ludra/nginx-build
1
0 Fork 0
forked from Hakase/nginx-build
Code Issues Pull Requests Releases Wiki Activity

Add config - strict_sni_header

Browse Source
This commit is contained in:
Hakase
2018-09-20 09:23:14 +09:00
parent 0480de42f3
commit 6c52beca9a
4 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -41,6 +41,7 @@ Example Web Server - [https://ssl.hakase.io/](https://ssl.hakase.io/)
- SSL Strict-SNI (ex: http { strict_sni on; } ) (Thanks to [@JemmyLoveJenny](https://github.com/hakasenyang/openssl-patch/issues/1#issuecomment-421551872))
- Strict SNI requires at least two ssl server settings (server { listen 443 ssl }).
- It does not matter what kind of certificate or duplicate.
- Use "strict_sni_header on" if you do not want to respond to invalid headers. (only with strict_sni)
## Upcoming Features
- Auto build (rpm, deb, etc.)
src/http/ngx_http_core_module.c
+9
View File
@@ -448,6 +448,13 @@ static ngx_command_t ngx_http_core_commands[] = {
offsetof(ngx_http_core_loc_conf_t, strict_sni),
NULL },
{ ngx_string("strict_sni_header"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
ngx_conf_set_flag_slot,
NGX_HTTP_LOC_CONF_OFFSET,
offsetof(ngx_http_core_loc_conf_t, strict_sni_header),
NULL },
{ ngx_string("tcp_nopush"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
ngx_conf_set_flag_slot,
@@ -3395,6 +3402,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
clcf->directio = NGX_CONF_UNSET;
clcf->directio_alignment = NGX_CONF_UNSET;
clcf->strict_sni = NGX_CONF_UNSET;
clcf->strict_sni_header = NGX_CONF_UNSET;
clcf->tcp_nopush = NGX_CONF_UNSET;
clcf->tcp_nodelay = NGX_CONF_UNSET;
clcf->send_timeout = NGX_CONF_UNSET_MSEC;
@@ -3624,6 +3632,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_off_value(conf->directio_alignment, prev->directio_alignment,
512);
ngx_conf_merge_value(conf->strict_sni, prev->strict_sni, 0);
ngx_conf_merge_value(conf->strict_sni_header, prev->strict_sni_header, 0);
ngx_conf_merge_value(conf->tcp_nopush, prev->tcp_nopush, 0);
ngx_conf_merge_value(conf->tcp_nodelay, prev->tcp_nodelay, 1);
src/http/ngx_http_core_module.h
+1
View File
@@ -383,6 +383,7 @@ struct ngx_http_core_loc_conf_s {
ngx_flag_t aio; /* aio */
ngx_flag_t aio_write; /* aio_write */
ngx_flag_t strict_sni; /* strict_sni */
ngx_flag_t strict_sni_header; /* strict_sni_header */
ngx_flag_t tcp_nopush; /* tcp_nopush */
ngx_flag_t tcp_nodelay; /* tcp_nodelay */
ngx_flag_t reset_timedout_connection; /* reset_timedout_connection */
src/http/ngx_http_request.c
+3 -3
View File
@@ -1059,10 +1059,10 @@ ngx_http_process_request_line(ngx_event_t *rev)
ngx_http_client_errors[rc - NGX_HTTP_CLIENT_ERROR]);
if (rc == NGX_HTTP_PARSE_INVALID_VERSION) {
(r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED);
(r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED);
} else {
(r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
(r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
}
return;
@@ -1816,7 +1816,7 @@ ngx_http_process_request_header(ngx_http_request_t *r)
if (r->headers_in.host == NULL && r->http_version > NGX_HTTP_VERSION_10) {
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"client sent HTTP/1.1 request without \"Host\" header");
(r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
(r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
return NGX_ERROR;
}