IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

SSL: avoid using OpenSSL config in build directory (ticket #2404).

Browse Source 
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx
is asked to build OpenSSL itself.  And with this macro automatic loading
of OpenSSL configuration (from the build directory) is prevented unless
the OPENSSL_CONF environment variable is explicitly set.

Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a
(fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350).
If nginx is used to compile these OpenSSL versions, configuring nginx with
NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
This commit is contained in:
Maxim Dounin 2023-06-21 01:29:53 +03:00
parent 2038b46e25
commit bdea5b703f
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
auto/lib/openssl/conf
View File

@ -8,6 +8,8 @@ if [ $OPENSSL != NONE ]; then
have=NGX_OPENSSL . auto/have have=NGX_OPENSSL . auto/have
have=NGX_SSL . auto/have have=NGX_SSL . auto/have
have=NGX_OPENSSL_NO_CONFIG . auto/have
if [ $USE_OPENSSL_QUIC = YES ]; then if [ $USE_OPENSSL_QUIC = YES ]; then
have=NGX_QUIC . auto/have have=NGX_QUIC . auto/have
have=NGX_QUIC_OPENSSL_COMPAT . auto/have have=NGX_QUIC_OPENSSL_COMPAT . auto/have

21
src/event/ngx_event_openssl.c
View File

@ -142,8 +142,19 @@ ngx_ssl_init(ngx_log_t *log)
{ {
#if (OPENSSL_INIT_LOAD_CONFIG && !defined LIBRESSL_VERSION_NUMBER) #if (OPENSSL_INIT_LOAD_CONFIG && !defined LIBRESSL_VERSION_NUMBER)
uint64_t opts;
OPENSSL_INIT_SETTINGS *init; OPENSSL_INIT_SETTINGS *init;
opts = OPENSSL_INIT_LOAD_CONFIG;
#if (NGX_OPENSSL_NO_CONFIG)
if (getenv("OPENSSL_CONF") == NULL) {
opts = OPENSSL_INIT_NO_LOAD_CONFIG;
}
#endif
init = OPENSSL_INIT_new(); init = OPENSSL_INIT_new();
if (init == NULL) { if (init == NULL) {
ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_INIT_new() failed"); ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_INIT_new() failed");
@ -158,7 +169,7 @@ ngx_ssl_init(ngx_log_t *log)
} }
#endif #endif
if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, init) == 0) { if (OPENSSL_init_ssl(opts, init) == 0) {
ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed"); ngx_ssl_error(NGX_LOG_ALERT, log, 0, "OPENSSL_init_ssl() failed");
return NGX_ERROR; return NGX_ERROR;
} }
@ -174,6 +185,14 @@ ngx_ssl_init(ngx_log_t *log)
#else #else
#if (NGX_OPENSSL_NO_CONFIG)
if (getenv("OPENSSL_CONF") == NULL) {
OPENSSL_no_config();
}
#endif
OPENSSL_config("nginx"); OPENSSL_config("nginx");
SSL_library_init(); SSL_library_init();