xref: /unit/src/nxt_tls.h (revision 1884:4645a43bc248)
1 
2 /*
3  * Copyright (C) Igor Sysoev
4  * Copyright (C) NGINX, Inc.
5  */
6 
7 #ifndef _NXT_TLS_H_INCLUDED_
8 #define _NXT_TLS_H_INCLUDED_
9 
10 
11 /*
12  * The SSL/TLS libraries lack vector I/O interface yet add noticeable
13  * overhead to each SSL/TLS record so buffering allows to decrease the
14  * overhead.  The typical overhead size is about 30 bytes, however, TLS
15  * supports also random padding up to 255 bytes.  The maximum SSLv3/TLS
16  * record size is 16K.  However, large records increase decryption latency.
17  * 4K is good compromise between 1-6% of SSL/TLS overhead and the latency.
18  * 4K buffer allows to send one SSL/TLS record (4096-bytes data and up to
19  * 224-bytes overhead) in three 1440-bytes TCP/IPv4 packets with timestamps
20  * and compatible with tunnels.
21  */
22 
23 #define NXT_TLS_BUFFER_SIZE       4096
24 
25 
26 typedef struct nxt_tls_conf_s         nxt_tls_conf_t;
27 typedef struct nxt_tls_bundle_conf_s  nxt_tls_bundle_conf_t;
28 
29 typedef struct {
30     nxt_int_t                     (*library_init)(nxt_task_t *task);
31     void                          (*library_free)(nxt_task_t *task);
32 
33     nxt_int_t                     (*server_init)(nxt_task_t *task,
34                                       nxt_tls_conf_t *conf, nxt_mp_t *mp,
35                                       nxt_bool_t last);
36     void                          (*server_free)(nxt_task_t *task,
37                                       nxt_tls_conf_t *conf);
38 } nxt_tls_lib_t;
39 
40 
41 typedef struct {
42     nxt_tls_bundle_conf_t         *bundle;
43 
44     nxt_str_t                     name;
45 } nxt_tls_bundle_hash_item_t;
46 
47 
48 struct nxt_tls_bundle_conf_s {
49     void                          *ctx;
50 
51     nxt_fd_t                      chain_file;
52     nxt_str_t                     *name;
53 
54     nxt_tls_bundle_conf_t         *next;
55 };
56 
57 
58 struct nxt_tls_conf_s {
59     nxt_tls_bundle_conf_t         *bundle;
60     nxt_lvlhsh_t                  bundle_hash;
61 
62     void                          (*conn_init)(nxt_task_t *task,
63                                       nxt_tls_conf_t *conf, nxt_conn_t *c);
64 
65     const nxt_tls_lib_t           *lib;
66 
67     char                          *ciphers;
68 
69     char                          *ca_certificate;
70 
71     size_t                        buffer_size;
72 
73     uint8_t                       no_wait_shutdown;  /* 1 bit */
74 };
75 
76 
77 #if (NXT_HAVE_OPENSSL)
78 extern const nxt_tls_lib_t        nxt_openssl_lib;
79 
80 void nxt_cdecl nxt_openssl_log_error(nxt_task_t *task, nxt_uint_t level,
81     const char *fmt, ...);
82 u_char *nxt_openssl_copy_error(u_char *p, u_char *end);
83 #endif
84 
85 #if (NXT_HAVE_GNUTLS)
86 extern const nxt_tls_lib_t        nxt_gnutls_lib;
87 #endif
88 
89 #if (NXT_HAVE_CYASSL)
90 extern const nxt_tls_lib_t        nxt_cyassl_lib;
91 #endif
92 
93 #if (NXT_HAVE_POLARSSL)
94 extern const nxt_tls_lib_t        nxt_polar_lib;
95 #endif
96 
97 
98 #endif /* _NXT_TLS_H_INCLUDED_ */
99