Sergey Kandaurov 36be79301e SSL: disabled renegotiation detection in client mode. ...

CVE-2009-3555 is no longer relevant and mitigated by the renegotiation
info extension (secure renegotiation).  On the other hand, unexpected
renegotiation still introduces potential security risks, and hence we do
not allow renegotiation on the server side, as we never request renegotiation.

On the client side the situation is different though.  There are backends
which explicitly request renegotiation, and disabled renegotiation
introduces interoperability problems.  This change allows renegotiation
on the client side, and fixes interoperability problems as observed with
such backends (ticket #872).

Additionally, with TLSv1.3 the SSL_CB_HANDSHAKE_START flag is currently set
by OpenSSL when receiving a NewSessionTicket message, and was detected by
nginx as a renegotiation attempt.  This looks like a bug in OpenSSL, though
this change also allows better interoperability till the problem is fixed.

2017-04-18 16:08:44 +03:00

auto

Set UDP datagram source address (ticket #1239).

2017-04-11 16:41:53 +03:00

conf

Added the REQUEST_SCHEME parameter.

2015-06-05 22:23:26 +03:00

contrib

Contrib: vim syntax, update 3rd party module directives.

2017-03-01 23:41:39 +08:00

docs

nginx-1.11.13-RELEASE

2017-04-04 18:01:57 +03:00

misc

Added HTTP/2 to win32 builds.

2017-03-21 17:28:15 +03:00

src

SSL: disabled renegotiation detection in client mode.

2017-04-18 16:08:44 +03:00

.hgtags

release-1.11.13 tag

2017-04-04 18:01:57 +03:00

Description

An official read-only mirror of http://hg.nginx.org/nginx/ which is updated hourly. Pull requests on GitHub cannot be accepted and will be automatically closed. The proper way to submit changes to nginx is via the nginx development mailing list, see http://nginx.org/en/docs/contributing_changes.html

78 MiB

Languages

C 97.6%

Vim Script 1.8%

XS 0.4%

Perl 0.1%