<feed xmlns='http://www.w3.org/2005/Atom'>
<title>nginx.git/auto/lib/openssl/conf, branch tunnel</title>
<subtitle>nginx</subtitle>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/'/>
<entry>
<title>QUIC: using QUIC API introduced in OpenSSL 3.5.</title>
<updated>2025-05-23T11:00:47+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2025-02-13T13:00:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=6a134dfd4888fc3850d22294687cfb3940994c69'/>
<id>6a134dfd4888fc3850d22294687cfb3940994c69</id>
<content type='text'>
Similarly to the QUIC API originated in BoringSSL, this API allows
to register custom TLS callbacks for an external QUIC implementation.
See the SSL_set_quic_tls_cbs manual page for details.

Due to a different approach used in OpenSSL 3.5, handling of CRYPTO
frames was streamlined to always write an incoming CRYPTO buffer to
the crypto context.  Using SSL_provide_quic_data(), this results in
transient allocation of chain links and buffers for CRYPTO frames
received in order.  Testing didn't reveal performance degradation of
QUIC handshakes, https://github.com/nginx/nginx/pull/646 provides
specific results.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Similarly to the QUIC API originated in BoringSSL, this API allows
to register custom TLS callbacks for an external QUIC implementation.
See the SSL_set_quic_tls_cbs manual page for details.

Due to a different approach used in OpenSSL 3.5, handling of CRYPTO
frames was streamlined to always write an incoming CRYPTO buffer to
the crypto context.  Using SSL_provide_quic_data(), this results in
transient allocation of chain links and buffers for CRYPTO frames
received in order.  Testing didn't reveal performance degradation of
QUIC handshakes, https://github.com/nginx/nginx/pull/646 provides
specific results.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: defined SSL API macros in a single place.</title>
<updated>2025-05-23T11:00:47+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2025-05-20T23:54:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=e561f7dbcfc27f5f648e5151de0796e691cbc1b0'/>
<id>e561f7dbcfc27f5f648e5151de0796e691cbc1b0</id>
<content type='text'>
All definitions now set in ngx_event_quic.h, this includes moving
NGX_QUIC_OPENSSL_COMPAT from autotests to compile time.  Further,
to improve code readability, a new NGX_QUIC_QUICTLS_API macro is
used for QuicTLS that provides old BoringSSL QUIC API.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
All definitions now set in ngx_event_quic.h, this includes moving
NGX_QUIC_OPENSSL_COMPAT from autotests to compile time.  Further,
to improve code readability, a new NGX_QUIC_QUICTLS_API macro is
used for QuicTLS that provides old BoringSSL QUIC API.
</pre>
</div>
</content>
</entry>
<entry>
<title>Configure: added support for Homebrew on Apple Silicon.</title>
<updated>2024-02-26T20:00:43+00:00</updated>
<author>
<name>Piotr Sikora</name>
<email>piotr@aviatrix.com</email>
</author>
<published>2024-02-26T20:00:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=2deded362ee052564e7359d53c81973c16b18e72'/>
<id>2deded362ee052564e7359d53c81973c16b18e72</id>
<content type='text'>
Signed-off-by: Piotr Sikora &lt;piotr@aviatrix.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Piotr Sikora &lt;piotr@aviatrix.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>SSL: avoid using OpenSSL config in build directory (ticket #2404).</title>
<updated>2023-06-20T22:29:53+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2023-06-20T22:29:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=bdea5b703ff6f6fcf98ac8dd4e1e9e5c9ad05017'/>
<id>bdea5b703ff6f6fcf98ac8dd4e1e9e5c9ad05017</id>
<content type='text'>
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx
is asked to build OpenSSL itself.  And with this macro automatic loading
of OpenSSL configuration (from the build directory) is prevented unless
the OPENSSL_CONF environment variable is explicitly set.

Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a
(fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350).
If nginx is used to compile these OpenSSL versions, configuring nginx with
NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx
is asked to build OpenSSL itself.  And with this macro automatic loading
of OpenSSL configuration (from the build directory) is prevented unless
the OPENSSL_CONF environment variable is explicitly set.

Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a
(fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350).
If nginx is used to compile these OpenSSL versions, configuring nginx with
NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: OpenSSL compatibility layer.</title>
<updated>2023-02-22T15:16:53+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-02-22T15:16:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=a36ebf7e95baebf445b0973bd270bc009b0b0e9a'/>
<id>a36ebf7e95baebf445b0973bd270bc009b0b0e9a</id>
<content type='text'>
The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API.

This implementation does not support 0-RTT.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API.

This implementation does not support 0-RTT.
</pre>
</div>
</content>
</entry>
<entry>
<title>Configure: fixed QUIC support test.</title>
<updated>2021-09-27T07:10:38+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2021-09-27T07:10:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=f2859767d4218e60f8ac3adbac6123c8a1f68279'/>
<id>f2859767d4218e60f8ac3adbac6123c8a1f68279</id>
<content type='text'>
OpenSSL library QUIC support cannot be tested at configure time when
using the --with-openssl option so assume it's present if requested.
While here, fixed the error message in case QUIC support is missing.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
OpenSSL library QUIC support cannot be tested at configure time when
using the --with-openssl option so assume it's present if requested.
While here, fixed the error message in case QUIC support is missing.
</pre>
</div>
</content>
</entry>
<entry>
<title>Configure: check for QUIC 0-RTT support at compile time.</title>
<updated>2021-09-27T07:10:37+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2021-09-27T07:10:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=8ce1c2c7e9abc90a63ad74df5ad4cc7c37b24c87'/>
<id>8ce1c2c7e9abc90a63ad74df5ad4cc7c37b24c87</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Configure: simplified condition.</title>
<updated>2021-09-21T11:46:17+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2021-09-21T11:46:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=3321ca0c833c88ef4870f3abb8870beb622e2171'/>
<id>3321ca0c833c88ef4870f3abb8870beb622e2171</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Removed NGX_OPENSSL_QUIC macro, NGX_QUIC is enough.</title>
<updated>2021-09-14T09:09:13+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2021-09-14T09:09:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=bd89c448b7e7beb15409e2abe2f174a36a7a0823'/>
<id>bd89c448b7e7beb15409e2abe2f174a36a7a0823</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Changed the OpenSSL QUIC support detection.</title>
<updated>2021-09-09T12:34:00+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2021-09-09T12:34:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=7a45071cb6a460c999a3ad5f978f8cfd5d792cdb'/>
<id>7a45071cb6a460c999a3ad5f978f8cfd5d792cdb</id>
<content type='text'>
As was changed in 253cf267f95a.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
As was changed in 253cf267f95a.
</pre>
</div>
</content>
</entry>
</feed>
