Commit Graph

8228 Commits

Author SHA1 Message Date
Sergey Kandaurov
ba15b2af1b HTTP/3: fixed CANCEL_PUSH handling. 2023-04-06 18:18:41 +04:00
Roman Arutyunyan
c136324721 QUIC: optimized sending stream response.
When a stream is created by client, it's often the case that nginx will send
immediate response on that stream.  An example is HTTP/3 request stream, which
in most cases quickly replies with at least HTTP headers.

QUIC stream init handlers are called from a posted event.  Output QUIC
frames are also sent to client from a posted event, called the push event.
If the push event is posted before the stream init event, then output produced
by stream may trigger sending an extra UDP datagram.  To address this, push
event is now re-posted when a new stream init event is posted.

An example is handling 0-RTT packets.  Client typically sends an init packet
coalesced with a 0-RTT packet.  Previously, nginx replied with a padded CRYPTO
datagram, followed by a 1-RTT stream reply datagram.  Now CRYPTO and STREAM
packets are coalesced in one reply datagram, which saves bandwidth.

Other examples include coalescing 1-RTT first stream response, and
MAX_STREAMS/STREAM sent in response to ACK/STREAM.
2023-04-03 16:17:12 +04:00
Sergey Kandaurov
e8fbc96747 Merged with the default branch. 2023-03-29 11:14:25 +04:00
Maxim Dounin
dfe70f74a3 release-1.23.4 tag 2023-03-28 18:01:54 +03:00
Maxim Dounin
f5a7f1033d nginx-1.23.4-RELEASE 2023-03-28 18:01:53 +03:00
Maxim Dounin
3fe687f477 Updated OpenSSL used for win32 builds. 2023-03-28 02:25:55 +03:00
Maxim Dounin
87471918b2 Gzip: compatibility with recent zlib-ng versions.
It now uses custom alloc_aligned() wrapper for all allocations,
therefore all allocations are larger than expected by (64 + sizeof(void*)).
Further, they are seen as allocations of 1 element.  Relevant calculations
were adjusted to reflect this, and state allocation is now protected
with a flag to avoid misinterpreting other allocations as the zlib
deflate_state allocation.

Further, it no longer forces window bits to 13 on compression level 1,
so the comment was adjusted to reflect this.
2023-03-27 21:25:05 +03:00
Maxim Dounin
7b24b93d67 SSL: enabled TLSv1.3 by default. 2023-03-24 02:57:43 +03:00
Maxim Dounin
2ca4355bf0 Mail: fixed handling of blocked client read events in proxy.
When establishing a connection to the backend, nginx blocks reading
from the client with ngx_mail_proxy_block_read().  Previously, such
events were lost, and in some cases this resulted in connection hangs.

Notably, this affected mail_imap_ssl.t on Windows, since the test
closes connections after requesting authentication, but without
waiting for any responses (so the connection close events might be
lost).

Fix is to post an event to read from the client after connecting to
the backend if there were blocked events.
2023-03-24 02:53:21 +03:00
Roman Arutyunyan
25d8ab363b QUIC: style. 2023-03-15 19:57:15 +04:00
Sergey Kandaurov
4d472cd792 HTTP/3: fixed OpenSSL compatibility layer initialization.
SSL context is not present if the default server has neither certificates nor
ssl_reject_handshake enabled.  Previously, this led to null pointer dereference
before it would be caught with configuration checks.

Additionally, non-default servers with distinct SSL contexts need to initialize
compatibility layer in order to complete a QUIC handshake.
2023-03-24 19:49:50 +04:00
Maxim Dounin
11ed95bb53 Syslog: introduced error log handler.
This ensures that errors which happen during logging to syslog are logged
with proper context, such as "while logging to syslog" and the server name.

Prodded by Safar Safarly.
2023-03-10 07:43:50 +03:00
Maxim Dounin
853912986d Syslog: removed usage of ngx_cycle->log and ngx_cycle->hostname.
During initial startup the ngx_cycle->hostname is not available, and
previously this resulted in incorrect logging.  Instead, hostname from the
configuration being parsed is now preserved in the syslog peer structure
and then used during logging.

Similarly, ngx_cycle->log might not match the configuration where the
syslog peer is defined if the configuration is not yet fully applied,
and previously this resulted in unexpected logging of syslog errors
and debug information.  Instead, cf->cycle->new_log is now referenced
in the syslog peer structure and used for logging, similarly to how it
is done in other modules.
2023-03-10 07:43:40 +03:00
Maxim Dounin
ff9e426337 HTTP/2: finalize request as bad if header validation fails.
Similarly to 7192:d5a535774861, this avoids spurious zero statuses
in access.log, and in line with other header-related errors.
2023-03-10 06:47:53 +03:00
Maxim Dounin
3c949f7c40 HTTP/2: socket leak with "return 444" in error_page (ticket #2455).
Similarly to ticket #274 (7354:1812f1d79d84), early request finalization
without calling ngx_http_run_posted_requests() resulted in a connection
hang (a socket leak) if the 400 (Bad Request) error was generated in
ngx_http_v2_state_process_header() due to invalid request headers and
"return 444" was used in error_page 400.
2023-03-10 06:47:48 +03:00
Maxim Dounin
5c480f9173 SSL: logging levels of errors observed with BoringSSL.
As tested with tlsfuzzer with BoringSSL, the following errors are
certainly client-related:

SSL_do_handshake() failed (SSL: error:10000066:SSL routines:OPENSSL_internal:BAD_ALERT)
SSL_do_handshake() failed (SSL: error:10000089:SSL routines:OPENSSL_internal:DECODE_ERROR)
SSL_do_handshake() failed (SSL: error:100000dc:SSL routines:OPENSSL_internal:TOO_MANY_WARNING_ALERTS)
SSL_do_handshake() failed (SSL: error:10000100:SSL routines:OPENSSL_internal:INVALID_COMPRESSION_LIST)
SSL_do_handshake() failed (SSL: error:10000102:SSL routines:OPENSSL_internal:MISSING_KEY_SHARE)
SSL_do_handshake() failed (SSL: error:1000010e:SSL routines:OPENSSL_internal:TOO_MUCH_SKIPPED_EARLY_DATA)
SSL_read() failed (SSL: error:100000b6:SSL routines:OPENSSL_internal:NO_RENEGOTIATION)

Accordingly, the SSL_R_BAD_ALERT, SSL_R_DECODE_ERROR,
SSL_R_TOO_MANY_WARNING_ALERTS, SSL_R_INVALID_COMPRESSION_LIST,
SSL_R_MISSING_KEY_SHARE, SSL_R_TOO_MUCH_SKIPPED_EARLY_DATA,
and SSL_R_NO_RENEGOTIATION errors are now logged at the "info" level.
2023-03-08 22:22:47 +03:00
Maxim Dounin
13987c88c3 SSL: logging levels of errors observed with tlsfuzzer and LibreSSL.
As tested with tlsfuzzer with LibreSSL 3.7.0, the following errors are
certainly client-related:

SSL_do_handshake() failed (SSL: error:14026073:SSL routines:ACCEPT_SR_CLNT_HELLO:bad packet length)
SSL_do_handshake() failed (SSL: error:1402612C:SSL routines:ACCEPT_SR_CLNT_HELLO:ssl3 session id too long)
SSL_do_handshake() failed (SSL: error:140380EA:SSL routines:ACCEPT_SR_KEY_EXCH:tls rsa encrypted value length is wrong)

Accordingly, the SSL_R_BAD_PACKET_LENGTH ("bad packet length"),
SSL_R_SSL3_SESSION_ID_TOO_LONG ("ssl3 session id too long"),
SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG ("tls rsa encrypted value
length is wrong") errors are now logged at the "info" level.
2023-03-08 22:22:34 +03:00
Maxim Dounin
a3a94f7534 SSL: logging levels of various errors reported with tlsfuzzer.
To further differentiate client-related errors and adjust logging levels
of various SSL errors, nginx was tested with tlsfuzzer with multiple
OpenSSL versions (3.1.0-beta1, 3.0.8, 1.1.1t, 1.1.0l, 1.0.2u, 1.0.1u,
1.0.0s, 0.9.8zh).

The following errors were observed during tlsfuzzer runs with OpenSSL 3.0.8,
and are clearly client-related:

SSL_do_handshake() failed (SSL: error:0A000092:SSL routines::data length too long)
SSL_do_handshake() failed (SSL: error:0A0000A0:SSL routines::length too short)
SSL_do_handshake() failed (SSL: error:0A000124:SSL routines::bad legacy version)
SSL_do_handshake() failed (SSL: error:0A000178:SSL routines::no shared signature algorithms)

Accordingly, the SSL_R_DATA_LENGTH_TOO_LONG ("data length too long"),
SSL_R_LENGTH_TOO_SHORT ("length too short"), SSL_R_BAD_LEGACY_VERSION
("bad legacy version"), and SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS
("no shared signature algorithms", misspelled as "sigature" in OpenSSL 1.0.2)
errors are now logged at the "info" level.

Additionally, the following errors were observed with OpenSSL 3.0.8 and
with TLSv1.3 enabled:

SSL_do_handshake() failed (SSL: error:0A00006F:SSL routines::bad digest length)
SSL_do_handshake() failed (SSL: error:0A000070:SSL routines::missing sigalgs extension)
SSL_do_handshake() failed (SSL: error:0A000096:SSL routines::encrypted length too long)
SSL_do_handshake() failed (SSL: error:0A00010F:SSL routines::bad length)
SSL_read() failed (SSL: error:0A00007A:SSL routines::bad key update)
SSL_read() failed (SSL: error:0A000125:SSL routines::mixed handshake and non handshake data)

Accordingly, the SSL_R_BAD_DIGEST_LENGTH ("bad digest length"),
SSL_R_MISSING_SIGALGS_EXTENSION ("missing sigalgs extension"),
SSL_R_ENCRYPTED_LENGTH_TOO_LONG ("encrypted length too long"),
SSL_R_BAD_LENGTH ("bad length"), SSL_R_BAD_KEY_UPDATE ("bad key update"),
and SSL_R_MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA ("mixed handshake and non
handshake data") errors are now logged at the "info" level.

Additionally, the following errors were observed with OpenSSL 1.1.1t:

SSL_do_handshake() failed (SSL: error:14094091:SSL routines:ssl3_read_bytes:data between ccs and finished)
SSL_do_handshake() failed (SSL: error:14094199:SSL routines:ssl3_read_bytes:too many warn alerts)
SSL_read() failed (SSL: error:1408F0C6:SSL routines:ssl3_get_record:packet length too long)
SSL_read() failed (SSL: error:14094085:SSL routines:ssl3_read_bytes:ccs received early)

Accordingly, the SSL_R_CCS_RECEIVED_EARLY ("ccs received early"),
SSL_R_DATA_BETWEEN_CCS_AND_FINISHED ("data between ccs and finished"),
SSL_R_PACKET_LENGTH_TOO_LONG ("packet length too long"), and
SSL_R_TOO_MANY_WARN_ALERTS ("too many warn alerts") errors are now logged
at the "info" level.

Additionally, the following errors were observed with OpenSSL 1.0.2u:

SSL_do_handshake() failed (SSL: error:1407612A:SSL routines:SSL23_GET_CLIENT_HELLO:record too small)
SSL_do_handshake() failed (SSL: error:1408C09A:SSL routines:ssl3_get_finished:got a fin before a ccs)

Accordingly, the SSL_R_RECORD_TOO_SMALL ("record too small") and
SSL_R_GOT_A_FIN_BEFORE_A_CCS ("got a fin before a ccs") errors are now
logged at the "info" level.

No additional client-related errors were observed while testing with
OpenSSL 3.1.0-beta1, OpenSSL 1.1.0l, OpenSSL 1.0.1u, OpenSSL 1.0.0s,
and OpenSSL 0.9.8zh.
2023-03-08 22:21:59 +03:00
Maxim Dounin
a976e6b9ef SSL: switched to detect log level based on the last error.
In some cases there might be multiple errors in the OpenSSL error queue,
notably when a libcrypto call fails, and then the SSL layer generates
an error itself.  For example, the following errors were observed
with OpenSSL 3.0.8 with TLSv1.3 enabled:

SSL_do_handshake() failed (SSL: error:02800066:Diffie-Hellman routines::invalid public key error:0A000132:SSL routines::bad ecpoint)
SSL_do_handshake() failed (SSL: error:08000066:elliptic curve routines::invalid encoding error:0A000132:SSL routines::bad ecpoint)
SSL_do_handshake() failed (SSL: error:0800006B:elliptic curve routines::point is not on curve error:0A000132:SSL routines::bad ecpoint)

In such cases it seems to be better to determine logging level based on
the last error in the error queue (the one added by the SSL layer,
SSL_R_BAD_ECPOINT in all of the above example example errors).  To do so,
the ngx_ssl_connection_error() function was changed to use
ERR_peek_last_error().
2023-03-08 22:21:53 +03:00
Yugo Horie
2c5fccd469 Core: stricter UTF-8 handling in ngx_utf8_decode().
An UTF-8 octet sequence cannot start with a 11111xxx byte (above 0xf8),
see https://datatracker.ietf.org/doc/html/rfc3629#section-3.  Previously,
such bytes were accepted by ngx_utf8_decode() and misinterpreted as 11110xxx
bytes (as in a 4-byte sequence).  While unlikely, this can potentially cause
issues.

Fix is to explicitly reject such bytes in ngx_utf8_decode().
2023-02-23 08:09:50 +09:00
Maxim Dounin
4ace957c4e Win32: non-ASCII names in ngx_fs_bsize(), ngx_fs_available().
This fixes potentially incorrect cache size calculations and non-working
"min_free" when using cache in directories with non-ASCII names.
2023-02-23 20:50:03 +03:00
Maxim Dounin
6c5fe80bc6 Win32: removed attempt to use a drive letter in ngx_fs_bsize().
Just a drive letter might not correctly represent file system being used,
notably when using symlinks (as created by "mklink /d").  As such, instead
of trying to call GetDiskFreeSpace() with just a drive letter, we now always
use GetDiskFreeSpace() with full path.

Further, it looks like the code to use just a drive letter never worked,
since it tried to test name[2] instead of name[1] to be ':'.
2023-02-23 20:50:00 +03:00
Maxim Dounin
2062ddef39 Win32: non-ASCII names support in ngx_open_tempfile().
This makes it possible to use temporary directories with non-ASCII characters,
either explicitly or via a prefix with non-ASCII characters in it.
2023-02-23 20:49:57 +03:00
Maxim Dounin
4d84bc4929 Win32: non-ASCII names support in ngx_rename_file().
This makes it possible to upload files with non-ASCII characters
when using the dav module (ticket #1433).
2023-02-23 20:49:55 +03:00
Maxim Dounin
1a9e5c8376 Win32: non-ASCII names support in ngx_delete_file().
This makes it possible to delete files with non-ASCII characters
when using the dav module (ticket #1433).
2023-02-23 20:49:54 +03:00
Maxim Dounin
dc4957485e Win32: reworked ngx_win32_rename_file() to use nginx wrappers.
This ensures that ngx_win32_rename_file() will support non-ASCII names
when supported by the wrappers.

Notably, this is used by PUT requests in the dav module when overwriting
existing files with non-ASCII names (ticket #1433).
2023-02-23 20:49:52 +03:00
Maxim Dounin
94d8cea620 Win32: reworked ngx_win32_rename_file() to check errors.
Previously, ngx_win32_rename_file() retried on all errors returned by
MoveFile() to a temporary name.  It only make sense, however, to retry
when the destination file already exists, similarly to the condition
when ngx_win32_rename_file() is called.  Retrying on other errors is
meaningless and might result in an infinite loop.
2023-02-23 20:49:50 +03:00
Maxim Dounin
f8075f1ef5 Win32: non-ASCII directory names support in ngx_delete_dir().
This makes it possible to delete directories with non-ASCII characters
when using the dav module (ticket #1433).
2023-02-23 20:49:47 +03:00
Maxim Dounin
89719dc5c1 Win32: non-ASCII directory names support in ngx_create_dir().
This makes it possible to create directories under prefix with non-ASCII
characters, as well as makes it possible to create directories with non-ASCII
characters when using the dav module (ticket #1433).

To ensure that the dav module operations are restricted similarly to
other file operations (in particular, short names are not allowed), the
ngx_win32_check_filename() function is used.  It improved to support
checking of just dirname, and now can be used to check paths when creating
files or directories.
2023-02-23 20:49:45 +03:00
Maxim Dounin
1edc23cc84 Win32: non-ASCII directory names support in ngx_getcwd().
This makes it possible to start nginx without a prefix explicitly set
in a directory with non-ASCII characters in it.
2023-02-23 20:49:44 +03:00
Maxim Dounin
99d5ad72a4 Win32: non-ASCII names support in "include" with wildcards.
Notably, ngx_open_glob() now supports opening directories with non-ASCII
characters, and pathnames returned by ngx_read_glob() are converted to UTF-8.
2023-02-23 20:49:41 +03:00
Maxim Dounin
1f8a66f199 Win32: non-ASCII names support in autoindex (ticket #458).
Notably, ngx_open_dir() now supports opening directories with non-ASCII
characters, and directory entries returned by ngx_read_dir() are properly
converted to UTF-8.
2023-02-23 20:49:39 +03:00
Maxim Dounin
dad6ec3aa6 Win32: OpenSSL compilation for x64 targets with MSVC.
To ensure proper target selection the NGX_MACHINE variable is now set
based on the MSVC compiler output, and the OpenSSL target is set based
on it.

This is not important as long as "no-asm" is used (as in misc/GNUmakefile
and win32 build instructions), but might be beneficial if someone is trying
to build OpenSSL with assembler code.
2023-02-23 18:16:08 +03:00
Maxim Dounin
62b790c331 Win32: i386 now assumed when crossbuilding (ticket #2416).
Previously, NGX_MACHINE was not set when crossbuilding, resulting in
NGX_ALIGNMENT=16 being used in 32-bit builds (if not explicitly set to a
correct value).  This in turn might result in memory corruption in
ngx_palloc() (as there are no usable aligned allocator on Windows, and
normal malloc() is used instead, which provides 8 byte alignment on
32-bit platforms).

To fix this, now i386 machine is set when crossbuilding, so nginx won't
assume strict alignment requirements.
2023-02-23 18:15:59 +03:00
Maxim Dounin
180be97d31 Win32: handling of localized MSVC cl output.
Output examples in English, Russian, and Spanish:

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.30319.01 for 80x86
Оптимизирующий 32-разрядный компилятор Microsoft (R) C/C++ версии 16.00.30319.01 для 80x86
Compilador de optimización de C/C++ de Microsoft (R) versión 16.00.30319.01 para x64

Since most of the words are translated, instead of looking for the words
"Compiler Version" we now search for "C/C++" and the version number.
2023-02-23 18:15:57 +03:00
Maxim Dounin
504ca56686 Win32: removed unneeded wildcard in NGX_CC_NAME test for msvc.
Wildcards for msvc in NGX_CC_NAME tests are not needed since 78f8ac479735.
2023-02-23 18:15:53 +03:00
Maxim Dounin
2485681308 Lingering close for connections with pipelined requests.
This is expected to help with clients using pipelining with some constant
depth, such as apt[1][2].

When downloading many resources, apt uses pipelining with some constant
depth, a number of requests in flight.  This essentially means that after
receiving a response it sends an additional request to the server, and
this can result in requests arriving to the server at any time.  Further,
additional requests are sent one-by-one, and can be easily seen as such
(neither as pipelined, nor followed by pipelined requests).

The only safe approach to close such connections (for example, when
keepalive_requests is reached) is with lingering.  To do so, now nginx
monitors if pipelining was used on the connection, and if it was, closes
the connection with lingering.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973861#10
[2] https://mailman.nginx.org/pipermail/nginx-devel/2023-January/ZA2SP5SJU55LHEBCJMFDB2AZVELRLTHI.html
2023-02-02 23:38:48 +03:00
Maxim Dounin
384a8d8dfb Fixed "zero size buf" alerts with subrequests.
Since 4611:2b6cb7528409 responses from the gzip static, flv, and mp4 modules
can be used with subrequests, though empty files were not properly handled.
Empty gzipped, flv, and mp4 files thus resulted in "zero size buf in output"
alerts.  While valid corresponding files are not expected to be empty, such
files shouldn't result in alerts.

Fix is to set b->sync on such empty subrequest responses, similarly to what
ngx_http_send_special() does.

Additionally, the static module, the ngx_http_send_response() function, and
file cache are modified to do the same instead of not sending the response
body at all in such cases, since not sending the response body at all is
believed to be at least questionable, and might break various filters
which do not expect such behaviour.
2023-01-28 05:23:33 +03:00
Maxim Dounin
856a01860e Style. 2023-01-28 05:20:23 +03:00
Maxim Dounin
dad65f3e44 Added warning about redefinition of listen socket protocol options.
The "listen" directive in the http module can be used multiple times
in different server blocks.  Originally, it was supposed to be specified
once with various socket options, and without any parameters in virtual
server blocks.  For example:

    server { listen 80 backlog=1024; server_name foo; ... }
    server { listen 80; server_name bar; ... }
    server { listen 80; server_name bazz; ... }

The address part of the syntax ("address[:port]" / "port" / "unix:path")
uniquely identifies the listening socket, and therefore is enough for
name-based virtual servers (to let nginx know that the virtual server
accepts requests on the listening socket in question).

To ensure that listening options do not conflict between virtual servers,
they were allowed only once.  For example, the following configuration
will be rejected ("duplicate listen options for 0.0.0.0:80 in ..."):

    server { listen 80 backlog=1024; server_name foo; ... }
    server { listen 80 backlog=512; server_name bar; ... }

At some point it was, however, noticed, that it is sometimes convenient
to repeat some options for clarity.  In nginx 0.8.51 the "ssl" parameter
was allowed to be specified multiple times, e.g.:

    server { listen 443 ssl backlog=1024; server_name foo; ... }
    server { listen 443 ssl; server_name bar; ... }
    server { listen 443 ssl; server_name bazz; ... }

This approach makes configuration more readable, since SSL sockets are
immediately visible in the configuration.  If this is not needed, just the
address can still be used.

Later, additional protocol-specific options similar to "ssl" were
introduced, notably "http2" and "proxy_protocol".  With these options,
one can write:

    server { listen 443 ssl backlog=1024; server_name foo; ... }
    server { listen 443 http2; server_name bar; ... }
    server { listen 443 proxy_protocol; server_name bazz; ... }

The resulting socket will use ssl, http2, and proxy_protocol, but this
is not really obvious from the configuration.

To emphasize such misleading configurations are discouraged, nginx now
warns as long as the "listen" directive is used with options different
from the options previously used if this is potentially confusing.

In particular, the following configurations are allowed:

    server { listen 8401 ssl backlog=1024; server_name foo; }
    server { listen 8401 ssl; server_name bar; }
    server { listen 8401 ssl; server_name bazz; }

    server { listen 8402 ssl http2 backlog=1024; server_name foo; }
    server { listen 8402 ssl; server_name bar; }
    server { listen 8402 ssl; server_name bazz; }

    server { listen 8403 ssl; server_name bar; }
    server { listen 8403 ssl; server_name bazz; }
    server { listen 8403 ssl http2; server_name foo; }

    server { listen 8404 ssl http2 backlog=1024; server_name foo; }
    server { listen 8404 http2; server_name bar; }
    server { listen 8404 http2; server_name bazz; }

    server { listen 8405 ssl http2 backlog=1024; server_name foo; }
    server { listen 8405 ssl http2; server_name bar; }
    server { listen 8405 ssl http2; server_name bazz; }

    server { listen 8406 ssl; server_name foo; }
    server { listen 8406; server_name bar; }
    server { listen 8406; server_name bazz; }

And the following configurations will generate warnings:

    server { listen 8501 ssl http2 backlog=1024; server_name foo; }
    server { listen 8501 http2; server_name bar; }
    server { listen 8501 ssl; server_name bazz; }

    server { listen 8502 backlog=1024; server_name foo; }
    server { listen 8502 ssl; server_name bar; }

    server { listen 8503 ssl; server_name foo; }
    server { listen 8503 http2; server_name bar; }

    server { listen 8504 ssl; server_name foo; }
    server { listen 8504 http2; server_name bar; }
    server { listen 8504 proxy_protocol; server_name bazz; }

    server { listen 8505 ssl http2 proxy_protocol; server_name foo; }
    server { listen 8505 ssl http2; server_name bar; }
    server { listen 8505 ssl; server_name bazz; }

    server { listen 8506 ssl http2; server_name foo; }
    server { listen 8506 ssl; server_name bar; }
    server { listen 8506; server_name bazz; }

    server { listen 8507 ssl; server_name bar; }
    server { listen 8507; server_name bazz; }
    server { listen 8507 ssl http2; server_name foo; }

    server { listen 8508 ssl; server_name bar; }
    server { listen 8508; server_name bazz; }
    server { listen 8508 ssl backlog=1024; server_name foo; }

    server { listen 8509; server_name bazz; }
    server { listen 8509 ssl; server_name bar; }
    server { listen 8509 ssl backlog=1024; server_name foo; }

The basic idea is that at most two sets of protocol options are allowed:
the main one (with socket options, if any), and a shorter one, with options
being a subset of the main options, repeated for clarity.  As long as the
shorter set of protocol options is used, all listen directives except the
main one should use it.
2023-01-28 01:29:45 +03:00
Roman Arutyunyan
a5f9b45aee HTTP/3: trigger more compatibility errors for "listen quic".
Now "ssl", "proxy_protocol" and "http2" are not allowed with "quic" in "listen"
directive.  Previously, only "ssl" was not allowed.
2023-01-26 15:25:33 +04:00
Roman Arutyunyan
815ef96124 HTTP/3: "quic" parameter of "listen" directive.
Now "listen" directve has a new "quic" parameter which enables QUIC protocol
for the address.  Further, to enable HTTP/3, a new directive "http3" is
introduced.  The hq-interop protocol is enabled by "http3_hq" as before.
Now application protocol is chosen by ALPN.

Previously used "http3" parameter of "listen" is deprecated.
2023-02-27 14:00:56 +04:00
Roman Arutyunyan
a36ebf7e95 QUIC: OpenSSL compatibility layer.
The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API.

This implementation does not support 0-RTT.
2023-02-22 19:16:53 +04:00
Sergey Kandaurov
76adb91913 QUIC: improved ssl_reject_handshake error logging.
The check follows the ngx_ssl_handshake() change in 59e1c73fe02b.
2023-02-23 16:26:38 +04:00
Sergey Kandaurov
d9610b40a6 QUIC: using ngx_ssl_handshake_log(). 2023-02-23 16:17:29 +04:00
Sergey Kandaurov
5149620d6d QUIC: moved "handshake failed" reason to send_alert.
A QUIC handshake failure breaks down into several cases:
- a handshake error which leads to a send_alert call
- an error triggered by the add_handshake_data callback
- internal errors (allocation etc)

Previously, in the first case, only error code was set in the send_alert
callback.  Now the "handshake failed" reason phrase is set there as well.
In the second case, both code and reason are set by add_handshake_data.
In the last case, setting reason phrase is removed: returning NGX_ERROR
now leads to closing the connection with just INTERNAL_ERROR.

Reported by Jiuzhou Cui.
2023-02-23 16:16:56 +04:00
Sergey Kandaurov
1ccba18f00 QUIC: using NGX_QUIC_ERR_CRYPTO macro in ALPN checks.
Patch by Jiuzhou Cui.
2023-02-23 15:49:59 +04:00
Sergey Kandaurov
40af97fdec QUIC: fixed indentation. 2023-02-13 14:01:50 +04:00
Sergey Kandaurov
f36da1dfa6 README: fixed toc.
While here, updated link to mailman.
2023-02-13 13:41:35 +04:00
Sergey Kandaurov
3b57dcecaf README: updated building from sources, added directives reference. 2023-02-08 12:47:35 +04:00