<feed xmlns='http://www.w3.org/2005/Atom'>
<title>nginx.git/src, branch release-1.25.0</title>
<subtitle>nginx</subtitle>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/'/>
<entry>
<title>QUIC: fixed OpenSSL compat layer with OpenSSL master branch.</title>
<updated>2023-05-22T20:45:18+00:00</updated>
<author>
<name>Sergey Kandaurov</name>
<email>pluknet@nginx.com</email>
</author>
<published>2023-05-22T20:45:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=05990c6bb0c11710c10639e7332726446a643a8c'/>
<id>05990c6bb0c11710c10639e7332726446a643a8c</id>
<content type='text'>
The layer is enabled as a fallback if the QUIC support is configured and the
BoringSSL API wasn't detected, or when using the --with-openssl option, also
compatible with QuicTLS and LibreSSL.  For the latter, the layer is assumed
to be present if QUIC was requested, so it needs to be undefined to prevent
QUIC API redefinition as appropriate.

A previously used approach to test the TLSEXT_TYPE_quic_transport_parameters
macro doesn't work with OpenSSL 3.2 master branch where this macro appeared
with incompatible QUIC API.  To fix the build there, the test is revised to
pass only for QuicTLS and LibreSSL.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The layer is enabled as a fallback if the QUIC support is configured and the
BoringSSL API wasn't detected, or when using the --with-openssl option, also
compatible with QuicTLS and LibreSSL.  For the latter, the layer is assumed
to be present if QUIC was requested, so it needs to be undefined to prevent
QUIC API redefinition as appropriate.

A previously used approach to test the TLSEXT_TYPE_quic_transport_parameters
macro doesn't work with OpenSSL 3.2 master branch where this macro appeared
with incompatible QUIC API.  To fix the build there, the test is revised to
pass only for QuicTLS and LibreSSL.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: fixed post-close use-after-free.</title>
<updated>2023-05-22T11:59:42+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-22T11:59:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=5ac9da4577d59f88032fcfde31b0b6a9ea9a88bd'/>
<id>5ac9da4577d59f88032fcfde31b0b6a9ea9a88bd</id>
<content type='text'>
Previously, ngx_quic_close_connection() could be called in a way that QUIC
connection was accessed after the call.  In most cases the connection is not
closed right away, but close timeout is scheduled.  However, it's not always
the case.  Also, if the close process started earlier for a different reason,
calling ngx_quic_close_connection() may actually close the connection.  The
connection object should not be accessed after that.

Now, when possible, return statement is added to eliminate post-close connection
object access.  In other places ngx_quic_close_connection() is substituted with
posting close event.

Also, the new way of closing connection in ngx_quic_stream_cleanup_handler()
fixes another problem in this function.  Previously it passed stream connection
instead of QUIC connection to ngx_quic_close_connection().  This could result
in incomplete connection shutdown.  One consequence of that could be that QUIC
streams were freed without shutting down their application contexts.  This could
result in another use-after-free.

Found by Coverity (CID 1530402).
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, ngx_quic_close_connection() could be called in a way that QUIC
connection was accessed after the call.  In most cases the connection is not
closed right away, but close timeout is scheduled.  However, it's not always
the case.  Also, if the close process started earlier for a different reason,
calling ngx_quic_close_connection() may actually close the connection.  The
connection object should not be accessed after that.

Now, when possible, return statement is added to eliminate post-close connection
object access.  In other places ngx_quic_close_connection() is substituted with
posting close event.

Also, the new way of closing connection in ngx_quic_stream_cleanup_handler()
fixes another problem in this function.  Previously it passed stream connection
instead of QUIC connection to ngx_quic_close_connection().  This could result
in incomplete connection shutdown.  One consequence of that could be that QUIC
streams were freed without shutting down their application contexts.  This could
result in another use-after-free.

Found by Coverity (CID 1530402).
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: better sockaddr initialization.</title>
<updated>2023-05-21T01:38:45+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2023-05-21T01:38:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=0400e3d5cea76e4b99cb7ff593404286c463cc82'/>
<id>0400e3d5cea76e4b99cb7ff593404286c463cc82</id>
<content type='text'>
The qsock-&gt;sockaddr field is a ngx_sockaddr_t union, and therefore can hold
any sockaddr (and union members, such qsock-&gt;sockaddr.sockaddr, can be used
to access appropriate variant of the sockaddr).  It is better to set it via
qsock-&gt;sockaddr itself though, and not qsock-&gt;sockaddr.sockaddr, so static
analyzers won't complain about out-of-bounds access.

Prodded by Coverity (CID 1530403).
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The qsock-&gt;sockaddr field is a ngx_sockaddr_t union, and therefore can hold
any sockaddr (and union members, such qsock-&gt;sockaddr.sockaddr, can be used
to access appropriate variant of the sockaddr).  It is better to set it via
qsock-&gt;sockaddr itself though, and not qsock-&gt;sockaddr.sockaddr, so static
analyzers won't complain about out-of-bounds access.

Prodded by Coverity (CID 1530403).
</pre>
</div>
</content>
</entry>
<entry>
<title>Merged with the quic branch.</title>
<updated>2023-05-19T17:46:36+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-19T17:46:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=4b0266174814e6cf60a275321121dbaab084ee64'/>
<id>4b0266174814e6cf60a275321121dbaab084ee64</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>HTTP/3: removed server push support.</title>
<updated>2023-05-12T06:02:10+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-12T06:02:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=e4edf78bac950213e00bb97ac46ece807f3cc073'/>
<id>e4edf78bac950213e00bb97ac46ece807f3cc073</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Common tree insert function for QUIC and UDP connections.</title>
<updated>2023-05-14T08:30:11+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-14T08:30:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=0a3c79614521d7612b63eff4e09c25ed219fb65b'/>
<id>0a3c79614521d7612b63eff4e09c25ed219fb65b</id>
<content type='text'>
Previously, ngx_udp_rbtree_insert_value() was used for plain UDP and
ngx_quic_rbtree_insert_value() was used for QUIC.  Because of this it was
impossible to initialize connection tree in ngx_create_listening() since
this function is not aware what kind of listening it creates.

Now ngx_udp_rbtree_insert_value() is used for both QUIC and UDP.  To make
is possible, a generic key field is added to ngx_udp_connection_t.  It keeps
client address for UDP and connection ID for QUIC.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, ngx_udp_rbtree_insert_value() was used for plain UDP and
ngx_quic_rbtree_insert_value() was used for QUIC.  Because of this it was
impossible to initialize connection tree in ngx_create_listening() since
this function is not aware what kind of listening it creates.

Now ngx_udp_rbtree_insert_value() is used for both QUIC and UDP.  To make
is possible, a generic key field is added to ngx_udp_connection_t.  It keeps
client address for UDP and connection ID for QUIC.
</pre>
</div>
</content>
</entry>
<entry>
<title>Stream: removed QUIC support.</title>
<updated>2023-05-14T08:05:35+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-14T08:05:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=779bfcff5f7544494c7c85ac73f41a033e749528'/>
<id>779bfcff5f7544494c7c85ac73f41a033e749528</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: style.</title>
<updated>2023-05-11T15:48:01+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2023-05-11T15:48:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=089d1f653001419ea9d0b463434a89007ec805bd'/>
<id>089d1f653001419ea9d0b463434a89007ec805bd</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>HTTP/3: removed "http3" parameter of "listen" directive.</title>
<updated>2023-05-11T09:22:10+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-11T09:22:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=2ce3eeeeb76318e414b62d399da70872d2de23d8'/>
<id>2ce3eeeeb76318e414b62d399da70872d2de23d8</id>
<content type='text'>
The parameter has been deprecated since c851a2ed5ce8.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The parameter has been deprecated since c851a2ed5ce8.
</pre>
</div>
</content>
</entry>
<entry>
<title>QUIC: removed "quic_mtu" directive.</title>
<updated>2023-05-11T06:37:51+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2023-05-11T06:37:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=6cc803e713698b4b09ab46ccd7ae986faa55c386'/>
<id>6cc803e713698b4b09ab46ccd7ae986faa55c386</id>
<content type='text'>
The directive used to set the value of the "max_udp_payload_size" transport
parameter.  According to RFC 9000, Section 18.2, the value specifies the size
of buffer for reading incoming datagrams:

    This limit does act as an additional constraint on datagram size in
    the same way as the path MTU, but it is a property of the endpoint
    and not the path; see Section 14. It is expected that this is the
    space an endpoint dedicates to holding incoming packets.

Current QUIC implementation uses the maximum possible buffer size (65527) for
reading datagrams.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The directive used to set the value of the "max_udp_payload_size" transport
parameter.  According to RFC 9000, Section 18.2, the value specifies the size
of buffer for reading incoming datagrams:

    This limit does act as an additional constraint on datagram size in
    the same way as the path MTU, but it is a property of the endpoint
    and not the path; see Section 14. It is expected that this is the
    space an endpoint dedicates to holding incoming packets.

Current QUIC implementation uses the maximum possible buffer size (65527) for
reading datagrams.
</pre>
</div>
</content>
</entry>
</feed>
