annotate contrib/geo2nginx.pl @ 7367:bf1ac3dc1e68

SSL: fixed segfault on renegotiation (ticket #1646). In e3ba4026c02d (1.15.4) nginx own renegotiation checks were disabled if SSL_OP_NO_RENEGOTIATION is available. But since SSL_OP_NO_RENEGOTIATION is only set on a connection, not in an SSL context, SSL_clear_option() removed it as long as a matching virtual server was found. This resulted in a segmentation fault similar to the one fixed in a6902a941279 (1.9.8), affecting nginx built with OpenSSL 1.1.0h or higher. To fix this, SSL_OP_NO_RENEGOTIATION is now explicitly set in ngx_http_ssl_servername() after adjusting options. Additionally, instead of c->ssl->renegotiation we now check c->ssl->handshaked, which seems to be a more correct flag to test, and will prevent the segmentation fault from happening even if SSL_OP_NO_RENEGOTIATION is not working.
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 02 Oct 2018 17:46:18 +0300
parents c9ad0d9c7d59
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
537
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1 #!/usr/bin/perl -w
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3 # (c) Andrei Nigmatulin, 2005
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
4 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
5 # this script provided "as is", without any warranties. use it at your own risk.
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
6 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
7 # special thanx to Andrew Sitnikov for perl port
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 # this script converts CSV geoip database (free download at http://www.maxmind.com/app/geoip_country)
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10 # to format, suitable for use with nginx_http_geo module (http://sysoev.ru/nginx)
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
11 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
12 # for example, line with ip range
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
13 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
14 # "62.16.68.0","62.16.127.255","1041253376","1041268735","RU","Russian Federation"
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
15 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
16 # will be converted to four subnetworks:
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
17 #
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
18 # 62.16.68.0/22 RU;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
19 # 62.16.72.0/21 RU;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
20 # 62.16.80.0/20 RU;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
21 # 62.16.96.0/19 RU;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
22
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
23
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
24 use warnings;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
25 use strict;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
26
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
27 while( <STDIN> ){
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
28 if (/"[^"]+","[^"]+","([^"]+)","([^"]+)","([^"]+)"/){
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
29 print_subnets($1, $2, $3);
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
30 }
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
31 }
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
32
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
33 sub print_subnets {
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
34 my ($a1, $a2, $c) = @_;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
35 my $l;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
36 while ($a1 <= $a2) {
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
37 for ($l = 0; ($a1 & (1 << $l)) == 0 && ($a1 + ((1 << ($l + 1)) - 1)) <= $a2; $l++){};
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
38 print long2ip($a1) . "/" . (32 - $l) . " " . $c . ";\n";
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
39 $a1 += (1 << $l);
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
40 }
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
41 }
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
42
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
43 sub long2ip {
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
44 my $ip = shift;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
45
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
46 my $str = 0;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
47
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
48 $str = ($ip & 255);
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
49
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
50 $ip >>= 8;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
51 $str = ($ip & 255).".$str";
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
52
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
53 $ip >>= 8;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
54 $str = ($ip & 255).".$str";
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
55
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
56 $ip >>= 8;
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
57 $str = ($ip & 255).".$str";
c9ad0d9c7d59 nginx-0.1.43-RELEASE import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
58 }