Mercurial > nginx
changeset 9415:f1c6fdc44ac2
SSL: disabled UI console prompts from worker processes.
Certain providers may attempt to reload the key on the first use after a
fork. Such attempt would require re-prompting the pin, and this time we
are not able to pass the password callback.
While it is addressable with configuration for a specific provider, it would
be prudent to ensure that no such prompts could block worker processes by
setting the default UI method.
UI_null() first appeared in 1.1.1 along with the OSSL_STORE, so it is safe
to assume the same set of guards.
| author | Aleksei Bavshin <a.bavshin@nginx.com> |
|---|---|
| date | Fri, 17 Jan 2025 12:24:08 -0800 |
| parents | 23971bd0b072 |
| children | 2034e305475d |
| files | src/event/ngx_event_openssl_cache.c |
| diffstat | 1 files changed, 20 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/event/ngx_event_openssl_cache.c Mon Dec 16 17:56:45 2024 -0800 +++ b/src/event/ngx_event_openssl_cache.c Fri Jan 17 12:24:08 2025 -0800 @@ -122,6 +122,8 @@ static void ngx_ssl_cache_node_free(ngx_rbtree_t *rbtree, ngx_ssl_cache_node_t *cn); +static ngx_int_t ngx_openssl_cache_init_worker(ngx_cycle_t *cycle); + static ngx_command_t ngx_openssl_cache_commands[] = { @@ -150,7 +152,7 @@ NGX_CORE_MODULE, /* module type */ NULL, /* init master */ NULL, /* init module */ - NULL, /* init process */ + ngx_openssl_cache_init_worker, /* init process */ NULL, /* init thread */ NULL, /* exit thread */ NULL, /* exit process */ @@ -1233,3 +1235,20 @@ node->right = sentinel; ngx_rbt_red(node); } + + +static ngx_int_t +ngx_openssl_cache_init_worker(ngx_cycle_t *cycle) +{ +#ifdef ERR_R_OSSL_STORE_LIB + + if (ngx_process != NGX_PROCESS_WORKER) { + return NGX_OK; + } + + UI_set_default_method(UI_null()); + +#endif + + return NGX_OK; +}