Hakase/nginx-quic
1
0 Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Latest update - GitHub ecb8093 (1.27.4)

Browse Source
This commit is contained in:
Hakase
2025-02-11 12:20:54 +09:00
parent da24305046
commit 90c231613f
6 changed files with 210 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/xml/nginx/changes.xml
+104
View File
@@ -5,6 +5,110 @@
<change_log title="nginx">
<changes ver="1.27.4" date="2025-02-05">
<change type="security">
<para lang="ru">
недостаточная проверка в обработке виртуальных серверов
при использовании SNI в TLSv1.3 позволяла повторно использовать
SSL-сессию в контексте другого виртуального сервера,
чтобы обойти проверку клиентских SSL-сертификатов (CVE-2025-23419).
</para>
<para lang="en">
insufficient check in virtual servers handling with TLSv1.3 SNI
allowed to reuse SSL sessions in a different virtual server,
to bypass client SSL certificates verification (CVE-2025-23419).
</para>
</change>
<change type="feature">
<para lang="ru">
директивы ssl_object_cache_inheritable, ssl_certificate_cache,
proxy_ssl_certificate_cache, grpc_ssl_certificate_cache
и uwsgi_ssl_certificate_cache.
</para>
<para lang="en">
the "ssl_object_cache_inheritable", "ssl_certificate_cache",
"proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache",
and "uwsgi_ssl_certificate_cache" directives.
</para>
</change>
<change type="feature">
<para lang="ru">
директива keepalive_min_timeout.
</para>
<para lang="en">
the "keepalive_min_timeout" directive.
</para>
</change>
<change type="workaround">
<para lang="ru">
при использовании zlib-ng
в логах появлялись сообщения "gzip filter failed to use preallocated memory".
</para>
<para lang="en">
"gzip filter failed to use preallocated memory" alerts appeared in logs
when using zlib-ng.
</para>
</change>
<change type="bugfix">
<para lang="ru">
nginx не мог собрать библиотеку libatomic из исходных текстов,
если использовался параметр --with-libatomic=DIR.
</para>
<para lang="en">
nginx could not build libatomic library using the library sources
if the --with-libatomic=DIR option was used.
</para>
</change>
<change type="bugfix">
<para lang="ru">
могла происходить ошибка установления соединения
при использовании 0-RTT в QUIC;
ошибка появилась в 1.27.1.
</para>
<para lang="en">
QUIC connection might not be established when using 0-RTT;
the bug had appeared in 1.27.1.
</para>
</change>
<change type="bugfix">
<para lang="ru">
теперь nginx игнорирует пакеты согласования версий QUIC от клиентов.
</para>
<para lang="en">
nginx now ignores QUIC version negotiation packets from clients.
</para>
</change>
<change type="bugfix">
<para lang="ru">
nginx не собирался на Solaris 10 и более ранних
с модулем ngx_http_v3_module.
</para>
<para lang="en">
nginx could not be built on Solaris 10 and earlier
with the ngx_http_v3_module.
</para>
</change>
<change>
<para lang="ru">
Исправления в HTTP/3.
</para>
<para lang="en">
Bugfixes in HTTP/3.
</para>
</change>
</changes>
<changes ver="1.27.3" date="2024-11-26">
<change type="feature">
src/http/ngx_http_core_module.c
+10
View File
@@ -509,6 +509,13 @@ static ngx_command_t ngx_http_core_commands[] = {
0,
NULL },
{ ngx_string("keepalive_min_timeout"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
ngx_conf_set_msec_slot,
NGX_HTTP_LOC_CONF_OFFSET,
offsetof(ngx_http_core_loc_conf_t, keepalive_min_timeout),
NULL },
{ ngx_string("keepalive_requests"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
ngx_conf_set_num_slot,
@@ -3606,6 +3613,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
clcf->keepalive_time = NGX_CONF_UNSET_MSEC;
clcf->keepalive_timeout = NGX_CONF_UNSET_MSEC;
clcf->keepalive_header = NGX_CONF_UNSET;
clcf->keepalive_min_timeout = NGX_CONF_UNSET_MSEC;
clcf->keepalive_requests = NGX_CONF_UNSET_UINT;
clcf->lingering_close = NGX_CONF_UNSET_UINT;
clcf->lingering_time = NGX_CONF_UNSET_MSEC;
@@ -3844,6 +3852,8 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
prev->keepalive_timeout, 75000);
ngx_conf_merge_sec_value(conf->keepalive_header,
prev->keepalive_header, 0);
ngx_conf_merge_msec_value(conf->keepalive_min_timeout,
prev->keepalive_min_timeout, 0);
ngx_conf_merge_uint_value(conf->keepalive_requests,
prev->keepalive_requests, 1000);
ngx_conf_merge_uint_value(conf->lingering_close,
src/http/ngx_http_core_module.h
+1
View File
@@ -370,6 +370,7 @@ struct ngx_http_core_loc_conf_s {
ngx_msec_t send_timeout; /* send_timeout */
ngx_msec_t keepalive_time; /* keepalive_time */
ngx_msec_t keepalive_timeout; /* keepalive_timeout */
ngx_msec_t keepalive_min_timeout; /* keepalive_min_timeout */
ngx_msec_t lingering_time; /* lingering_time */
ngx_msec_t lingering_timeout; /* lingering_timeout */
ngx_msec_t resolver_timeout; /* resolver_timeout */
src/http/ngx_http_request.c
+62 -3
View File
@@ -932,6 +932,31 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
goto done;
}
sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module);
#if (defined TLS1_3_VERSION \
&& !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
/*
* SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
* but servername being negotiated in every TLSv1.3 handshake
* is only returned in OpenSSL 1.1.1+ as well
*/
if (sscf->verify) {
const char *hostname;
hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
c->ssl->handshake_rejected = 1;
*ad = SSL_AD_ACCESS_DENIED;
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
}
#endif
hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
if (hc->ssl_servername == NULL) {
goto error;
@@ -945,8 +970,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
ngx_set_connection_log(c, clcf->error_log);
sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
c->ssl->buffer_size = sscf->buffer_size;
if (sscf->ssl.ctx) {
@@ -2799,6 +2822,13 @@ ngx_http_finalize_connection(ngx_http_request_t *r)
r->lingering_close = 1;
}
if (r->keepalive
&& clcf->keepalive_min_timeout > 0)
{
ngx_http_set_keepalive(r);
return;
}
if (!ngx_terminate
&& !ngx_exiting
&& r->keepalive
@@ -3301,10 +3331,22 @@ ngx_http_set_keepalive(ngx_http_request_t *r)
r->http_state = NGX_HTTP_KEEPALIVE_STATE;
#endif
if (clcf->keepalive_min_timeout == 0) {
c->idle = 1;
ngx_reusable_connection(c, 1);
}
ngx_add_timer(rev, clcf->keepalive_timeout);
if (clcf->keepalive_min_timeout > 0
&& clcf->keepalive_timeout > clcf->keepalive_min_timeout)
{
hc->keepalive_timeout = clcf->keepalive_timeout
- clcf->keepalive_min_timeout;
} else {
hc->keepalive_timeout = 0;
}
ngx_add_timer(rev, clcf->keepalive_timeout - hc->keepalive_timeout);
if (rev->ready) {
ngx_post_event(rev, &ngx_posted_events);
@@ -3319,11 +3361,28 @@ ngx_http_keepalive_handler(ngx_event_t *rev)
ssize_t n;
ngx_buf_t *b;
ngx_connection_t *c;
ngx_http_connection_t *hc;
c = rev->data;
hc = c->data;
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http keepalive handler");
if (!ngx_terminate
&& !ngx_exiting
&& rev->timedout
&& hc->keepalive_timeout > 0)
{
c->idle = 1;
ngx_reusable_connection(c, 1);
ngx_add_timer(rev, hc->keepalive_timeout);
hc->keepalive_timeout = 0;
rev->timedout = 0;
return;
}
if (rev->timedout || c->close) {
ngx_http_close_connection(c);
return;
src/http/ngx_http_request.h
+2
View File
@@ -329,6 +329,8 @@ typedef struct {
ngx_chain_t *free;
ngx_msec_t keepalive_timeout;
unsigned ssl:1;
unsigned proxy_protocol:1;
} ngx_http_connection_t;
src/stream/ngx_stream_ssl_module.c
+25 -2
View File
@@ -589,12 +589,35 @@ ngx_stream_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
goto done;
}
sscf = ngx_stream_get_module_srv_conf(cscf->ctx, ngx_stream_ssl_module);
#if (defined TLS1_3_VERSION \
&& !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
/*
* SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
* but servername being negotiated in every TLSv1.3 handshake
* is only returned in OpenSSL 1.1.1+ as well
*/
if (sscf->verify) {
const char *hostname;
hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
c->ssl->handshake_rejected = 1;
*ad = SSL_AD_ACCESS_DENIED;
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
}
#endif
s->srv_conf = cscf->ctx->srv_conf;
ngx_set_connection_log(c, cscf->error_log);
sscf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
if (sscf->ssl.ctx) {
if (SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx) == NULL) {
goto error;