Welcome! Log In Create A New Profile

Advanced

Re: SSL: reject unsupported protocols "negotiated" during handshake

Piotr Sikora
April 03, 2013 06:18PM
Hey Maxim,

> Do we care? I think it's ok to assume HTTP by default, even if a
> client sent something different from what we've advertised.

I'm not sure about you, but I do. I don't see a point in trying to
process something that is known to fail down the line... Especially,
if it produces noise in the logs.

Right now, forced SPDY/3 request is logged like that:

access.log:
127.0.0.1 - - [03/Apr/2013:14:05:10 -0700]
"\x80\x03\x00\x01\x01\x00\x00\xDB\x00\x00\x00\x01\x00\x00\x00\x00`\x0080\xE3\xC6\xA7\xC2\x00\xC1\x00>\xFF\x00\x00\x00\x08\x00\x00\x00\x05:host\x00\x00\x00\x10example.net:7070\x00\x00\x00\x07:method\x00\x00\x00\x03GET\x00\x00\x00\x05:path\x00\x00\x00\x01/\x00\x00\x00\x07:scheme\x00\x00\x00\x05https\x00\x00\x00\x08:version\x00\x00\x00\x08HTTP/1.1\x00\x00\x00\x06accept\x00\x00\x00\x03*/*\x00\x00\x00\x0Faccept-encoding\x00\x00\x00"
400 189 "-" "-"

error.log:
2013/04/03 14:05:10 [info] 54833#0: *4 client sent invalid method
while reading client request line, client: 127.0.0.1, server: _,
request: "?`80??>:hostexample.net:7070:methodGET:path/:schemehttp:versioHTTP/1.1accept*/*accept-encoding"

vs patched:

error.log:
2013/04/03 14:08:59 [error] 55828#0: *1 client negotiated unsupported
protocol "spdy/3" while SSL handshaking, client: 127.0.0.1, server:
0.0.0.0:7070

Best regards,
Piotr Sikora

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

SSL: reject unsupported protocols "negotiated" during handshake

Piotr Sikora 1133 April 02, 2013 09:08PM

Re: SSL: reject unsupported protocols "negotiated" during handshake

Maxim Dounin 445 April 03, 2013 07:04AM

Re: SSL: reject unsupported protocols "negotiated" during handshake

Piotr Sikora 476 April 03, 2013 06:18PM

Re: SSL: reject unsupported protocols "negotiated" during handshake

Maxim Dounin 785 April 04, 2013 10:42AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 187
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready