view auto/lib/pcre/conf @ 6982:ac9b1df5b246

SSL: disabled renegotiation detection in client mode. CVE-2009-3555 is no longer relevant and mitigated by the renegotiation info extension (secure renegotiation). On the other hand, unexpected renegotiation still introduces potential security risks, and hence we do not allow renegotiation on the server side, as we never request renegotiation. On the client side the situation is different though. There are backends which explicitly request renegotiation, and disabled renegotiation introduces interoperability problems. This change allows renegotiation on the client side, and fixes interoperability problems as observed with such backends (ticket #872). Additionally, with TLSv1.3 the SSL_CB_HANDSHAKE_START flag is currently set by OpenSSL when receiving a NewSessionTicket message, and was detected by nginx as a renegotiation attempt. This looks like a bug in OpenSSL, though this change also allows better interoperability till the problem is fixed.
author Sergey Kandaurov <pluknet@nginx.com>
date Tue, 18 Apr 2017 16:08:44 +0300
parents 78f8ac479735
children 8007ea138d6a
line wrap: on
line source


# Copyright (C) Igor Sysoev
# Copyright (C) Nginx, Inc.


if [ $PCRE != NONE ]; then
    CORE_INCS="$CORE_INCS $PCRE"

    case "$NGX_CC_NAME" in

        msvc | owc | bcc)
            have=NGX_PCRE . auto/have
            have=PCRE_STATIC . auto/have
            CORE_DEPS="$CORE_DEPS $PCRE/pcre.h"
            LINK_DEPS="$LINK_DEPS $PCRE/pcre.lib"
            CORE_LIBS="$CORE_LIBS $PCRE/pcre.lib"
        ;;

        icc)
            have=NGX_PCRE . auto/have
            CORE_DEPS="$CORE_DEPS $PCRE/pcre.h"

            LINK_DEPS="$LINK_DEPS $PCRE/.libs/libpcre.a"

            echo $ngx_n "checking for PCRE library ...$ngx_c"

            if [ -f $PCRE/pcre.h ]; then
                ngx_pcre_ver=`grep PCRE_MAJOR $PCRE/pcre.h \
                              | sed -e 's/^.*PCRE_MAJOR.* \(.*\)$/\1/'`

            else if [ -f $PCRE/configure.in ]; then
                ngx_pcre_ver=`grep PCRE_MAJOR= $PCRE/configure.in \
                              | sed -e 's/^.*=\(.*\)$/\1/'`

            else
                ngx_pcre_ver=`grep pcre_major, $PCRE/configure.ac \
                              | sed -e 's/^.*pcre_major,.*\[\(.*\)\].*$/\1/'`
            fi
            fi

            echo " $ngx_pcre_ver major version found"

            # to allow -ipo optimization we link with the *.o but not library

            case "$ngx_pcre_ver" in
                4|5)
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre.o"
                ;;

                6)
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_chartables.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_compile.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_exec.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_fullinfo.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_globals.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_tables.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_try_flipped.o"
                ;;

                *)
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_chartables.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_compile.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_exec.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_fullinfo.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_globals.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_tables.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_try_flipped.o"
                    CORE_LIBS="$CORE_LIBS $PCRE/pcre_newline.o"
                ;;

            esac
        ;;

        *)
            have=NGX_PCRE . auto/have

            if [ "$NGX_PLATFORM" = win32 ]; then
                have=PCRE_STATIC . auto/have
            fi

            CORE_DEPS="$CORE_DEPS $PCRE/pcre.h"
            LINK_DEPS="$LINK_DEPS $PCRE/.libs/libpcre.a"
            CORE_LIBS="$CORE_LIBS $PCRE/.libs/libpcre.a"
        ;;

    esac


    if [ $PCRE_JIT = YES ]; then
        have=NGX_HAVE_PCRE_JIT . auto/have
        PCRE_CONF_OPT="$PCRE_CONF_OPT --enable-jit"
    fi

else

    if [ "$NGX_PLATFORM" != win32 ]; then

        PCRE=NO

        ngx_feature="PCRE library"
        ngx_feature_name="NGX_PCRE"
        ngx_feature_run=no
        ngx_feature_incs="#include <pcre.h>"
        ngx_feature_path=
        ngx_feature_libs="-lpcre"
        ngx_feature_test="pcre *re;
                          re = pcre_compile(NULL, 0, NULL, 0, NULL);
                          if (re == NULL) return 1"
        . auto/feature

        if [ $ngx_found = no ]; then

            # FreeBSD port

            ngx_feature="PCRE library in /usr/local/"
            ngx_feature_path="/usr/local/include"

            if [ $NGX_RPATH = YES ]; then
                ngx_feature_libs="-R/usr/local/lib -L/usr/local/lib -lpcre"
            else
                ngx_feature_libs="-L/usr/local/lib -lpcre"
            fi

            . auto/feature
        fi

        if [ $ngx_found = no ]; then

            # RedHat RPM, Solaris package

            ngx_feature="PCRE library in /usr/include/pcre/"
            ngx_feature_path="/usr/include/pcre"
            ngx_feature_libs="-lpcre"

            . auto/feature
        fi

        if [ $ngx_found = no ]; then

            # NetBSD port

            ngx_feature="PCRE library in /usr/pkg/"
            ngx_feature_path="/usr/pkg/include"

            if [ $NGX_RPATH = YES ]; then
                ngx_feature_libs="-R/usr/pkg/lib -L/usr/pkg/lib -lpcre"
            else
                ngx_feature_libs="-L/usr/pkg/lib -lpcre"
            fi

            . auto/feature
        fi

        if [ $ngx_found = no ]; then

            # MacPorts

            ngx_feature="PCRE library in /opt/local/"
            ngx_feature_path="/opt/local/include"

            if [ $NGX_RPATH = YES ]; then
                ngx_feature_libs="-R/opt/local/lib -L/opt/local/lib -lpcre"
            else
                ngx_feature_libs="-L/opt/local/lib -lpcre"
            fi

            . auto/feature
        fi

        if [ $ngx_found = yes ]; then
            CORE_INCS="$CORE_INCS $ngx_feature_path"
            CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
            PCRE=YES
        fi

        if [ $PCRE = YES ]; then
            ngx_feature="PCRE JIT support"
            ngx_feature_name="NGX_HAVE_PCRE_JIT"
            ngx_feature_test="int jit = 0;
                              pcre_free_study(NULL);
                              pcre_config(PCRE_CONFIG_JIT, &jit);
                              if (jit != 1) return 1;"
            . auto/feature

            if [ $ngx_found = yes ]; then
                PCRE_JIT=YES
            fi
        fi
    fi

    if [ $PCRE != YES ]; then
cat << END

$0: error: the HTTP rewrite module requires the PCRE library.
You can either disable the module by using --without-http_rewrite_module
option, or install the PCRE library into the system, or build the PCRE library
statically from the source with nginx by using --with-pcre=<path> option.

END
        exit 1
    fi

fi