1 2 /* 3 * Copyright (C) Igor Sysoev 4 * Copyright (C) NGINX, Inc. 5 */ 6 7 #ifndef _NXT_TLS_H_INCLUDED_ 8 #define _NXT_TLS_H_INCLUDED_ 9 10 11 #include <nxt_conf.h> 12 13 14 /* 15 * The SSL/TLS libraries lack vector I/O interface yet add noticeable 16 * overhead to each SSL/TLS record so buffering allows to decrease the 17 * overhead. The typical overhead size is about 30 bytes, however, TLS 18 * supports also random padding up to 255 bytes. The maximum SSLv3/TLS 19 * record size is 16K. However, large records increase decryption latency. 20 * 4K is good compromise between 1-6% of SSL/TLS overhead and the latency. 21 * 4K buffer allows to send one SSL/TLS record (4096-bytes data and up to 22 * 224-bytes overhead) in three 1440-bytes TCP/IPv4 packets with timestamps 23 * and compatible with tunnels. 24 */ 25 26 #define NXT_TLS_BUFFER_SIZE 4096 27 28 29 typedef struct nxt_tls_conf_s nxt_tls_conf_t; 30 typedef struct nxt_tls_bundle_conf_s nxt_tls_bundle_conf_t; 31 32 typedef struct { 33 nxt_int_t (*library_init)(nxt_task_t *task); 34 void (*library_free)(nxt_task_t *task); 35 36 nxt_int_t (*server_init)(nxt_task_t *task, 37 nxt_tls_conf_t *conf, nxt_mp_t *mp, 38 nxt_conf_value_t *conf_cmds, 39 nxt_bool_t last); 40 void (*server_free)(nxt_task_t *task, 41 nxt_tls_conf_t *conf); 42 } nxt_tls_lib_t; 43 44 45 typedef struct { 46 nxt_tls_bundle_conf_t *bundle; 47 48 nxt_str_t name; 49 } nxt_tls_bundle_hash_item_t; 50 51 52 struct nxt_tls_bundle_conf_s { 53 void *ctx; 54 55 nxt_fd_t chain_file; 56 nxt_str_t name; 57 58 nxt_tls_bundle_conf_t *next; 59 }; 60 61 62 struct nxt_tls_conf_s { 63 nxt_tls_bundle_conf_t *bundle; 64 nxt_lvlhsh_t bundle_hash; 65 66 void (*conn_init)(nxt_task_t *task, 67 nxt_tls_conf_t *conf, nxt_conn_t *c); 68 69 const nxt_tls_lib_t *lib; 70 71 char *ciphers; 72 73 char *ca_certificate; 74 75 size_t buffer_size; 76 77 uint8_t no_wait_shutdown; /* 1 bit */ 78 }; 79 80 81 #if (NXT_HAVE_OPENSSL) 82 extern const nxt_tls_lib_t nxt_openssl_lib; 83 84 void nxt_cdecl nxt_openssl_log_error(nxt_task_t *task, nxt_uint_t level, 85 const char *fmt, ...); 86 u_char *nxt_openssl_copy_error(u_char *p, u_char *end); 87 #endif 88 89 #if (NXT_HAVE_GNUTLS) 90 extern const nxt_tls_lib_t nxt_gnutls_lib; 91 #endif 92 93 #if (NXT_HAVE_CYASSL) 94 extern const nxt_tls_lib_t nxt_cyassl_lib; 95 #endif 96 97 #if (NXT_HAVE_POLARSSL) 98 extern const nxt_tls_lib_t nxt_polar_lib; 99 #endif 100 101 102 #endif /* _NXT_TLS_H_INCLUDED_ */ 103