[nginx] SSL: $ssl_curve (ticket #2135).

[Sergey Kandaurov]

details:   https://hg.nginx.org/nginx/rev/3443c02ca1d1
branches:  
changeset: 7973:3443c02ca1d1
user:      Sergey Kandaurov <pluknet at nginx.com>
date:      Mon Nov 01 18:09:34 2021 +0300
description:
SSL: $ssl_curve (ticket #2135).

The variable contains a negotiated curve used for the handshake key
exchange process.  Known curves are listed by their names, unknown
ones are shown in hex.

Note that for resumed sessions in TLSv1.2 and older protocols,
$ssl_curve contains the curve used during the initial handshake,
while in TLSv1.3 it contains the curve used during the session
resumption (see the SSL_get_negotiated_group manual page for
details).

The variable is only meaningful when using OpenSSL 3.0 and above.
With older versions the variable is empty.

diffstat:

 src/event/ngx_event_openssl.c          |  36 ++++++++++++++++++++++++++++++++++
 src/event/ngx_event_openssl.h          |   2 +
 src/http/modules/ngx_http_ssl_module.c |   3 ++
 src/stream/ngx_stream_ssl_module.c     |   3 ++
 4 files changed, 44 insertions(+), 0 deletions(-)

diffs (84 lines):

diff -r 284f03d6f154 -r 3443c02ca1d1 src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c	Tue Nov 23 12:52:43 2021 +0300
+++ b/src/event/ngx_event_openssl.c	Mon Nov 01 18:09:34 2021 +0300
@@ -4734,6 +4734,42 @@ ngx_ssl_get_ciphers(ngx_connection_t *c,
 
 
 ngx_int_t
+ngx_ssl_get_curve(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
+{
+#ifdef SSL_get_negotiated_group
+
+    int  nid;
+
+    nid = SSL_get_negotiated_group(c->ssl->connection);
+
+    if (nid != NID_undef) {
+
+        if ((nid & TLSEXT_nid_unknown) == 0) {
+            s->len = ngx_strlen(OBJ_nid2sn(nid));
+            s->data = (u_char *) OBJ_nid2sn(nid);
+            return NGX_OK;
+        }
+
+        s->len = sizeof("0x0000") - 1;
+
+        s->data = ngx_pnalloc(pool, s->len);
+        if (s->data == NULL) {
+            return NGX_ERROR;
+        }
+
+        ngx_sprintf(s->data, "0x%04xd", nid & 0xffff);
+
+        return NGX_OK;
+    }
+
+#endif
+
+    s->len = 0;
+    return NGX_OK;
+}
+
+
+ngx_int_t
 ngx_ssl_get_curves(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 {
 #ifdef SSL_CTRL_GET_CURVES
diff -r 284f03d6f154 -r 3443c02ca1d1 src/event/ngx_event_openssl.h
--- a/src/event/ngx_event_openssl.h	Tue Nov 23 12:52:43 2021 +0300
+++ b/src/event/ngx_event_openssl.h	Mon Nov 01 18:09:34 2021 +0300
@@ -256,6 +256,8 @@ ngx_int_t ngx_ssl_get_cipher_name(ngx_co
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_ciphers(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
+ngx_int_t ngx_ssl_get_curve(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s);
 ngx_int_t ngx_ssl_get_curves(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool,
diff -r 284f03d6f154 -r 3443c02ca1d1 src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c	Tue Nov 23 12:52:43 2021 +0300
+++ b/src/http/modules/ngx_http_ssl_module.c	Mon Nov 01 18:09:34 2021 +0300
@@ -342,6 +342,9 @@ static ngx_http_variable_t  ngx_http_ssl
     { ngx_string("ssl_ciphers"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_ciphers, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_curve"), NULL, ngx_http_ssl_variable,
+      (uintptr_t) ngx_ssl_get_curve, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_curves"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_curves, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
diff -r 284f03d6f154 -r 3443c02ca1d1 src/stream/ngx_stream_ssl_module.c
--- a/src/stream/ngx_stream_ssl_module.c	Tue Nov 23 12:52:43 2021 +0300
+++ b/src/stream/ngx_stream_ssl_module.c	Mon Nov 01 18:09:34 2021 +0300
@@ -269,6 +269,9 @@ static ngx_stream_variable_t  ngx_stream
     { ngx_string("ssl_ciphers"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_ciphers, NGX_STREAM_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_curve"), NULL, ngx_stream_ssl_variable,
+      (uintptr_t) ngx_ssl_get_curve, NGX_STREAM_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_curves"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_curves, NGX_STREAM_VAR_CHANGEABLE, 0 },