ludra/nginx-build
1
0 Fork 0
forked from Hakase/nginx-build
Code Issues Pull Requests Releases Wiki Activity

If strict_sni is ON and invalid header is received, the connection is terminated.

Browse Source
This commit is contained in:
Hakase
2018-09-16 15:57:38 +09:00
parent c77f6412dc
commit 01ec7ac6b5
1 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/http/ngx_http_request.c
+14 -8
View File
@@ -932,15 +932,18 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
static void static void
ngx_http_process_request_line(ngx_event_t *rev) ngx_http_process_request_line(ngx_event_t *rev)
{ {
ssize_t n; ssize_t n;
ngx_int_t rc, rv; ngx_int_t rc, rv;
ngx_str_t host; ngx_str_t host;
ngx_connection_t *c; ngx_connection_t *c;
ngx_http_request_t *r; ngx_http_core_loc_conf_t *clcf;
ngx_http_request_t *r;
c = rev->data; c = rev->data;
r = c->data; r = c->data;
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0, ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0,
"http process request line"); "http process request line");
@@ -1056,10 +1059,10 @@ ngx_http_process_request_line(ngx_event_t *rev)
ngx_http_client_errors[rc - NGX_HTTP_CLIENT_ERROR]); ngx_http_client_errors[rc - NGX_HTTP_CLIENT_ERROR]);
if (rc == NGX_HTTP_PARSE_INVALID_VERSION) { if (rc == NGX_HTTP_PARSE_INVALID_VERSION) {
(r->http_connection->ssl) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED); (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED);
} else { } else {
(r->http_connection->ssl) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
} }
return; return;
@@ -1800,6 +1803,9 @@ ngx_http_process_multi_header_lines(ngx_http_request_t *r, ngx_table_elt_t *h,
ngx_int_t ngx_int_t
ngx_http_process_request_header(ngx_http_request_t *r) ngx_http_process_request_header(ngx_http_request_t *r)
{ {
ngx_http_core_loc_conf_t *clcf;
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
if (r->headers_in.server.len == 0 if (r->headers_in.server.len == 0
&& ngx_http_set_virtual_server(r, &r->headers_in.server) && ngx_http_set_virtual_server(r, &r->headers_in.server)
== NGX_ERROR) == NGX_ERROR)
@@ -1810,7 +1816,7 @@ ngx_http_process_request_header(ngx_http_request_t *r)
if (r->headers_in.host == NULL && r->http_version > NGX_HTTP_VERSION_10) { if (r->headers_in.host == NULL && r->http_version > NGX_HTTP_VERSION_10) {
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"client sent HTTP/1.1 request without \"Host\" header"); "client sent HTTP/1.1 request without \"Host\" header");
(r->http_connection->ssl) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
return NGX_ERROR; return NGX_ERROR;
} }