<feed xmlns='http://www.w3.org/2005/Atom'>
<title>nginx.git/auto/lib/openssl, branch no-short-read-checks</title>
<subtitle>nginx</subtitle>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/'/>
<entry>
<title>QUIC: using QUIC API introduced in OpenSSL 3.5.</title>
<updated>2025-05-23T11:00:47+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2025-02-13T13:00:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=6a134dfd4888fc3850d22294687cfb3940994c69'/>
<id>6a134dfd4888fc3850d22294687cfb3940994c69</id>
<content type='text'>
Similarly to the QUIC API originated in BoringSSL, this API allows
to register custom TLS callbacks for an external QUIC implementation.
See the SSL_set_quic_tls_cbs manual page for details.

Due to a different approach used in OpenSSL 3.5, handling of CRYPTO
frames was streamlined to always write an incoming CRYPTO buffer to
the crypto context.  Using SSL_provide_quic_data(), this results in
transient allocation of chain links and buffers for CRYPTO frames
received in order.  Testing didn't reveal performance degradation of
QUIC handshakes, https://github.com/nginx/nginx/pull/646 provides
specific results.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Similarly to the QUIC API originated in BoringSSL, this API allows
to register custom TLS callbacks for an external QUIC implementation.
See the SSL_set_quic_tls_cbs manual page for details.

Due to a different approach used in OpenSSL 3.5, handling of CRYPTO
frames was streamlined to always write an incoming CRYPTO buffer to
the crypto context.  Using SSL_provide_quic_data(), this results in
transient allocation of chain links and buffers for CRYPTO frames
received in order.  Testing didn't reveal performance degradation of
QUIC handshakes, https://github.com/nginx/nginx/pull/646 provides
specific results.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: defined SSL API macros in a single place.</title>
<updated>2025-05-23T11:00:47+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2025-05-20T23:54:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=e561f7dbcfc27f5f648e5151de0796e691cbc1b0'/>
<id>e561f7dbcfc27f5f648e5151de0796e691cbc1b0</id>
<content type='text'>
All definitions now set in ngx_event_quic.h, this includes moving
NGX_QUIC_OPENSSL_COMPAT from autotests to compile time.  Further,
to improve code readability, a new NGX_QUIC_QUICTLS_API macro is
used for QuicTLS that provides old BoringSSL QUIC API.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
All definitions now set in ngx_event_quic.h, this includes moving
NGX_QUIC_OPENSSL_COMPAT from autotests to compile time.  Further,
to improve code readability, a new NGX_QUIC_QUICTLS_API macro is
used for QuicTLS that provides old BoringSSL QUIC API.
</pre>
</div>
</content>
</entry>
<entry>
<title>Win32: added detection of ARM64 target.</title>
<updated>2025-04-18T19:57:26+00:00</updated>
<author>
<name>Aleksei Bavshin</name>
<email>a.bavshin@nginx.com</email>
</author>
<published>2025-01-14T19:11:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=020b1db7eb187d4a9a5f1d6154c664a463473b36'/>
<id>020b1db7eb187d4a9a5f1d6154c664a463473b36</id>
<content type='text'>
This extends the target selection implemented in dad6ec3aa63f to support
Windows ARM64 platforms.  OpenSSL support for VC-WIN64-ARM target first
appeared in 1.1.1 and is present in all currently supported (3.x)
branches.

As a side effect, ARM64 Windows builds will get 16-byte alignment along
with the rest of non-x86 platforms.  This is safe, as malloc on 64-bit
Windows guarantees the fundamental alignment of allocations, 16 bytes.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This extends the target selection implemented in dad6ec3aa63f to support
Windows ARM64 platforms.  OpenSSL support for VC-WIN64-ARM target first
appeared in 1.1.1 and is present in all currently supported (3.x)
branches.

As a side effect, ARM64 Windows builds will get 16-byte alignment along
with the rest of non-x86 platforms.  This is safe, as malloc on 64-bit
Windows guarantees the fundamental alignment of allocations, 16 bytes.
</pre>
</div>
</content>
</entry>
<entry>
<title>Configure: added support for Homebrew on Apple Silicon.</title>
<updated>2024-02-26T20:00:43+00:00</updated>
<author>
<name>Piotr Sikora</name>
<email>piotr@aviatrix.com</email>
</author>
<published>2024-02-26T20:00:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=2deded362ee052564e7359d53c81973c16b18e72'/>
<id>2deded362ee052564e7359d53c81973c16b18e72</id>
<content type='text'>
Signed-off-by: Piotr Sikora &lt;piotr@aviatrix.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Piotr Sikora &lt;piotr@aviatrix.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>SSL: avoid using OpenSSL config in build directory (ticket #2404).</title>
<updated>2023-06-20T22:29:53+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2023-06-20T22:29:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=bdea5b703ff6f6fcf98ac8dd4e1e9e5c9ad05017'/>
<id>bdea5b703ff6f6fcf98ac8dd4e1e9e5c9ad05017</id>
<content type='text'>
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx
is asked to build OpenSSL itself.  And with this macro automatic loading
of OpenSSL configuration (from the build directory) is prevented unless
the OPENSSL_CONF environment variable is explicitly set.

Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a
(fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350).
If nginx is used to compile these OpenSSL versions, configuring nginx with
NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx
is asked to build OpenSSL itself.  And with this macro automatic loading
of OpenSSL configuration (from the build directory) is prevented unless
the OPENSSL_CONF environment variable is explicitly set.

Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a
(fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350).
If nginx is used to compile these OpenSSL versions, configuring nginx with
NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
</pre>
</div>
</content>
</entry>
<entry>
<title>Merged with the default branch.</title>
<updated>2023-03-29T07:14:25+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2023-03-29T07:14:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=e8fbc967470b39513248cd961ccccf7a032831ea'/>
<id>e8fbc967470b39513248cd961ccccf7a032831ea</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Win32: OpenSSL compilation for x64 targets with MSVC.</title>
<updated>2023-02-23T15:16:08+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2023-02-23T15:16:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=dad6ec3aa63fbd3b427d74842fa659f7a0b82f3b'/>
<id>dad6ec3aa63fbd3b427d74842fa659f7a0b82f3b</id>
<content type='text'>
To ensure proper target selection the NGX_MACHINE variable is now set
based on the MSVC compiler output, and the OpenSSL target is set based
on it.

This is not important as long as "no-asm" is used (as in misc/GNUmakefile
and win32 build instructions), but might be beneficial if someone is trying
to build OpenSSL with assembler code.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
To ensure proper target selection the NGX_MACHINE variable is now set
based on the MSVC compiler output, and the OpenSSL target is set based
on it.

This is not important as long as "no-asm" is used (as in misc/GNUmakefile
and win32 build instructions), but might be beneficial if someone is trying
to build OpenSSL with assembler code.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: OpenSSL compatibility layer.</title>
<updated>2023-02-22T15:16:53+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-02-22T15:16:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=a36ebf7e95baebf445b0973bd270bc009b0b0e9a'/>
<id>a36ebf7e95baebf445b0973bd270bc009b0b0e9a</id>
<content type='text'>
The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API.

This implementation does not support 0-RTT.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API.

This implementation does not support 0-RTT.
</pre>
</div>
</content>
</entry>
<entry>
<title>Win32: disabled threads support in OpenSSL builds.</title>
<updated>2022-09-06T21:47:31+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2022-09-06T21:47:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=fb0890aee646ec4bb2b5c57f113f5bed433be7cc'/>
<id>fb0890aee646ec4bb2b5c57f113f5bed433be7cc</id>
<content type='text'>
Threads are disabled during UNIX builds (see b329c0ab1a48), and also not
needed for Windows builds.

This used to be the default before OpenSSL 1.1.0.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Threads are disabled during UNIX builds (see b329c0ab1a48), and also not
needed for Windows builds.

This used to be the default before OpenSSL 1.1.0.
</pre>
</div>
</content>
</entry>
<entry>
<title>Merged with the default branch.</title>
<updated>2022-10-20T12:41:36+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2022-10-20T12:41:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=3123fac3e764b4706881ffcb8f8b554c1628c5e0'/>
<id>3123fac3e764b4706881ffcb8f8b554c1628c5e0</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
