Mercurial > hg > nginx
comparison src/http/ngx_http_request.c @ 5095:4fbef397c753
SNI: added restriction on requesting host other than negotiated.
According to RFC 6066, client is not supposed to request a different server
name at the application layer. Server implementations that rely upon these
names being equal must validate that a client did not send a different name
in HTTP request. Current versions of Apache HTTP server always return 400
"Bad Request" in such cases.
There exist implementations however (e.g., SPDY) that rely on being able to
request different host names in one connection. Given this, we only reject
requests with differing host names if verification of client certificates
is enabled in a corresponding server configuration.
An example of configuration that might not work as expected:
server {
listen 433 ssl default;
return 404;
}
server {
listen 433 ssl;
server_name example.org;
ssl_client_certificate org.cert;
ssl_verify_client on;
}
server {
listen 433 ssl;
server_name example.com;
ssl_client_certificate com.cert;
ssl_verify_client on;
}
Previously, a client was able to request example.com by presenting
a certificate for example.org, and vice versa.
author | Valentin Bartenev <vbart@nginx.com> |
---|---|
date | Wed, 27 Feb 2013 17:41:34 +0000 |
parents | e0a3714a36f8 |
children | 63014d919fec |
comparison
equal
deleted
inserted
replaced
5094:e0a3714a36f8 | 5095:4fbef397c753 |
---|---|
1870 } | 1870 } |
1871 | 1871 |
1872 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME | 1872 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME |
1873 | 1873 |
1874 if (hc->ssl_servername) { | 1874 if (hc->ssl_servername) { |
1875 ngx_http_ssl_srv_conf_t *sscf; | |
1876 | |
1875 if (rc == NGX_DECLINED) { | 1877 if (rc == NGX_DECLINED) { |
1876 cscf = hc->addr_conf->default_server; | 1878 cscf = hc->addr_conf->default_server; |
1877 rc = NGX_OK; | 1879 rc = NGX_OK; |
1880 } | |
1881 | |
1882 sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module); | |
1883 | |
1884 if (sscf->verify) { | |
1885 ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, | |
1886 "client attempted to request the server name " | |
1887 "different from that one was negotiated"); | |
1888 ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); | |
1889 return NGX_ERROR; | |
1878 } | 1890 } |
1879 } | 1891 } |
1880 | 1892 |
1881 #endif | 1893 #endif |
1882 | 1894 |