From 96130466e920cec1c8aa8bfda14f66ca636edba8 Mon Sep 17 00:00:00 2001 From: Hakase Date: Sun, 16 Sep 2018 06:30:12 +0900 Subject: [PATCH] Add support config strict_sni - on/off --- src/http/ngx_http_core_module.c | 9 +++++++ src/http/ngx_http_core_module.h | 1 + src/http/ngx_http_request.c | 18 ++++++------- strict-sni-example.patch | 47 --------------------------------- 4 files changed, 19 insertions(+), 56 deletions(-) delete mode 100644 strict-sni-example.patch diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index 135b604..d941737 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -441,6 +441,13 @@ static ngx_command_t ngx_http_core_commands[] = { offsetof(ngx_http_core_loc_conf_t, directio_alignment), NULL }, + { ngx_string("strict_sni"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_core_loc_conf_t, strict_sni), + NULL }, + { ngx_string("tcp_nopush"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, ngx_conf_set_flag_slot, @@ -3387,6 +3394,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf) clcf->read_ahead = NGX_CONF_UNSET_SIZE; clcf->directio = NGX_CONF_UNSET; clcf->directio_alignment = NGX_CONF_UNSET; + clcf->strict_sni = NGX_CONF_UNSET; clcf->tcp_nopush = NGX_CONF_UNSET; clcf->tcp_nodelay = NGX_CONF_UNSET; clcf->send_timeout = NGX_CONF_UNSET_MSEC; @@ -3615,6 +3623,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) NGX_OPEN_FILE_DIRECTIO_OFF); ngx_conf_merge_off_value(conf->directio_alignment, prev->directio_alignment, 512); + ngx_conf_merge_value(conf->strict_sni, prev->strict_sni, 0); ngx_conf_merge_value(conf->tcp_nopush, prev->tcp_nopush, 0); ngx_conf_merge_value(conf->tcp_nodelay, prev->tcp_nodelay, 1); diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h index 4c6da7c..ca722b1 100644 --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -382,6 +382,7 @@ struct ngx_http_core_loc_conf_s { ngx_flag_t sendfile; /* sendfile */ ngx_flag_t aio; /* aio */ ngx_flag_t aio_write; /* aio_write */ + ngx_flag_t strict_sni; /* strict_sni */ ngx_flag_t tcp_nopush; /* tcp_nopush */ ngx_flag_t tcp_nodelay; /* tcp_nodelay */ ngx_flag_t reset_timedout_connection; /* reset_timedout_connection */ diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 98cc8c7..b7aead9 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -846,14 +846,18 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) ngx_http_core_loc_conf_t *clcf; ngx_http_core_srv_conf_t *cscf; + c = ngx_ssl_get_connection(ssl_conn); + + hc = c->data; + + clcf = ngx_http_get_module_loc_conf(hc->conf_ctx, ngx_http_core_module); + servername = SSL_get_servername(ssl_conn, TLSEXT_NAMETYPE_host_name); if (servername == NULL) { - return SSL_TLSEXT_ERR_NOACK; + return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK; } - c = ngx_ssl_get_connection(ssl_conn); - if (c->ssl->renegotiation) { return SSL_TLSEXT_ERR_NOACK; } @@ -864,7 +868,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) host.len = ngx_strlen(servername); if (host.len == 0) { - return SSL_TLSEXT_ERR_NOACK; + return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK; } host.data = (u_char *) servername; @@ -873,13 +877,11 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) return SSL_TLSEXT_ERR_NOACK; } - hc = c->data; - if (ngx_http_find_virtual_server(c, hc->addr_conf->virtual_names, &host, NULL, &cscf) != NGX_OK) { - return SSL_TLSEXT_ERR_NOACK; + return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK; } hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t)); @@ -891,8 +893,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) hc->conf_ctx = cscf->ctx; - clcf = ngx_http_get_module_loc_conf(hc->conf_ctx, ngx_http_core_module); - ngx_set_connection_log(c, clcf->error_log); sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module); diff --git a/strict-sni-example.patch b/strict-sni-example.patch deleted file mode 100644 index 92b5e1f..0000000 --- a/strict-sni-example.patch +++ /dev/null @@ -1,47 +0,0 @@ -diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c -index 98cc8c7..0810526 100644 ---- a/src/http/ngx_http_request.c -+++ b/src/http/ngx_http_request.c -@@ -849,7 +849,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) - servername = SSL_get_servername(ssl_conn, TLSEXT_NAMETYPE_host_name); - - if (servername == NULL) { -- return SSL_TLSEXT_ERR_NOACK; -+ return SSL_TLSEXT_ERR_ALERT_FATAL; - } - - c = ngx_ssl_get_connection(ssl_conn); -@@ -864,7 +864,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) - host.len = ngx_strlen(servername); - - if (host.len == 0) { -- return SSL_TLSEXT_ERR_NOACK; -+ return SSL_TLSEXT_ERR_ALERT_FATAL; - } - - host.data = (u_char *) servername; -@@ -879,7 +879,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) - NULL, &cscf) - != NGX_OK) - { -- return SSL_TLSEXT_ERR_NOACK; -+ return SSL_TLSEXT_ERR_ALERT_FATAL; - } - - hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t)); -diff --git a/lib/openssl/ssl/statem/extensions.c b/lib/openssl/ssl/statem/extensions.c -index 8422161dc1..675446e59f 100644 ---- a/lib/openssl/ssl/statem/extensions.c -+++ b/lib/openssl/ssl/statem/extensions.c -@@ -998,7 +998,9 @@ static int final_server_name(SSL *s, unsigned int context, int sent) - - switch (ret) { - case SSL_TLSEXT_ERR_ALERT_FATAL: -- SSLfatal(s, altmp, SSL_F_FINAL_SERVER_NAME, SSL_R_CALLBACK_FAILED); -+ s->statem.in_init = 1; -+ s->statem.state = MSG_FLOW_ERROR; -+ ssl3_send_alert(s, SSL3_AL_FATAL, SSL_F_FINAL_RENEGOTIATE); - return 0; - - case SSL_TLSEXT_ERR_ALERT_WARNING: -