annotate src/event/modules/ngx_iocp_module.h @ 7732:59e1c73fe02b

SSL: ssl_reject_handshake directive (ticket #195). In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 22 Oct 2020 18:02:28 +0300
parents d620f497c50f
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
441
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 288
diff changeset
1
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 288
diff changeset
2 /*
444
42d11f017717 nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents: 441
diff changeset
3 * Copyright (C) Igor Sysoev
4412
d620f497c50f Copyright updated.
Maxim Konovalov <maxim@nginx.com>
parents: 444
diff changeset
4 * Copyright (C) Nginx, Inc.
441
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 288
diff changeset
5 */
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 288
diff changeset
6
da8c5707af39 nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents: 288
diff changeset
7
59
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 #ifndef _NGX_IOCP_MODULE_H_INCLUDED_
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 #define _NGX_IOCP_MODULE_H_INCLUDED_
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
11
103
6dfda4cf5200 nginx-0.0.1-2003-06-11-19:28:34 import
Igor Sysoev <igor@sysoev.ru>
parents: 59
diff changeset
12 typedef struct {
6dfda4cf5200 nginx-0.0.1-2003-06-11-19:28:34 import
Igor Sysoev <igor@sysoev.ru>
parents: 59
diff changeset
13 int threads;
288
f81d075ad172 nginx-0.0.2-2004-03-14-23:46:25 import
Igor Sysoev <igor@sysoev.ru>
parents: 103
diff changeset
14 int post_acceptex;
103
6dfda4cf5200 nginx-0.0.1-2003-06-11-19:28:34 import
Igor Sysoev <igor@sysoev.ru>
parents: 59
diff changeset
15 int acceptex_read;
6dfda4cf5200 nginx-0.0.1-2003-06-11-19:28:34 import
Igor Sysoev <igor@sysoev.ru>
parents: 59
diff changeset
16 } ngx_iocp_conf_t;
59
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
17
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
18
103
6dfda4cf5200 nginx-0.0.1-2003-06-11-19:28:34 import
Igor Sysoev <igor@sysoev.ru>
parents: 59
diff changeset
19 extern ngx_module_t ngx_iocp_module;
59
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
20
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
21
e8cdc2989cee nginx-0.0.1-2003-02-06-20:21:13 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
22 #endif /* _NGX_IOCP_MODULE_H_INCLUDED_ */