Mercurial > hg > nginx-quic
view auto/module @ 7367:bf1ac3dc1e68
SSL: fixed segfault on renegotiation (ticket #1646).
In e3ba4026c02d (1.15.4) nginx own renegotiation checks were disabled
if SSL_OP_NO_RENEGOTIATION is available. But since SSL_OP_NO_RENEGOTIATION
is only set on a connection, not in an SSL context, SSL_clear_option()
removed it as long as a matching virtual server was found. This resulted
in a segmentation fault similar to the one fixed in a6902a941279 (1.9.8),
affecting nginx built with OpenSSL 1.1.0h or higher.
To fix this, SSL_OP_NO_RENEGOTIATION is now explicitly set in
ngx_http_ssl_servername() after adjusting options. Additionally, instead
of c->ssl->renegotiation we now check c->ssl->handshaked, which seems
to be a more correct flag to test, and will prevent the segmentation fault
from happening even if SSL_OP_NO_RENEGOTIATION is not working.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 02 Oct 2018 17:46:18 +0300 |
parents | 2c7a2d75938a |
children | 4b1299b1856a |
line wrap: on
line source
# Copyright (C) Ruslan Ermilov # Copyright (C) Nginx, Inc. case $ngx_module_type in HTTP_*) ngx_var=HTTP ;; *) ngx_var=$ngx_module_type ;; esac if [ "$ngx_module_link" = DYNAMIC ]; then for ngx_module in $ngx_module_name; do # extract the first name break done DYNAMIC_MODULES="$DYNAMIC_MODULES $ngx_module" eval ${ngx_module}_SRCS=\"$ngx_module_srcs\" eval ${ngx_module}_MODULES=\"$ngx_module_name\" if [ -z "$ngx_module_order" -a \ \( "$ngx_module_type" = "HTTP_FILTER" \ -o "$ngx_module_type" = "HTTP_AUX_FILTER" \) ] then eval ${ngx_module}_ORDER=\"$ngx_module_name \ ngx_http_copy_filter_module\" else eval ${ngx_module}_ORDER=\"$ngx_module_order\" fi if test -n "$ngx_module_incs"; then CORE_INCS="$CORE_INCS $ngx_module_incs" fi if test -n "$ngx_module_deps"; then NGX_ADDON_DEPS="$NGX_ADDON_DEPS $ngx_module_deps" fi libs= for lib in $ngx_module_libs do case $lib in LIBXSLT | LIBGD | GEOIP | PERL) libs="$libs \$NGX_LIB_$lib" if eval [ "\$USE_${lib}" = NO ] ; then eval USE_${lib}=DYNAMIC fi ;; PCRE | OPENSSL | ZLIB) eval USE_${lib}=YES ;; MD5 | SHA1) # obsolete ;; *) libs="$libs $lib" ;; esac done eval ${ngx_module}_LIBS=\'$libs\' elif [ "$ngx_module_link" = YES ]; then eval ${ngx_module_type}_MODULES=\"\$${ngx_module_type}_MODULES \ $ngx_module_name\" eval ${ngx_var}_SRCS=\"\$${ngx_var}_SRCS $ngx_module_srcs\" if test -n "$ngx_module_incs"; then eval ${ngx_var}_INCS=\"\$${ngx_var}_INCS $ngx_module_incs\" fi if test -n "$ngx_module_deps"; then eval ${ngx_var}_DEPS=\"\$${ngx_var}_DEPS $ngx_module_deps\" fi for lib in $ngx_module_libs do case $lib in PCRE | OPENSSL | ZLIB | LIBXSLT | LIBGD | PERL | GEOIP) eval USE_${lib}=YES ;; MD5 | SHA1) # obsolete ;; *) CORE_LIBS="$CORE_LIBS $lib" ;; esac done elif [ "$ngx_module_link" = ADDON ]; then eval ${ngx_module_type}_MODULES=\"\$${ngx_module_type}_MODULES \ $ngx_module_name\" NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_module_srcs" if test -n "$ngx_module_incs"; then eval ${ngx_var}_INCS=\"\$${ngx_var}_INCS $ngx_module_incs\" fi if test -n "$ngx_module_deps"; then NGX_ADDON_DEPS="$NGX_ADDON_DEPS $ngx_module_deps" fi for lib in $ngx_module_libs do case $lib in PCRE | OPENSSL | ZLIB | LIBXSLT | LIBGD | PERL | GEOIP) eval USE_${lib}=YES ;; MD5 | SHA1) # obsolete ;; *) CORE_LIBS="$CORE_LIBS $lib" ;; esac done fi