Welcome! Log In Create A New Profile

Advanced

[PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

geniuss99
March 11, 2021 01:30PM
src/http/modules/ngx_http_upstream_keepalive_module.c | 42 +++++++++++++++++++
1 files changed, 42 insertions(+), 0 deletions(-)


# HG changeset patch
# User geniuss99 <geniuss.dev@gmail.com>
# Date 1615484979 -10800
# Thu Mar 11 20:49:39 2021 +0300
# Node ID ed1348e8e25381b3b1a2540289effcf7ccec6fd6
# Parent 0215ec9aaa8af6036c62e1db676c9b0cc1d5fca4
Keepalive: add new option "keepalive_ssl_respect_sni".

This option allows handling the following usecase:
1. proxy https requests with different hostnames to server with same ip;
2. use cache of upstream connections via keepalive option in upstream module;
3. reuse connection from keepalive pool only if ip and servername used during
handshake with upstream match hostname from downstream request.

When this option is turned on not only the ip address of upstream server is
taken into account upon connection search but also servername used during
handshake procedure.

diff -r 0215ec9aaa8a -r ed1348e8e253 src/http/modules/ngx_http_upstream_keepalive_module.c
--- a/src/http/modules/ngx_http_upstream_keepalive_module.c Thu Mar 11 09:58:45 2021 +0300
+++ b/src/http/modules/ngx_http_upstream_keepalive_module.c Thu Mar 11 20:49:39 2021 +0300
@@ -15,6 +15,10 @@
ngx_uint_t requests;
ngx_msec_t timeout;

+#if (NGX_HTTP_SSL)
+ ngx_flag_t ssl_respect_sni;
+#endif
+
ngx_queue_t cache;
ngx_queue_t free;

@@ -49,6 +53,7 @@
#if (NGX_HTTP_SSL)
ngx_event_set_peer_session_pt original_set_session;
ngx_event_save_peer_session_pt original_save_session;
+ ngx_str_t *http_request_server;
#endif

} ngx_http_upstream_keepalive_peer_data_t;
@@ -100,6 +105,16 @@
offsetof(ngx_http_upstream_keepalive_srv_conf_t, requests),
NULL },

+#if (NGX_HTTP_SSL)
+
+ { ngx_string("keepalive_ssl_respect_sni"),
+ NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_SRV_CONF_OFFSET,
+ offsetof(ngx_http_upstream_keepalive_srv_conf_t, ssl_respect_sni),
+ NULL },
+
+#endif
ngx_null_command
};

@@ -152,6 +167,10 @@
ngx_conf_init_msec_value(kcf->timeout, 60000);
ngx_conf_init_uint_value(kcf->requests, 100);

+#if (NGX_HTTP_SSL)
+ ngx_conf_init_value(kcf->ssl_respect_sni, 0);
+#endif
+
if (kcf->original_init_upstream(cf, us) != NGX_OK) {
return NGX_ERROR;
}
@@ -217,6 +236,8 @@
kp->original_save_session = r->upstream->peer.save_session;
r->upstream->peer.set_session = ngx_http_upstream_keepalive_set_session;
r->upstream->peer.save_session = ngx_http_upstream_keepalive_save_session;
+
+ kp->http_request_server = &r->headers_in.server;
#endif

return NGX_OK;
@@ -232,6 +253,10 @@
ngx_int_t rc;
ngx_queue_t *q, *cache;
ngx_connection_t *c;
+#if (NGX_HTTP_SSL)
+ ngx_int_t *ssl_respect_sni;
+ const char *ssl_server_name;
+#endif

ngx_log_debug0(NGX_LOG_DEBUG_HTTP, pc->log, 0,
"get keepalive peer");
@@ -248,6 +273,10 @@

cache = &kp->conf->cache;

+#if (NGX_HTTP_SSL)
+ ssl_respect_sni = &kp->conf->ssl_respect_sni;
+#endif
+
for (q = ngx_queue_head(cache);
q != ngx_queue_sentinel(cache);
q = ngx_queue_next(q))
@@ -259,6 +288,15 @@
item->socklen, pc->socklen)
== 0)
{
+#if (NGX_HTTP_SSL)
+ /* check if server_name from ssl connection corresponds to requested host */
+ if (*ssl_respect_sni == 1 && c->ssl != NULL && c->ssl->connection != NULL && c->ssl->handshaked) {
+ ssl_server_name = SSL_get_servername(c->ssl->connection, TLSEXT_NAMETYPE_host_name);
+ if (ssl_server_name != NULL && ngx_strncasecmp(kp->http_request_server->data, (u_char*) ssl_server_name, ngx_strlen(ssl_server_name)) != 0) {
+ continue;
+ }
+ }
+#endif
ngx_queue_remove(q);
ngx_queue_insert_head(&kp->conf->free, q);

@@ -516,6 +554,10 @@
conf->timeout = NGX_CONF_UNSET_MSEC;
conf->requests = NGX_CONF_UNSET_UINT;

+#if (NGX_HTTP_SSL)
+ conf->ssl_respect_sni = NGX_CONF_UNSET;
+#endif
+
return conf;
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

geniuss99 153 March 11, 2021 01:30PM

Re: [PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

Maxim Dounin 14 March 12, 2021 02:38PM

Re: [PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

geniuss99 14 March 16, 2021 10:44AM

Re: [PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

Maxim Dounin 12 March 16, 2021 07:26PM

Re: [PATCH] Keepalive: add new option "keepalive_ssl_respect_sni"

geniuss99 23 March 17, 2021 12:18PM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 51
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready