annotate auto/lib/make @ 6982:ac9b1df5b246

SSL: disabled renegotiation detection in client mode. CVE-2009-3555 is no longer relevant and mitigated by the renegotiation info extension (secure renegotiation). On the other hand, unexpected renegotiation still introduces potential security risks, and hence we do not allow renegotiation on the server side, as we never request renegotiation. On the client side the situation is different though. There are backends which explicitly request renegotiation, and disabled renegotiation introduces interoperability problems. This change allows renegotiation on the client side, and fixes interoperability problems as observed with such backends (ticket #872). Additionally, with TLSv1.3 the SSL_CB_HANDSHAKE_START flag is currently set by OpenSSL when receiving a NewSessionTicket message, and was detected by nginx as a renegotiation attempt. This looks like a bug in OpenSSL, though this change also allows better interoperability till the problem is fixed.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 18 Apr 2017 16:08:44 +0300
parents 9eefb38f0005
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
444
42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
1
42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
2 # Copyright (C) Igor Sysoev
4412
d620f497c50f Copyright updated.
Maxim Konovalov <maxim@nginx.com>
parents: 3363
diff changeset
3 # Copyright (C) Nginx, Inc.
444
42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents: 399
diff changeset
4
286
fc8dc489247e nginx-0.0.2-2004-03-12-00:34:52 import
Igor Sysoev <igor@sysoev.ru>
parents: 282
diff changeset
5
320
d621239c30f7 nginx-0.0.3-2004-04-18-23:06:02 import
Igor Sysoev <igor@sysoev.ru>
parents: 297
diff changeset
6 if [ $PCRE != NONE -a $PCRE != NO -a $PCRE != YES ]; then
286
fc8dc489247e nginx-0.0.2-2004-03-12-00:34:52 import
Igor Sysoev <igor@sysoev.ru>
parents: 282
diff changeset
7 . auto/lib/pcre/make
fc8dc489247e nginx-0.0.2-2004-03-12-00:34:52 import
Igor Sysoev <igor@sysoev.ru>
parents: 282
diff changeset
8 fi
195
8dee38ea9117 nginx-0.0.1-2003-11-25-23:44:56 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9
399
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 320
diff changeset
10 if [ $OPENSSL != NONE -a $OPENSSL != NO -a $OPENSSL != YES ]; then
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 320
diff changeset
11 . auto/lib/openssl/make
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 320
diff changeset
12 fi
4e21d1291a14 nginx-0.0.7-2004-07-25-22:34:14 import
Igor Sysoev <igor@sysoev.ru>
parents: 320
diff changeset
13
320
d621239c30f7 nginx-0.0.3-2004-04-18-23:06:02 import
Igor Sysoev <igor@sysoev.ru>
parents: 297
diff changeset
14 if [ $ZLIB != NONE -a $ZLIB != NO -a $ZLIB != YES ]; then
282
30310107dbc9 nginx-0.0.2-2004-03-09-22:47:07 import
Igor Sysoev <igor@sysoev.ru>
parents: 274
diff changeset
15 . auto/lib/zlib/make
30310107dbc9 nginx-0.0.2-2004-03-09-22:47:07 import
Igor Sysoev <igor@sysoev.ru>
parents: 274
diff changeset
16 fi
599
869b6444d234 nginx-0.3.21-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 444
diff changeset
17
3363
b4aa418af6ef libatomic_ops support
Igor Sysoev <igor@sysoev.ru>
parents: 653
diff changeset
18 if [ $NGX_LIBATOMIC != NO -a $NGX_LIBATOMIC != YES ]; then
b4aa418af6ef libatomic_ops support
Igor Sysoev <igor@sysoev.ru>
parents: 653
diff changeset
19 . auto/lib/libatomic/make
b4aa418af6ef libatomic_ops support
Igor Sysoev <igor@sysoev.ru>
parents: 653
diff changeset
20 fi
b4aa418af6ef libatomic_ops support
Igor Sysoev <igor@sysoev.ru>
parents: 653
diff changeset
21
6419
39a806ccf21e Dynamic modules: perl.
Ruslan Ermilov <ru@nginx.com>
parents: 4412
diff changeset
22 if [ $USE_PERL != NO ]; then
599
869b6444d234 nginx-0.3.21-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 444
diff changeset
23 . auto/lib/perl/make
869b6444d234 nginx-0.3.21-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents: 444
diff changeset
24 fi