From 6c52beca9ab8505d08339fedd0831b7bd226dc6e Mon Sep 17 00:00:00 2001 From: Hakase Date: Thu, 20 Sep 2018 09:23:14 +0900 Subject: [PATCH] Add config - strict_sni_header --- README.md | 1 + src/http/ngx_http_core_module.c | 9 +++++++++ src/http/ngx_http_core_module.h | 1 + src/http/ngx_http_request.c | 6 +++--- 4 files changed, 14 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index fa5f854..b7cac1b 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ Example Web Server - [https://ssl.hakase.io/](https://ssl.hakase.io/) - SSL Strict-SNI (ex: http { strict_sni on; } ) (Thanks to [@JemmyLoveJenny](https://github.com/hakasenyang/openssl-patch/issues/1#issuecomment-421551872)) - Strict SNI requires at least two ssl server settings (server { listen 443 ssl }). - It does not matter what kind of certificate or duplicate. + - Use "strict_sni_header on" if you do not want to respond to invalid headers. (only with strict_sni) ## Upcoming Features - Auto build (rpm, deb, etc.) diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index d941737..a0b8b13 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -448,6 +448,13 @@ static ngx_command_t ngx_http_core_commands[] = { offsetof(ngx_http_core_loc_conf_t, strict_sni), NULL }, + { ngx_string("strict_sni_header"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_core_loc_conf_t, strict_sni_header), + NULL }, + { ngx_string("tcp_nopush"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, ngx_conf_set_flag_slot, @@ -3395,6 +3402,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf) clcf->directio = NGX_CONF_UNSET; clcf->directio_alignment = NGX_CONF_UNSET; clcf->strict_sni = NGX_CONF_UNSET; + clcf->strict_sni_header = NGX_CONF_UNSET; clcf->tcp_nopush = NGX_CONF_UNSET; clcf->tcp_nodelay = NGX_CONF_UNSET; clcf->send_timeout = NGX_CONF_UNSET_MSEC; @@ -3624,6 +3632,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) ngx_conf_merge_off_value(conf->directio_alignment, prev->directio_alignment, 512); ngx_conf_merge_value(conf->strict_sni, prev->strict_sni, 0); + ngx_conf_merge_value(conf->strict_sni_header, prev->strict_sni_header, 0); ngx_conf_merge_value(conf->tcp_nopush, prev->tcp_nopush, 0); ngx_conf_merge_value(conf->tcp_nodelay, prev->tcp_nodelay, 1); diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h index ca722b1..04e14d0 100644 --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -383,6 +383,7 @@ struct ngx_http_core_loc_conf_s { ngx_flag_t aio; /* aio */ ngx_flag_t aio_write; /* aio_write */ ngx_flag_t strict_sni; /* strict_sni */ + ngx_flag_t strict_sni_header; /* strict_sni_header */ ngx_flag_t tcp_nopush; /* tcp_nopush */ ngx_flag_t tcp_nodelay; /* tcp_nodelay */ ngx_flag_t reset_timedout_connection; /* reset_timedout_connection */ diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index c41322c..a2d3ebe 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -1059,10 +1059,10 @@ ngx_http_process_request_line(ngx_event_t *rev) ngx_http_client_errors[rc - NGX_HTTP_CLIENT_ERROR]); if (rc == NGX_HTTP_PARSE_INVALID_VERSION) { - (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED); + (r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_VERSION_NOT_SUPPORTED); } else { - (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + (r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); } return; @@ -1816,7 +1816,7 @@ ngx_http_process_request_header(ngx_http_request_t *r) if (r->headers_in.host == NULL && r->http_version > NGX_HTTP_VERSION_10) { ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, "client sent HTTP/1.1 request without \"Host\" header"); - (r->http_connection->ssl && clcf->strict_sni) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + (r->http_connection->ssl && clcf->strict_sni && clcf->strict_sni_header) ? ngx_http_terminate_request(r, 0) : ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); return NGX_ERROR; }