSL_CTX *ssl_ctx, ngx_int_t ngx_ssl_set_client_hello_callback(ngx_ssl_t *ssl,
ngx_ssl_client_hello_arg *cb); ngx_ssl_client_hello_arg *cb);
#ifdef SSL_CLIENT_HELLO_SUCCESS #ifdef SSL_CLIENT_HELLO_SUCCESS
int ngx_ssl_client_hello_callback(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg); int ngx_ssl_client_hello_callback(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg);

4
src/http/modules/ngx_http_ssl_module.c
View File

@ -758,7 +758,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
{ {
static ngx_ssl_client_hello_arg cb = { ngx_http_ssl_servername }; static ngx_ssl_client_hello_arg cb = { ngx_http_ssl_servername };
ngx_ssl_set_client_hello_callback(conf->ssl.ctx, &cb); if (ngx_ssl_set_client_hello_callback(&conf->ssl, &cb) != NGX_OK) {
return NGX_CONF_ERROR;
}
if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
ngx_http_ssl_servername) ngx_http_ssl_servername)

4
src/stream/ngx_stream_ssl_module.c
View File

@ -1008,7 +1008,9 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
{ {
static ngx_ssl_client_hello_arg cb = { ngx_stream_ssl_servername }; static ngx_ssl_client_hello_arg cb = { ngx_stream_ssl_servername };
ngx_ssl_set_client_hello_callback(conf->ssl.ctx, &cb); if (ngx_ssl_set_client_hello_callback(&conf->ssl, &cb) != NGX_OK) {
return NGX_CONF_ERROR;
}
SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
ngx_stream_ssl_servername); ngx_stream_ssl_servername);