Mercurial > hg > nginx-quic
view contrib/geo2nginx.pl @ 5094:e0a3714a36f8
SNI: reset to default server if requested host was not found.
Not only this is consistent with a case without SNI, but this also
prevents abusing configurations that assume that the $host variable
is limited to one of the configured names for a server.
An example of potentially unsafe configuration:
server {
listen 443 ssl default_server;
...
}
server {
listen 443;
server_name example.com;
location / {
proxy_pass http://$host;
}
}
Note: it is possible to negotiate "example.com" by SNI, and to request
arbitrary host name that does not exist in the configuration above.
author | Valentin Bartenev <vbart@nginx.com> |
---|---|
date | Wed, 27 Feb 2013 17:38:54 +0000 |
parents | c9ad0d9c7d59 |
children |
line wrap: on
line source
#!/usr/bin/perl -w # (c) Andrei Nigmatulin, 2005 # # this script provided "as is", without any warranties. use it at your own risk. # # special thanx to Andrew Sitnikov for perl port # # this script converts CSV geoip database (free download at http://www.maxmind.com/app/geoip_country) # to format, suitable for use with nginx_http_geo module (http://sysoev.ru/nginx) # # for example, line with ip range # # "62.16.68.0","62.16.127.255","1041253376","1041268735","RU","Russian Federation" # # will be converted to four subnetworks: # # 62.16.68.0/22 RU; # 62.16.72.0/21 RU; # 62.16.80.0/20 RU; # 62.16.96.0/19 RU; use warnings; use strict; while( <STDIN> ){ if (/"[^"]+","[^"]+","([^"]+)","([^"]+)","([^"]+)"/){ print_subnets($1, $2, $3); } } sub print_subnets { my ($a1, $a2, $c) = @_; my $l; while ($a1 <= $a2) { for ($l = 0; ($a1 & (1 << $l)) == 0 && ($a1 + ((1 << ($l + 1)) - 1)) <= $a2; $l++){}; print long2ip($a1) . "/" . (32 - $l) . " " . $c . ";\n"; $a1 += (1 << $l); } } sub long2ip { my $ip = shift; my $str = 0; $str = ($ip & 255); $ip >>= 8; $str = ($ip & 255).".$str"; $ip >>= 8; $str = ($ip & 255).".$str"; $ip >>= 8; $str = ($ip & 255).".$str"; }