summaryrefslogtreecommitdiffhomepage
path: root/src/event (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2023-09-13QUIC: "handshake_timeout" configuration parameter.Roman Arutyunyan4-2/+13
Previously QUIC did not have such parameter and handshake duration was controlled by HTTP/3. However that required creating and storing HTTP/3 session on first client datagram. Apparently there's no convenient way to store the session object until QUIC handshake is complete. In the followup patches session creation will be postponed to init() callback.
2023-09-01QUIC: removed use of SSL_quic_read_level and SSL_quic_write_level.Sergey Kandaurov4-51/+8
As explained in BoringSSL change[1], levels were introduced in the original QUIC API to draw a line between when keys are released and when are active. In the new QUIC API they are released in separate calls when it's needed. BoringSSL has then a consideration to remove levels API, hence the change. If not available e.g. from a QUIC packet header, levels can be taken based on keys availability. The only real use of levels is to prevent using app keys before they are active in QuicTLS that provides the old BoringSSL QUIC API, it is replaced with an equivalent check of c->ssl->handshaked. This change also removes OpenSSL compat shims since they are no longer used. The only exception left is caching write level from the keylog callback in the internal field which is a handy equivalent of checking keys availability. [1] https://boringssl.googlesource.com/boringssl/+/1e859054
2023-09-01QUIC: refined sending CONNECTION_CLOSE in various packet types.Sergey Kandaurov1-11/+10
As per RFC 9000, section 10.2.3, to ensure that peer successfully removed packet protection, CONNECTION_CLOSE can be sent in multiple packets using different packet protection levels. Now it is sent in all protection levels available. This roughly corresponds to the following paragraph: * Prior to confirming the handshake, a peer might be unable to process 1-RTT packets, so an endpoint SHOULD send a CONNECTION_CLOSE frame in both Handshake and 1-RTT packets. A server SHOULD also send a CONNECTION_CLOSE frame in an Initial packet. In practice, this change allows to avoid sending an Initial packet when we know the client has handshake keys, by checking if we have discarded initial keys. Also, this fixes sending CONNECTION_CLOSE when using QuicTLS with old QUIC API, where TLS stack releases application read keys before handshake confirmation; it is fixed by sending CONNECTION_CLOSE additionally in a Handshake packet.
2023-08-31QUIC: ignore path validation socket error (ticket #2532).Roman Arutyunyan1-3/+1
Previously, a socket error on a path being validated resulted in validation error and subsequent QUIC connection closure. Now the error is ignored and path validation proceeds as usual, with several retries and a timeout. When validating the old path after an apparent migration, that path may already be unavailable and sendmsg() may return an error, which should not result in QUIC connection close. When validating the new path, it's possible that the new client address is spoofed (See RFC 9000, 9.3.2. On-Path Address Spoofing). This address may as well be unavailable and should not trigger QUIC connection closure.
2023-08-30QUIC: use last client dcid to receive initial packets.Roman Arutyunyan2-3/+3
Previously, original dcid was used to receive initial client packets in case server initial response was lost. However, last dcid should be used instead. These two are the same unless retry is used. In case of retry, client resends initial packet with a new dcid, that is different from the original dcid. If server response is lost, the client resends this packet again with the same dcid. This is shown in RFC 9000, 7.3. Authenticating Connection IDs, Figure 8. The issue manifested itself with creating multiple server sessions in response to each post-retry client initial packet, if server response is lost.
2023-08-25QUIC: posted generating TLS Key Update next keys.Sergey Kandaurov5-14/+37
Since at least f9fbeb4ee0de and certainly after 924882f42dea, which TLS Key Update support predates, queued data output is deferred to a posted push handler. To address timing signals after these changes, generating next keys is now posted to run after the push handler.
2023-08-14QUIC: path MTU discovery.Roman Arutyunyan8-100/+338
MTU selection starts by doubling the initial MTU until the first failure. Then binary search is used to find the path MTU.
2023-08-08QUIC: allowed ngx_quic_frame_sendto() to return NGX_AGAIN.Roman Arutyunyan2-4/+4
Previously, NGX_AGAIN returned by ngx_quic_send() was treated by ngx_quic_frame_sendto() as error, which triggered errors in its callers. However, a blocked socket is not an error. Now NGX_AGAIN is passed as is to the ngx_quic_frame_sendto() callers, which can safely ignore it.
2023-07-06QUIC: removed explicit packet padding for certain frames.Roman Arutyunyan1-29/+1
The frames for which the padding is removed are PATH_CHALLENGE and PATH_RESPONSE, which are sent separately by ngx_quic_frame_sendto().
2023-07-06QUIC: removed path->limited flag.Roman Arutyunyan6-13/+5
Its value is the opposite of path->validated.
2023-08-14QUIC: fixed probe-congestion deadlock.Roman Arutyunyan3-56/+11
When probe timeout expired while congestion window was exhausted, probe PINGs could not be sent. As a result, lost packets could not be declared lost and congestion window could not be freed for new packets. This deadlock continued until connection idle timeout expiration. Now PINGs are sent separately from the frame queue without congestion control, as specified by RFC 9002, Section 7: An endpoint MUST NOT send a packet if it would cause bytes_in_flight (see Appendix B.2) to be larger than the congestion window, unless the packet is sent on a PTO timer expiration (see Section 6.2) or when entering recovery (see Section 7.3.2).
2023-08-01QUIC: fixed PTO expiration condition.Roman Arutyunyan1-1/+1
Previously, PTO handler analyzed the first packet in the sent queue for the timeout expiration. However, the last sent packet should be analyzed instead. An example is timeout calculation in ngx_quic_set_lost_timer().
2023-08-01QUIC: avoid accessing freed frame.Roman Arutyunyan1-1/+3
Previously the field pnum of a potentially freed frame was accessed. Now the value is copied to a local variable. The old behavior did not cause any problems since the frame memory is not freed, but is moved to a free queue instead.
2023-07-27QUIC: fixed congesion control in GSO mode.Roman Arutyunyan1-1/+1
In non-GSO mode, a datagram is sent if congestion window is not exceeded by the time of send. The window could be exceeded by a small amount after the send. In GSO mode, congestion window was checked in a similar way, but for all concatenated datagrams as a whole. This could result in exceeding congestion window by a lot. Now congestion window is checked for every datagram in GSO mode as well.
2023-08-10QUIC: always add ACK frame to the queue head.Roman Arutyunyan1-1/+2
Previously it was added to the tail as all other frames. However, if the amount of queued data is large, it could delay the delivery of ACK, which could trigger frames retransmissions and slow down the connection.
2023-07-27QUIC: optimized ACK delay.Roman Arutyunyan1-1/+2
Previously ACK was not generated if max_ack_delay was not yet expired and the number of unacknowledged ack-eliciting packets was less than two, as allowed by RFC 9000 13.2.1-13.2.2. However this only makes sense to avoid sending ACK-only packets, as explained by the RFC: On the other hand, reducing the frequency of packets that carry only acknowledgments reduces packet transmission and processing cost at both endpoints. Now ACK is delayed only if output frame queue is empty. Otherwise ACK is sent immediately, which significantly improves QUIC performance with certain tests.
2023-06-21SSL: avoid using OpenSSL config in build directory (ticket #2404).Maxim Dounin1-1/+20
With this change, the NGX_OPENSSL_NO_CONFIG macro is defined when nginx is asked to build OpenSSL itself. And with this macro automatic loading of OpenSSL configuration (from the build directory) is prevented unless the OPENSSL_CONF environment variable is explicitly set. Note that not loading configuration is broken in OpenSSL 1.1.1 and 1.1.1a (fixed in OpenSSL 1.1.1b, see https://github.com/openssl/openssl/issues/7350). If nginx is used to compile these OpenSSL versions, configuring nginx with NGX_OPENSSL_NO_CONFIG explicitly set to 0 might be used as a workaround.
2023-06-21SSL: provided "nginx" appname when loading OpenSSL configs.Maxim Dounin1-3/+21
Following OpenSSL 0.9.8f, OpenSSL tries to load application-specific configuration section first, and then falls back to the "openssl_conf" default section if application-specific section is not found, by using CONF_modules_load_file(CONF_MFLAGS_DEFAULT_SECTION). Therefore this change is not expected to introduce any compatibility issues with existing configurations. It does, however, make it easier to configure specific OpenSSL settings for nginx in system-wide OpenSSL configuration (ticket #2449). Instead of checking OPENSSL_VERSION_NUMBER when using the OPENSSL_init_ssl() interface, the code now tests for OPENSSL_INIT_LOAD_CONFIG to be defined and true, and also explicitly excludes LibreSSL. This ensures that this interface is not used with BoringSSL and LibreSSL, which do not provide additional library initialization settings, notably the OPENSSL_INIT_set_config_appname() call.
2023-06-08QUIC: use AEAD to encrypt address validation tokens.Roman Arutyunyan2-17/+36
Previously used AES256-CBC is now substituted with AES256-GCM. Although there seem to be no tangible consequences of token integrity loss.
2023-06-16QUIC: removed TLS1_3_CK_* macros wrap up.Sergey Kandaurov1-7/+0
They were preserved in 172705615d04 to ease transition from older BoringSSL.
2023-06-20QUIC: style.Sergey Kandaurov1-4/+4
2023-06-20QUIC: unified ngx_quic_tls_open() and ngx_quic_tls_seal().Sergey Kandaurov1-11/+7
2023-06-20QUIC: TLS_AES_128_CCM_SHA256 cipher suite support.Roman Arutyunyan2-11/+49
2023-06-09QUIC: common cipher control constants instead of GCM-related.Roman Arutyunyan1-8/+8
The constants are used for both GCM and CHACHAPOLY.
2023-06-09QUIC: a new constant for AEAD tag length.Roman Arutyunyan4-16/+17
Previously used constant EVP_GCM_TLS_TAG_LEN had misleading name since it was used not only with GCM, but also with CHACHAPOLY. Now a new constant NGX_QUIC_TAG_LEN introduced. Luckily all AEAD algorithms used by QUIC have the same tag length of 16.
2023-06-12QUIC: fixed rttvar on subsequent RTT samples (ticket #2505).Sergey Kandaurov1-1/+1
Previously, computing rttvar used an updated smoothed_rtt value as per RFC 9002, section 5.3, which appears to be specified in a wrong order. A technical errata ID 7539 is reported.
2023-05-28QUIC: fixed compat with ciphers other than AES128 (ticket #2500).Roman Arutyunyan1-0/+1
Previously, rec.level field was not uninitialized in SSL_provide_quic_data(). As a result, its value was always ssl_encryption_initial. Later in ngx_quic_ciphers() such level resulted in resetting the cipher to TLS1_3_CK_AES_128_GCM_SHA256 and using AES128 to encrypt the packet. Now the level is initialized and the right cipher is used.
2023-05-23QUIC: fixed OpenSSL compat layer with OpenSSL master branch.Sergey Kandaurov1-1/+2
The layer is enabled as a fallback if the QUIC support is configured and the BoringSSL API wasn't detected, or when using the --with-openssl option, also compatible with QuicTLS and LibreSSL. For the latter, the layer is assumed to be present if QUIC was requested, so it needs to be undefined to prevent QUIC API redefinition as appropriate. A previously used approach to test the TLSEXT_TYPE_quic_transport_parameters macro doesn't work with OpenSSL 3.2 master branch where this macro appeared with incompatible QUIC API. To fix the build there, the test is revised to pass only for QuicTLS and LibreSSL.
2023-05-22QUIC: fixed post-close use-after-free.Roman Arutyunyan3-7/+16
Previously, ngx_quic_close_connection() could be called in a way that QUIC connection was accessed after the call. In most cases the connection is not closed right away, but close timeout is scheduled. However, it's not always the case. Also, if the close process started earlier for a different reason, calling ngx_quic_close_connection() may actually close the connection. The connection object should not be accessed after that. Now, when possible, return statement is added to eliminate post-close connection object access. In other places ngx_quic_close_connection() is substituted with posting close event. Also, the new way of closing connection in ngx_quic_stream_cleanup_handler() fixes another problem in this function. Previously it passed stream connection instead of QUIC connection to ngx_quic_close_connection(). This could result in incomplete connection shutdown. One consequence of that could be that QUIC streams were freed without shutting down their application contexts. This could result in another use-after-free. Found by Coverity (CID 1530402).
2023-05-21QUIC: better sockaddr initialization.Maxim Dounin1-1/+1
The qsock->sockaddr field is a ngx_sockaddr_t union, and therefore can hold any sockaddr (and union members, such qsock->sockaddr.sockaddr, can be used to access appropriate variant of the sockaddr). It is better to set it via qsock->sockaddr itself though, and not qsock->sockaddr.sockaddr, so static analyzers won't complain about out-of-bounds access. Prodded by Coverity (CID 1530403).
2023-05-14Common tree insert function for QUIC and UDP connections.Roman Arutyunyan5-57/+6
Previously, ngx_udp_rbtree_insert_value() was used for plain UDP and ngx_quic_rbtree_insert_value() was used for QUIC. Because of this it was impossible to initialize connection tree in ngx_create_listening() since this function is not aware what kind of listening it creates. Now ngx_udp_rbtree_insert_value() is used for both QUIC and UDP. To make is possible, a generic key field is added to ngx_udp_connection_t. It keeps client address for UDP and connection ID for QUIC.
2023-05-11QUIC: removed "quic_mtu" directive.Roman Arutyunyan2-2/+1
The directive used to set the value of the "max_udp_payload_size" transport parameter. According to RFC 9000, Section 18.2, the value specifies the size of buffer for reading incoming datagrams: This limit does act as an additional constraint on datagram size in the same way as the path MTU, but it is a property of the endpoint and not the path; see Section 14. It is expected that this is the space an endpoint dedicates to holding incoming packets. Current QUIC implementation uses the maximum possible buffer size (65527) for reading datagrams.
2023-05-11QUIC: resized input datagram buffer from 65535 to 65527.Roman Arutyunyan1-1/+1
The value of 65527 is the maximum permitted UDP payload size.
2023-05-11QUIC: keep stream sockaddr and addr_text constant.Roman Arutyunyan1-2/+29
HTTP and Stream variables $remote_addr and $binary_remote_addr rely on constant client address, particularly because they are cacheable. However, QUIC client may migrate to a new address. While there's no perfect way to handle this, the proposed solution is to copy client address to QUIC stream at stream creation. The change also fixes truncated $remote_addr if migration happened while the stream was active. The reason is addr_text string was copied to stream by value.
2023-04-27QUIC: set c->socklen for streams.Roman Arutyunyan1-0/+1
Previously, the value was not set and remained zero. While in nginx code the value of c->sockaddr is accessed without taking c->socklen into account, invalid c->socklen could lead to unexpected results in third-party modules.
2023-04-27QUIC: fixed addr_text after migration (ticket #2488).Roman Arutyunyan1-6/+3
Previously, the post-migration value of addr_text could be truncated, if it was longer than the previous one. Also, the new value always included port, which should not be there.
2023-05-09QUIC: reschedule path validation on path insertion/removal.Sergey Kandaurov1-3/+45
Two issues fixed: - new path validation could be scheduled late - a validated path could leave a spurious timer
2023-05-09QUIC: lower bound path validation PTO.Sergey Kandaurov1-2/+2
According to RFC 9000, 8.2.4. Failed Path Validation, the following value is recommended as a validation timeout: A value of three times the larger of the current PTO or the PTO for the new path (using kInitialRtt, as defined in [QUIC-RECOVERY]) is RECOMMENDED. The change adds PTO of the new path to the equation as the lower bound.
2023-05-09QUIC: separated path validation retransmit backoff.Sergey Kandaurov2-7/+10
Path validation packets containing PATH_CHALLENGE frames are sent separately from regular frame queue, because of the need to use a decicated path and pad the packets. The packets are sent periodically, separately from the regular probe/lost detection mechanism. A path validation packet is resent up to 3 times, each time after PTO expiration, with increasing per-path PTO backoff.
2023-05-09QUIC: removed check for in-flight packets in computing PTO.Sergey Kandaurov1-5/+1
The check is needed for clients in order to unblock a server due to anti-amplification limits, and it seems to make no sense for servers. See RFC 9002, A.6 and A.8 for a further explanation. This makes max_ack_delay to now always account, notably including PATH_CHALLENGE timers as noted in the last paragraph of 9000, 9.4, unlike when it was only used when there are packets in flight. While here, fixed nearby style.
2023-05-04QUIC: fixed encryption level in ngx_quic_frame_sendto().Roman Arutyunyan1-1/+1
Previously, ssl_encryption_application was hardcoded. Before 9553eea74f2a, ngx_quic_frame_sendto() was used only for PATH_CHALLENGE/PATH_RESPONSE sent at the application level only. Since 9553eea74f2a, ngx_quic_frame_sendto() is also used for CONNECTION_CLOSE, which can be sent at initial level after SSL handshake error or rejection. This resulted in packet encryption error. Now level is copied from frame, which fixes the error.
2023-05-02QUIC: optimized immediate close.Roman Arutyunyan2-15/+11
Previously, before sending CONNECTION_CLOSE to client, all pending frames were sent. This is redundant and could prevent CONNECTION_CLOSE from being sent due to congestion control. Now pending frames are freed and CONNECTION_CLOSE is sent without congestion control, as advised by RFC 9002: Packets containing frames besides ACK or CONNECTION_CLOSE frames count toward congestion control limits and are considered to be in flight.
2023-05-04QUIC: fixed split frames error handling.Sergey Kandaurov1-2/+5
Do not corrupt frame data chain pointer on ngx_quic_read_buffer() error. The error leads to closing a QUIC connection where the frame may be used as part of the QUIC connection tear down, which envolves writing pending frames, including this one.
2023-04-03QUIC: optimized sending stream response.Roman Arutyunyan1-0/+11
When a stream is created by client, it's often the case that nginx will send immediate response on that stream. An example is HTTP/3 request stream, which in most cases quickly replies with at least HTTP headers. QUIC stream init handlers are called from a posted event. Output QUIC frames are also sent to client from a posted event, called the push event. If the push event is posted before the stream init event, then output produced by stream may trigger sending an extra UDP datagram. To address this, push event is now re-posted when a new stream init event is posted. An example is handling 0-RTT packets. Client typically sends an init packet coalesced with a 0-RTT packet. Previously, nginx replied with a padded CRYPTO datagram, followed by a 1-RTT stream reply datagram. Now CRYPTO and STREAM packets are coalesced in one reply datagram, which saves bandwidth. Other examples include coalescing 1-RTT first stream response, and MAX_STREAMS/STREAM sent in response to ACK/STREAM.
2023-03-15QUIC: style.Roman Arutyunyan1-1/+1
2023-03-08SSL: logging levels of errors observed with BoringSSL.Maxim Dounin1-0/+21
As tested with tlsfuzzer with BoringSSL, the following errors are certainly client-related: SSL_do_handshake() failed (SSL: error:10000066:SSL routines:OPENSSL_internal:BAD_ALERT) SSL_do_handshake() failed (SSL: error:10000089:SSL routines:OPENSSL_internal:DECODE_ERROR) SSL_do_handshake() failed (SSL: error:100000dc:SSL routines:OPENSSL_internal:TOO_MANY_WARNING_ALERTS) SSL_do_handshake() failed (SSL: error:10000100:SSL routines:OPENSSL_internal:INVALID_COMPRESSION_LIST) SSL_do_handshake() failed (SSL: error:10000102:SSL routines:OPENSSL_internal:MISSING_KEY_SHARE) SSL_do_handshake() failed (SSL: error:1000010e:SSL routines:OPENSSL_internal:TOO_MUCH_SKIPPED_EARLY_DATA) SSL_read() failed (SSL: error:100000b6:SSL routines:OPENSSL_internal:NO_RENEGOTIATION) Accordingly, the SSL_R_BAD_ALERT, SSL_R_DECODE_ERROR, SSL_R_TOO_MANY_WARNING_ALERTS, SSL_R_INVALID_COMPRESSION_LIST, SSL_R_MISSING_KEY_SHARE, SSL_R_TOO_MUCH_SKIPPED_EARLY_DATA, and SSL_R_NO_RENEGOTIATION errors are now logged at the "info" level.
2023-03-08SSL: logging levels of errors observed with tlsfuzzer and LibreSSL.Maxim Dounin1-0/+7
As tested with tlsfuzzer with LibreSSL 3.7.0, the following errors are certainly client-related: SSL_do_handshake() failed (SSL: error:14026073:SSL routines:ACCEPT_SR_CLNT_HELLO:bad packet length) SSL_do_handshake() failed (SSL: error:1402612C:SSL routines:ACCEPT_SR_CLNT_HELLO:ssl3 session id too long) SSL_do_handshake() failed (SSL: error:140380EA:SSL routines:ACCEPT_SR_KEY_EXCH:tls rsa encrypted value length is wrong) Accordingly, the SSL_R_BAD_PACKET_LENGTH ("bad packet length"), SSL_R_SSL3_SESSION_ID_TOO_LONG ("ssl3 session id too long"), SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG ("tls rsa encrypted value length is wrong") errors are now logged at the "info" level.
2023-03-08SSL: logging levels of various errors reported with tlsfuzzer.Maxim Dounin1-0/+41
To further differentiate client-related errors and adjust logging levels of various SSL errors, nginx was tested with tlsfuzzer with multiple OpenSSL versions (3.1.0-beta1, 3.0.8, 1.1.1t, 1.1.0l, 1.0.2u, 1.0.1u, 1.0.0s, 0.9.8zh). The following errors were observed during tlsfuzzer runs with OpenSSL 3.0.8, and are clearly client-related: SSL_do_handshake() failed (SSL: error:0A000092:SSL routines::data length too long) SSL_do_handshake() failed (SSL: error:0A0000A0:SSL routines::length too short) SSL_do_handshake() failed (SSL: error:0A000124:SSL routines::bad legacy version) SSL_do_handshake() failed (SSL: error:0A000178:SSL routines::no shared signature algorithms) Accordingly, the SSL_R_DATA_LENGTH_TOO_LONG ("data length too long"), SSL_R_LENGTH_TOO_SHORT ("length too short"), SSL_R_BAD_LEGACY_VERSION ("bad legacy version"), and SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS ("no shared signature algorithms", misspelled as "sigature" in OpenSSL 1.0.2) errors are now logged at the "info" level. Additionally, the following errors were observed with OpenSSL 3.0.8 and with TLSv1.3 enabled: SSL_do_handshake() failed (SSL: error:0A00006F:SSL routines::bad digest length) SSL_do_handshake() failed (SSL: error:0A000070:SSL routines::missing sigalgs extension) SSL_do_handshake() failed (SSL: error:0A000096:SSL routines::encrypted length too long) SSL_do_handshake() failed (SSL: error:0A00010F:SSL routines::bad length) SSL_read() failed (SSL: error:0A00007A:SSL routines::bad key update) SSL_read() failed (SSL: error:0A000125:SSL routines::mixed handshake and non handshake data) Accordingly, the SSL_R_BAD_DIGEST_LENGTH ("bad digest length"), SSL_R_MISSING_SIGALGS_EXTENSION ("missing sigalgs extension"), SSL_R_ENCRYPTED_LENGTH_TOO_LONG ("encrypted length too long"), SSL_R_BAD_LENGTH ("bad length"), SSL_R_BAD_KEY_UPDATE ("bad key update"), and SSL_R_MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA ("mixed handshake and non handshake data") errors are now logged at the "info" level. Additionally, the following errors were observed with OpenSSL 1.1.1t: SSL_do_handshake() failed (SSL: error:14094091:SSL routines:ssl3_read_bytes:data between ccs and finished) SSL_do_handshake() failed (SSL: error:14094199:SSL routines:ssl3_read_bytes:too many warn alerts) SSL_read() failed (SSL: error:1408F0C6:SSL routines:ssl3_get_record:packet length too long) SSL_read() failed (SSL: error:14094085:SSL routines:ssl3_read_bytes:ccs received early) Accordingly, the SSL_R_CCS_RECEIVED_EARLY ("ccs received early"), SSL_R_DATA_BETWEEN_CCS_AND_FINISHED ("data between ccs and finished"), SSL_R_PACKET_LENGTH_TOO_LONG ("packet length too long"), and SSL_R_TOO_MANY_WARN_ALERTS ("too many warn alerts") errors are now logged at the "info" level. Additionally, the following errors were observed with OpenSSL 1.0.2u: SSL_do_handshake() failed (SSL: error:1407612A:SSL routines:SSL23_GET_CLIENT_HELLO:record too small) SSL_do_handshake() failed (SSL: error:1408C09A:SSL routines:ssl3_get_finished:got a fin before a ccs) Accordingly, the SSL_R_RECORD_TOO_SMALL ("record too small") and SSL_R_GOT_A_FIN_BEFORE_A_CCS ("got a fin before a ccs") errors are now logged at the "info" level. No additional client-related errors were observed while testing with OpenSSL 3.1.0-beta1, OpenSSL 1.1.0l, OpenSSL 1.0.1u, OpenSSL 1.0.0s, and OpenSSL 0.9.8zh.
2023-03-08SSL: switched to detect log level based on the last error.Maxim Dounin1-1/+1
In some cases there might be multiple errors in the OpenSSL error queue, notably when a libcrypto call fails, and then the SSL layer generates an error itself. For example, the following errors were observed with OpenSSL 3.0.8 with TLSv1.3 enabled: SSL_do_handshake() failed (SSL: error:02800066:Diffie-Hellman routines::invalid public key error:0A000132:SSL routines::bad ecpoint) SSL_do_handshake() failed (SSL: error:08000066:elliptic curve routines::invalid encoding error:0A000132:SSL routines::bad ecpoint) SSL_do_handshake() failed (SSL: error:0800006B:elliptic curve routines::point is not on curve error:0A000132:SSL routines::bad ecpoint) In such cases it seems to be better to determine logging level based on the last error in the error queue (the one added by the SSL layer, SSL_R_BAD_ECPOINT in all of the above example example errors). To do so, the ngx_ssl_connection_error() function was changed to use ERR_peek_last_error().
2023-01-28Style.Maxim Dounin1-2/+2
generated by cgit (git 2.34.1) at 2026-01-06 04:13:14 +0000