mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-24 14:16:20 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

HTTP/3: fixed segfault when using SSL certificates with variables.

Browse Source 
A QUIC connection doesn't have c->log->data and friends initialized to sensible
values.  Yet, a request can be created in the certificate callback with such an
assumption, which leads to a segmentation fault due to null pointer dereference
in ngx_http_free_request().  The fix is to adjust initializing the QUIC part of
a connection such that it has all of that in place.

Further, this appends logging error context for unsuccessful QUIC handshakes:
- cannot load certificate .. while handling frames
- SSL_do_handshake() failed .. while sending frames
This commit is contained in:
Sergey Kandaurov 2021-09-29 15:01:59 +03:00
parent 1ea6f35fbf
commit dab6035d68
2 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/http/modules/ngx_http_quic_module.c
View File

@ -198,8 +198,6 @@ ngx_http_quic_init(ngx_connection_t *c)
hc->ssl = 1;
if (c->quic == NULL) {
c->log->connection = c->number;
qcf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_quic_module);
ngx_quic_run(c, qcf);

16
src/http/ngx_http_request.c
View File

@ -299,14 +299,6 @@ ngx_http_init_connection(ngx_connection_t *c)
/* the default server configuration for the address:port */
hc->conf_ctx = hc->addr_conf->default_server->ctx;
#if (NGX_HTTP_QUIC)
if (hc->addr_conf->quic) {
if (ngx_http_quic_init(c) == NGX_DONE) {
return;
}
}
#endif
ctx = ngx_palloc(c->pool, sizeof(ngx_http_log_ctx_t));
if (ctx == NULL) {
ngx_http_close_connection(c);
@ -324,6 +316,14 @@ ngx_http_init_connection(ngx_connection_t *c)
c->log_error = NGX_ERROR_INFO;
#if (NGX_HTTP_QUIC)
if (hc->addr_conf->quic) {
if (ngx_http_quic_init(c) == NGX_DONE) {
return;
}
}
#endif
rev = c->read;
rev->handler = ngx_http_wait_request_handler;
c->write->handler = ngx_http_empty_handler;