Latest update - 9213 (nginx 1.25.4)

.hgtags

@@ -476,3 +476,4 @@ ac779115ed6ee4f3039e9aea414a54e560450ee2 release-1.23.4
 f8134640e8615448205785cf00b0bc810489b495 release-1.25.1
 1d839f05409d1a50d0f15a2bf36547001f99ae40 release-1.25.2
 294a3d07234f8f65d7b0e0b0e2c5b05c12c5da0a release-1.25.3
+173a0a7dbce569adbb70257c6ec4f0f6bc585009 release-1.25.4

docs/xml/nginx/changes.xml

@@ -5,6 +5,82 @@
 <change_log title="nginx">
 
 
+<changes ver="1.25.4" date="2024-02-14">
+
+<change type="security">
+<para lang="ru">
+при использовании HTTP/3 в рабочем процессе мог произойти segmentation fault
+во время обработки специально созданной QUIC-сессии
+(CVE-2024-24989, CVE-2024-24990).
+</para>
+<para lang="en">
+when using HTTP/3 a segmentation fault might occur in a worker process
+while processing a specially crafted QUIC session
+(CVE-2024-24989, CVE-2024-24990).
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+соединения с незавершенными AIO-операциями могли закрываться преждевременно
+во время плавного завершения старых рабочих процессов.
+</para>
+<para lang="en">
+connections with pending AIO operations might be closed prematurely
+during graceful shutdown of old worker processes.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+теперь nginx не пишет в лог сообщения об утечке сокетов,
+если во время плавного завершения старых рабочих процессов
+было запрошено быстрое завершение.
+</para>
+<para lang="en">
+socket leak alerts no longer logged when fast shutdown
+was requested after graceful shutdown of old worker processes.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+при использовании AIO в подзапросе могла происходить
+ошибка на сокете, утечка сокетов,
+либо segmentation fault в рабочем процессе (при SSL-проксировании).
+</para>
+<para lang="en">
+a socket descriptor error, a socket leak,
+or a segmentation fault in a worker process (for SSL proxying)
+might occur if AIO was used in a subrequest.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+в рабочем процессе мог произойти segmentation fault,
+если использовалось SSL-проксирование и директива image_filter,
+а ошибки с кодом 415 перенаправлялись с помощью директивы error_page.
+</para>
+<para lang="en">
+a segmentation fault might occur in a worker process
+if SSL proxying was used along with the "image_filter" directive
+and errors with code 415 were redirected with the "error_page" directive.
+</para>
+</change>
+
+<change>
+<para lang="ru">
+Исправления и улучшения в HTTP/3.
+</para>
+<para lang="en">
+Bugfixes and improvements in HTTP/3.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.25.3" date="2023-10-24">
 
 <change type="change">

misc/GNUmakefile

@@ -6,8 +6,8 @@ TEMP =		tmp
 
 CC =		cl
 OBJS =		objs.msvc8
-OPENSSL =	openssl-3.0.11
+OPENSSL =	openssl-3.0.13
-ZLIB =		zlib-1.3
+ZLIB =		zlib-1.3.1
 PCRE =		pcre2-10.39
 
 

src/event/quic/ngx_event_quic_migration.c

@@ -909,6 +909,7 @@ static ngx_int_t
 ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
 {
     size_t                  mtu;
+    uint64_t                pnum;
     ngx_int_t               rc;
     ngx_uint_t              log_error;
     ngx_quic_frame_t       *frame;
@@ -925,7 +926,7 @@ ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
 
     qc = ngx_quic_get_connection(c);
     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);
-    path->mtu_pnum[path->tries] = ctx->pnum;
+    pnum = ctx->pnum;
 
     ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
                    "quic path seq:%uL send probe "
@@ -943,14 +944,18 @@ ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
     path->mtu = mtu;
     c->log_error = log_error;
 
+    if (rc == NGX_OK) {
+        path->mtu_pnum[path->tries] = pnum;
+        return NGX_OK;
+    }
+
+    ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
+                   "quic path seq:%uL rejected mtu:%uz",
+                   path->seqnum, path->mtud);
+
     if (rc == NGX_ERROR) {
         if (c->write->error) {
             c->write->error = 0;
-
-            ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
-                           "quic path seq:%uL rejected mtu:%uz",
-                           path->seqnum, path->mtud);
-
             return NGX_DECLINED;
         }
 
@@ -976,7 +981,7 @@ ngx_quic_handle_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path,
         pnum = path->mtu_pnum[i];
 
         if (pnum == NGX_QUIC_UNSET_PN) {
-            break;
+            continue;
         }
 
         if (pnum < min || pnum > max) {

src/event/quic/ngx_event_quic_protection.c

@@ -1144,8 +1144,19 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, uint64_t *largest_pn)
         key_phase = (pkt->flags & NGX_QUIC_PKT_KPHASE) != 0;
 
         if (key_phase != pkt->key_phase) {
-            secret = &pkt->keys->next_key.client;
+            if (pkt->keys->next_key.client.ctx != NULL) {
-            pkt->key_update = 1;
+                secret = &pkt->keys->next_key.client;
+                pkt->key_update = 1;
+
+            } else {
+                /*
+                 * RFC 9001,  6.3. Timing of Receive Key Generation.
+                 *
+                 * Trial decryption to avoid timing side-channel.
+                 */
+                ngx_log_debug0(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
+                               "quic next key missing");
+            }
         }
     }
 

src/event/quic/ngx_event_quic_streams.c

@@ -1097,6 +1097,7 @@ ngx_quic_stream_cleanup_handler(void *data)
                    "quic stream id:0x%xL cleanup", qs->id);
 
     if (ngx_quic_shutdown_stream(c, NGX_RDWR_SHUTDOWN) != NGX_OK) {
+        qs->connection = NULL;
         goto failed;
     }