mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-31 18:46:15 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

SSL: only select SPDY using NPN if "spdy" is enabled.

Browse Source 
OpenSSL doesn't check if the negotiated protocol has been announced.
As a result, the client might force using SPDY even if it wasn't
enabled in configuration.
This commit is contained in:
Valentin Bartenev 2015-11-05 15:01:09 +03:00
parent d4cd59c17b
commit 43e9607fdf
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/http/ngx_http_request.c
View File

@ -770,24 +770,32 @@ ngx_http_ssl_handshake_handler(ngx_connection_t *c)
{ {
unsigned int len; unsigned int len;
const unsigned char *data; const unsigned char *data;
ngx_http_connection_t *hc;
static const ngx_str_t spdy = ngx_string(NGX_SPDY_NPN_NEGOTIATED); static const ngx_str_t spdy = ngx_string(NGX_SPDY_NPN_NEGOTIATED);
hc = c->data;
if (hc->addr_conf->spdy) {
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
SSL_get0_alpn_selected(c->ssl->connection, &data, &len); SSL_get0_alpn_selected(c->ssl->connection, &data, &len);
#ifdef TLSEXT_TYPE_next_proto_neg #ifdef TLSEXT_TYPE_next_proto_neg
if (len == 0) { if (len == 0) {
SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len); SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
} }
#endif #endif
#else /* TLSEXT_TYPE_next_proto_neg */ #else /* TLSEXT_TYPE_next_proto_neg */
SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len); SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
#endif #endif
if (len == spdy.len && ngx_strncmp(data, spdy.data, spdy.len) == 0) { if (len == spdy.len
ngx_http_spdy_init(c->read); && ngx_strncmp(data, spdy.data, spdy.len) == 0)
return; {
ngx_http_spdy_init(c->read);
return;
}
} }
} }
#endif #endif