diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml index b469617..b55177d 100644 --- a/docs/xml/nginx/changes.xml +++ b/docs/xml/nginx/changes.xml @@ -5,6 +5,110 @@ + + + + +недостаточная проверка в обработке виртуальных серверов +при использовании SNI в TLSv1.3 позволяла повторно использовать +SSL-сессию в контексте другого виртуального сервера, +чтобы обойти проверку клиентских SSL-сертификатов (CVE-2025-23419). + + +insufficient check in virtual servers handling with TLSv1.3 SNI +allowed to reuse SSL sessions in a different virtual server, +to bypass client SSL certificates verification (CVE-2025-23419). + + + + + +директивы ssl_object_cache_inheritable, ssl_certificate_cache, +proxy_ssl_certificate_cache, grpc_ssl_certificate_cache +и uwsgi_ssl_certificate_cache. + + +the "ssl_object_cache_inheritable", "ssl_certificate_cache", +"proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache", +and "uwsgi_ssl_certificate_cache" directives. + + + + + +директива keepalive_min_timeout. + + +the "keepalive_min_timeout" directive. + + + + + +при использовании zlib-ng +в логах появлялись сообщения "gzip filter failed to use preallocated memory". + + +"gzip filter failed to use preallocated memory" alerts appeared in logs +when using zlib-ng. + + + + + +nginx не мог собрать библиотеку libatomic из исходных текстов, +если использовался параметр --with-libatomic=DIR. + + +nginx could not build libatomic library using the library sources +if the --with-libatomic=DIR option was used. + + + + + +могла происходить ошибка установления соединения +при использовании 0-RTT в QUIC; +ошибка появилась в 1.27.1. + + +QUIC connection might not be established when using 0-RTT; +the bug had appeared in 1.27.1. + + + + + +теперь nginx игнорирует пакеты согласования версий QUIC от клиентов. + + +nginx now ignores QUIC version negotiation packets from clients. + + + + + +nginx не собирался на Solaris 10 и более ранних +с модулем ngx_http_v3_module. + + +nginx could not be built on Solaris 10 and earlier +with the ngx_http_v3_module. + + + + + +Исправления в HTTP/3. + + +Bugfixes in HTTP/3. + + + + + + diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index 033a3bf..a1540c0 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -509,6 +509,13 @@ static ngx_command_t ngx_http_core_commands[] = { 0, NULL }, + { ngx_string("keepalive_min_timeout"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, + ngx_conf_set_msec_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_core_loc_conf_t, keepalive_min_timeout), + NULL }, + { ngx_string("keepalive_requests"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, ngx_conf_set_num_slot, @@ -3606,6 +3613,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf) clcf->keepalive_time = NGX_CONF_UNSET_MSEC; clcf->keepalive_timeout = NGX_CONF_UNSET_MSEC; clcf->keepalive_header = NGX_CONF_UNSET; + clcf->keepalive_min_timeout = NGX_CONF_UNSET_MSEC; clcf->keepalive_requests = NGX_CONF_UNSET_UINT; clcf->lingering_close = NGX_CONF_UNSET_UINT; clcf->lingering_time = NGX_CONF_UNSET_MSEC; @@ -3844,6 +3852,8 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) prev->keepalive_timeout, 75000); ngx_conf_merge_sec_value(conf->keepalive_header, prev->keepalive_header, 0); + ngx_conf_merge_msec_value(conf->keepalive_min_timeout, + prev->keepalive_min_timeout, 0); ngx_conf_merge_uint_value(conf->keepalive_requests, prev->keepalive_requests, 1000); ngx_conf_merge_uint_value(conf->lingering_close, diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h index 765e7ff..e7e266b 100644 --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -370,6 +370,7 @@ struct ngx_http_core_loc_conf_s { ngx_msec_t send_timeout; /* send_timeout */ ngx_msec_t keepalive_time; /* keepalive_time */ ngx_msec_t keepalive_timeout; /* keepalive_timeout */ + ngx_msec_t keepalive_min_timeout; /* keepalive_min_timeout */ ngx_msec_t lingering_time; /* lingering_time */ ngx_msec_t lingering_timeout; /* lingering_timeout */ ngx_msec_t resolver_timeout; /* resolver_timeout */ diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index f44c9e7..ceac8d3 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -932,6 +932,31 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) goto done; } + sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module); + +#if (defined TLS1_3_VERSION \ + && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL) + + /* + * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+, + * but servername being negotiated in every TLSv1.3 handshake + * is only returned in OpenSSL 1.1.1+ as well + */ + + if (sscf->verify) { + const char *hostname; + + hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn)); + + if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) { + c->ssl->handshake_rejected = 1; + *ad = SSL_AD_ACCESS_DENIED; + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + } + +#endif + hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t)); if (hc->ssl_servername == NULL) { goto error; @@ -945,8 +970,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) ngx_set_connection_log(c, clcf->error_log); - sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module); - c->ssl->buffer_size = sscf->buffer_size; if (sscf->ssl.ctx) { @@ -2799,6 +2822,13 @@ ngx_http_finalize_connection(ngx_http_request_t *r) r->lingering_close = 1; } + if (r->keepalive + && clcf->keepalive_min_timeout > 0) + { + ngx_http_set_keepalive(r); + return; + } + if (!ngx_terminate && !ngx_exiting && r->keepalive @@ -3301,10 +3331,22 @@ ngx_http_set_keepalive(ngx_http_request_t *r) r->http_state = NGX_HTTP_KEEPALIVE_STATE; #endif - c->idle = 1; - ngx_reusable_connection(c, 1); + if (clcf->keepalive_min_timeout == 0) { + c->idle = 1; + ngx_reusable_connection(c, 1); + } - ngx_add_timer(rev, clcf->keepalive_timeout); + if (clcf->keepalive_min_timeout > 0 + && clcf->keepalive_timeout > clcf->keepalive_min_timeout) + { + hc->keepalive_timeout = clcf->keepalive_timeout + - clcf->keepalive_min_timeout; + + } else { + hc->keepalive_timeout = 0; + } + + ngx_add_timer(rev, clcf->keepalive_timeout - hc->keepalive_timeout); if (rev->ready) { ngx_post_event(rev, &ngx_posted_events); @@ -3315,15 +3357,32 @@ ngx_http_set_keepalive(ngx_http_request_t *r) static void ngx_http_keepalive_handler(ngx_event_t *rev) { - size_t size; - ssize_t n; - ngx_buf_t *b; - ngx_connection_t *c; + size_t size; + ssize_t n; + ngx_buf_t *b; + ngx_connection_t *c; + ngx_http_connection_t *hc; c = rev->data; + hc = c->data; ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http keepalive handler"); + if (!ngx_terminate + && !ngx_exiting + && rev->timedout + && hc->keepalive_timeout > 0) + { + c->idle = 1; + ngx_reusable_connection(c, 1); + + ngx_add_timer(rev, hc->keepalive_timeout); + + hc->keepalive_timeout = 0; + rev->timedout = 0; + return; + } + if (rev->timedout || c->close) { ngx_http_close_connection(c); return; diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h index 65c8333..9407f46 100644 --- a/src/http/ngx_http_request.h +++ b/src/http/ngx_http_request.h @@ -329,6 +329,8 @@ typedef struct { ngx_chain_t *free; + ngx_msec_t keepalive_timeout; + unsigned ssl:1; unsigned proxy_protocol:1; } ngx_http_connection_t; diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c index 74d1e77..f732712 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c @@ -589,12 +589,35 @@ ngx_stream_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg) goto done; } + sscf = ngx_stream_get_module_srv_conf(cscf->ctx, ngx_stream_ssl_module); + +#if (defined TLS1_3_VERSION \ + && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL) + + /* + * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+, + * but servername being negotiated in every TLSv1.3 handshake + * is only returned in OpenSSL 1.1.1+ as well + */ + + if (sscf->verify) { + const char *hostname; + + hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn)); + + if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) { + c->ssl->handshake_rejected = 1; + *ad = SSL_AD_ACCESS_DENIED; + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + } + +#endif + s->srv_conf = cscf->ctx->srv_conf; ngx_set_connection_log(c, cscf->error_log); - sscf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module); - if (sscf->ssl.ctx) { if (SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx) == NULL) { goto error;