+ rev="83">

@@ -166,6 +166,11 @@ versions: x86_64, aarch64/arm64 + +2023 +x86_64, aarch64/arm64 + + @@ -531,7 +536,7 @@ Install the prerequisites: sudo yum install yum-utils -To set up the yum repository, create the file named +To set up the yum repository for Amazon Linux 2, create the file named /etc/yum.repos.d/nginx.repo with the following contents: @@ -553,6 +558,28 @@ gpgkey=https://nginx.org/keys/nginx_sign module_hotfixes=true +To set up the yum repository for Amazon Linux 2023, create the file named +/etc/yum.repos.d/nginx.repo +with the following contents: + + +[nginx-stable] +name=nginx stable repo +baseurl=http://nginx.org/packages/amzn/2023/$basearch/ +gpgcheck=1 +enabled=1 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true + +[nginx-mainline] +name=nginx mainline repo +baseurl=http://nginx.org/packages/mainline/amzn/2023/$basearch/ +gpgcheck=1 +enabled=0 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true + + By default, the repository for stable nginx packages is used. If you would like to use mainline nginx packages, run the following command: diff -r 0f468b4e01d6 -r 23d3cabaab95 xml/ru/linux_packages.xml --- a/xml/ru/linux_packages.xml Thu Mar 09 22:20:24 2023 +0000 +++ b/xml/ru/linux_packages.xml Mon Mar 20 11:20:57 2023 -0700 @@ -7,7 +7,7 @@

+ rev="83">

@@ -166,6 +166,11 @@ x86_64, aarch64/arm64 + +2023 +x86_64, aarch64/arm64 + + @@ -528,7 +533,7 @@ sudo apk add nginx-module-image-filter at n sudo yum install yum-utils -Для подключения yum-репозитория создайте файл с именем +Для подключения yum-репозитория для Amazon Linux 2 создайте файл с именем /etc/yum.repos.d/nginx.repo со следующим содержимым: @@ -550,6 +555,28 @@ gpgkey=https://nginx.org/keys/nginx_sign module_hotfixes=true +Для подключения yum-репозитория для Amazon Linux 2023 создайте файл с именем +/etc/yum.repos.d/nginx.repo +со следующим содержимым: + + +[nginx-stable] +name=nginx stable repo +baseurl=http://nginx.org/packages/amzn/2023/$basearch/ +gpgcheck=1 +enabled=1 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true + +[nginx-mainline] +name=nginx mainline repo +baseurl=http://nginx.org/packages/mainline/amzn/2023/$basearch/ +gpgcheck=1 +enabled=0 +gpgkey=https://nginx.org/keys/nginx_signing.key +module_hotfixes=true + + По умолчанию используется репозиторий для стабильной версии nginx. Если предпочтительно использовать пакеты для основной версии nginx, выполните следующую команду: From mdounin at mdounin.ru Mon Mar 20 23:55:38 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 21 Mar 2023 02:55:38 +0300 Subject: [PATCH] Win32: PCRE2 Unicode support with MSVC In-Reply-To: References: Message-ID: Hello! On Mon, Mar 20, 2023 at 06:58:32PM +0400, Sergey Kandaurov wrote: > # HG changeset patch > # User Sergey Kandaurov > # Date 1679324252 -14400 > # Mon Mar 20 18:57:32 2023 +0400 > # Node ID d0b013a7050e00613804b399ae2ca74551b2a071 > # Parent 8771d35d55d0a2b1cefaab04401d6f837f5a05a2 > Win32: PCRE2 Unicode support with MSVC. > > Unicode support in PCRE2 is enabled by default on configure/cmake side > by defining SUPPORT_UNICODE. Previously, this macro was not defined > when compiling directly PCRE2 sources for Windows with MSVC. > > In particular, this change allows to specify Unicode properties, such as > \P, \p, or \X, as caught by http_server_name.t adjusted to run on Windows: > > nginx: [emerg] pcre2_compile() failed: this version of PCRE2 does not have > support for \P, \p, or \X > > diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make > --- a/auto/lib/pcre/make > +++ b/auto/lib/pcre/make > @@ -61,7 +61,7 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then > > PCRE_CFLAGS = -O2 -Ob1 -Oi -Gs $LIBC $CPU_OPT > PCRE_FLAGS = -DHAVE_CONFIG_H -DPCRE2_STATIC -DPCRE2_CODE_UNIT_WIDTH=8 \\ > - -DHAVE_MEMMOVE > + -DHAVE_MEMMOVE -DSUPPORT_UNICODE > > PCRE_SRCS = $ngx_pcre_srcs > PCRE_OBJS = $ngx_pcre_objs The PCRE2 compilation in auto/lib/pcre/make mostly matches PCRE compilation in auto/lib/pcre/makefile.msvc, and it never tried to enable Unicode / UTF-8 support. This in turn matches PCRE configure behaviour: UTF-8 support is disabled by default and needs to be explicitly enabled. While we might consider enabling Unicode support for PCRE2, since it is now enabled by default in PCRE2 (or for both PCRE and PCRE2, since it is something usually expected to work nowadays), for tests a better solution might be to don't rely on this. Unicode / UTF-8 support might not be available on various other platforms as well, so it's generally might be a good idea to adjust tests to tolerate PCRE/PCRE2 compiled without Unicode / UTF-8 support. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Mon Mar 20 23:59:29 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 21 Mar 2023 02:59:29 +0300 Subject: [PATCH 3 of 3] Tests: adapted session reuse tests to work with TLSv1.3 In-Reply-To: <976BD0E8-0B6B-4C96-9255-54B6F915B7F1@nginx.com> References: <946c3b39d1f9adf3f96f.1678424406@vm-bsd.mdounin.ru> <976BD0E8-0B6B-4C96-9255-54B6F915B7F1@nginx.com> Message-ID: Hello! On Mon, Mar 20, 2023 at 07:48:13PM +0400, Sergey Kandaurov wrote: > > On 10 Mar 2023, at 09:00, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1678424073 -10800 > > # Fri Mar 10 07:54:33 2023 +0300 > > # Node ID 946c3b39d1f9adf3f96f1c04963539ecd1c63a8f > > # Parent 49d12f8c4cf69e1cbe7feccae3b0ea1ac2ca8c2f > > Tests: adapted session reuse tests to work with TLSv1.3. > > > > In TLSv1.3, session tickets are sent after the handshake, and saving session > > right after the handshake is not going to work. To properly test session > > resumption, sessions are now saved after some data exchange. > > > > diff --git a/mail_ssl.t b/mail_ssl.t > > --- a/mail_ssl.t > > +++ b/mail_ssl.t > > @@ -182,24 +182,28 @@ my $s = Test::Nginx::IMAP->new(); > > my ($ssl, $ses); > > > > ($s, $ssl) = get_ssl_socket(8145); > > +Net::SSLeay::read($ssl); > > $ses = Net::SSLeay::get_session($ssl); > > > > [..] > > Good for me. Thanks, pushed to http://mdounin.ru/hg/nginx-tests. -- Maxim Dounin http://mdounin.ru/ From v.zhestikov at f5.com Tue Mar 21 04:18:03 2023 From: v.zhestikov at f5.com (Vadim Zhestikov) Date: Tue, 21 Mar 2023 04:18:03 +0000 Subject: [njs] Added support for export {name as default} statement. Message-ID: details: https://hg.nginx.org/njs/rev/fbd36220ea17 branches: changeset: 2073:fbd36220ea17 user: Vadim Zhestikov date: Mon Mar 20 21:09:58 2023 -0700 description: Added support for export {name as default} statement. This fixes #624 issue on Github. diffstat: src/njs_parser.c | 78 +++++++++++++++++++++++++++++++++- test/js/import_as_default.t.js | 9 +++ test/js/import_as_default_compare.t.js | 14 ++++++ test/js/import_as_default_double.t.js | 9 +++ test/js/module/lib4.js | 2 + test/js/module/lib5.js | 6 ++ test/js/module/lib6-1.js | 6 ++ test/js/module/lib6.js | 6 ++ 8 files changed, 128 insertions(+), 2 deletions(-) diffs (175 lines): diff -r 95f57822bdaa -r fbd36220ea17 src/njs_parser.c --- a/src/njs_parser.c Fri Mar 10 14:15:29 2023 -0800 +++ b/src/njs_parser.c Mon Mar 20 21:09:58 2023 -0700 @@ -7973,6 +7973,9 @@ njs_parser_export(njs_parser_t *parser, njs_queue_link_t *current) { njs_parser_node_t *node; + njs_lexer_token_t *peek; + + static const njs_str_t as_string = njs_str("as"); if (!parser->module) { njs_parser_syntax_error(parser, "Illegal export statement"); @@ -7980,8 +7983,79 @@ njs_parser_export(njs_parser_t *parser, } if (token->type != NJS_TOKEN_DEFAULT) { - njs_parser_syntax_error(parser, "Non-default export is not supported"); - return NJS_DONE; + + if (token->type != NJS_TOKEN_OPEN_BRACE) { + njs_parser_syntax_error(parser, + "Non-default export is not supported"); + return NJS_DONE; + } + + /* + * 'export {' + * supported only: export {identifier as default}; + */ + + njs_lexer_consume_token(parser->lexer, 1); + + token = njs_lexer_token(parser->lexer, 0); + if (njs_slow_path(token == NULL)) { + return NJS_ERROR; + } + + if (token->type != NJS_TOKEN_NAME) { + njs_parser_syntax_error(parser, "Identifier expected"); + return NJS_DONE; + } + + peek = njs_lexer_peek_token(parser->lexer, token, 0); + if (njs_slow_path(peek == NULL)) { + return NJS_ERROR; + } + + if (peek->type != NJS_TOKEN_NAME || + !njs_strstr_eq(&peek->text, &as_string)) + { + njs_parser_syntax_error(parser, "'as' expected"); + return NJS_DONE; + } + + peek = njs_lexer_peek_token(parser->lexer, peek, 0); + if (njs_slow_path(peek == NULL)) { + return NJS_ERROR; + } + + if (peek->type != NJS_TOKEN_DEFAULT) { + njs_parser_syntax_error(parser, + "Non-default export is not supported"); + return NJS_DONE; + } + + peek = njs_lexer_peek_token(parser->lexer, peek, 1); + if (njs_slow_path(token == NULL)) { + return NJS_ERROR; + } + + if (peek->type != NJS_TOKEN_CLOSE_BRACE) { + njs_parser_syntax_error(parser, "Close brace is expected"); + return NJS_DONE; + } + + node = njs_parser_node_new(parser, NJS_TOKEN_EXPORT); + if (node == NULL) { + return NJS_ERROR; + } + + node->token_line = parser->line; + node->right = njs_parser_reference(parser, token); + if (node->right == NULL) { + return NJS_ERROR; + } + + parser->node = node; + + njs_lexer_consume_token(parser->lexer, 4); + + return njs_parser_stack_pop(parser); } njs_lexer_consume_token(parser->lexer, 1); diff -r 95f57822bdaa -r fbd36220ea17 test/js/import_as_default.t.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/import_as_default.t.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,9 @@ +/*--- +includes: [] +flags: [] +paths: [test/js/module/] +---*/ + +import imp from 'lib4.js'; + +assert.sameValue(imp, 10); diff -r 95f57822bdaa -r fbd36220ea17 test/js/import_as_default_compare.t.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/import_as_default_compare.t.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,14 @@ +/*--- +includes: [] +flags: [] +paths: [test/js/module] +---*/ + +import a from 'lib6.js'; +import b from 'lib6-1.js'; + +assert.sameValue(a.a, 1); +assert.sameValue(a.b, 2); + +assert.sameValue(a.a, b.a); +assert.sameValue(a.b, b.b); diff -r 95f57822bdaa -r fbd36220ea17 test/js/import_as_default_double.t.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/import_as_default_double.t.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,9 @@ +/*--- +includes: [] +flags: [] +paths: [test/js/module] +negative: + phase: runtime +---*/ + +import m from 'lib5.js'; diff -r 95f57822bdaa -r fbd36220ea17 test/js/module/lib4.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/module/lib4.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,2 @@ +var var10 = 10; +export { var10 as default }; diff -r 95f57822bdaa -r fbd36220ea17 test/js/module/lib5.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/module/lib5.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,6 @@ +var uu = 10; +var uu1 = 11; + +export { uu as default }; + +export { uu1 as default }; diff -r 95f57822bdaa -r fbd36220ea17 test/js/module/lib6-1.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/module/lib6-1.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,6 @@ +var obj = { + a:1, + b:2 +} + +export default obj; diff -r 95f57822bdaa -r fbd36220ea17 test/js/module/lib6.js --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/js/module/lib6.js Mon Mar 20 21:09:58 2023 -0700 @@ -0,0 +1,6 @@ +var obj = { + a:1, + b:2 +} + +export {obj as default}; From xeioex at nginx.com Tue Mar 21 04:26:39 2023 From: xeioex at nginx.com (Dmitry Volyntsev) Date: Tue, 21 Mar 2023 04:26:39 +0000 Subject: [njs] Crypto: added Hash.copy() method. Message-ID: details: https://hg.nginx.org/njs/rev/edf1c2aef957 branches: changeset: 2074:edf1c2aef957 user: Dmitry Volyntsev date: Mon Mar 20 21:25:47 2023 -0700 description: Crypto: added Hash.copy() method. This closes #625 issue on Github. diffstat: external/njs_crypto_module.c | 42 ++++++++++++++++++++++++++++++++++++++++++ src/test/njs_unit_test.c | 20 ++++++++++++++++++++ 2 files changed, 62 insertions(+), 0 deletions(-) diffs (96 lines): diff -r fbd36220ea17 -r edf1c2aef957 external/njs_crypto_module.c --- a/external/njs_crypto_module.c Mon Mar 20 21:09:58 2023 -0700 +++ b/external/njs_crypto_module.c Mon Mar 20 21:25:47 2023 -0700 @@ -67,6 +67,8 @@ static njs_int_t njs_hash_prototype_upda njs_uint_t nargs, njs_index_t hmac); static njs_int_t njs_hash_prototype_digest(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, njs_index_t hmac); +static njs_int_t njs_hash_prototype_copy(njs_vm_t *vm, njs_value_t *args, + njs_uint_t nargs, njs_index_t hmac); static njs_int_t njs_crypto_create_hmac(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, njs_index_t unused); @@ -173,6 +175,16 @@ static njs_external_t njs_ext_crypto_ha { .flags = NJS_EXTERN_METHOD, + .name.string = njs_str("copy"), + .writable = 1, + .configurable = 1, + .u.method = { + .native = njs_hash_prototype_copy, + } + }, + + { + .flags = NJS_EXTERN_METHOD, .name.string = njs_str("constructor"), .writable = 1, .configurable = 1, @@ -471,6 +483,36 @@ exception: static njs_int_t +njs_hash_prototype_copy(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, + njs_index_t unused) +{ + njs_digest_t *dgst, *copy; + + dgst = njs_vm_external(vm, njs_crypto_hash_proto_id, njs_argument(args, 0)); + if (njs_slow_path(dgst == NULL)) { + njs_type_error(vm, "\"this\" is not a hash object"); + return NJS_ERROR; + } + + if (njs_slow_path(dgst->alg == NULL)) { + njs_error(vm, "Digest already called"); + return NJS_ERROR; + } + + copy = njs_mp_alloc(njs_vm_memory_pool(vm), sizeof(njs_digest_t)); + if (njs_slow_path(copy == NULL)) { + njs_memory_error(vm); + return NJS_ERROR; + } + + memcpy(copy, dgst, sizeof(njs_digest_t)); + + return njs_vm_external_create(vm, njs_vm_retval(vm), + njs_crypto_hash_proto_id, copy, 0); +} + + +static njs_int_t njs_crypto_create_hmac(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, njs_index_t unused) { diff -r fbd36220ea17 -r edf1c2aef957 src/test/njs_unit_test.c --- a/src/test/njs_unit_test.c Mon Mar 20 21:09:58 2023 -0700 +++ b/src/test/njs_unit_test.c Mon Mar 20 21:25:47 2023 -0700 @@ -20360,6 +20360,26 @@ static njs_unit_test_t njs_crypto_modul "OBZPvRdgPXP2lri01yZk1zW7anyIV3aH/SrjP9aWQVM=," "OBZPvRdgPXP2lri01yZk1zW7anyIV3aH_SrjP9aWQVM") }, + { njs_str("const crypto = require('crypto');" + "let hash = crypto.createHash('sha256');" + "let digests = [];" + "hash.update('one');" + "digests.push(hash.copy().digest('hex'));" + "hash.update('two');" + "digests.push(hash.copy().digest('hex'));" + "hash.update('three');" + "digests.push(hash.copy().digest('hex'));" + "digests"), + njs_str("7692c3ad3540bb803c020b3aee66cd8887123234ea0c6e7143c0add73ff431ed," + "25b6746d5172ed6352966a013d93ac846e1110d5a25e8f183b5931f4688842a1," + "4592092e1061c7ea85af2aed194621cc17a2762bae33a79bf8ce33fd0168b801") }, + + { njs_str("const crypto = require('crypto');" + "let hash = crypto.createHash('sha256');" + "hash.update('one').digest();" + "hash.copy()"), + njs_str("Error: Digest already called") }, + { njs_str("var hash = require('crypto').createHash;" "njs.dump(['', 'abc'.repeat(100)].map(v => {" " return ['md5', 'sha1', 'sha256'].map(h => {" From yar at nginx.com Tue Mar 21 07:19:09 2023 From: yar at nginx.com (=?utf-8?q?Yaroslav_Zhuravlev?=) Date: Tue, 21 Mar 2023 08:19:09 +0100 Subject: [PATCH] Added TLSv1.3 to the default value of ssl_protocols and friends Message-ID: <477d0fe1e6cb95533ffb.1679383149@ORK-ML-00007151> xml/en/docs/http/configuring_https_servers.xml | 13 +++++++++---- xml/en/docs/http/ngx_http_grpc_module.xml | 4 ++-- xml/en/docs/http/ngx_http_proxy_module.xml | 4 ++-- xml/en/docs/http/ngx_http_ssl_module.xml | 6 +++--- xml/en/docs/http/ngx_http_uwsgi_module.xml | 4 ++-- xml/en/docs/mail/ngx_mail_ssl_module.xml | 6 +++--- xml/en/docs/stream/ngx_stream_proxy_module.xml | 4 ++-- xml/en/docs/stream/ngx_stream_ssl_module.xml | 6 +++--- xml/ru/docs/http/configuring_https_servers.xml | 13 +++++++++---- xml/ru/docs/http/ngx_http_grpc_module.xml | 4 ++-- xml/ru/docs/http/ngx_http_proxy_module.xml | 4 ++-- xml/ru/docs/http/ngx_http_ssl_module.xml | 6 +++--- xml/ru/docs/http/ngx_http_uwsgi_module.xml | 4 ++-- xml/ru/docs/mail/ngx_mail_ssl_module.xml | 6 +++--- xml/ru/docs/stream/ngx_stream_proxy_module.xml | 4 ++-- xml/ru/docs/stream/ngx_stream_ssl_module.xml | 6 +++--- 16 files changed, 52 insertions(+), 42 deletions(-) -------------- next part -------------- A non-text attachment was scrubbed... Name: nginx.org.patch Type: text/x-patch Size: 16654 bytes Desc: not available URL: From pluknet at nginx.com Tue Mar 21 09:50:58 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Tue, 21 Mar 2023 13:50:58 +0400 Subject: [PATCH] Win32: PCRE2 Unicode support with MSVC In-Reply-To: References: Message-ID: <066209D7-B63D-4A51-98C1-2CD0CFA33BFB@nginx.com> > On 21 Mar 2023, at 03:55, Maxim Dounin wrote: > > Hello! > > On Mon, Mar 20, 2023 at 06:58:32PM +0400, Sergey Kandaurov wrote: > >> # HG changeset patch >> # User Sergey Kandaurov >> # Date 1679324252 -14400 >> # Mon Mar 20 18:57:32 2023 +0400 >> # Node ID d0b013a7050e00613804b399ae2ca74551b2a071 >> # Parent 8771d35d55d0a2b1cefaab04401d6f837f5a05a2 >> Win32: PCRE2 Unicode support with MSVC. >> >> Unicode support in PCRE2 is enabled by default on configure/cmake side >> by defining SUPPORT_UNICODE. Previously, this macro was not defined >> when compiling directly PCRE2 sources for Windows with MSVC. >> >> In particular, this change allows to specify Unicode properties, such as >> \P, \p, or \X, as caught by http_server_name.t adjusted to run on Windows: >> >> nginx: [emerg] pcre2_compile() failed: this version of PCRE2 does not have >> support for \P, \p, or \X >> >> diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make >> --- a/auto/lib/pcre/make >> +++ b/auto/lib/pcre/make >> @@ -61,7 +61,7 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then >> >> PCRE_CFLAGS = -O2 -Ob1 -Oi -Gs $LIBC $CPU_OPT >> PCRE_FLAGS = -DHAVE_CONFIG_H -DPCRE2_STATIC -DPCRE2_CODE_UNIT_WIDTH=8 \\ >> - -DHAVE_MEMMOVE >> + -DHAVE_MEMMOVE -DSUPPORT_UNICODE >> >> PCRE_SRCS = $ngx_pcre_srcs >> PCRE_OBJS = $ngx_pcre_objs > > The PCRE2 compilation in auto/lib/pcre/make mostly matches PCRE > compilation in auto/lib/pcre/makefile.msvc, and it never tried to > enable Unicode / UTF-8 support. This in turn matches PCRE > configure behaviour: UTF-8 support is disabled by default and > needs to be explicitly enabled. This looks unrelated, because PCRE(1) is a different library. > > While we might consider enabling Unicode support for PCRE2, since > it is now enabled by default in PCRE2 (or for both PCRE and PCRE2, > since it is something usually expected to work nowadays), for > tests a better solution might be to don't rely on this. Unicode / > UTF-8 support might not be available on various other platforms as > well, so it's generally might be a good idea to adjust tests to > tolerate PCRE/PCRE2 compiled without Unicode / UTF-8 support. > As explained in the commit log, PCRE2 has Unicode support by default, as configured by configure or cmake, which makes it depend on how nginx for Windows was built: - PCRE2 Unicode support is present if built with GCC MinGW - it is not if built manually (missing configuration) with MSVC Such inconsistency doesn't look related to "various other platforms". -- Sergey Kandaurov From pluknet at nginx.com Tue Mar 21 11:24:47 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Tue, 21 Mar 2023 15:24:47 +0400 Subject: [PATCH 11 of 12] Win32: fixed ngx_fs_bsize() for symlinks In-Reply-To: <5EC16E2F-2F2D-4049-A734-6C734B7AE541@nginx.com> References:

<5F74999F-228E-43AB-B059-879964530E55@nginx.com> <5EC16E2F-2F2D-4049-A734-6C734B7AE541@nginx.com> Message-ID: <5495B4DB-F94F-49B9-A3B5-721ABBF442DF@nginx.com> > On 24 Feb 2023, at 14:40, Sergey Kandaurov wrote: > >> >> On 23 Feb 2023, at 22:46, Maxim Dounin wrote: >> >> Hello! >> >> On Wed, Feb 22, 2023 at 08:01:15PM +0400, Sergey Kandaurov wrote: >> >>>> On 19 Feb 2023, at 21:23, Maxim Dounin wrote: >>>> >>>> Hello! >>>> >>>> On Fri, Feb 17, 2023 at 07:17:02PM +0400, Sergey Kandaurov wrote: >>>> >>>>>> On 13 Jan 2023, at 01:35, Maxim Dounin wrote: >>>>>> >>>>>> # HG changeset patch >>>>>> # User Maxim Dounin >>>>>> # Date 1673549010 -10800 >>>>>> # Thu Jan 12 21:43:30 2023 +0300 >>>>>> # Node ID be7eb9ec28dcbfdfd2e850befc8d051c0e4d46fd >>>>>> # Parent e62c8e9724ba68a698a2c3613edca73fe4e1c4ae >>>>>> Win32: fixed ngx_fs_bsize() for symlinks. >>>>>> >>>>>> Just a drive letter might not correctly represent file system being used, >>>>>> notably when using symlinks (as created by "mklink /d"). As such, instead >>>>>> of calling GetDiskFreeSpace() with just a drive letter, we now always >>>>>> use GetDiskFreeSpace() with full path. >>>>>> >>>>>> diff -r e62c8e9724ba -r be7eb9ec28dc src/os/win32/ngx_files.c >>>>>> --- a/src/os/win32/ngx_files.c Thu Jan 12 21:43:14 2023 +0300 >>>>>> +++ b/src/os/win32/ngx_files.c Thu Jan 12 21:43:30 2023 +0300 >>>>>> @@ -955,14 +955,8 @@ ngx_directio_off(ngx_fd_t fd) >>>>>> size_t >>>>>> ngx_fs_bsize(u_char *name) >>>>>> { >>>>>> - u_char root[4]; >>>>>> u_long sc, bs, nfree, ncl; >>>>>> >>>>>> - if (name[2] == ':') { >>>>>> - ngx_cpystrn(root, name, 4); >>>>>> - name = root; >>>>>> - } >>>>>> - >>>>> >>>>> BTW, I wonder how this condition could be true. >>>>> Specifically, what name should represent in order to match. >>>>> I'm happy that it's leaving though. >>>> >>>> I tend to think that this actually never worked, and the original >>>> intention was to test name[1] instead. >>>> >>>> Updated commit log: >>>> >>>> : Win32: removed attempt to use a drive letter in ngx_fs_bsize(). >>>> : >>>> : Just a drive letter might not correctly represent file system being used, >>>> : notably when using symlinks (as created by "mklink /d"). As such, instead >>>> : of trying to call GetDiskFreeSpace() with just a drive letter, we now always >>>> : use GetDiskFreeSpace() with full path. >>>> : >>>> : Further, it looks like the code to use just a drive letter never worked, >>>> : since it tried to test name[2] instead of name[1] to be ':'. >>>> >>>> [...] >>>> >>> >>> Looks fine, thanks. >> >> Thanks for the review, pushed to http://mdounin.ru/hg/nginx. > > Tests for autoindex and dav modules for your consideration. Pushed, with some cleanup. -- Sergey Kandaurov From arut at nginx.com Tue Mar 21 13:13:45 2023 From: arut at nginx.com (Roman Arutyunyan) Date: Tue, 21 Mar 2023 17:13:45 +0400 Subject: [PATCH] SSL: enabled TLSv1.3 by default In-Reply-To: <3496c963b43636104fa7.1679318394@vm-bsd.mdounin.ru> References: <3496c963b43636104fa7.1679318394@vm-bsd.mdounin.ru> Message-ID: <20230321131345.cd3hmxihqls46ovw@N00W24XTQX> Hi, On Mon, Mar 20, 2023 at 04:19:54PM +0300, Maxim Dounin wrote: > # HG changeset patch > # User Maxim Dounin > # Date 1678891161 -10800 > # Wed Mar 15 17:39:21 2023 +0300 > # Node ID 3496c963b43636104fa794e84969eb077abec6b0 > # Parent b97f2b983d1564d29280d03828503edca21a79ee > SSL: enabled TLSv1.3 by default. > > diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c > --- a/src/http/modules/ngx_http_grpc_module.c > +++ b/src/http/modules/ngx_http_grpc_module.c > @@ -4473,8 +4473,9 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t > prev->upstream.ssl_session_reuse, 1); > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > "DEFAULT"); > diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c > --- a/src/http/modules/ngx_http_proxy_module.c > +++ b/src/http/modules/ngx_http_proxy_module.c > @@ -3734,8 +3734,9 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t > prev->upstream.ssl_session_reuse, 1); > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > "DEFAULT"); > diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c > --- a/src/http/modules/ngx_http_ssl_module.c > +++ b/src/http/modules/ngx_http_ssl_module.c > @@ -632,8 +632,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * > ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, > NGX_SSL_BUFSIZE); > diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c > --- a/src/http/modules/ngx_http_uwsgi_module.c > +++ b/src/http/modules/ngx_http_uwsgi_module.c > @@ -1875,8 +1875,9 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t > prev->upstream.ssl_session_reuse, 1); > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > "DEFAULT"); > diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c > --- a/src/mail/ngx_mail_ssl_module.c > +++ b/src/mail/ngx_mail_ssl_module.c > @@ -360,8 +360,9 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, > prev->prefer_server_ciphers, 0); > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c > --- a/src/stream/ngx_stream_proxy_module.c > +++ b/src/stream/ngx_stream_proxy_module.c > @@ -2163,8 +2163,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf > prev->ssl_session_reuse, 1); > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); > > diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c > --- a/src/stream/ngx_stream_ssl_module.c > +++ b/src/stream/ngx_stream_ssl_module.c > @@ -703,8 +703,9 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf > prev->prefer_server_ciphers, 0); > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > + (NGX_CONF_BITMASK_SET > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > https://mailman.nginx.org/mailman/listinfo/nginx-devel Looks fine From maxim at nginx.com Tue Mar 21 15:12:35 2023 From: maxim at nginx.com (Maxim Konovalov) Date: Tue, 21 Mar 2023 08:12:35 -0700 Subject: [PATCH] Linux packages: added Amazon Linux 2023 In-Reply-To: <23d3cabaab95fb09ea40.1679337499@QGCD7XG9R9> References: <23d3cabaab95fb09ea40.1679337499@QGCD7XG9R9> Message-ID: <07b0ed91-1a95-2b19-9121-9128b7d734d3@nginx.com> On 20.03.2023 11:38, Konstantin Pavlov wrote: > # HG changeset patch > # User Konstantin Pavlov > # Date 1679336457 25200 > # Mon Mar 20 11:20:57 2023 -0700 > # Node ID 23d3cabaab95fb09ea40f113759f4eaed99ec9d7 > # Parent 0f468b4e01d67cab96a44e0886dda3180104ae1a > Linux packages: added Amazon Linux 2023. > [...] Looks good. -- Maxim Konovalov From mdounin at mdounin.ru Tue Mar 21 19:49:53 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 21 Mar 2023 22:49:53 +0300 Subject: [PATCH] Win32: PCRE2 Unicode support with MSVC In-Reply-To: <066209D7-B63D-4A51-98C1-2CD0CFA33BFB@nginx.com> References: <066209D7-B63D-4A51-98C1-2CD0CFA33BFB@nginx.com> Message-ID: Hello! On Tue, Mar 21, 2023 at 01:50:58PM +0400, Sergey Kandaurov wrote: > > > On 21 Mar 2023, at 03:55, Maxim Dounin wrote: > > > > Hello! > > > > On Mon, Mar 20, 2023 at 06:58:32PM +0400, Sergey Kandaurov wrote: > > > >> # HG changeset patch > >> # User Sergey Kandaurov > >> # Date 1679324252 -14400 > >> # Mon Mar 20 18:57:32 2023 +0400 > >> # Node ID d0b013a7050e00613804b399ae2ca74551b2a071 > >> # Parent 8771d35d55d0a2b1cefaab04401d6f837f5a05a2 > >> Win32: PCRE2 Unicode support with MSVC. > >> > >> Unicode support in PCRE2 is enabled by default on configure/cmake side > >> by defining SUPPORT_UNICODE. Previously, this macro was not defined > >> when compiling directly PCRE2 sources for Windows with MSVC. > >> > >> In particular, this change allows to specify Unicode properties, such as > >> \P, \p, or \X, as caught by http_server_name.t adjusted to run on Windows: > >> > >> nginx: [emerg] pcre2_compile() failed: this version of PCRE2 does not have > >> support for \P, \p, or \X > >> > >> diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make > >> --- a/auto/lib/pcre/make > >> +++ b/auto/lib/pcre/make > >> @@ -61,7 +61,7 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then > >> > >> PCRE_CFLAGS = -O2 -Ob1 -Oi -Gs $LIBC $CPU_OPT > >> PCRE_FLAGS = -DHAVE_CONFIG_H -DPCRE2_STATIC -DPCRE2_CODE_UNIT_WIDTH=8 \\ > >> - -DHAVE_MEMMOVE > >> + -DHAVE_MEMMOVE -DSUPPORT_UNICODE > >> > >> PCRE_SRCS = $ngx_pcre_srcs > >> PCRE_OBJS = $ngx_pcre_objs > > > > The PCRE2 compilation in auto/lib/pcre/make mostly matches PCRE > > compilation in auto/lib/pcre/makefile.msvc, and it never tried to > > enable Unicode / UTF-8 support. This in turn matches PCRE > > configure behaviour: UTF-8 support is disabled by default and > > needs to be explicitly enabled. > > This looks unrelated, because PCRE(1) is a different library. Well, not really. Even if we consider these to be different libraries, both PCRE and PCRE2 are libraries to implement regular expression matching as used by nginx, and it looks logical that nginx compiles them with similar / identical feature sets when asked to compile. > > While we might consider enabling Unicode support for PCRE2, since > > it is now enabled by default in PCRE2 (or for both PCRE and PCRE2, > > since it is something usually expected to work nowadays), for > > tests a better solution might be to don't rely on this. Unicode / > > UTF-8 support might not be available on various other platforms as > > well, so it's generally might be a good idea to adjust tests to > > tolerate PCRE/PCRE2 compiled without Unicode / UTF-8 support. > > As explained in the commit log, PCRE2 has Unicode support by default, > as configured by configure or cmake, which makes it depend on how > nginx for Windows was built: > - PCRE2 Unicode support is present if built with GCC MinGW > - it is not if built manually (missing configuration) with MSVC > > Such inconsistency doesn't look related to "various other platforms". Similarly, when nginx on Windows is built with PCRE instead of PCRE2, Unicode support won't be available. Further, the same applies to PCRE on Unix as long as it is built by nginx (and UTF-8 support is not explicitly enabled with "--with-pcre-opt=..."). Further, there can be other platforms where PCRE (or even PCRE2) is built without Unicode support. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Wed Mar 22 01:02:01 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Wed, 22 Mar 2023 04:02:01 +0300 Subject: [PATCH] Tests: run syslog and error_log tests on win32 In-Reply-To: References: Message-ID: Hello! On Mon, Mar 20, 2023 at 06:13:34PM +0400, Sergey Kandaurov wrote: > # HG changeset patch > # User Sergey Kandaurov > # Date 1679321601 -14400 > # Mon Mar 20 18:13:21 2023 +0400 > # Node ID f3225ad9300ee2c11c0dec54b9605e67060b7347 > # Parent 1e1d0f3874b0c5b1e399ec76b0198b5c9c265a36 > Tests: run syslog and error_log tests on win32. > > They are supposed to work well now, no reason to skip them. It might be a good idea to explicitly mention why it wasn't supposed to work. > An exception is logging to stderr. And why stderr is not supposed to. (Just in case, the culprit is CreateProcess(CREATE_NO_WINDOW) used when starting worker processes, which creates a process without a console. This probably can be improved to preserve console if logging to stderr is used.) > > diff --git a/error_log.t b/error_log.t > --- a/error_log.t > +++ b/error_log.t > @@ -22,8 +22,6 @@ use Test::Nginx; > select STDERR; $| = 1; > select STDOUT; $| = 1; > > -plan(skip_all => 'win32') if $^O eq 'MSWin32'; > - > my $t = Test::Nginx->new()->has(qw/http limit_req/) > ->plan(25)->write_file_expand('nginx.conf', <<'EOF'); > > @@ -110,7 +108,7 @@ EOF > open OLDERR, ">&", \*STDERR; > open STDERR, '>', $t->testdir() . '/stderr' or die "Can't reopen STDERR: $!"; > open my $stderr, '<', $t->testdir() . '/stderr' > - or die "Can't open stderr file: $!"; > + or die "Can't open stderr file: $!" unless $^O eq 'MSWin32'; It shouldn't be a problem to open the file on Windows. Though will require explicitly closing it at the end of the test, so the test suite will be able to remove the test directory in destructor. (In other tests this will also require reordering of daemon startup, to avoid leaking the descriptor to daemons.) > > $t->run(); > > @@ -123,40 +121,69 @@ open STDERR, ">&", \*OLDERR; > http_get('/'); > > SKIP: { > - > skip "no --with-debug", 3 unless $t->has_module('--with-debug'); > > http_get('/debug'); > isnt(lines($t, 'e_debug_debug.log', '[debug]'), 0, 'file debug debug'); > is(lines($t, 'e_debug_info.log', '[debug]'), 0, 'file debug info'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > isnt(lines($t, 'stderr', '[debug]'), 0, 'stderr debug'); So this won't be a SKIP, but rather TODO. Further, it will actually work with "master_process off;". > > } > > +} > + > http_get('/info'); > is(lines($t, 'e_info_debug.log', '[info]'), 1, 'file info debug'); > is(lines($t, 'e_info_info.log', '[info]'), 1, 'file info info'); > is(lines($t, 'e_info_notice.log', '[info]'), 0, 'file info notice'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > is(lines($t, 'stderr', '[info]'), 1, 'stderr info'); > > +} > + > http_get('/notice'); > is(lines($t, 'e_notice_info.log', '[notice]'), 1, 'file notice info'); > is(lines($t, 'e_notice_notice.log', '[notice]'), 1, 'file notice notice'); > is(lines($t, 'e_notice_warn.log', '[notice]'), 0, 'file notice warn'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > is(lines($t, 'stderr', '[notice]'), 1, 'stderr notice'); > > +} > + > http_get('/warn'); > is(lines($t, 'e_warn_notice.log', '[warn]'), 1, 'file warn notice'); > is(lines($t, 'e_warn_warn.log', '[warn]'), 1, 'file warn warn'); > is(lines($t, 'e_warn_error.log', '[warn]'), 0, 'file warn error'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > is(lines($t, 'stderr', '[warn]'), 1, 'stderr warn'); > > +} > + > http_get('/error'); > is(lines($t, 'e_error_warn.log', '[error]'), 1, 'file error warn'); > is(lines($t, 'e_error_error.log', '[error]'), 1, 'file error error'); > is(lines($t, 'e_error_alert.log', '[error]'), 0, 'file error alert'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > is(lines($t, 'stderr', '[error]'), 1, 'stderr error'); > > +} > + > # count log messages emitted with various error_log levels > > http_get('/file_low'); > @@ -168,6 +195,9 @@ is(lines($t, 'e_multi.log', '[error]'), > http_get('/file_high'); > is(lines($t, 'e_multi_high.log', '[error]'), 1, 'file high'); > > +SKIP: { > +skip 'win32', 3 if $^O eq 'MSWin32'; > + > http_get('/stderr_low'); > is(lines($t, 'stderr', '[error]'), 2, 'stderr low'); > > @@ -177,6 +207,8 @@ is(lines($t, 'stderr', '[error]'), 2, 's > http_get('/stderr_high'); > is(lines($t, 'stderr', '[error]'), 1, 'stderr high'); > > +} > + > ############################################################################### > > sub lines { > diff --git a/mail_error_log.t b/mail_error_log.t > --- a/mail_error_log.t > +++ b/mail_error_log.t > @@ -26,8 +26,6 @@ use Test::Nginx::IMAP; > select STDERR; $| = 1; > select STDOUT; $| = 1; > > -plan(skip_all => 'win32') if $^O eq 'MSWin32'; > - > my $t = Test::Nginx->new()->has(qw/mail imap http rewrite/); > > $t->plan(30)->write_file_expand('nginx.conf', <<'EOF'); > @@ -87,7 +85,7 @@ EOF > open OLDERR, ">&", \*STDERR; > open STDERR, '>', $t->testdir() . '/stderr' or die "Can't reopen STDERR: $!"; > open my $stderr, '<', $t->testdir() . '/stderr' > - or die "Can't open stderr file: $!"; > + or die "Can't open stderr file: $!" unless $^O eq 'MSWin32'; > > $t->run_daemon(\&Test::Nginx::IMAP::imap_test_daemon); > $t->run_daemon(\&syslog_daemon, port(8981), $t, 's_glob.log'); > @@ -117,9 +115,15 @@ isnt(lines($t, 'e_debug.log', '[debug]') > > isnt(lines($t, 'e_info.log', '[info]'), 0, 'file info in info'); > is(lines($t, 'e_info.log', '[debug]'), 0, 'file debug in info'); > + > +SKIP: { > +skip 'win32', 2 if $^O eq 'MSWin32'; > + > isnt(lines($t, 'stderr', '[info]'), 0, 'stderr info in info'); > is(lines($t, 'stderr', '[debug]'), 0, 'stderr debug in info'); > > +} > + > # multiple error_log > > like($t->read_file('e_glob.log'), qr!nginx/[.0-9]+!, 'error global'); > @@ -255,13 +259,16 @@ sub syslog_daemon { > LocalAddr => "127.0.0.1:$port" > ); > > - open my $fh, '>', $t->testdir() . '/' . $file; > - select $fh; $| = 1; > + my $path = $t->testdir() . '/' . $file; > + open my $fh, '>', $path; > + close $fh; > > while (1) { > my $buffer; > $s->recv($buffer, 4096); > + open $fh, '>>', $path; > print $fh $buffer . "\n"; > + close $fh; > } It might be a good idea to clarify in the commit log why this is needed. (Notably, that pseudo-processes created by Perl's fork() emulation on win32 cannot be gracefully stopped when they are blocked in a system call, and using kill('KILL') as nginx does seems to leave the files open.) > } > > diff --git a/stream_error_log.t b/stream_error_log.t > --- a/stream_error_log.t > +++ b/stream_error_log.t > @@ -26,8 +26,6 @@ use Test::Nginx::Stream qw/ stream /; > select STDERR; $| = 1; > select STDOUT; $| = 1; > > -plan(skip_all => 'win32') if $^O eq 'MSWin32'; > - > my $t = Test::Nginx->new()->has(qw/stream/)->plan(34); > > $t->write_file_expand('nginx.conf', <<'EOF'); > @@ -75,7 +73,7 @@ EOF > open OLDERR, ">&", \*STDERR; > open STDERR, '>', $t->testdir() . '/stderr' or die "Can't reopen STDERR: $!"; > open my $stderr, '<', $t->testdir() . '/stderr' > - or die "Can't open stderr file: $!"; > + or die "Can't open stderr file: $!" unless $^O eq 'MSWin32'; > > $t->run_daemon(\&stream_daemon); > $t->run_daemon(\&syslog_daemon, port(8983), $t, 's_glob.log'); > @@ -104,9 +102,15 @@ isnt(lines($t, 'e_debug.log', '[debug]') > > isnt(lines($t, 'e_info.log', '[info]'), 0, 'file info in info'); > is(lines($t, 'e_info.log', '[debug]'), 0, 'file debug in info'); > + > +SKIP: { > +skip 'win32', 2 if $^O eq 'MSWin32'; > + > isnt(lines($t, 'stderr', '[info]'), 0, 'stderr info in info'); > is(lines($t, 'stderr', '[debug]'), 0, 'stderr debug in info'); > > +} > + > # multiple error_log > > like($t->read_file('e_glob.log'), qr!nginx/[.0-9]+!, 'error global'); > @@ -135,8 +139,14 @@ my $msg = 'no live upstreams while conne > > unlike($t->read_file('e_glob.log'), qr/$msg/ms, 'stream error in global'); > like($t->read_file('e_info.log'), qr/$msg/ms, 'stream error in info'); > +unlike($t->read_file('e_emerg.log'), qr/$msg/ms, 'stream error in emerg'); > + > +SKIP: { > +skip 'win32', 1 if $^O eq 'MSWin32'; > + > like($t->read_file('stderr'), qr/$msg/ms, 'stream error in info stderr'); > -unlike($t->read_file('e_emerg.log'), qr/$msg/ms, 'stream error in emerg'); > + > +} > > $msg = "bytes from/to client:5/4, bytes from/to upstream:4/5"; > > @@ -264,13 +274,16 @@ sub syslog_daemon { > LocalAddr => "127.0.0.1:$port" > ); > > - open my $fh, '>', $t->testdir() . '/' . $file; > - select $fh; $| = 1; > + my $path = $t->testdir() . '/' . $file; > + open my $fh, '>', $path; > + close $fh; > > while (1) { > my $buffer; > $s->recv($buffer, 4096); > + open $fh, '>>', $path; > print $fh $buffer . "\n"; > + close $fh; > } > } > > diff --git a/syslog.t b/syslog.t > --- a/syslog.t > +++ b/syslog.t > @@ -25,8 +25,6 @@ use Test::Nginx; > select STDERR; $| = 1; > select STDOUT; $| = 1; > > -plan(skip_all => 'win32') if $^O eq 'MSWin32'; > - > my $t = Test::Nginx->new()->has(qw/http limit_req/)->plan(62); > > $t->write_file_expand('nginx.conf', <<'EOF'); > @@ -186,7 +184,6 @@ is($lines[1], $lines[2], 'error_log many > # error_log log levels > > SKIP: { > - > skip "no --with-debug", 1 unless $t->has_module('--with-debug'); > > isnt(syslog_lines('/debug', '[debug]'), 0, 'debug'); > @@ -340,13 +337,16 @@ sub syslog_daemon { > LocalAddr => "127.0.0.1:$port" > ); > > - open my $fh, '>', $t->testdir() . '/' . $file; > - select $fh; $| = 1; > + my $path = $t->testdir() . '/' . $file; > + open my $fh, '>', $path; > + close $fh; > > while (1) { > my $buffer; > $s->recv($buffer, 4096); > + open $fh, '>>', $path; > print $fh $buffer . "\n"; > + close $fh; > } > } > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > https://mailman.nginx.org/mailman/listinfo/nginx-devel -- Maxim Dounin http://mdounin.ru/ From pluknet at nginx.com Wed Mar 22 08:57:56 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 12:57:56 +0400 Subject: [PATCH 01 of 20] Tests: separate SSL session reuse tests In-Reply-To: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> References: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> Message-ID: <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679105686 -10800 > # Sat Mar 18 05:14:46 2023 +0300 > # Node ID 86c394a226d2a7d463da7a1b7e88375c71c0c69b > # Parent 3c9aa6c23fc836725b96cf056d218217a5a81603 > Tests: separate SSL session reuse tests. > > Instead of being mixed with generic SSL tests, session reuse variants > are now tested in a separate file. > > In the generic SSL tests only basic session reuse is now tested, > notably with session tickets enabled and a shared SSL session cache. > This should make it possible to reuse sessions in all cases (except > when it's not supported, such as with LibreSSL with TLSv1.3). > > Note that session reuse with tickets implies that $ssl_session_id > is selected by the client and therefore is not available on the > initial connection. Relevant test is modified to handle this. > > Further, BoringSSL does not use legacy session ID with TLSv1.3 even > if it is sent by the client. In contrast, OpenSSL always generates > an unique legacy session id, so it is available with TLSv1.3 even if > session resumption does not work (such as with old Net::SSLeay and > IO::Socket::SSL modules). Note that TLSv1.3 has only ticket based session resumption. BoringSSL has a different notion on using legacy session IDs in TLSv1.3, see tls13_create_session_with_ticket() in sources: // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. // Envoy's tests depend on this, although perhaps they shouldn't. SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id); Later, SSL_SESSION_get_id() was additionally annotated in ssl.h: // As a workaround for some broken applications, BoringSSL sometimes synthesizes // arbitrary session IDs for non-ID-based sessions. This behavior may be // removed in the future. As for TLSv1.3 server context, BoringSSL doesn't seem to use "session ID" besides echoing the client's legacy_session_id field content in the legacy_session_id_echo field of ServerHello/HRR during handshake, as mandated in RFC 8446, 4.1.3. So it doesn't settle in the session. > > diff --git a/ssl.t b/ssl.t > --- a/ssl.t > +++ b/ssl.t > @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( > plan(skip_all => 'IO::Socket::SSL too old') if $@; > > my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) > - ->has_daemon('openssl')->plan(28); > + ->has_daemon('openssl')->plan(21); > > $t->write_file_expand('nginx.conf', <<'EOF'); > > @@ -47,7 +47,6 @@ http { > > ssl_certificate_key localhost.key; > ssl_certificate localhost.crt; > - ssl_session_tickets off; > > log_format ssl $ssl_protocol; > > @@ -59,6 +58,7 @@ http { > ssl_certificate_key inner.key; > ssl_certificate inner.crt; > ssl_session_cache shared:SSL:1m; > + ssl_session_tickets on; > ssl_verify_client optional_no_ca; > > keepalive_requests 1000; > @@ -100,57 +100,11 @@ http { > } > > server { > - listen 127.0.0.1:8081; > - server_name localhost; > - > - # Special case for enabled "ssl" directive. > - > - ssl on; Removing tests for the "ssl" legacy directive doesn't feel right now and is out of scope of this change. Please put this back. Not being able to test it is fragile and can be left silently broken, especially with the upcoming quic merge. On the other hand, I'm fine with finally removing this directive. It was made obsolete in version 1.15.0, released on 05 Jun 2018, with the "listen .. ssl" upgrade path available back to 0.7.14, released on 01 Sep 2008. > - ssl_session_cache builtin; > - > - location / { > - return 200 "body $ssl_session_reused"; > - } > - } > - > - server { > - listen 127.0.0.1:8082 ssl; > - server_name localhost; > - > - ssl_session_cache builtin:1000; > - > - location / { > - return 200 "body $ssl_session_reused"; > - } > - } > - > - server { > - listen 127.0.0.1:8083 ssl; > - server_name localhost; > - > - ssl_session_cache none; > - > - location / { > - return 200 "body $ssl_session_reused"; > - } > - } > - > - server { > - listen 127.0.0.1:8084 ssl; > - server_name localhost; > - > - ssl_session_cache off; > - > - location / { > - return 200 "body $ssl_session_reused"; > - } > - } > - > - server { > listen 127.0.0.1:8086 ssl; Since you noticeably touched this file, you could renumber these ports as well. > server_name localhost; > > ssl_session_cache shared:SSL:1m; > + ssl_session_tickets on; > ssl_session_timeout 1; > > location / { > @@ -216,59 +170,34 @@ foreach my $name ('localhost', 'inner') > or die "Can't create certificate for $name: $!\n"; > } > > -# suppress deprecation warning > - > -open OLDERR, ">&", \*STDERR; close STDERR; > $t->run(); > -open STDERR, ">&", \*OLDERR; > > ############################################################################### > > -my $ctx; > +# ssl session reuse > > -SKIP: { > -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ > - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); > +my $ctx = get_ssl_context(); > > -$ctx = get_ssl_context(); > +like(get('/', 8085, $ctx), qr/^body \.$/m, 'session'); > > -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); > -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); > - > -$ctx = get_ssl_context(); > +TODO: { > +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' > + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); > +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' > + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); Not sure why do you convert this to TODO. TODO blocks are used for something we control or able to fix. SSL libraries are not something like that, so using SKIP there is more appropriate and follows other platform-specific tests. Besides that, TODOs plagues diagnostic output for no purpose. See also Test::More documentation: When do I use SKIP vs. TODO? If it's something the user might not be able to do, use SKIP. This includes optional modules that aren't installed, running under an OS that doesn't have some feature (like "fork()" or symlinks), or maybe you need an Internet connection and one isn't available. If it's something the programmer hasn't done yet, use TODO. This is for any code you haven't written yet, or bugs you have yet to fix, but want to put tests in your testing script (always a good idea). > > -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); > -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); > - > -$ctx = get_ssl_context(); > - > -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); > -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); > +like(get('/', 8085, $ctx), qr/^body r$/m, 'session reused'); > > } > > -$ctx = get_ssl_context(); > - > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); > - > -$ctx = get_ssl_context(); > - > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); > - > # ssl certificate inheritance > > -my $s = get_ssl_socket(8081); > +my $s = get_ssl_socket(8086); > like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); > > -$s->close(); > - > $s = get_ssl_socket(8085); > like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); > > -$s->close(); > - > # session timeout > > $ctx = get_ssl_context(); > @@ -280,8 +209,12 @@ like(get('/', 8086, $ctx), qr/^body \.$/ > > # embedded variables > > -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); > +$ctx = get_ssl_context(); > +like(get('/id', 8085, $ctx), qr/^body (\w{64})?$/m, 'session id'); > +like(get('/id', 8085, $ctx), qr/^body \w{64}$/m, 'session id reused'); > + > unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); > + > like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); > > SKIP: { > @@ -334,6 +267,10 @@ like(`grep -F '[crit]' ${\($t->testdir() > > ############################################################################### > > +sub test_tls13 { > + return get('/protocol', 8085) =~ /TLSv1.3/; > +} > + > sub get { > my ($uri, $port, $ctx) = @_; > my $s = get_ssl_socket($port, $ctx) or return; > diff --git a/ssl.t b/ssl_session_reuse.t > copy from ssl.t > copy to ssl_session_reuse.t > --- a/ssl.t > +++ b/ssl_session_reuse.t > @@ -2,6 +2,7 @@ > > # (C) Sergey Kandaurov Initial session resumption tests in ssl.t is Andrey's work. You can drop this line, doesn't belong there. > # (C) Andrey Zelenkov > +# (C) Maxim Dounin > # (C) Nginx, Inc. > > # Tests for http ssl module. The description needs update. You can drop the line "use Socket qw/ CRLF /;" below, now unused. > @@ -30,8 +31,8 @@ plan(skip_all => 'IO::Socket::SSL not in > eval { IO::Socket::SSL::SSL_VERIFY_NONE(); }; > plan(skip_all => 'IO::Socket::SSL too old') if $@; > > -my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) > - ->has_daemon('openssl')->plan(28); > +my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite/) > + ->has_daemon('openssl')->plan(8); > > $t->write_file_expand('nginx.conf', <<'EOF'); > > @@ -47,66 +48,37 @@ http { > > ssl_certificate_key localhost.key; > ssl_certificate localhost.crt; > - ssl_session_tickets off; > - > - log_format ssl $ssl_protocol; > > server { > - listen 127.0.0.1:8085 ssl; > - listen 127.0.0.1:8080; > + listen 127.0.0.1:8443 ssl; > server_name localhost; > > - ssl_certificate_key inner.key; > - ssl_certificate inner.crt; > - ssl_session_cache shared:SSL:1m; > - ssl_verify_client optional_no_ca; > - > - keepalive_requests 1000; > - > location / { > return 200 "body $ssl_session_reused"; > } > - location /id { > - return 200 "body $ssl_session_id"; > - } > - location /cipher { > - return 200 "body $ssl_cipher"; > - } > - location /ciphers { > - return 200 "body $ssl_ciphers"; > - } > - location /client_verify { > - return 200 "body $ssl_client_verify"; > - } > location /protocol { > return 200 "body $ssl_protocol"; > } > - location /issuer { > - return 200 "body $ssl_client_i_dn:$ssl_client_i_dn_legacy"; > - } > - location /subject { > - return 200 "body $ssl_client_s_dn:$ssl_client_s_dn_legacy"; > - } > - location /time { > - return 200 "body $ssl_client_v_start!$ssl_client_v_end!$ssl_client_v_remain"; > - } > - > - location /body { > - add_header X-Body $request_body always; > - proxy_pass http://127.0.0.1:8080/; > - > - access_log %%TESTDIR%%/ssl.log ssl; > - } > } > > server { > - listen 127.0.0.1:8081; > + listen 127.0.0.1:8444 ssl; > server_name localhost; > > - # Special case for enabled "ssl" directive. > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets on; > > - ssl on; > - ssl_session_cache builtin; > + location / { > + return 200 "body $ssl_session_reused"; > + } > + } > + > + server { > + listen 127.0.0.1:8445 ssl; > + server_name localhost; > + > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets off; > > location / { > return 200 "body $ssl_session_reused"; > @@ -114,10 +86,11 @@ http { > } > > server { > - listen 127.0.0.1:8082 ssl; > + listen 127.0.0.1:8446 ssl; > server_name localhost; > > - ssl_session_cache builtin:1000; > + ssl_session_cache builtin; > + ssl_session_tickets off; > > location / { > return 200 "body $ssl_session_reused"; > @@ -125,10 +98,11 @@ http { > } > > server { > - listen 127.0.0.1:8083 ssl; > + listen 127.0.0.1:8447 ssl; > server_name localhost; > > - ssl_session_cache none; > + ssl_session_cache builtin:1000; > + ssl_session_tickets off; > > location / { > return 200 "body $ssl_session_reused"; > @@ -136,10 +110,11 @@ http { > } > > server { > - listen 127.0.0.1:8084 ssl; > + listen 127.0.0.1:8448 ssl; > server_name localhost; > > - ssl_session_cache off; > + ssl_session_cache none; > + ssl_session_tickets off; > > location / { > return 200 "body $ssl_session_reused"; > @@ -147,11 +122,11 @@ http { > } > > server { > - listen 127.0.0.1:8086 ssl; > + listen 127.0.0.1:8449 ssl; > server_name localhost; > > - ssl_session_cache shared:SSL:1m; > - ssl_session_timeout 1; > + ssl_session_cache off; > + ssl_session_tickets off; > > location / { > return 200 "body $ssl_session_reused"; > @@ -171,44 +146,7 @@ EOF > > my $d = $t->testdir(); > > -$t->write_file('ca.conf', < -[ ca ] > -default_ca = myca > - > -[ myca ] > -new_certs_dir = $d > -database = $d/certindex > -default_md = sha256 > -policy = myca_policy > -serial = $d/certserial > -default_days = 3 > - > -[ myca_policy ] > -commonName = supplied > -EOF > - > -$t->write_file('certserial', '1000'); > -$t->write_file('certindex', ''); > - > -system('openssl req -x509 -new ' > - . "-config $d/openssl.conf -subj /CN=issuer/ " > - . "-out $d/issuer.crt -keyout $d/issuer.key " > - . ">>$d/openssl.out 2>&1") == 0 > - or die "Can't create certificate for issuer: $!\n"; > - > -system("openssl req -new " > - . "-config $d/openssl.conf -subj /CN=subject/ " > - . "-out $d/subject.csr -keyout $d/subject.key " > - . ">>$d/openssl.out 2>&1") == 0 > - or die "Can't create certificate for subject: $!\n"; > - > -system("openssl ca -batch -config $d/ca.conf " > - . "-keyfile $d/issuer.key -cert $d/issuer.crt " > - . "-subj /CN=subject/ -in $d/subject.csr -out $d/subject.crt " > - . ">>$d/openssl.out 2>&1") == 0 > - or die "Can't sign certificate for subject: $!\n"; > - > -foreach my $name ('localhost', 'inner') { > +foreach my $name ('localhost') { > system('openssl req -x509 -new ' > . "-config $d/openssl.conf -subj /CN=$name/ " > . "-out $d/$name.crt -keyout $d/$name.key " > @@ -216,124 +154,56 @@ foreach my $name ('localhost', 'inner') > or die "Can't create certificate for $name: $!\n"; > } > > -# suppress deprecation warning > - > -open OLDERR, ">&", \*STDERR; close STDERR; > $t->run(); > -open STDERR, ">&", \*OLDERR; > > ############################################################################### > > my $ctx; You can remove this declaration to the only sub test_reuse user. > > -SKIP: { > -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ > - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); > - > -$ctx = get_ssl_context(); > - > -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); > -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); > +# session reuse: > +# > +# - only tickets, the default > +# - tickets and shared cache, should work always > +# - only shared cache > +# - only builtin cache > +# - only builtin cache with explicitly configured size > +# - only cache none > +# - only cache off > > -$ctx = get_ssl_context(); > - > -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); > -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); > +TODO: { > +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' > + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); > +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' > + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); > > -$ctx = get_ssl_context(); > - > -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); > -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); > +is(test_reuse(8443), 1, 'tickets reused'); > +is(test_reuse(8444), 1, 'tickets and cache reused'); > +is(test_reuse(8445), 1, 'cache shared reused'); > +is(test_reuse(8446), 1, 'cache builtin reused'); > +is(test_reuse(8447), 1, 'cache builtin size reused'); > > } > > -$ctx = get_ssl_context(); > - > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); > - > -$ctx = get_ssl_context(); > - > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); > - > -# ssl certificate inheritance > - > -my $s = get_ssl_socket(8081); > -like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); > - > -$s->close(); > - > -$s = get_ssl_socket(8085); > -like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); > - > -$s->close(); > - > -# session timeout > - > -$ctx = get_ssl_context(); > - > -get('/', 8086, $ctx); > -select undef, undef, undef, 2.1; > - > -like(get('/', 8086, $ctx), qr/^body \.$/m, 'session timeout'); > - > -# embedded variables > - > -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); > -unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); > -like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); > - > -SKIP: { > -skip 'BoringSSL', 1 if $t->has_module('BoringSSL'); > - > -like(get('/ciphers', 8085), qr/^body [:\w-]+$/m, 'ciphers'); > - > -} > - > -like(get('/client_verify', 8085), qr/^body NONE$/m, 'client verify'); > -like(get('/protocol', 8085), qr/^body (TLS|SSL)v(\d|\.)+$/m, 'protocol'); > -like(cert('/issuer', 8085), qr!^body CN=issuer:/CN=issuer$!m, 'issuer'); > -like(cert('/subject', 8085), qr!^body CN=subject:/CN=subject$!m, 'subject'); > -like(cert('/time', 8085), qr/^body [:\s\w]+![:\s\w]+![23]$/m, 'time'); > - > -# c->read->ready handling bug in ngx_ssl_recv(), triggered with chunked body > - > -like(get_body('/body', '0123456789', 20, 5), qr/X-Body: (0123456789){100}/, > - 'request body chunked'); > - > -# pipelined requests > - > -$s = get_ssl_socket(8085); > -my $req = < -GET / HTTP/1.1 > -Host: localhost > - > -EOF > - > -$req x= 1000; > - > -my $r = http($req, socket => $s) || ""; > -$s = undef; > -is(() = $r =~ /(200 OK)/g, 1000, 'pipelined requests'); > - > -# OpenSSL 3.0 error "unexpected eof while reading" seen as a critical error > - > -ok(get_ssl_socket(8085), 'ssl unexpected eof'); > - > -# close_notify is sent before lingering close > - > -is(get_ssl_shutdown(8085), 1, 'ssl shutdown on lingering close'); > +is(test_reuse(8448), 0, 'cache none not reused'); > +is(test_reuse(8449), 0, 'cache off not reused'); > > $t->stop(); > > -like($t->read_file('ssl.log'), qr/^(TLS|SSL)v(\d|\.)+$/m, > - 'log ssl variable on lingering close'); > - > like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); > > ############################################################################### > > +sub test_tls13 { > + return get('/protocol', 8443) =~ /TLSv1.3/; > +} > + > +sub test_reuse { > + my ($port) = @_; > + $ctx = get_ssl_context(); > + get('/', $port, $ctx); > + return (get('/', $port, $ctx) =~ qr/^body r$/m) ? 1 : 0; > +} > + > sub get { > my ($uri, $port, $ctx) = @_; > my $s = get_ssl_socket($port, $ctx) or return; > @@ -342,30 +212,6 @@ sub get { > return $r; > } > > -sub get_body { > - my ($uri, $body, $len, $n) = @_; > - my $s = get_ssl_socket(8085) or return; > - http("GET /body HTTP/1.1" . CRLF > - . "Host: localhost" . CRLF > - . "Connection: close" . CRLF > - . "Transfer-Encoding: chunked" . CRLF . CRLF, > - socket => $s, start => 1); > - my $chs = unpack("H*", pack("C", length($body) * $len)); > - http($chs . CRLF . $body x $len . CRLF, socket => $s, start => 1) > - for 1 .. $n; > - my $r = http("0" . CRLF . CRLF, socket => $s); > - $s->close(); > - return $r; > -} > - > -sub cert { > - my ($uri, $port) = @_; > - my $s = get_ssl_socket($port, undef, > - SSL_cert_file => "$d/subject.crt", > - SSL_key_file => "$d/subject.key") or return; > - http_get($uri, socket => $s); > -} > - > sub get_ssl_context { > return IO::Socket::SSL::SSL_Context->new( > SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(), > @@ -402,18 +248,4 @@ sub get_ssl_socket { > return $s; > } > > -sub get_ssl_shutdown { > - my ($port) = @_; > - > - my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > - my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > - Net::SSLeay::set_fd($ssl, fileno($s)); > - Net::SSLeay::connect($ssl) or die("ssl connect"); > - Net::SSLeay::write($ssl, 'GET /' . CRLF . 'extra'); > - Net::SSLeay::read($ssl); > - Net::SSLeay::set_shutdown($ssl, 1); > - Net::SSLeay::shutdown($ssl); > -} > - > ############################################################################### -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 09:20:25 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 13:20:25 +0400 Subject: [PATCH 03 of 20] Tests: separate SSL session reuse tests in mail In-Reply-To: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> References: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> Message-ID: > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679107816 -10800 > # Sat Mar 18 05:50:16 2023 +0300 > # Node ID 97b09b6633f69747c0d6ef13c76739bdd6b7f3bb > # Parent 125fb8461d88a81a62ccb40d0e205a01ecc759f5 > Tests: separate SSL session reuse tests in mail. > > Instead of being mixed with generic SSL tests, session reuse variants > are now tested in a separate file. > > diff --git a/mail_ssl.t b/mail_ssl.t > --- a/mail_ssl.t > +++ b/mail_ssl.t > @@ -37,7 +37,7 @@ eval { exists &Net::SSLeay::P_alpn_selec > plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; > > my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) > - ->has_daemon('openssl')->plan(22); > + ->has_daemon('openssl')->plan(18); > > $t->write_file_expand('nginx.conf', <<'EOF'); > > @@ -51,44 +51,25 @@ events { > mail { > ssl_certificate_key localhost.key; > ssl_certificate localhost.crt; > - ssl_session_tickets off; > > ssl_password_file password; > > auth_http http://127.0.0.1:8080; # unused > > - ssl_session_cache none; > - > server { > listen 127.0.0.1:8143; > listen 127.0.0.1:8145 ssl; > protocol imap; > - > - ssl_session_cache builtin; > } > > server { > - listen 127.0.0.1:8146 ssl; > - protocol imap; > - > - ssl_session_cache off; > - } > - > - server { > - listen 127.0.0.1:8147; > + listen 127.0.0.1:8148; > protocol imap; > > # Special case for enabled "ssl" directive. > > ssl on; > - ssl_session_cache builtin:1000; > - } > > - server { > - listen 127.0.0.1:8148 ssl; > - protocol imap; > - > - ssl_session_cache shared:SSL:1m; > ssl_certificate_key inherits.key; > ssl_certificate inherits.crt; > } > @@ -169,46 +150,16 @@ open STDERR, ">&", \*OLDERR; > > ############################################################################### > > +my ($s, $ssl, $ses); > + $ses is no longer used there, and other cleanup on top off this change: diff --git a/mail_ssl.t b/mail_ssl.t --- a/mail_ssl.t +++ b/mail_ssl.t @@ -150,7 +150,7 @@ open STDERR, ">&", \*OLDERR; ############################################################################### -my ($s, $ssl, $ses); +my ($s, $ssl); # simple tests to ensure that nothing broke with ssl_password_file directive @@ -170,7 +170,7 @@ like(Net::SSLeay::dump_peer_certificate( # alpn -ok(get_ssl_socket(8148, undef, ['imap']), 'alpn'); +ok(get_ssl_socket(8148, ['imap']), 'alpn'); SKIP: { $t->{_configure_args} =~ /LibreSSL ([\d\.]+)/; @@ -181,7 +181,7 @@ skip 'OpenSSL too old', 1 if defined $1 TODO: { local $TODO = 'not yet' unless $t->has_version('1.21.4'); -ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected'); +ok(!get_ssl_socket(8148, ['unknown']), 'alpn rejected'); } @@ -268,11 +268,10 @@ ok(!get_ssl_socket(8148, undef, ['unknow ############################################################################### sub get_ssl_socket { - my ($port, $ses, $alpn) = @_; + my ($port, $alpn) = @_; my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_session($ssl, $ses) if defined $ses; Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; Net::SSLeay::set_fd($ssl, fileno($s)); Net::SSLeay::connect($ssl) == 1 or return; diff --git a/mail_ssl_session_reuse.t b/mail_ssl_session_reuse.t --- a/mail_ssl_session_reuse.t +++ b/mail_ssl_session_reuse.t @@ -132,8 +132,6 @@ my $ctx = Net::SSLeay::CTX_new() or die( ############################################################################### -my ($ssl, $ses); - # session reuse: # # - only tickets, the default -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 09:46:33 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 13:46:33 +0400 Subject: [PATCH 03 of 20] Tests: separate SSL session reuse tests in mail In-Reply-To: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> References: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> Message-ID: > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679107816 -10800 > # Sat Mar 18 05:50:16 2023 +0300 > # Node ID 97b09b6633f69747c0d6ef13c76739bdd6b7f3bb > # Parent 125fb8461d88a81a62ccb40d0e205a01ecc759f5 > Tests: separate SSL session reuse tests in mail. > > Instead of being mixed with generic SSL tests, session reuse variants > are now tested in a separate file. > > [..] > diff --git a/mail_ssl.t b/mail_ssl_session_reuse.t > copy from mail_ssl.t > copy to mail_ssl_session_reuse.t > --- a/mail_ssl.t > +++ b/mail_ssl_session_reuse.t > @@ -1,6 +1,7 @@ > #!/usr/bin/perl > > # (C) Andrey Zelenkov > +# (C) Maxim Dounin > # (C) Nginx, Inc. > > # Tests for mail ssl module. > @@ -33,11 +34,8 @@ eval { > }; > plan(skip_all => 'Net::SSLeay not installed') if $@; > > -eval { exists &Net::SSLeay::P_alpn_selected or die; }; > -plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; > - > -my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) > - ->has_daemon('openssl')->plan(22); > +my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap/) > + ->has_daemon('openssl')->plan(7); > > $t->write_file_expand('nginx.conf', <<'EOF'); > > @@ -49,90 +47,62 @@ events { > } > > mail { > - ssl_certificate_key localhost.key; > - ssl_certificate localhost.crt; > - ssl_session_tickets off; > + auth_http http://127.0.0.1:8080; > > - ssl_password_file password; > - > - auth_http http://127.0.0.1:8080; # unused > - > - ssl_session_cache none; > + ssl_certificate localhost.crt; > + ssl_certificate_key localhost.key; > > server { > - listen 127.0.0.1:8143; > - listen 127.0.0.1:8145 ssl; > - protocol imap; > - > - ssl_session_cache builtin; > + listen 127.0.0.1:8993 ssl; > + protocol imap; > } > > server { > - listen 127.0.0.1:8146 ssl; > - protocol imap; > + listen 127.0.0.1:8994 ssl; > + protocol imap; > > - ssl_session_cache off; > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets on; > } > > server { > - listen 127.0.0.1:8147; > - protocol imap; > + listen 127.0.0.1:8995 ssl; > + protocol imap; > > - # Special case for enabled "ssl" directive. > - > - ssl on; > - ssl_session_cache builtin:1000; > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8148 ssl; > - protocol imap; > - > - ssl_session_cache shared:SSL:1m; > - ssl_certificate_key inherits.key; > - ssl_certificate inherits.crt; > - } > + listen 127.0.0.1:8996 ssl; > + protocol imap; > > - server { > - listen 127.0.0.1:8149; > - protocol imap; > - > - starttls on; > - } > - > - server { > - listen 127.0.0.1:8150; > - protocol imap; > - > - starttls only; > + ssl_session_cache builtin; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8151; > - protocol pop3; > + listen 127.0.0.1:8997 ssl; > + protocol imap; > > - starttls on; > + ssl_session_cache builtin:1000; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8152; > - protocol pop3; > + listen 127.0.0.1:8998 ssl; > + protocol imap; > > - starttls only; > + ssl_session_cache none; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8153; > - protocol smtp; > - > - starttls on; > - } > + listen 127.0.0.1:8999 ssl; > + protocol imap; > > - server { > - listen 127.0.0.1:8154; > - protocol smtp; > - > - starttls only; > + ssl_session_cache off; > + ssl_session_tickets off; > } > } > > @@ -148,181 +118,57 @@ EOF > > my $d = $t->testdir(); > > -foreach my $name ('localhost', 'inherits') { > - system("openssl genrsa -out $d/$name.key -passout pass:localhost " > - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 > - or die "Can't create private key: $!\n"; > +foreach my $name ('localhost') { > system('openssl req -x509 -new ' > . "-config $d/openssl.conf -subj /CN=$name/ " > - . "-out $d/$name.crt " > - . "-key $d/$name.key -passin pass:localhost" > + . "-out $d/$name.crt -keyout $d/$name.key " > . ">>$d/openssl.out 2>&1") == 0 > or die "Can't create certificate for $name: $!\n"; > } > > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > -$t->write_file('password', 'localhost'); > > -open OLDERR, ">&", \*STDERR; close STDERR; > $t->run(); > -open STDERR, ">&", \*OLDERR; > > ############################################################################### > > [..] > +# session reuse: > +# > +# - only tickets, the default > +# - tickets and shared cache "should work always", like in http and stream? > +# - only shared cache > +# - only builtin cache > +# - only builtin cache with explicitly configured size > +# - only cache none > +# - only cache off > > [..] > +is(test_reuse(8993), 1, 'tickets reused'); > +is(test_reuse(8994), 1, 'tickets and cache reused'); > +is(test_reuse(8995), 1, 'cache shared reused'); > +is(test_reuse(8996), 1, 'cache builtin reused'); > +is(test_reuse(8997), 1, 'cache builtin size reused'); > +is(test_reuse(8998), 0, 'cache none not reused'); > +is(test_reuse(8999), 0, 'cache off not reused'); > > ############################################################################### > > +sub test_reuse { > + my ($port) = @_; > + my ($s, $ssl) = get_ssl_socket($port); > + Net::SSLeay::read($ssl); > + my $ses = Net::SSLeay::get_session($ssl); > + ($s, $ssl) = get_ssl_socket($port, $ses); > + return Net::SSLeay::session_reused($ssl); > +} > + > sub get_ssl_socket { > - my ($port, $ses, $alpn) = @_; > + my ($port, $ses) = @_; > > my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > Net::SSLeay::set_session($ssl, $ses) if defined $ses; > - Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; > Net::SSLeay::set_fd($ssl, fileno($s)); > Net::SSLeay::connect($ssl) == 1 or return; Since this won't fail anymore on ALPN checks, you can convert this back to die. > return ($s, $ssl); -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 09:55:48 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 13:55:48 +0400 Subject: [PATCH 05 of 20] Tests: separate SSL session reuse tests in stream In-Reply-To: <530336cb449dcb028a55.1679148900@vm-bsd.mdounin.ru> References: <530336cb449dcb028a55.1679148900@vm-bsd.mdounin.ru> Message-ID: <2640439F-CFF2-4ABB-92F6-7D71AA1DF4A6@nginx.com> > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679140351 -10800 > # Sat Mar 18 14:52:31 2023 +0300 > # Node ID 530336cb449dcb028a55a5a401a122d07521e3a4 > # Parent 3ab3b2d1c2e67bc1f05e386218ceb08da873a477 > Tests: separate SSL session reuse tests in stream. > > Instead of being mixed with generic SSL tests, session reuse variants > are now tested in a separate file. > > diff --git a/stream_ssl.t b/stream_ssl.t > --- a/stream_ssl.t > +++ b/stream_ssl.t > @@ -37,7 +37,7 @@ plan(skip_all => 'win32') if $^O eq 'MSW > > my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); > > -$t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); > +$t->plan(5)->write_file_expand('nginx.conf', <<'EOF'); > > %%TEST_GLOBALS%% > > @@ -51,40 +51,35 @@ stream { > > ssl_certificate_key localhost.key; > ssl_certificate localhost.crt; > - ssl_session_tickets off; > > # inherited by server "inherits" > ssl_password_file password_stream; > > server { > - listen 127.0.0.1:8080 ssl; > + listen 127.0.0.1:8443 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache builtin; > ssl_password_file password; > } > > server { > - listen 127.0.0.1:8082 ssl; > + listen 127.0.0.1:8444 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache off; > ssl_password_file password_many; > } > > server { > - listen 127.0.0.1:8083 ssl; > + listen 127.0.0.1:8445 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache builtin:1000; > ssl_password_file password_fifo; > } > > server { > - listen 127.0.0.1:8084 ssl; > + listen 127.0.0.1:8446 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache shared:SSL:1m; > ssl_certificate_key inherits.key; > ssl_certificate inherits.crt; > } > @@ -138,52 +133,26 @@ kill 'INT', $p if $@; > > ############################################################################### > > -my ($s, $ssl, $ses); > +my ($s, $ssl); > > -($s, $ssl) = get_ssl_socket(port(8080)); > +($s, $ssl) = get_ssl_socket(8443); > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl'); > > -# ssl_session_cache > - > -($s, $ssl) = get_ssl_socket(port(8080)); > +($s, $ssl) = get_ssl_socket(8444); > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > -Net::SSLeay::read($ssl); > -$ses = Net::SSLeay::get_session($ssl); > - > -($s, $ssl) = get_ssl_socket(port(8080), $ses); > -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); > - > -($s, $ssl) = get_ssl_socket(port(8082)); > -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > -Net::SSLeay::read($ssl); > -$ses = Net::SSLeay::get_session($ssl); > +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password many'); > > -($s, $ssl) = get_ssl_socket(port(8082), $ses); > -isnt(Net::SSLeay::session_reused($ssl), 1, 'session not reused'); > - > -($s, $ssl) = get_ssl_socket(port(8083)); > +($s, $ssl) = get_ssl_socket(8444); should be 8445 > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > -Net::SSLeay::read($ssl); > -$ses = Net::SSLeay::get_session($ssl); > - > -($s, $ssl) = get_ssl_socket(port(8083), $ses); > -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); > - > -($s, $ssl) = get_ssl_socket(port(8084)); > -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > -Net::SSLeay::read($ssl); > -$ses = Net::SSLeay::get_session($ssl); > - > -($s, $ssl) = get_ssl_socket(port(8084), $ses); > -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); > +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password fifo'); > > # ssl_certificate inheritance > > -($s, $ssl) = get_ssl_socket(port(8080)); > +($s, $ssl) = get_ssl_socket(8443); > like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=localhost/, 'CN'); > > -($s, $ssl) = get_ssl_socket(port(8084)); > +($s, $ssl) = get_ssl_socket(8446); > like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner'); > > ############################################################################### > @@ -191,7 +160,7 @@ like(Net::SSLeay::dump_peer_certificate( > sub get_ssl_socket { > my ($port, $ses) = @_; > > - my $s = IO::Socket::INET->new('127.0.0.1:' . $port); > + my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > Net::SSLeay::set_session($ssl, $ses) if defined $ses; Session test remnants can be cleaned up. > Net::SSLeay::set_fd($ssl, fileno($s)); > diff --git a/stream_ssl.t b/stream_ssl_session_reuse.t > copy from stream_ssl.t > copy to stream_ssl_session_reuse.t > --- a/stream_ssl.t > +++ b/stream_ssl_session_reuse.t > @@ -1,6 +1,7 @@ > #!/usr/bin/perl > > # (C) Sergey Kandaurov > +# (C) Maxim Dounin > # (C) Nginx, Inc. > > # Tests for stream ssl module. > @@ -12,7 +13,6 @@ use strict; > > use Test::More; > > -use POSIX qw/ mkfifo /; This file can be run now on win32. > use Socket qw/ $CRLF /; > > BEGIN { use FindBin; chdir($FindBin::Bin); } > @@ -49,44 +49,60 @@ events { > stream { > %%TEST_GLOBALS_STREAM%% > > + ssl_certificate localhost.crt; > ssl_certificate_key localhost.key; > - ssl_certificate localhost.crt; > - ssl_session_tickets off; > > - # inherited by server "inherits" > - ssl_password_file password_stream; > + server { > + listen 127.0.0.1:8443 ssl; > + proxy_pass 127.0.0.1:8081; > + } > > server { > - listen 127.0.0.1:8080 ssl; > + listen 127.0.0.1:8444 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache builtin; > - ssl_password_file password; > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets on; > + } > + > + server { > + listen 127.0.0.1:8445 ssl; > + proxy_pass 127.0.0.1:8081; > + > + ssl_session_cache shared:SSL:1m; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8082 ssl; > + listen 127.0.0.1:8446 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache off; > - ssl_password_file password_many; > + ssl_session_cache builtin; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8083 ssl; > + listen 127.0.0.1:8447 ssl; > proxy_pass 127.0.0.1:8081; > > ssl_session_cache builtin:1000; > - ssl_password_file password_fifo; > + ssl_session_tickets off; > } > > server { > - listen 127.0.0.1:8084 ssl; > + listen 127.0.0.1:8448 ssl; > proxy_pass 127.0.0.1:8081; > > - ssl_session_cache shared:SSL:1m; > - ssl_certificate_key inherits.key; > - ssl_certificate inherits.crt; > + ssl_session_cache none; > + ssl_session_tickets off; > + } > + > + server { > + listen 127.0.0.1:8449 ssl; > + proxy_pass 127.0.0.1:8081; > + > + ssl_session_cache off; > + ssl_session_tickets off; > } > } > > @@ -101,16 +117,11 @@ distinguished_name = req_distinguished_n > EOF > > my $d = $t->testdir(); > -mkfifo("$d/password_fifo", 0700); > > -foreach my $name ('localhost', 'inherits') { > - system("openssl genrsa -out $d/$name.key -passout pass:$name " > - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 > - or die "Can't create private key: $!\n"; > +foreach my $name ('localhost') { > system('openssl req -x509 -new ' > . "-config $d/openssl.conf -subj /CN=$name/ " > - . "-out $d/$name.crt " > - . "-key $d/$name.key -passin pass:$name" > + . "-out $d/$name.crt -keyout $d/$name.key " > . ">>$d/openssl.out 2>&1") == 0 > or die "Can't create certificate for $name: $!\n"; > } > @@ -118,80 +129,48 @@ foreach my $name ('localhost', 'inherits > This introduces one more occurrence of extra blank line on copy/paste, I'd rather fix it in both files. [..] diff --git a/stream_ssl.t b/stream_ssl.t --- a/stream_ssl.t +++ b/stream_ssl.t @@ -110,7 +110,6 @@ foreach my $name ('localhost', 'inherits or die "Can't create certificate for $name: $!\n"; } - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); $t->write_file('password', 'localhost'); @@ -143,7 +142,7 @@ like(Net::SSLeay::read($ssl), qr/200 OK/ Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password many'); -($s, $ssl) = get_ssl_socket(8444); +($s, $ssl) = get_ssl_socket(8445); Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password fifo'); @@ -158,11 +157,10 @@ like(Net::SSLeay::dump_peer_certificate( ############################################################################### sub get_ssl_socket { - my ($port, $ses) = @_; + my ($port) = @_; my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_session($ssl, $ses) if defined $ses; Net::SSLeay::set_fd($ssl, fileno($s)); Net::SSLeay::connect($ssl) or die("ssl connect"); return ($s, $ssl); diff --git a/stream_ssl_session_reuse.t b/stream_ssl_session_reuse.t --- a/stream_ssl_session_reuse.t +++ b/stream_ssl_session_reuse.t @@ -33,8 +33,6 @@ eval { }; plan(skip_all => 'Net::SSLeay not installed') if $@; -plan(skip_all => 'win32') if $^O eq 'MSWin32'; - my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); $t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); @@ -126,7 +124,6 @@ foreach my $name ('localhost') { or die "Can't create certificate for $name: $!\n"; } - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); $t->run_daemon(\&http_daemon); -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 09:59:27 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 13:59:27 +0400 Subject: [PATCH 06 of 20] Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in mail In-Reply-To: References:

Message-ID: <10CCED02-0019-4520-AD41-CFCE12E38417@nginx.com> > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679140402 -10800 > # Sat Mar 18 14:53:22 2023 +0300 > # Node ID d90fe31a80d5e85b59e525e874d24f409716b64c > # Parent 530336cb449dcb028a55a5a401a122d07521e3a4 > Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in mail. in stream > > LibreSSL does not support session reuse with TLSv1.3 at all. BoringSSL > with TLSv1.3 only supports session tickets, but not server-side session > cache. > By the way, why introduce three separate changesets (p02, p04, p06) with identical description and similar changes. I'd combine them. > diff --git a/stream_ssl_session_reuse.t b/stream_ssl_session_reuse.t > --- a/stream_ssl_session_reuse.t > +++ b/stream_ssl_session_reuse.t > @@ -147,16 +147,35 @@ my $ctx = Net::SSLeay::CTX_new() or die( > # - only cache none > # - only cache off > > +TODO: { > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > + if $t->has_module('LibreSSL') && test_tls13(); > + > is(test_reuse(8443), 1, 'tickets reused'); > is(test_reuse(8444), 1, 'tickets and cache reused'); > + > +TODO: { > +local $TODO = 'no TLSv1.3 session cache in BoringSSL' > + if $t->has_module('BoringSSL') && test_tls13(); > + > is(test_reuse(8445), 1, 'cache shared reused'); > is(test_reuse(8446), 1, 'cache builtin reused'); > is(test_reuse(8447), 1, 'cache builtin size reused'); > + > +} > +} > + > is(test_reuse(8448), 0, 'cache none not reused'); > is(test_reuse(8449), 0, 'cache off not reused'); > > + extra blank line > ############################################################################### > > +sub test_tls13 { > + my ($s, $ssl) = get_ssl_socket(8443); > + return (Net::SSLeay::version($ssl) > 0x303); > +} > + > sub test_reuse { > my ($port) = @_; > my ($s, $ssl) = get_ssl_socket($port); -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 10:39:12 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 14:39:12 +0400 Subject: [PATCH 15 of 20] Tests: LibreSSL does not send CA lists with TLSv1.3 In-Reply-To: <6d5bede76a77ca86483f.1679148910@vm-bsd.mdounin.ru> References: <6d5bede76a77ca86483f.1679148910@vm-bsd.mdounin.ru> Message-ID: > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679148737 -10800 > # Sat Mar 18 17:12:17 2023 +0300 > # Node ID 6d5bede76a77ca86483f63088587913a61b8b18d > # Parent 230b9cadce9b57213bf529940ca04224f9f121eb > Tests: LibreSSL does not send CA lists with TLSv1.3. Specifically, it doesn't implement the "certificate_authorities" extension used in TLSv1.3 to carry CA lists in the CertificateRequest message. > > diff --git a/ssl_verify_client.t b/ssl_verify_client.t > --- a/ssl_verify_client.t > +++ b/ssl_verify_client.t > @@ -55,6 +55,7 @@ http { > %%TEST_GLOBALS_HTTP%% > > add_header X-Verify x$ssl_client_verify:${ssl_client_cert}x; > + add_header X-Protocol $ssl_protocol; > > ssl_session_cache shared:SSL:1m; > ssl_session_tickets off; > @@ -169,15 +170,24 @@ like(get('optional', '3.example.com'), q > SKIP: { > skip 'Net::SSLeay version >= 1.36 required', 1 if $Net::SSLeay::VERSION < 1.36; > > +TODO: { > +local $TODO = 'broken TLSv1.3 CA list in LibreSSL' > + if $t->has_module('LibreSSL') && test_tls13(); > + > my $ca = join ' ', get('optional', '3.example.com'); > is($ca, '/CN=2.example.com', 'no trusted sent'); > > } > +} > > like(get('optional', undef, 'localhost'), qr/421 Misdirected/, 'misdirected'); > > ############################################################################### > > +sub test_tls13 { > + get('optional') =~ /TLSv1.3/; > +} > + > sub get { > my ($sni, $cert, $host) = @_; > > diff --git a/stream_ssl_verify_client.t b/stream_ssl_verify_client.t > --- a/stream_ssl_verify_client.t > +++ b/stream_ssl_verify_client.t > @@ -86,6 +86,11 @@ stream { > ssl_verify_client optional_no_ca; > ssl_client_certificate 2.example.com.crt; > } > + > + server { > + listen 127.0.0.1:8084 ssl; > + return $ssl_protocol; > + } > } > > EOF > @@ -126,10 +131,15 @@ like(get(8082, '3.example.com'), qr/SUCC > SKIP: { > skip 'Net::SSLeay version >= 1.36 required', 1 if $Net::SSLeay::VERSION < 1.36; > > +TODO: { > +local $TODO = 'broken TLSv1.3 CA list in LibreSSL' > + if $t->has_module('LibreSSL') && test_tls13(); > + > my $ca = join ' ', get(8082, '3.example.com'); > is($ca, '/CN=2.example.com', 'no trusted sent'); > > } > +} > > $t->stop(); > > @@ -137,6 +147,10 @@ is($t->read_file('status.log'), "500\n20 > > ############################################################################### > > +sub test_tls13 { > + get(8084) =~ /TLSv1.3/; > +} > + > sub get { > my ($port, $cert) = @_; > -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 11:05:16 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 15:05:16 +0400 Subject: [PATCH 19 of 20] Tests: removed multiple server certificates from ssl_ocsp.t In-Reply-To: <782531c3cd79dcf70027.1679148914@vm-bsd.mdounin.ru> References: <782531c3cd79dcf70027.1679148914@vm-bsd.mdounin.ru> Message-ID: <5AD7ACF5-169D-4578-8D3C-DA691B2F935F@nginx.com> > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679148855 -10800 > # Sat Mar 18 17:14:15 2023 +0300 > # Node ID 782531c3cd79dcf700276e10bef00e524de009d1 > # Parent c140f78fbc8f62c9694d3b969d1309570a96f2e7 > Tests: removed multiple server certificates from ssl_ocsp.t. > > Multiple server certificates are not needed to test OCSP verification of > client certificates (in contrast to OCSP stapling, where server certificates > are verified, and different staples should be correctly returned with > different server certificates). And using multiple server certificates > causes issues when testing with LibreSSL due to broken sigalgs-based > server certificate selection in LibreSSL with TLSv1.3. > > Accordingly, the test is simplified to do not use multiple server > certificates. > > diff --git a/ssl_ocsp.t b/ssl_ocsp.t > --- a/ssl_ocsp.t > +++ b/ssl_ocsp.t > @@ -63,10 +63,7 @@ http { > ssl_verify_depth 2; > ssl_client_certificate trusted.crt; > > - ssl_ciphers DEFAULT:ECCdraft; > - > - ssl_certificate_key ec.key; > - ssl_certificate ec.crt; > +# ssl_ciphers DEFAULT:ECCdraft; This doesn't serve its purpose now and can be removed, now that you've removed multiple (ECC) certificates. It was used to run tests with ECC certificates/ciphers, as otherwise it would result in "no shared cipher" error. ECCdraft is an old alias used to enable ECC ciphersuites and run tests with ECC certificate on OpenSSL 0.9.8, before they became official in RFC 4492. - ECC ciphersuites were disabled by default in 0.9.8c, and ECCdraft alias was used to turn them back. - ECC ciphersuites were re-enabled in 0.9.9 (1.0.0) > > ssl_certificate_key rsa.key; > ssl_certificate rsa.crt; > @@ -273,13 +270,8 @@ system("openssl ocsp -index $d/certindex > > # server cert/key > > -system("openssl ecparam -genkey -out $d/ec.key -name prime256v1 " > - . ">>$d/openssl.out 2>&1") == 0 or die "Can't create EC pem: $!\n"; > -system("openssl genrsa -out $d/rsa.key 2048 >>$d/openssl.out 2>&1") == 0 > - or die "Can't create RSA pem: $!\n"; > - > -foreach my $name ('ec', 'rsa') { > - system("openssl req -x509 -new -key $d/$name.key " > +foreach my $name ('rsa') { > + system('openssl req -x509 -new ' > . "-config $d/openssl.conf -subj /CN=$name/ " > . "-out $d/$name.crt -keyout $d/$name.key " > . ">>$d/openssl.out 2>&1") == 0 > @@ -288,7 +280,7 @@ foreach my $name ('ec', 'rsa') { > > $t->run_daemon(\&http_daemon, $t, port(8081)); > $t->run_daemon(\&http_daemon, $t, port(8082)); > -$t->run()->plan(14); > +$t->run()->plan(15); > > $t->waitforsocket("127.0.0.1:" . port(8081)); > $t->waitforsocket("127.0.0.1:" . port(8082)); > @@ -297,17 +289,17 @@ my $version = get_version(); > > ############################################################################### > > -like(get('RSA', 'end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); > +like(get('end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); > > # demonstrate that ocsp int request is failed due to missing resolver > > -like(get('RSA', 'end', sni => 'resolver'), > +like(get('end', sni => 'resolver'), > qr/400 Bad.*FAILED:certificate status request failed/s, > 'ocsp many failed request'); > > # demonstrate that ocsp int request is actually made by failing ocsp response > > -like(get('RSA', 'end', port => 8444), > +like(get('end', port => 8444), > qr/400 Bad.*FAILED:certificate status request failed/s, > 'ocsp many failed'); > > @@ -323,11 +315,11 @@ system("openssl ocsp -index $d/certindex > . ">>$d/openssl.out 2>&1") == 0 > or die "Can't create OCSP response: $!\n"; > > -like(get('RSA', 'end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); > +like(get('end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); > > # store into ssl_ocsp_cache > > -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); > +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); > > # revoke > > @@ -346,23 +338,23 @@ system("openssl ocsp -index $d/certindex > . ">>$d/openssl.out 2>&1") == 0 > or die "Can't create OCSP response: $!\n"; > > -like(get('RSA', 'end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); > +like(get('end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); > > # with different responder where it's still valid > > -like(get('RSA', 'end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); > +like(get('end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); > > # with different context to responder where it's still valid > > -like(get('RSA', 'end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); > +like(get('end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); > > # with cached ocsp response it's still valid > > -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); > +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); > > # ocsp end response signed with invalid (root) cert, expect HTTP 400 > > -like(get('ECDSA', 'ec-end'), > +like(get('ec-end'), > qr/400 Bad.*FAILED:certificate status request failed/s, > 'root ca not trusted'); > > @@ -374,12 +366,12 @@ system("openssl ocsp -index $d/certindex > . ">>$d/openssl.out 2>&1") == 0 > or die "Can't create EC OCSP response: $!\n"; > > -like(get('ECDSA', 'ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); > +like(get('ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); > > -my ($s, $ssl) = get('ECDSA', 'ec-end'); > +my ($s, $ssl) = get('ec-end'); > my $ses = Net::SSLeay::get_session($ssl); > > -like(get('ECDSA', 'ec-end', ses => $ses), > +like(get('ec-end', ses => $ses), > qr/200 OK.*SUCCESS:r/s, 'session reused'); > > # revoke with saved session > @@ -401,19 +393,22 @@ system("openssl ocsp -index $d/certindex > > # reusing session with revoked certificate > > -like(get('ECDSA', 'ec-end', ses => $ses), > +like(get('ec-end', ses => $ses), > qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); > > # regression test for self-signed > > -like(get('RSA', 'root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); > +like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); > + > +# check for errors > + > +like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); > > ############################################################################### > > sub get { > - my ($type, $cert, %extra) = @_; > - $type = 'PSS' if $type eq 'RSA' && $version > 0x0303; > - my ($s, $ssl) = get_ssl_socket($type, $cert, %extra); > + my ($cert, %extra) = @_; > + my ($s, $ssl) = get_ssl_socket($cert, %extra); > my $cipher = Net::SSLeay::get_cipher($ssl); > Test::Nginx::log_core('||', "cipher: $cipher"); > my $host = $extra{sni} ? $extra{sni} : 'localhost'; > @@ -428,7 +423,7 @@ sub get { > } > > sub get_ssl_socket { > - my ($type, $cert, %extra) = @_; > + my ($cert, %extra) = @_; > my $ses = $extra{ses}; > my $sni = $extra{sni}; > my $port = $extra{port} || 8443; > @@ -450,18 +445,6 @@ sub get_ssl_socket { > > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > > - if (defined $type) { > - my $ssleay = Net::SSLeay::SSLeay(); > - if ($ssleay < 0x1000200f || $ssleay == 0x20000000) { > - Net::SSLeay::CTX_set_cipher_list($ctx, $type) > - or die("Failed to set cipher list"); > - } else { > - # SSL_CTRL_SET_SIGALGS_LIST > - Net::SSLeay::CTX_ctrl($ctx, 98, 0, $type . '+SHA256') > - or die("Failed to set sigalgs"); > - } > - } > - > Net::SSLeay::set_cert_and_key($ctx, "$d/$cert.crt", "$d/$cert.key") > or die if $cert; > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 11:11:44 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 15:11:44 +0400 Subject: [PATCH 20 of 20] Tests: fixed ssl_ocsp.t with LibreSSL and TLSv1.3 In-Reply-To: References:

Message-ID: > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > # HG changeset patch > # User Maxim Dounin > # Date 1679148869 -10800 > # Sat Mar 18 17:14:29 2023 +0300 > # Node ID f6f6a21b1c2a0d88cb2a4993f4c0113a3fb1e019 > # Parent 782531c3cd79dcf700276e10bef00e524de009d1 > Tests: fixed ssl_ocsp.t with LibreSSL and TLSv1.3. > > LibreSSL does not support session reuse with TLSv1.3. Since LibreSSL is so broken wrt TLSv1.3, I don't think it deserves annotating every test in separate changed. The LibreSSL changes could be easily combined: this is at least p11, p12, p13, p16, p17, p20. Other broken or missing functionality such as signature algorithms and certificate authorities can be skipped in separate commits, though. > > diff --git a/ssl_ocsp.t b/ssl_ocsp.t > --- a/ssl_ocsp.t > +++ b/ssl_ocsp.t > @@ -371,9 +371,15 @@ like(get('ec-end'), qr/200 OK.*SUCCESS/s > my ($s, $ssl) = get('ec-end'); > my $ses = Net::SSLeay::get_session($ssl); > > +TODO: { > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > + if $t->has_module('LibreSSL') and $version > 0x303; > + > like(get('ec-end', ses => $ses), > qr/200 OK.*SUCCESS:r/s, 'session reused'); > > +} > + > # revoke with saved session > > system("openssl ca -config $d/ca.conf -revoke $d/ec-end.crt " > @@ -393,9 +399,15 @@ system("openssl ocsp -index $d/certindex > > # reusing session with revoked certificate > > +TODO: { > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > + if $t->has_module('LibreSSL') and $version > 0x303; > + > like(get('ec-end', ses => $ses), > qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); > > +} > + > # regression test for self-signed > > like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); -- Sergey Kandaurov From pluknet at nginx.com Wed Mar 22 11:43:12 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Wed, 22 Mar 2023 15:43:12 +0400 Subject: [PATCH 00 of 20] tests suite fixes for TLSv1.3 In-Reply-To: References: Message-ID: > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > Hello! > > Here are patch series for the test suite to address test failures > observed with TLSv1.3 enabled with BoringSSL and LibreSSL. > > Short summary of the issues seen: > > - BoringSSL with TLSv1.3 does not support session reuse via server-side > session cache, only with tickets. > > - BoringSSL with TLSv1.3 does not provide $ssl_session_id. > > - LibreSSL with TLSv1.3 does not support session reuse. > > - LibreSSL with TLSv1.3 fails to negotiate certificates based on > signature algorithms supported by the client, and fails with > "missing rsa certificate" and "unknown pkey type" errors. > > - LibreSSL with TLSv1.3 does not send CA lists to the client. > Missing peaces that allow me to run with LibreSSL: # HG changeset patch # User Sergey Kandaurov # Date 1679485246 -14400 # Wed Mar 22 15:40:46 2023 +0400 # Node ID dfe434f295d3da7e3b67bbbafeab245bb591f397 # Parent 826e00e7c037d617781239963e8b868b6b0de225 Tests: fixed upstream zone tests with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/stream_upstream_zone_ssl.t b/stream_upstream_zone_ssl.t --- a/stream_upstream_zone_ssl.t +++ b/stream_upstream_zone_ssl.t @@ -82,6 +82,19 @@ stream { ssl_certificate localhost.crt; ssl_session_cache builtin; } + + server { + listen 127.0.0.1:8085; + proxy_pass 127.0.0.1:8086; + } + + server { + listen 127.0.0.1:8086 ssl; + return $ssl_protocol; + + ssl_certificate_key localhost.key; + ssl_certificate localhost.crt; + } } EOF @@ -112,13 +125,33 @@ is(stream('127.0.0.1:' . port(8080))->re is(stream('127.0.0.1:' . port(8080))->read(), '.', 'ssl 2'); is(stream('127.0.0.1:' . port(8081))->read(), '.', 'ssl session new'); + +SKIP: { +skip 'no TLSv1.3 sessions in LibreSSL', 2 + if $t->has_module('LibreSSL') && test_tls13(); + is(stream('127.0.0.1:' . port(8081))->read(), 'r', 'ssl session reused'); is(stream('127.0.0.1:' . port(8081))->read(), 'r', 'ssl session reused 2'); +} + is(stream('127.0.0.1:' . port(8082))->read(), '.', 'backup ssl'); is(stream('127.0.0.1:' . port(8082))->read(), '.', 'backup ssl 2'); is(stream('127.0.0.1:' . port(8083))->read(), '.', 'backup ssl session new'); + +SKIP: { +skip 'no TLSv1.3 sessions in LibreSSL', 1 + if $t->has_module('LibreSSL') && test_tls13(); + is(stream('127.0.0.1:' . port(8083))->read(), 'r', 'backup ssl session reused'); +} + ############################################################################### + +sub test_tls13 { + stream('127.0.0.1:' . port(8085))->read() eq 'TLSv1.3'; +} + +############################################################################### diff --git a/upstream_zone_ssl.t b/upstream_zone_ssl.t --- a/upstream_zone_ssl.t +++ b/upstream_zone_ssl.t @@ -56,6 +56,7 @@ http { location / { add_header X-Session $ssl_session_reused; + add_header X-Protocol $ssl_protocol; } } @@ -114,12 +115,32 @@ foreach my $name ('localhost') { like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl'); like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl 2'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: \./s, 'ssl session new'); + +SKIP: { +skip 'no TLSv1.3 sessions in LibreSSL', 2 + if $t->has_module('LibreSSL') && test_tls13(); + like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused 2'); +} + like(http_get('/backup'), qr/200 OK.*X-Session: \./s, 'backup'); like(http_get('/backup'), qr/200 OK.*X-Session: \./s, 'backup 2'); like(http_get('/backup_reuse'), qr/200 OK.*X-Session: \./s, 'backup new'); + +SKIP: { +skip 'no TLSv1.3 sessions in LibreSSL', 1 + if $t->has_module('LibreSSL') && test_tls13(); + like(http_get('/backup_reuse'), qr/200 OK.*X-Session: r/s, 'backup reused'); +} + ############################################################################### + +sub test_tls13 { + return http_get('/ssl') =~ /TLSv1.3/; +} + +############################################################################### -- Sergey Kandaurov From v.zhestikov at f5.com Wed Mar 22 16:38:15 2023 From: v.zhestikov at f5.com (Vadim Zhestikov) Date: Wed, 22 Mar 2023 16:38:15 +0000 Subject: [njs] Fixed invalid NULL pointer check. Message-ID: details: https://hg.nginx.org/njs/rev/8e6a2cb0c23d branches: changeset: 2075:8e6a2cb0c23d user: Vadim Zhestikov date: Wed Mar 22 09:36:58 2023 -0700 description: Fixed invalid NULL pointer check. This fixes Coverity issues CID 1524495 and CID 1524494. diffstat: src/njs_parser.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diffs (14 lines): diff -r edf1c2aef957 -r 8e6a2cb0c23d src/njs_parser.c --- a/src/njs_parser.c Mon Mar 20 21:25:47 2023 -0700 +++ b/src/njs_parser.c Wed Mar 22 09:36:58 2023 -0700 @@ -8030,8 +8030,8 @@ njs_parser_export(njs_parser_t *parser, return NJS_DONE; } - peek = njs_lexer_peek_token(parser->lexer, peek, 1); - if (njs_slow_path(token == NULL)) { + peek = njs_lexer_peek_token(parser->lexer, peek, 0); + if (njs_slow_path(peek == NULL)) { return NJS_ERROR; } From arut at nginx.com Wed Mar 22 16:38:52 2023 From: arut at nginx.com (Roman Arutyunyan) Date: Wed, 22 Mar 2023 20:38:52 +0400 Subject: [PATCH] Mail: fixed handling of blocked client read events in proxy In-Reply-To: References: Message-ID: <20230322163852.yoqkx7aimwkvzrnf@N00W24XTQX> Hi, On Sat, Mar 11, 2023 at 02:24:49PM +0300, Maxim Dounin wrote: > # HG changeset patch > # User Maxim Dounin > # Date 1678533841 -10800 > # Sat Mar 11 14:24:01 2023 +0300 > # Node ID b97f2b983d1564d29280d03828503edca21a79ee > # Parent 8771d35d55d0a2b1cefaab04401d6f837f5a05a2 > Mail: fixed handling of blocked client read events in proxy. > > When establishing a connection to the backend, nginx blocks reading > from the client with ngx_mail_proxy_block_read(). Previously, such > events were lost, and in some cases this resulted in connection hangs. > > Notably, this affected mail_imap_ssl.t on Windows, since the test > closes connections after requesting authentication, but without > waiting for any responses (so the connection close events might be > lost). The following patch alowed me to trigger the issue on my laptop. It slows down the auth http backend and switches event processing to select. diff --git a/mail_imap_ssl.t b/mail_imap_ssl.t --- a/mail_imap_ssl.t +++ b/mail_imap_ssl.t @@ -42,6 +42,7 @@ my $t = Test::Nginx->new()->has(qw/mail daemon off; events { + use select; } mail { @@ -104,6 +105,7 @@ http { server { listen 127.0.0.1:8080; server_name localhost; + limit_rate 100; location = /mail/auth { access_log auth.log test; > Fix is to post an event to read from the client after connecting to > the backend if there were blocked events. > > diff --git a/src/mail/ngx_mail_proxy_module.c b/src/mail/ngx_mail_proxy_module.c > --- a/src/mail/ngx_mail_proxy_module.c > +++ b/src/mail/ngx_mail_proxy_module.c > @@ -327,7 +327,9 @@ ngx_mail_proxy_pop3_handler(ngx_event_t > c->log->action = NULL; > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > - if (s->buffer->pos < s->buffer->last) { > + if (s->buffer->pos < s->buffer->last > + || s->connection->read->ready) > + { > ngx_post_event(c->write, &ngx_posted_events); > } > > @@ -486,7 +488,9 @@ ngx_mail_proxy_imap_handler(ngx_event_t > c->log->action = NULL; > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > - if (s->buffer->pos < s->buffer->last) { > + if (s->buffer->pos < s->buffer->last > + || s->connection->read->ready) > + { > ngx_post_event(c->write, &ngx_posted_events); > } > > @@ -821,7 +825,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t > c->log->action = NULL; > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > - if (s->buffer->pos < s->buffer->last) { > + if (s->buffer->pos < s->buffer->last > + || s->connection->read->ready) > + { > ngx_post_event(c->write, &ngx_posted_events); > } Looks ok From xeioex at nginx.com Thu Mar 23 05:43:15 2023 From: xeioex at nginx.com (Dmitry Volyntsev) Date: Thu, 23 Mar 2023 05:43:15 +0000 Subject: [njs] Fix compiler detection when CC has a wrapper. Message-ID: details: https://hg.nginx.org/njs/rev/ec007866a53b branches: changeset: 2076:ec007866a53b user: Orgad Shaneh date: Wed Mar 22 15:22:37 2023 +0200 description: Fix compiler detection when CC has a wrapper. For example CC='ccache gcc'. diffstat: auto/cc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diffs (12 lines): diff -r 8e6a2cb0c23d -r ec007866a53b auto/cc --- a/auto/cc Wed Mar 22 09:36:58 2023 -0700 +++ b/auto/cc Wed Mar 22 15:22:37 2023 +0200 @@ -13,7 +13,7 @@ END # Allow error exit status. set +e -if [ -z `which $CC` ]; then +if [ -z "$(which $CC)" ]; then echo echo $0: error: $CC not found. echo From roy at teeuwen.be Thu Mar 23 08:26:48 2023 From: roy at teeuwen.be (Roy Teeuwen) Date: Thu, 23 Mar 2023 09:26:48 +0100 Subject: Configurable sleep period for connections In-Reply-To: References: Message-ID: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark> Hey, We are using NGINX as a proxy / caching layer for a backend application. Our backend has a relatively slow response time, ranging between the 100 to 300ms. We want the NGINX proxy to be as speedy as possible, to do this we have implemented the following logic: - Cache all responses for 5 mins (based on cache control headers) - Use stale cache for error's on the backend - Do a background update for stale cache The last part has an issue, namely if a first request reaches nginx, it will trigger a background request, but other requests for the same resource will be locked until this background request is finished instead of still returning the stale cache that is available. This is caused by the fact that there is a keepalive on the connection, which locks all subsequent requests until the background request is finished. The issue that we are facing in this situation is that the locking is very long, namely 500ms hardcoded. I think it is caused by this: https://github.com/nginx/nginx/blob/master/src/core/ngx_connection.c#L703 This means that our relatively slow backend of 100-200ms actually gets worse than better. Is it an option to make this 500ms a configurable setting instead of 500ms? Are there any downsides to making this 500ms lower? I'd be willing to see if we can contribute this. Another option that I'd tried is to set the keepalive to 0, so that every request is a new connection. In small amounts of requests this actually seemed to solve the issue, but the moment that we went to a real life situation, this degraded the performance massively, so we had to revert this Greets, Roy -------------- next part -------------- An HTML attachment was scrubbed... URL: From pluknet at nginx.com Thu Mar 23 13:18:00 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Thu, 23 Mar 2023 17:18:00 +0400 Subject: [PATCH] QUIC: OpenSSL compatibility layer In-Reply-To: <20230208144138.u7pozeds34nqr6mi@N00W24XTQX> References: <64a365dcb52503e91d91.1671606452@arut-laptop> <20230109111316.yfqj24unoubibihz@N00W24XTQX> <20230202183522.o4w5xbjvegbchts4@Y9MQ9X2QVV> <20230206142701.pxzaq3irckqads7y@N00W24XTQX> <20230208122810.tsxynyhlqgt2ubsm@Y9MQ9X2QVV> <20230208144138.u7pozeds34nqr6mi@N00W24XTQX> Message-ID: <20230323131800.3tvdw4i336x36dsv@Y9MQ9X2QVV> On Wed, Feb 08, 2023 at 06:41:38PM +0400, Roman Arutyunyan wrote: > # HG changeset patch > # User Roman Arutyunyan > # Date 1675867049 -14400 > # Wed Feb 08 18:37:29 2023 +0400 > # Branch quic > # Node ID a3142c8833f5bf1186599e7938141f5062fac4a2 > # Parent 3c33d39a51d334d99fcc7d2b45e8d8190c431492 > QUIC: OpenSSL compatibility layer. > > The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API. > > This implementation does not support 0-RTT. [..] > diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c > --- a/src/http/modules/ngx_http_ssl_module.c > +++ b/src/http/modules/ngx_http_ssl_module.c > @@ -9,6 +9,10 @@ > #include > #include > > +#if (NGX_QUIC_OPENSSL_COMPAT) > +#include > +#endif > + > > typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, > ngx_pool_t *pool, ngx_str_t *s); > @@ -1317,16 +1321,22 @@ ngx_http_ssl_init(ngx_conf_t *cf) > continue; > } > > + cscf = addr[a].default_server; > + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > + > if (addr[a].opt.http3) { > name = "http3"; > > +#if (NGX_QUIC_OPENSSL_COMPAT) > + if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { > + return NGX_ERROR; > + } > +#endif > + > } else { > name = "ssl"; > } > > - cscf = addr[a].default_server; > - sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > - > if (sscf->certificates) { > > if (addr[a].opt.http3 && !(sscf->protocols & NGX_SSL_TLSv1_3)) { > diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c > --- a/src/stream/ngx_stream_ssl_module.c > +++ b/src/stream/ngx_stream_ssl_module.c > @@ -9,6 +9,10 @@ > #include > #include > > +#if (NGX_QUIC_OPENSSL_COMPAT) > +#include > +#endif > + > > typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, > ngx_pool_t *pool, ngx_str_t *s); > @@ -1218,6 +1222,12 @@ ngx_stream_ssl_init(ngx_conf_t *cf) > > scf = listen[i].ctx->srv_conf[ngx_stream_ssl_module.ctx_index]; > > +#if (NGX_QUIC_OPENSSL_COMPAT) > + if (ngx_quic_compat_init(cf, scf->ssl.ctx) != NGX_OK) { > + return NGX_ERROR; > + } > +#endif > + > if (scf->certificates && !(scf->protocols & NGX_SSL_TLSv1_3)) { > ngx_log_error(NGX_LOG_EMERG, cf->log, 0, > "\"ssl_protocols\" must enable TLSv1.3 for " Following internal discussion with Roman, below is a fix for compat layer initialization. This is a fallout after moving initialization from ngx_ssl_create(). Although that change was justified, it has left a couple of issues: - SSL context can be NULL (normally caught later in function) - only the default server was initialized, breaks with SNI. The latter was caught by h3_ssl_reject_handshake.t The fix is to initialize all servers that have SSL context. The postconfiguration function is quite large, so this is moved to the separate function. While here, moved back assignments closer to the place of their use. # HG changeset patch # User Sergey Kandaurov # Date 1679577205 -14400 # Thu Mar 23 17:13:25 2023 +0400 # Branch quic # Node ID dcef88bdea77cf84b97580f21fbe05cc05ab631d # Parent f4279edda9fdbbd836a86926d86cdc727492e94c HTTP/3: fixed OpenSSL compatibility layer initialization. SSL context is not present if the default server has neither certificates nor ssl_reject_handshake enabled. Previously, this led to null pointer dereference before it would be caught with configuration checks. Additionally, virtual servers with distinct SSL contexts need to initialize compatibility layer in order to complete a QUIC handshake. diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -56,6 +56,10 @@ static char *ngx_http_ssl_conf_command_c void *data); static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); +#if (NGX_QUIC_OPENSSL_COMPAT) +static ngx_int_t ngx_http_ssl_quic_compat_init(ngx_conf_t *cf, + ngx_http_conf_addr_t *addr); +#endif static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { @@ -1328,14 +1332,11 @@ ngx_http_ssl_init(ngx_conf_t *cf) continue; } - cscf = addr[a].default_server; - sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; - if (addr[a].opt.quic) { name = "quic"; #if (NGX_QUIC_OPENSSL_COMPAT) - if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { + if (ngx_http_ssl_quic_compat_init(cf, &addr[a]) != NGX_OK) { return NGX_ERROR; } #endif @@ -1344,6 +1345,9 @@ ngx_http_ssl_init(ngx_conf_t *cf) name = "ssl"; } + cscf = addr[a].default_server; + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; + if (sscf->certificates) { if (addr[a].opt.quic && !(sscf->protocols & NGX_SSL_TLSv1_3)) { @@ -1391,3 +1395,27 @@ ngx_http_ssl_init(ngx_conf_t *cf) return NGX_OK; } + + +static ngx_int_t +ngx_http_ssl_quic_compat_init(ngx_conf_t *cf, ngx_http_conf_addr_t *addr) +{ + ngx_uint_t s; + ngx_http_ssl_srv_conf_t *sscf; + ngx_http_core_srv_conf_t **cscfp, *cscf; + + cscfp = addr->servers.elts; + for (s = 0; s < addr->servers.nelts; s++) { + + cscf = cscfp[s]; + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; + + if (sscf->certificates || sscf->reject_handshake) { + if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { + return NGX_ERROR; + } + } + } + + return NGX_OK; +} From arut at nginx.com Thu Mar 23 13:53:57 2023 From: arut at nginx.com (Roman Arutyunyan) Date: Thu, 23 Mar 2023 17:53:57 +0400 Subject: [PATCH] QUIC: OpenSSL compatibility layer In-Reply-To: <20230323131800.3tvdw4i336x36dsv@Y9MQ9X2QVV> References: <64a365dcb52503e91d91.1671606452@arut-laptop> <20230109111316.yfqj24unoubibihz@N00W24XTQX> <20230202183522.o4w5xbjvegbchts4@Y9MQ9X2QVV> <20230206142701.pxzaq3irckqads7y@N00W24XTQX> <20230208122810.tsxynyhlqgt2ubsm@Y9MQ9X2QVV> <20230208144138.u7pozeds34nqr6mi@N00W24XTQX> <20230323131800.3tvdw4i336x36dsv@Y9MQ9X2QVV> Message-ID: <20230323135357.3s3wf75r4no6snbk@N00W24XTQX> Hi, On Thu, Mar 23, 2023 at 05:18:00PM +0400, Sergey Kandaurov wrote: > On Wed, Feb 08, 2023 at 06:41:38PM +0400, Roman Arutyunyan wrote: > > # HG changeset patch > > # User Roman Arutyunyan > > # Date 1675867049 -14400 > > # Wed Feb 08 18:37:29 2023 +0400 > > # Branch quic > > # Node ID a3142c8833f5bf1186599e7938141f5062fac4a2 > > # Parent 3c33d39a51d334d99fcc7d2b45e8d8190c431492 > > QUIC: OpenSSL compatibility layer. > > > > The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API. > > > > This implementation does not support 0-RTT. > > [..] > > > diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c > > --- a/src/http/modules/ngx_http_ssl_module.c > > +++ b/src/http/modules/ngx_http_ssl_module.c > > @@ -9,6 +9,10 @@ > > #include > > #include > > > > +#if (NGX_QUIC_OPENSSL_COMPAT) > > +#include > > +#endif > > + > > > > typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, > > ngx_pool_t *pool, ngx_str_t *s); > > @@ -1317,16 +1321,22 @@ ngx_http_ssl_init(ngx_conf_t *cf) > > continue; > > } > > > > + cscf = addr[a].default_server; > > + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > > + > > if (addr[a].opt.http3) { > > name = "http3"; > > > > +#if (NGX_QUIC_OPENSSL_COMPAT) > > + if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { > > + return NGX_ERROR; > > + } > > +#endif > > + > > } else { > > name = "ssl"; > > } > > > > - cscf = addr[a].default_server; > > - sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > > - > > if (sscf->certificates) { > > > > if (addr[a].opt.http3 && !(sscf->protocols & NGX_SSL_TLSv1_3)) { > > diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c > > --- a/src/stream/ngx_stream_ssl_module.c > > +++ b/src/stream/ngx_stream_ssl_module.c > > @@ -9,6 +9,10 @@ > > #include > > #include > > > > +#if (NGX_QUIC_OPENSSL_COMPAT) > > +#include > > +#endif > > + > > > > typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, > > ngx_pool_t *pool, ngx_str_t *s); > > @@ -1218,6 +1222,12 @@ ngx_stream_ssl_init(ngx_conf_t *cf) > > > > scf = listen[i].ctx->srv_conf[ngx_stream_ssl_module.ctx_index]; > > > > +#if (NGX_QUIC_OPENSSL_COMPAT) > > + if (ngx_quic_compat_init(cf, scf->ssl.ctx) != NGX_OK) { > > + return NGX_ERROR; > > + } > > +#endif > > + > > if (scf->certificates && !(scf->protocols & NGX_SSL_TLSv1_3)) { > > ngx_log_error(NGX_LOG_EMERG, cf->log, 0, > > "\"ssl_protocols\" must enable TLSv1.3 for " > > Following internal discussion with Roman, below is a fix for compat > layer initialization. This is a fallout after moving initialization > from ngx_ssl_create(). Although that change was justified, it has > left a couple of issues: > - SSL context can be NULL (normally caught later in function) > - only the default server was initialized, breaks with SNI. > The latter was caught by h3_ssl_reject_handshake.t > > The fix is to initialize all servers that have SSL context. > The postconfiguration function is quite large, so this is moved > to the separate function. While here, moved back assignments > closer to the place of their use. > > # HG changeset patch > # User Sergey Kandaurov > # Date 1679577205 -14400 > # Thu Mar 23 17:13:25 2023 +0400 > # Branch quic > # Node ID dcef88bdea77cf84b97580f21fbe05cc05ab631d > # Parent f4279edda9fdbbd836a86926d86cdc727492e94c > HTTP/3: fixed OpenSSL compatibility layer initialization. > > SSL context is not present if the default server has neither certificates nor > ssl_reject_handshake enabled. Previously, this led to null pointer dereference > before it would be caught with configuration checks. > > Additionally, virtual servers with distinct SSL contexts need to initialize > compatibility layer in order to complete a QUIC handshake. > > diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c > --- a/src/http/modules/ngx_http_ssl_module.c > +++ b/src/http/modules/ngx_http_ssl_module.c > @@ -56,6 +56,10 @@ static char *ngx_http_ssl_conf_command_c > void *data); > > static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); > +#if (NGX_QUIC_OPENSSL_COMPAT) > +static ngx_int_t ngx_http_ssl_quic_compat_init(ngx_conf_t *cf, > + ngx_http_conf_addr_t *addr); > +#endif > > > static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { > @@ -1328,14 +1332,11 @@ ngx_http_ssl_init(ngx_conf_t *cf) > continue; > } > > - cscf = addr[a].default_server; > - sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > - > if (addr[a].opt.quic) { > name = "quic"; > > #if (NGX_QUIC_OPENSSL_COMPAT) > - if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { > + if (ngx_http_ssl_quic_compat_init(cf, &addr[a]) != NGX_OK) { > return NGX_ERROR; > } > #endif > @@ -1344,6 +1345,9 @@ ngx_http_ssl_init(ngx_conf_t *cf) > name = "ssl"; > } > > + cscf = addr[a].default_server; > + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > + > if (sscf->certificates) { > > if (addr[a].opt.quic && !(sscf->protocols & NGX_SSL_TLSv1_3)) { > @@ -1391,3 +1395,27 @@ ngx_http_ssl_init(ngx_conf_t *cf) > > return NGX_OK; > } > + > + > +static ngx_int_t > +ngx_http_ssl_quic_compat_init(ngx_conf_t *cf, ngx_http_conf_addr_t *addr) > +{ > + ngx_uint_t s; > + ngx_http_ssl_srv_conf_t *sscf; > + ngx_http_core_srv_conf_t **cscfp, *cscf; > + > + cscfp = addr->servers.elts; > + for (s = 0; s < addr->servers.nelts; s++) { > + > + cscf = cscfp[s]; > + sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index]; > + > + if (sscf->certificates || sscf->reject_handshake) { > + if (ngx_quic_compat_init(cf, sscf->ssl.ctx) != NGX_OK) { > + return NGX_ERROR; > + } > + } > + } > + > + return NGX_OK; > +} Looks good From mdounin at mdounin.ru Thu Mar 23 14:10:12 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:10:12 +0300 Subject: [PATCH 01 of 20] Tests: separate SSL session reuse tests In-Reply-To: <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> References: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> Message-ID: Hello! On Wed, Mar 22, 2023 at 12:57:56PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679105686 -10800 > > # Sat Mar 18 05:14:46 2023 +0300 > > # Node ID 86c394a226d2a7d463da7a1b7e88375c71c0c69b > > # Parent 3c9aa6c23fc836725b96cf056d218217a5a81603 > > Tests: separate SSL session reuse tests. > > > > Instead of being mixed with generic SSL tests, session reuse variants > > are now tested in a separate file. > > > > In the generic SSL tests only basic session reuse is now tested, > > notably with session tickets enabled and a shared SSL session cache. > > This should make it possible to reuse sessions in all cases (except > > when it's not supported, such as with LibreSSL with TLSv1.3). > > > > Note that session reuse with tickets implies that $ssl_session_id > > is selected by the client and therefore is not available on the > > initial connection. Relevant test is modified to handle this. > > > > Further, BoringSSL does not use legacy session ID with TLSv1.3 even > > if it is sent by the client. In contrast, OpenSSL always generates > > an unique legacy session id, so it is available with TLSv1.3 even if > > session resumption does not work (such as with old Net::SSLeay and > > IO::Socket::SSL modules). > > Note that TLSv1.3 has only ticket based session resumption. > BoringSSL has a different notion on using legacy session IDs > in TLSv1.3, see tls13_create_session_with_ticket() in sources: > > // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. > // Envoy's tests depend on this, although perhaps they shouldn't. > SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id); > > Later, SSL_SESSION_get_id() was additionally annotated in ssl.h: > > // As a workaround for some broken applications, BoringSSL sometimes synthesizes > // arbitrary session IDs for non-ID-based sessions. This behavior may be > // removed in the future. > > As for TLSv1.3 server context, BoringSSL doesn't seem to use "session ID" > besides echoing the client's legacy_session_id field content in the > legacy_session_id_echo field of ServerHello/HRR during handshake, > as mandated in RFC 8446, 4.1.3. So it doesn't settle in the session. Yes, that's basically what "BoringSSL does not use legacy session ID with TLSv1.3..." sentence describes. > > > > diff --git a/ssl.t b/ssl.t > > --- a/ssl.t > > +++ b/ssl.t > > @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( > > plan(skip_all => 'IO::Socket::SSL too old') if $@; > > > > my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) > > - ->has_daemon('openssl')->plan(28); > > + ->has_daemon('openssl')->plan(21); > > > > $t->write_file_expand('nginx.conf', <<'EOF'); > > > > @@ -47,7 +47,6 @@ http { > > > > ssl_certificate_key localhost.key; > > ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > > > log_format ssl $ssl_protocol; > > > > @@ -59,6 +58,7 @@ http { > > ssl_certificate_key inner.key; > > ssl_certificate inner.crt; > > ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets on; > > ssl_verify_client optional_no_ca; > > > > keepalive_requests 1000; > > @@ -100,57 +100,11 @@ http { > > } > > > > server { > > - listen 127.0.0.1:8081; > > - server_name localhost; > > - > > - # Special case for enabled "ssl" directive. > > - > > - ssl on; > > Removing tests for the "ssl" legacy directive doesn't feel right > now and is out of scope of this change. Please put this back. > Not being able to test it is fragile and can be left silently > broken, especially with the upcoming quic merge. It used to be tested as a side effect of session reuse tests, and hence it is now gone. It is also tested at least in ssl_reject_handshake.t, so I tend to think it is enough. > On the other hand, I'm fine with finally removing this directive. > It was made obsolete in version 1.15.0, released on 05 Jun 2018, > with the "listen .. ssl" upgrade path available back to 0.7.14, > released on 01 Sep 2008. I think we'll consider this in 1.25.x branch. > > - ssl_session_cache builtin; > > - > > - location / { > > - return 200 "body $ssl_session_reused"; > > - } > > - } > > - > > - server { > > - listen 127.0.0.1:8082 ssl; > > - server_name localhost; > > - > > - ssl_session_cache builtin:1000; > > - > > - location / { > > - return 200 "body $ssl_session_reused"; > > - } > > - } > > - > > - server { > > - listen 127.0.0.1:8083 ssl; > > - server_name localhost; > > - > > - ssl_session_cache none; > > - > > - location / { > > - return 200 "body $ssl_session_reused"; > > - } > > - } > > - > > - server { > > - listen 127.0.0.1:8084 ssl; > > - server_name localhost; > > - > > - ssl_session_cache off; > > - > > - location / { > > - return 200 "body $ssl_session_reused"; > > - } > > - } > > - > > - server { > > listen 127.0.0.1:8086 ssl; > > Since you noticeably touched this file, > you could renumber these ports as well. I've tried my best to keep refrain from unrelated changes, the patch is already rather big. > > server_name localhost; > > > > ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets on; > > ssl_session_timeout 1; > > > > location / { > > @@ -216,59 +170,34 @@ foreach my $name ('localhost', 'inner') > > or die "Can't create certificate for $name: $!\n"; > > } > > > > -# suppress deprecation warning > > - > > -open OLDERR, ">&", \*STDERR; close STDERR; > > $t->run(); > > -open STDERR, ">&", \*OLDERR; > > > > ############################################################################### > > > > -my $ctx; > > +# ssl session reuse > > > > -SKIP: { > > -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ > > - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); > > +my $ctx = get_ssl_context(); > > > > -$ctx = get_ssl_context(); > > +like(get('/', 8085, $ctx), qr/^body \.$/m, 'session'); > > > > -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); > > -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); > > - > > -$ctx = get_ssl_context(); > > +TODO: { > > +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' > > + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); > > +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' > > + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); > > Not sure why do you convert this to TODO. > > TODO blocks are used for something we control or able to fix. > SSL libraries are not something like that, so using SKIP there > is more appropriate and follows other platform-specific tests. > Besides that, TODOs plagues diagnostic output for no purpose. > > See also Test::More documentation: > > When do I use SKIP vs. TODO? > If it's something the user might not be able to do, use SKIP. This > includes optional modules that aren't installed, running under an OS > that doesn't have some feature (like "fork()" or symlinks), or maybe > you need an Internet connection and one isn't available. > > If it's something the programmer hasn't done yet, use TODO. This is > for any code you haven't written yet, or bugs you have yet to fix, > but want to put tests in your testing script (always a good idea). As you can see from the Test::More documentation, the main distinction is: SKIP is to be used when something cannot be tested, and TODO is to use when something doesn't work (but we can test it). In this particular case, things can be tested - but tests will fail due to lack of support in IO::Socket::SSL / Net::SSLeay. Immediate benefits of using TODO here is that a) test output provides good indication of what actually happens with these module versions (that is, it does not unexpectedly die or segfault, but session reuse does not work), b) tests are actually run and it can be easily spotted if they unexpectedly succeed, and c) it combines nicely with LibreSSL / BoringSSL TODOs (which are TODO for similar reasons, see the following patches). As the code in question is not under our control, it might be good enough to use SKIP instead of TODO (and the patch series does this at least once). But I tend to think that at least in case of LibreSSL it would be much better to use TODOs, so we'll be able to see when things are finally fixed in LibreSSL - I would expect this to happen in a foreseeable future. > > > > -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); > > -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); > > - > > -$ctx = get_ssl_context(); > > - > > -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); > > -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); > > +like(get('/', 8085, $ctx), qr/^body r$/m, 'session reused'); > > > > } > > > > -$ctx = get_ssl_context(); > > - > > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); > > -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); > > - > > -$ctx = get_ssl_context(); > > - > > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); > > -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); > > - > > # ssl certificate inheritance > > > > -my $s = get_ssl_socket(8081); > > +my $s = get_ssl_socket(8086); > > like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); > > > > -$s->close(); > > - > > $s = get_ssl_socket(8085); > > like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); > > > > -$s->close(); > > - > > # session timeout > > > > $ctx = get_ssl_context(); > > @@ -280,8 +209,12 @@ like(get('/', 8086, $ctx), qr/^body \.$/ > > > > # embedded variables > > > > -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); > > +$ctx = get_ssl_context(); > > +like(get('/id', 8085, $ctx), qr/^body (\w{64})?$/m, 'session id'); > > +like(get('/id', 8085, $ctx), qr/^body \w{64}$/m, 'session id reused'); > > + > > unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); > > + > > like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); > > > > SKIP: { > > @@ -334,6 +267,10 @@ like(`grep -F '[crit]' ${\($t->testdir() > > > > ############################################################################### > > > > +sub test_tls13 { > > + return get('/protocol', 8085) =~ /TLSv1.3/; > > +} > > + > > sub get { > > my ($uri, $port, $ctx) = @_; > > my $s = get_ssl_socket($port, $ctx) or return; > > diff --git a/ssl.t b/ssl_session_reuse.t > > copy from ssl.t > > copy to ssl_session_reuse.t > > --- a/ssl.t > > +++ b/ssl_session_reuse.t > > @@ -2,6 +2,7 @@ > > > > # (C) Sergey Kandaurov > > Initial session resumption tests in ssl.t is Andrey's work. > You can drop this line, doesn't belong there. Ok, removed. > > # (C) Andrey Zelenkov > > +# (C) Maxim Dounin > > # (C) Nginx, Inc. > > > > # Tests for http ssl module. > > The description needs update. Thanks, fixed. -# Tests for http ssl module. +# Tests for http ssl module, session reuse. The same in the other *_ssl_session_reuse.t tests. > You can drop the line "use Socket qw/ CRLF /;" below, now unused. Thanks, removed. > > @@ -30,8 +31,8 @@ plan(skip_all => 'IO::Socket::SSL not in > > eval { IO::Socket::SSL::SSL_VERIFY_NONE(); }; > > plan(skip_all => 'IO::Socket::SSL too old') if $@; > > > > -my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) > > - ->has_daemon('openssl')->plan(28); > > +my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite/) > > + ->has_daemon('openssl')->plan(8); > > > > $t->write_file_expand('nginx.conf', <<'EOF'); > > > > @@ -47,66 +48,37 @@ http { > > > > ssl_certificate_key localhost.key; > > ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > - > > - log_format ssl $ssl_protocol; > > > > server { > > - listen 127.0.0.1:8085 ssl; > > - listen 127.0.0.1:8080; > > + listen 127.0.0.1:8443 ssl; > > server_name localhost; > > > > - ssl_certificate_key inner.key; > > - ssl_certificate inner.crt; > > - ssl_session_cache shared:SSL:1m; > > - ssl_verify_client optional_no_ca; > > - > > - keepalive_requests 1000; > > - > > location / { > > return 200 "body $ssl_session_reused"; > > } > > - location /id { > > - return 200 "body $ssl_session_id"; > > - } > > - location /cipher { > > - return 200 "body $ssl_cipher"; > > - } > > - location /ciphers { > > - return 200 "body $ssl_ciphers"; > > - } > > - location /client_verify { > > - return 200 "body $ssl_client_verify"; > > - } > > location /protocol { > > return 200 "body $ssl_protocol"; > > } > > - location /issuer { > > - return 200 "body $ssl_client_i_dn:$ssl_client_i_dn_legacy"; > > - } > > - location /subject { > > - return 200 "body $ssl_client_s_dn:$ssl_client_s_dn_legacy"; > > - } > > - location /time { > > - return 200 "body $ssl_client_v_start!$ssl_client_v_end!$ssl_client_v_remain"; > > - } > > - > > - location /body { > > - add_header X-Body $request_body always; > > - proxy_pass http://127.0.0.1:8080/; > > - > > - access_log %%TESTDIR%%/ssl.log ssl; > > - } > > } > > > > server { > > - listen 127.0.0.1:8081; > > + listen 127.0.0.1:8444 ssl; > > server_name localhost; > > > > - # Special case for enabled "ssl" directive. > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets on; > > > > - ssl on; > > - ssl_session_cache builtin; > > + location / { > > + return 200 "body $ssl_session_reused"; > > + } > > + } > > + > > + server { > > + listen 127.0.0.1:8445 ssl; > > + server_name localhost; > > + > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets off; > > > > location / { > > return 200 "body $ssl_session_reused"; > > @@ -114,10 +86,11 @@ http { > > } > > > > server { > > - listen 127.0.0.1:8082 ssl; > > + listen 127.0.0.1:8446 ssl; > > server_name localhost; > > > > - ssl_session_cache builtin:1000; > > + ssl_session_cache builtin; > > + ssl_session_tickets off; > > > > location / { > > return 200 "body $ssl_session_reused"; > > @@ -125,10 +98,11 @@ http { > > } > > > > server { > > - listen 127.0.0.1:8083 ssl; > > + listen 127.0.0.1:8447 ssl; > > server_name localhost; > > > > - ssl_session_cache none; > > + ssl_session_cache builtin:1000; > > + ssl_session_tickets off; > > > > location / { > > return 200 "body $ssl_session_reused"; > > @@ -136,10 +110,11 @@ http { > > } > > > > server { > > - listen 127.0.0.1:8084 ssl; > > + listen 127.0.0.1:8448 ssl; > > server_name localhost; > > > > - ssl_session_cache off; > > + ssl_session_cache none; > > + ssl_session_tickets off; > > > > location / { > > return 200 "body $ssl_session_reused"; > > @@ -147,11 +122,11 @@ http { > > } > > > > server { > > - listen 127.0.0.1:8086 ssl; > > + listen 127.0.0.1:8449 ssl; > > server_name localhost; > > > > - ssl_session_cache shared:SSL:1m; > > - ssl_session_timeout 1; > > + ssl_session_cache off; > > + ssl_session_tickets off; > > > > location / { > > return 200 "body $ssl_session_reused"; > > @@ -171,44 +146,7 @@ EOF > > > > my $d = $t->testdir(); > > > > -$t->write_file('ca.conf', < > -[ ca ] > > -default_ca = myca > > - > > -[ myca ] > > -new_certs_dir = $d > > -database = $d/certindex > > -default_md = sha256 > > -policy = myca_policy > > -serial = $d/certserial > > -default_days = 3 > > - > > -[ myca_policy ] > > -commonName = supplied > > -EOF > > - > > -$t->write_file('certserial', '1000'); > > -$t->write_file('certindex', ''); > > - > > -system('openssl req -x509 -new ' > > - . "-config $d/openssl.conf -subj /CN=issuer/ " > > - . "-out $d/issuer.crt -keyout $d/issuer.key " > > - . ">>$d/openssl.out 2>&1") == 0 > > - or die "Can't create certificate for issuer: $!\n"; > > - > > -system("openssl req -new " > > - . "-config $d/openssl.conf -subj /CN=subject/ " > > - . "-out $d/subject.csr -keyout $d/subject.key " > > - . ">>$d/openssl.out 2>&1") == 0 > > - or die "Can't create certificate for subject: $!\n"; > > - > > -system("openssl ca -batch -config $d/ca.conf " > > - . "-keyfile $d/issuer.key -cert $d/issuer.crt " > > - . "-subj /CN=subject/ -in $d/subject.csr -out $d/subject.crt " > > - . ">>$d/openssl.out 2>&1") == 0 > > - or die "Can't sign certificate for subject: $!\n"; > > - > > -foreach my $name ('localhost', 'inner') { > > +foreach my $name ('localhost') { > > system('openssl req -x509 -new ' > > . "-config $d/openssl.conf -subj /CN=$name/ " > > . "-out $d/$name.crt -keyout $d/$name.key " > > @@ -216,124 +154,56 @@ foreach my $name ('localhost', 'inner') > > or die "Can't create certificate for $name: $!\n"; > > } > > > > -# suppress deprecation warning > > - > > -open OLDERR, ">&", \*STDERR; close STDERR; > > $t->run(); > > -open STDERR, ">&", \*OLDERR; > > > > ############################################################################### > > > > my $ctx; > > You can remove this declaration to the only sub test_reuse user. Thanks, fixed (as well as in mail). [...] Updated patch: # HG changeset patch # User Maxim Dounin # Date 1679498636 -10800 # Wed Mar 22 18:23:56 2023 +0300 # Node ID 8fb46a1a0f3e6ca94e2c59ce50e3043a67cde674 # Parent 1f125771f1a1014dcceb8b765f3dd3153d4552f9 Tests: separate SSL session reuse tests. Instead of being mixed with generic SSL tests, session reuse variants are now tested in a separate file. In the generic SSL tests only basic session reuse is now tested, notably with session tickets enabled and a shared SSL session cache. This should make it possible to reuse sessions in all cases (except when it's not supported, such as with LibreSSL with TLSv1.3). Note that session reuse with tickets implies that $ssl_session_id is selected by the client and therefore is not available on the initial connection. Relevant test is modified to handle this. Further, BoringSSL does not use legacy session ID with TLSv1.3 even if it is sent by the client. In contrast, OpenSSL always generates an unique legacy session id, so it is available with TLSv1.3 even if session resumption does not work (such as with old Net::SSLeay and IO::Socket::SSL modules). diff --git a/ssl.t b/ssl.t --- a/ssl.t +++ b/ssl.t @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( plan(skip_all => 'IO::Socket::SSL too old') if $@; my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) - ->has_daemon('openssl')->plan(28); + ->has_daemon('openssl')->plan(21); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -47,7 +47,6 @@ http { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; log_format ssl $ssl_protocol; @@ -59,6 +58,7 @@ http { ssl_certificate_key inner.key; ssl_certificate inner.crt; ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; ssl_verify_client optional_no_ca; keepalive_requests 1000; @@ -100,57 +100,11 @@ http { } server { - listen 127.0.0.1:8081; - server_name localhost; - - # Special case for enabled "ssl" directive. - - ssl on; - ssl_session_cache builtin; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8082 ssl; - server_name localhost; - - ssl_session_cache builtin:1000; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8083 ssl; - server_name localhost; - - ssl_session_cache none; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8084 ssl; - server_name localhost; - - ssl_session_cache off; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { listen 127.0.0.1:8086 ssl; server_name localhost; ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; ssl_session_timeout 1; location / { @@ -216,59 +170,34 @@ foreach my $name ('localhost', 'inner') or die "Can't create certificate for $name: $!\n"; } -# suppress deprecation warning - -open OLDERR, ">&", \*STDERR; close STDERR; $t->run(); -open STDERR, ">&", \*OLDERR; ############################################################################### -my $ctx; +# ssl session reuse -SKIP: { -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); +my $ctx = get_ssl_context(); -$ctx = get_ssl_context(); +like(get('/', 8085, $ctx), qr/^body \.$/m, 'session'); -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); - -$ctx = get_ssl_context(); +TODO: { +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); +like(get('/', 8085, $ctx), qr/^body r$/m, 'session reused'); } -$ctx = get_ssl_context(); - -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); - # ssl certificate inheritance -my $s = get_ssl_socket(8081); +my $s = get_ssl_socket(8086); like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); -$s->close(); - $s = get_ssl_socket(8085); like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); -$s->close(); - # session timeout $ctx = get_ssl_context(); @@ -280,8 +209,12 @@ like(get('/', 8086, $ctx), qr/^body \.$/ # embedded variables -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); +$ctx = get_ssl_context(); +like(get('/id', 8085, $ctx), qr/^body (\w{64})?$/m, 'session id'); +like(get('/id', 8085, $ctx), qr/^body \w{64}$/m, 'session id reused'); + unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); + like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); SKIP: { @@ -334,6 +267,10 @@ like(`grep -F '[crit]' ${\($t->testdir() ############################################################################### +sub test_tls13 { + return get('/protocol', 8085) =~ /TLSv1.3/; +} + sub get { my ($uri, $port, $ctx) = @_; my $s = get_ssl_socket($port, $ctx) or return; diff --git a/ssl.t b/ssl_session_reuse.t copy from ssl.t copy to ssl_session_reuse.t --- a/ssl.t +++ b/ssl_session_reuse.t @@ -1,10 +1,10 @@ #!/usr/bin/perl -# (C) Sergey Kandaurov # (C) Andrey Zelenkov +# (C) Maxim Dounin # (C) Nginx, Inc. -# Tests for http ssl module. +# Tests for http ssl module, session reuse. ############################################################################### @@ -13,8 +13,6 @@ use strict; use Test::More; -use Socket qw/ CRLF /; - BEGIN { use FindBin; chdir($FindBin::Bin); } use lib 'lib'; @@ -30,8 +28,8 @@ plan(skip_all => 'IO::Socket::SSL not in eval { IO::Socket::SSL::SSL_VERIFY_NONE(); }; plan(skip_all => 'IO::Socket::SSL too old') if $@; -my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) - ->has_daemon('openssl')->plan(28); +my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite/) + ->has_daemon('openssl')->plan(8); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -47,66 +45,37 @@ http { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; - - log_format ssl $ssl_protocol; server { - listen 127.0.0.1:8085 ssl; - listen 127.0.0.1:8080; + listen 127.0.0.1:8443 ssl; server_name localhost; - ssl_certificate_key inner.key; - ssl_certificate inner.crt; - ssl_session_cache shared:SSL:1m; - ssl_verify_client optional_no_ca; - - keepalive_requests 1000; - location / { return 200 "body $ssl_session_reused"; } - location /id { - return 200 "body $ssl_session_id"; - } - location /cipher { - return 200 "body $ssl_cipher"; - } - location /ciphers { - return 200 "body $ssl_ciphers"; - } - location /client_verify { - return 200 "body $ssl_client_verify"; - } location /protocol { return 200 "body $ssl_protocol"; } - location /issuer { - return 200 "body $ssl_client_i_dn:$ssl_client_i_dn_legacy"; - } - location /subject { - return 200 "body $ssl_client_s_dn:$ssl_client_s_dn_legacy"; - } - location /time { - return 200 "body $ssl_client_v_start!$ssl_client_v_end!$ssl_client_v_remain"; - } - - location /body { - add_header X-Body $request_body always; - proxy_pass http://127.0.0.1:8080/; - - access_log %%TESTDIR%%/ssl.log ssl; - } } server { - listen 127.0.0.1:8081; + listen 127.0.0.1:8444 ssl; server_name localhost; - # Special case for enabled "ssl" directive. + ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; - ssl on; - ssl_session_cache builtin; + location / { + return 200 "body $ssl_session_reused"; + } + } + + server { + listen 127.0.0.1:8445 ssl; + server_name localhost; + + ssl_session_cache shared:SSL:1m; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -114,10 +83,11 @@ http { } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8446 ssl; server_name localhost; - ssl_session_cache builtin:1000; + ssl_session_cache builtin; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -125,10 +95,11 @@ http { } server { - listen 127.0.0.1:8083 ssl; + listen 127.0.0.1:8447 ssl; server_name localhost; - ssl_session_cache none; + ssl_session_cache builtin:1000; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -136,10 +107,11 @@ http { } server { - listen 127.0.0.1:8084 ssl; + listen 127.0.0.1:8448 ssl; server_name localhost; - ssl_session_cache off; + ssl_session_cache none; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -147,11 +119,11 @@ http { } server { - listen 127.0.0.1:8086 ssl; + listen 127.0.0.1:8449 ssl; server_name localhost; - ssl_session_cache shared:SSL:1m; - ssl_session_timeout 1; + ssl_session_cache off; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -171,44 +143,7 @@ EOF my $d = $t->testdir(); -$t->write_file('ca.conf', <write_file('certserial', '1000'); -$t->write_file('certindex', ''); - -system('openssl req -x509 -new ' - . "-config $d/openssl.conf -subj /CN=issuer/ " - . "-out $d/issuer.crt -keyout $d/issuer.key " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't create certificate for issuer: $!\n"; - -system("openssl req -new " - . "-config $d/openssl.conf -subj /CN=subject/ " - . "-out $d/subject.csr -keyout $d/subject.key " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't create certificate for subject: $!\n"; - -system("openssl ca -batch -config $d/ca.conf " - . "-keyfile $d/issuer.key -cert $d/issuer.crt " - . "-subj /CN=subject/ -in $d/subject.csr -out $d/subject.crt " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't sign certificate for subject: $!\n"; - -foreach my $name ('localhost', 'inner') { +foreach my $name ('localhost') { system('openssl req -x509 -new ' . "-config $d/openssl.conf -subj /CN=$name/ " . "-out $d/$name.crt -keyout $d/$name.key " @@ -216,124 +151,54 @@ foreach my $name ('localhost', 'inner') or die "Can't create certificate for $name: $!\n"; } -# suppress deprecation warning - -open OLDERR, ">&", \*STDERR; close STDERR; $t->run(); -open STDERR, ">&", \*OLDERR; ############################################################################### -my $ctx; - -SKIP: { -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); - -$ctx = get_ssl_context(); +# session reuse: +# +# - only tickets, the default +# - tickets and shared cache, should work always +# - only shared cache +# - only builtin cache +# - only builtin cache with explicitly configured size +# - only cache none +# - only cache off -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); - -$ctx = get_ssl_context(); +TODO: { +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); +is(test_reuse(8443), 1, 'tickets reused'); +is(test_reuse(8444), 1, 'tickets and cache reused'); +is(test_reuse(8445), 1, 'cache shared reused'); +is(test_reuse(8446), 1, 'cache builtin reused'); +is(test_reuse(8447), 1, 'cache builtin size reused'); } -$ctx = get_ssl_context(); - -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); - -# ssl certificate inheritance - -my $s = get_ssl_socket(8081); -like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); - -$s->close(); - -$s = get_ssl_socket(8085); -like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); - -$s->close(); - -# session timeout - -$ctx = get_ssl_context(); - -get('/', 8086, $ctx); -select undef, undef, undef, 2.1; - -like(get('/', 8086, $ctx), qr/^body \.$/m, 'session timeout'); - -# embedded variables - -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); -unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); -like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); - -SKIP: { -skip 'BoringSSL', 1 if $t->has_module('BoringSSL'); - -like(get('/ciphers', 8085), qr/^body [:\w-]+$/m, 'ciphers'); - -} - -like(get('/client_verify', 8085), qr/^body NONE$/m, 'client verify'); -like(get('/protocol', 8085), qr/^body (TLS|SSL)v(\d|\.)+$/m, 'protocol'); -like(cert('/issuer', 8085), qr!^body CN=issuer:/CN=issuer$!m, 'issuer'); -like(cert('/subject', 8085), qr!^body CN=subject:/CN=subject$!m, 'subject'); -like(cert('/time', 8085), qr/^body [:\s\w]+![:\s\w]+![23]$/m, 'time'); - -# c->read->ready handling bug in ngx_ssl_recv(), triggered with chunked body - -like(get_body('/body', '0123456789', 20, 5), qr/X-Body: (0123456789){100}/, - 'request body chunked'); - -# pipelined requests - -$s = get_ssl_socket(8085); -my $req = < $s) || ""; -$s = undef; -is(() = $r =~ /(200 OK)/g, 1000, 'pipelined requests'); - -# OpenSSL 3.0 error "unexpected eof while reading" seen as a critical error - -ok(get_ssl_socket(8085), 'ssl unexpected eof'); - -# close_notify is sent before lingering close - -is(get_ssl_shutdown(8085), 1, 'ssl shutdown on lingering close'); +is(test_reuse(8448), 0, 'cache none not reused'); +is(test_reuse(8449), 0, 'cache off not reused'); $t->stop(); -like($t->read_file('ssl.log'), qr/^(TLS|SSL)v(\d|\.)+$/m, - 'log ssl variable on lingering close'); - like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); ############################################################################### +sub test_tls13 { + return get('/protocol', 8443) =~ /TLSv1.3/; +} + +sub test_reuse { + my ($port) = @_; + my $ctx = get_ssl_context(); + get('/', $port, $ctx); + return (get('/', $port, $ctx) =~ qr/^body r$/m) ? 1 : 0; +} + sub get { my ($uri, $port, $ctx) = @_; my $s = get_ssl_socket($port, $ctx) or return; @@ -342,30 +207,6 @@ sub get { return $r; } -sub get_body { - my ($uri, $body, $len, $n) = @_; - my $s = get_ssl_socket(8085) or return; - http("GET /body HTTP/1.1" . CRLF - . "Host: localhost" . CRLF - . "Connection: close" . CRLF - . "Transfer-Encoding: chunked" . CRLF . CRLF, - socket => $s, start => 1); - my $chs = unpack("H*", pack("C", length($body) * $len)); - http($chs . CRLF . $body x $len . CRLF, socket => $s, start => 1) - for 1 .. $n; - my $r = http("0" . CRLF . CRLF, socket => $s); - $s->close(); - return $r; -} - -sub cert { - my ($uri, $port) = @_; - my $s = get_ssl_socket($port, undef, - SSL_cert_file => "$d/subject.crt", - SSL_key_file => "$d/subject.key") or return; - http_get($uri, socket => $s); -} - sub get_ssl_context { return IO::Socket::SSL::SSL_Context->new( SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(), @@ -402,18 +243,4 @@ sub get_ssl_socket { return $s; } -sub get_ssl_shutdown { - my ($port) = @_; - - my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); - my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_fd($ssl, fileno($s)); - Net::SSLeay::connect($ssl) or die("ssl connect"); - Net::SSLeay::write($ssl, 'GET /' . CRLF . 'extra'); - Net::SSLeay::read($ssl); - Net::SSLeay::set_shutdown($ssl, 1); - Net::SSLeay::shutdown($ssl); -} - ############################################################################### -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:15:47 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:15:47 +0300 Subject: [PATCH 03 of 20] Tests: separate SSL session reuse tests in mail In-Reply-To: References: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> Message-ID: Hello! On Wed, Mar 22, 2023 at 01:46:33PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679107816 -10800 > > # Sat Mar 18 05:50:16 2023 +0300 > > # Node ID 97b09b6633f69747c0d6ef13c76739bdd6b7f3bb > > # Parent 125fb8461d88a81a62ccb40d0e205a01ecc759f5 > > Tests: separate SSL session reuse tests in mail. > > > > Instead of being mixed with generic SSL tests, session reuse variants > > are now tested in a separate file. > > > > [..] > > diff --git a/mail_ssl.t b/mail_ssl_session_reuse.t > > copy from mail_ssl.t > > copy to mail_ssl_session_reuse.t > > --- a/mail_ssl.t > > +++ b/mail_ssl_session_reuse.t > > @@ -1,6 +1,7 @@ > > #!/usr/bin/perl > > > > # (C) Andrey Zelenkov > > +# (C) Maxim Dounin > > # (C) Nginx, Inc. > > > > # Tests for mail ssl module. > > @@ -33,11 +34,8 @@ eval { > > }; > > plan(skip_all => 'Net::SSLeay not installed') if $@; > > > > -eval { exists &Net::SSLeay::P_alpn_selected or die; }; > > -plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; > > - > > -my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) > > - ->has_daemon('openssl')->plan(22); > > +my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap/) > > + ->has_daemon('openssl')->plan(7); > > > > $t->write_file_expand('nginx.conf', <<'EOF'); > > > > @@ -49,90 +47,62 @@ events { > > } > > > > mail { > > - ssl_certificate_key localhost.key; > > - ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > + auth_http http://127.0.0.1:8080; > > > > - ssl_password_file password; > > - > > - auth_http http://127.0.0.1:8080; # unused > > - > > - ssl_session_cache none; > > + ssl_certificate localhost.crt; > > + ssl_certificate_key localhost.key; > > > > server { > > - listen 127.0.0.1:8143; > > - listen 127.0.0.1:8145 ssl; > > - protocol imap; > > - > > - ssl_session_cache builtin; > > + listen 127.0.0.1:8993 ssl; > > + protocol imap; > > } > > > > server { > > - listen 127.0.0.1:8146 ssl; > > - protocol imap; > > + listen 127.0.0.1:8994 ssl; > > + protocol imap; > > > > - ssl_session_cache off; > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets on; > > } > > > > server { > > - listen 127.0.0.1:8147; > > - protocol imap; > > + listen 127.0.0.1:8995 ssl; > > + protocol imap; > > > > - # Special case for enabled "ssl" directive. > > - > > - ssl on; > > - ssl_session_cache builtin:1000; > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8148 ssl; > > - protocol imap; > > - > > - ssl_session_cache shared:SSL:1m; > > - ssl_certificate_key inherits.key; > > - ssl_certificate inherits.crt; > > - } > > + listen 127.0.0.1:8996 ssl; > > + protocol imap; > > > > - server { > > - listen 127.0.0.1:8149; > > - protocol imap; > > - > > - starttls on; > > - } > > - > > - server { > > - listen 127.0.0.1:8150; > > - protocol imap; > > - > > - starttls only; > > + ssl_session_cache builtin; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8151; > > - protocol pop3; > > + listen 127.0.0.1:8997 ssl; > > + protocol imap; > > > > - starttls on; > > + ssl_session_cache builtin:1000; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8152; > > - protocol pop3; > > + listen 127.0.0.1:8998 ssl; > > + protocol imap; > > > > - starttls only; > > + ssl_session_cache none; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8153; > > - protocol smtp; > > - > > - starttls on; > > - } > > + listen 127.0.0.1:8999 ssl; > > + protocol imap; > > > > - server { > > - listen 127.0.0.1:8154; > > - protocol smtp; > > - > > - starttls only; > > + ssl_session_cache off; > > + ssl_session_tickets off; > > } > > } > > > > @@ -148,181 +118,57 @@ EOF > > > > my $d = $t->testdir(); > > > > -foreach my $name ('localhost', 'inherits') { > > - system("openssl genrsa -out $d/$name.key -passout pass:localhost " > > - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 > > - or die "Can't create private key: $!\n"; > > +foreach my $name ('localhost') { > > system('openssl req -x509 -new ' > > . "-config $d/openssl.conf -subj /CN=$name/ " > > - . "-out $d/$name.crt " > > - . "-key $d/$name.key -passin pass:localhost" > > + . "-out $d/$name.crt -keyout $d/$name.key " > > . ">>$d/openssl.out 2>&1") == 0 > > or die "Can't create certificate for $name: $!\n"; > > } > > > > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > > -$t->write_file('password', 'localhost'); > > > > -open OLDERR, ">&", \*STDERR; close STDERR; > > $t->run(); > > -open STDERR, ">&", \*OLDERR; > > > > ############################################################################### > > > > [..] > > +# session reuse: > > +# > > +# - only tickets, the default > > +# - tickets and shared cache > > "should work always", like in http and stream? Added, thanks. > > +# - only shared cache > > +# - only builtin cache > > +# - only builtin cache with explicitly configured size > > +# - only cache none > > +# - only cache off > > > > [..] > > +is(test_reuse(8993), 1, 'tickets reused'); > > +is(test_reuse(8994), 1, 'tickets and cache reused'); > > +is(test_reuse(8995), 1, 'cache shared reused'); > > +is(test_reuse(8996), 1, 'cache builtin reused'); > > +is(test_reuse(8997), 1, 'cache builtin size reused'); > > +is(test_reuse(8998), 0, 'cache none not reused'); > > +is(test_reuse(8999), 0, 'cache off not reused'); > > > > ############################################################################### > > > > +sub test_reuse { > > + my ($port) = @_; > > + my ($s, $ssl) = get_ssl_socket($port); > > + Net::SSLeay::read($ssl); > > + my $ses = Net::SSLeay::get_session($ssl); > > + ($s, $ssl) = get_ssl_socket($port, $ses); > > + return Net::SSLeay::session_reused($ssl); > > +} > > + > > sub get_ssl_socket { > > - my ($port, $ses, $alpn) = @_; > > + my ($port, $ses) = @_; > > > > my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > > Net::SSLeay::set_session($ssl, $ses) if defined $ses; > > - Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; > > Net::SSLeay::set_fd($ssl, fileno($s)); > > Net::SSLeay::connect($ssl) == 1 or return; > > Since this won't fail anymore on ALPN checks, > you can convert this back to die. Strictly speaking, it shouldn't die regardless of whether connect() can legitimately fail during tests or not. If connect() fails (for example, due to a bug in some of the session reuse variants), it still should run other tests. Fixing this (and other issues, such as missing timeout and SIGPIPE handling) is out of the scope of this patch series though. > > return ($s, $ssl); -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:16:19 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:16:19 +0300 Subject: [PATCH 05 of 20] Tests: separate SSL session reuse tests in stream In-Reply-To: <2640439F-CFF2-4ABB-92F6-7D71AA1DF4A6@nginx.com> References: <530336cb449dcb028a55.1679148900@vm-bsd.mdounin.ru> <2640439F-CFF2-4ABB-92F6-7D71AA1DF4A6@nginx.com> Message-ID: Hello! On Wed, Mar 22, 2023 at 01:55:48PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679140351 -10800 > > # Sat Mar 18 14:52:31 2023 +0300 > > # Node ID 530336cb449dcb028a55a5a401a122d07521e3a4 > > # Parent 3ab3b2d1c2e67bc1f05e386218ceb08da873a477 > > Tests: separate SSL session reuse tests in stream. > > > > Instead of being mixed with generic SSL tests, session reuse variants > > are now tested in a separate file. > > > > diff --git a/stream_ssl.t b/stream_ssl.t > > --- a/stream_ssl.t > > +++ b/stream_ssl.t > > @@ -37,7 +37,7 @@ plan(skip_all => 'win32') if $^O eq 'MSW > > > > my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); > > > > -$t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); > > +$t->plan(5)->write_file_expand('nginx.conf', <<'EOF'); > > > > %%TEST_GLOBALS%% > > > > @@ -51,40 +51,35 @@ stream { > > > > ssl_certificate_key localhost.key; > > ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > > > # inherited by server "inherits" > > ssl_password_file password_stream; > > > > server { > > - listen 127.0.0.1:8080 ssl; > > + listen 127.0.0.1:8443 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache builtin; > > ssl_password_file password; > > } > > > > server { > > - listen 127.0.0.1:8082 ssl; > > + listen 127.0.0.1:8444 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache off; > > ssl_password_file password_many; > > } > > > > server { > > - listen 127.0.0.1:8083 ssl; > > + listen 127.0.0.1:8445 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache builtin:1000; > > ssl_password_file password_fifo; > > } > > > > server { > > - listen 127.0.0.1:8084 ssl; > > + listen 127.0.0.1:8446 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache shared:SSL:1m; > > ssl_certificate_key inherits.key; > > ssl_certificate inherits.crt; > > } > > @@ -138,52 +133,26 @@ kill 'INT', $p if $@; > > > > ############################################################################### > > > > -my ($s, $ssl, $ses); > > +my ($s, $ssl); > > > > -($s, $ssl) = get_ssl_socket(port(8080)); > > +($s, $ssl) = get_ssl_socket(8443); > > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > > like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl'); > > > > -# ssl_session_cache > > - > > -($s, $ssl) = get_ssl_socket(port(8080)); > > +($s, $ssl) = get_ssl_socket(8444); > > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > > -Net::SSLeay::read($ssl); > > -$ses = Net::SSLeay::get_session($ssl); > > - > > -($s, $ssl) = get_ssl_socket(port(8080), $ses); > > -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); > > - > > -($s, $ssl) = get_ssl_socket(port(8082)); > > -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > > -Net::SSLeay::read($ssl); > > -$ses = Net::SSLeay::get_session($ssl); > > +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password many'); > > > > -($s, $ssl) = get_ssl_socket(port(8082), $ses); > > -isnt(Net::SSLeay::session_reused($ssl), 1, 'session not reused'); > > - > > -($s, $ssl) = get_ssl_socket(port(8083)); > > +($s, $ssl) = get_ssl_socket(8444); > > should be 8445 Fixed, thanks for catching. > > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > > -Net::SSLeay::read($ssl); > > -$ses = Net::SSLeay::get_session($ssl); > > - > > -($s, $ssl) = get_ssl_socket(port(8083), $ses); > > -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); > > - > > -($s, $ssl) = get_ssl_socket(port(8084)); > > -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > > -Net::SSLeay::read($ssl); > > -$ses = Net::SSLeay::get_session($ssl); > > - > > -($s, $ssl) = get_ssl_socket(port(8084), $ses); > > -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); > > +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password fifo'); > > > > # ssl_certificate inheritance > > > > -($s, $ssl) = get_ssl_socket(port(8080)); > > +($s, $ssl) = get_ssl_socket(8443); > > like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=localhost/, 'CN'); > > > > -($s, $ssl) = get_ssl_socket(port(8084)); > > +($s, $ssl) = get_ssl_socket(8446); > > like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner'); > > > > ############################################################################### > > @@ -191,7 +160,7 @@ like(Net::SSLeay::dump_peer_certificate( > > sub get_ssl_socket { > > my ($port, $ses) = @_; > > > > - my $s = IO::Socket::INET->new('127.0.0.1:' . $port); > > + my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > > Net::SSLeay::set_session($ssl, $ses) if defined $ses; > > Session test remnants can be cleaned up. Removed, thanks. > > Net::SSLeay::set_fd($ssl, fileno($s)); > > diff --git a/stream_ssl.t b/stream_ssl_session_reuse.t > > copy from stream_ssl.t > > copy to stream_ssl_session_reuse.t > > --- a/stream_ssl.t > > +++ b/stream_ssl_session_reuse.t > > @@ -1,6 +1,7 @@ > > #!/usr/bin/perl > > > > # (C) Sergey Kandaurov > > +# (C) Maxim Dounin > > # (C) Nginx, Inc. > > > > # Tests for stream ssl module. > > @@ -12,7 +13,6 @@ use strict; > > > > use Test::More; > > > > -use POSIX qw/ mkfifo /; > > This file can be run now on win32. Yes, thanks, removed the win32 check. > > > use Socket qw/ $CRLF /; > > > > BEGIN { use FindBin; chdir($FindBin::Bin); } > > @@ -49,44 +49,60 @@ events { > > stream { > > %%TEST_GLOBALS_STREAM%% > > > > + ssl_certificate localhost.crt; > > ssl_certificate_key localhost.key; > > - ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > > > - # inherited by server "inherits" > > - ssl_password_file password_stream; > > + server { > > + listen 127.0.0.1:8443 ssl; > > + proxy_pass 127.0.0.1:8081; > > + } > > > > server { > > - listen 127.0.0.1:8080 ssl; > > + listen 127.0.0.1:8444 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache builtin; > > - ssl_password_file password; > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets on; > > + } > > + > > + server { > > + listen 127.0.0.1:8445 ssl; > > + proxy_pass 127.0.0.1:8081; > > + > > + ssl_session_cache shared:SSL:1m; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8082 ssl; > > + listen 127.0.0.1:8446 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache off; > > - ssl_password_file password_many; > > + ssl_session_cache builtin; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8083 ssl; > > + listen 127.0.0.1:8447 ssl; > > proxy_pass 127.0.0.1:8081; > > > > ssl_session_cache builtin:1000; > > - ssl_password_file password_fifo; > > + ssl_session_tickets off; > > } > > > > server { > > - listen 127.0.0.1:8084 ssl; > > + listen 127.0.0.1:8448 ssl; > > proxy_pass 127.0.0.1:8081; > > > > - ssl_session_cache shared:SSL:1m; > > - ssl_certificate_key inherits.key; > > - ssl_certificate inherits.crt; > > + ssl_session_cache none; > > + ssl_session_tickets off; > > + } > > + > > + server { > > + listen 127.0.0.1:8449 ssl; > > + proxy_pass 127.0.0.1:8081; > > + > > + ssl_session_cache off; > > + ssl_session_tickets off; > > } > > } > > > > @@ -101,16 +117,11 @@ distinguished_name = req_distinguished_n > > EOF > > > > my $d = $t->testdir(); > > -mkfifo("$d/password_fifo", 0700); > > > > -foreach my $name ('localhost', 'inherits') { > > - system("openssl genrsa -out $d/$name.key -passout pass:$name " > > - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 > > - or die "Can't create private key: $!\n"; > > +foreach my $name ('localhost') { > > system('openssl req -x509 -new ' > > . "-config $d/openssl.conf -subj /CN=$name/ " > > - . "-out $d/$name.crt " > > - . "-key $d/$name.key -passin pass:$name" > > + . "-out $d/$name.crt -keyout $d/$name.key " > > . ">>$d/openssl.out 2>&1") == 0 > > or die "Can't create certificate for $name: $!\n"; > > } > > @@ -118,80 +129,48 @@ foreach my $name ('localhost', 'inherits > > > > This introduces one more occurrence of extra blank line on copy/paste, > I'd rather fix it in both files. Multiple blank lines not exactly violate style, but I agree that it's probably better to remove these. Removed. > > [..] > > diff --git a/stream_ssl.t b/stream_ssl.t > --- a/stream_ssl.t > +++ b/stream_ssl.t > @@ -110,7 +110,6 @@ foreach my $name ('localhost', 'inherits > or die "Can't create certificate for $name: $!\n"; > } > > - > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > > $t->write_file('password', 'localhost'); > @@ -143,7 +142,7 @@ like(Net::SSLeay::read($ssl), qr/200 OK/ > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password many'); > > -($s, $ssl) = get_ssl_socket(8444); > +($s, $ssl) = get_ssl_socket(8445); > Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); > like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password fifo'); > > @@ -158,11 +157,10 @@ like(Net::SSLeay::dump_peer_certificate( > ############################################################################### > > sub get_ssl_socket { > - my ($port, $ses) = @_; > + my ($port) = @_; > > my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > - Net::SSLeay::set_session($ssl, $ses) if defined $ses; > Net::SSLeay::set_fd($ssl, fileno($s)); > Net::SSLeay::connect($ssl) or die("ssl connect"); > return ($s, $ssl); > diff --git a/stream_ssl_session_reuse.t b/stream_ssl_session_reuse.t > --- a/stream_ssl_session_reuse.t > +++ b/stream_ssl_session_reuse.t > @@ -33,8 +33,6 @@ eval { > }; > plan(skip_all => 'Net::SSLeay not installed') if $@; > > -plan(skip_all => 'win32') if $^O eq 'MSWin32'; > - > my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); > > $t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); > @@ -126,7 +124,6 @@ foreach my $name ('localhost') { > or die "Can't create certificate for $name: $!\n"; > } > > - > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > > $t->run_daemon(\&http_daemon); My diff matches, thanks. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:16:47 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:16:47 +0300 Subject: [PATCH 06 of 20] Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in mail In-Reply-To: <10CCED02-0019-4520-AD41-CFCE12E38417@nginx.com> References:

<10CCED02-0019-4520-AD41-CFCE12E38417@nginx.com> Message-ID: Hello! On Wed, Mar 22, 2023 at 01:59:27PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679140402 -10800 > > # Sat Mar 18 14:53:22 2023 +0300 > > # Node ID d90fe31a80d5e85b59e525e874d24f409716b64c > > # Parent 530336cb449dcb028a55a5a401a122d07521e3a4 > > Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in mail. > > in stream Fixed, thnx. > > > > LibreSSL does not support session reuse with TLSv1.3 at all. BoringSSL > > with TLSv1.3 only supports session tickets, but not server-side session > > cache. > > > > By the way, why introduce three separate changesets (p02, p04, p06) > with identical description and similar changes. I'd combine them. These patches complement corresponding changes to introduce separate session reuse tests. And these in turn are mostly preparation to make it possible to easily add TODOs for LibreSSL and BoringSSL. While combining some or even all of these patches is certainly possible, I believe it is much easier to understand and review them separately. In general, the patch series follows logic "prepare a test file for changes if needed, add appropriate TODOs". This ensures that preparation changes can be easily seen as such, and also ensures that each individual patch is simple enough. > > diff --git a/stream_ssl_session_reuse.t b/stream_ssl_session_reuse.t > > --- a/stream_ssl_session_reuse.t > > +++ b/stream_ssl_session_reuse.t > > @@ -147,16 +147,35 @@ my $ctx = Net::SSLeay::CTX_new() or die( > > # - only cache none > > # - only cache off > > > > +TODO: { > > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > > + if $t->has_module('LibreSSL') && test_tls13(); > > + > > is(test_reuse(8443), 1, 'tickets reused'); > > is(test_reuse(8444), 1, 'tickets and cache reused'); > > + > > +TODO: { > > +local $TODO = 'no TLSv1.3 session cache in BoringSSL' > > + if $t->has_module('BoringSSL') && test_tls13(); > > + > > is(test_reuse(8445), 1, 'cache shared reused'); > > is(test_reuse(8446), 1, 'cache builtin reused'); > > is(test_reuse(8447), 1, 'cache builtin size reused'); > > + > > +} > > +} > > + > > is(test_reuse(8448), 0, 'cache none not reused'); > > is(test_reuse(8449), 0, 'cache off not reused'); > > > > + > > extra blank line Fixed, thanks. > > ############################################################################### > > > > +sub test_tls13 { > > + my ($s, $ssl) = get_ssl_socket(8443); > > + return (Net::SSLeay::version($ssl) > 0x303); > > +} > > + > > sub test_reuse { > > my ($port) = @_; > > my ($s, $ssl) = get_ssl_socket($port); -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:17:29 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:17:29 +0300 Subject: [PATCH 19 of 20] Tests: removed multiple server certificates from ssl_ocsp.t In-Reply-To: <5AD7ACF5-169D-4578-8D3C-DA691B2F935F@nginx.com> References: <782531c3cd79dcf70027.1679148914@vm-bsd.mdounin.ru> <5AD7ACF5-169D-4578-8D3C-DA691B2F935F@nginx.com> Message-ID: Hello! On Wed, Mar 22, 2023 at 03:05:16PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679148855 -10800 > > # Sat Mar 18 17:14:15 2023 +0300 > > # Node ID 782531c3cd79dcf700276e10bef00e524de009d1 > > # Parent c140f78fbc8f62c9694d3b969d1309570a96f2e7 > > Tests: removed multiple server certificates from ssl_ocsp.t. > > > > Multiple server certificates are not needed to test OCSP verification of > > client certificates (in contrast to OCSP stapling, where server certificates > > are verified, and different staples should be correctly returned with > > different server certificates). And using multiple server certificates > > causes issues when testing with LibreSSL due to broken sigalgs-based > > server certificate selection in LibreSSL with TLSv1.3. > > > > Accordingly, the test is simplified to do not use multiple server > > certificates. > > > > diff --git a/ssl_ocsp.t b/ssl_ocsp.t > > --- a/ssl_ocsp.t > > +++ b/ssl_ocsp.t > > @@ -63,10 +63,7 @@ http { > > ssl_verify_depth 2; > > ssl_client_certificate trusted.crt; > > > > - ssl_ciphers DEFAULT:ECCdraft; > > - > > - ssl_certificate_key ec.key; > > - ssl_certificate ec.crt; > > +# ssl_ciphers DEFAULT:ECCdraft; > > This doesn't serve its purpose now and can be removed, > now that you've removed multiple (ECC) certificates. > It was used to run tests with ECC certificates/ciphers, > as otherwise it would result in "no shared cipher" error. > > ECCdraft is an old alias used to enable ECC ciphersuites > and run tests with ECC certificate on OpenSSL 0.9.8, > before they became official in RFC 4492. > > - ECC ciphersuites were disabled by default in 0.9.8c, > and ECCdraft alias was used to turn them back. > - ECC ciphersuites were re-enabled in 0.9.9 (1.0.0) Err, thanks for catching. I actually commented it out to make sure it's safe to remove it now, but forgot to actually remove. Removed. > > > > ssl_certificate_key rsa.key; > > ssl_certificate rsa.crt; > > @@ -273,13 +270,8 @@ system("openssl ocsp -index $d/certindex > > > > # server cert/key > > > > -system("openssl ecparam -genkey -out $d/ec.key -name prime256v1 " > > - . ">>$d/openssl.out 2>&1") == 0 or die "Can't create EC pem: $!\n"; > > -system("openssl genrsa -out $d/rsa.key 2048 >>$d/openssl.out 2>&1") == 0 > > - or die "Can't create RSA pem: $!\n"; > > - > > -foreach my $name ('ec', 'rsa') { > > - system("openssl req -x509 -new -key $d/$name.key " > > +foreach my $name ('rsa') { > > + system('openssl req -x509 -new ' > > . "-config $d/openssl.conf -subj /CN=$name/ " > > . "-out $d/$name.crt -keyout $d/$name.key " > > . ">>$d/openssl.out 2>&1") == 0 > > @@ -288,7 +280,7 @@ foreach my $name ('ec', 'rsa') { > > > > $t->run_daemon(\&http_daemon, $t, port(8081)); > > $t->run_daemon(\&http_daemon, $t, port(8082)); > > -$t->run()->plan(14); > > +$t->run()->plan(15); > > > > $t->waitforsocket("127.0.0.1:" . port(8081)); > > $t->waitforsocket("127.0.0.1:" . port(8082)); > > @@ -297,17 +289,17 @@ my $version = get_version(); > > > > ############################################################################### > > > > -like(get('RSA', 'end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); > > +like(get('end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); > > > > # demonstrate that ocsp int request is failed due to missing resolver > > > > -like(get('RSA', 'end', sni => 'resolver'), > > +like(get('end', sni => 'resolver'), > > qr/400 Bad.*FAILED:certificate status request failed/s, > > 'ocsp many failed request'); > > > > # demonstrate that ocsp int request is actually made by failing ocsp response > > > > -like(get('RSA', 'end', port => 8444), > > +like(get('end', port => 8444), > > qr/400 Bad.*FAILED:certificate status request failed/s, > > 'ocsp many failed'); > > > > @@ -323,11 +315,11 @@ system("openssl ocsp -index $d/certindex > > . ">>$d/openssl.out 2>&1") == 0 > > or die "Can't create OCSP response: $!\n"; > > > > -like(get('RSA', 'end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); > > +like(get('end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); > > > > # store into ssl_ocsp_cache > > > > -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); > > +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); > > > > # revoke > > > > @@ -346,23 +338,23 @@ system("openssl ocsp -index $d/certindex > > . ">>$d/openssl.out 2>&1") == 0 > > or die "Can't create OCSP response: $!\n"; > > > > -like(get('RSA', 'end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); > > +like(get('end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); > > > > # with different responder where it's still valid > > > > -like(get('RSA', 'end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); > > +like(get('end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); > > > > # with different context to responder where it's still valid > > > > -like(get('RSA', 'end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); > > +like(get('end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); > > > > # with cached ocsp response it's still valid > > > > -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); > > +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); > > > > # ocsp end response signed with invalid (root) cert, expect HTTP 400 > > > > -like(get('ECDSA', 'ec-end'), > > +like(get('ec-end'), > > qr/400 Bad.*FAILED:certificate status request failed/s, > > 'root ca not trusted'); > > > > @@ -374,12 +366,12 @@ system("openssl ocsp -index $d/certindex > > . ">>$d/openssl.out 2>&1") == 0 > > or die "Can't create EC OCSP response: $!\n"; > > > > -like(get('ECDSA', 'ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); > > +like(get('ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); > > > > -my ($s, $ssl) = get('ECDSA', 'ec-end'); > > +my ($s, $ssl) = get('ec-end'); > > my $ses = Net::SSLeay::get_session($ssl); > > > > -like(get('ECDSA', 'ec-end', ses => $ses), > > +like(get('ec-end', ses => $ses), > > qr/200 OK.*SUCCESS:r/s, 'session reused'); > > > > # revoke with saved session > > @@ -401,19 +393,22 @@ system("openssl ocsp -index $d/certindex > > > > # reusing session with revoked certificate > > > > -like(get('ECDSA', 'ec-end', ses => $ses), > > +like(get('ec-end', ses => $ses), > > qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); > > > > # regression test for self-signed > > > > -like(get('RSA', 'root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); > > +like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); > > + > > +# check for errors > > + > > +like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); > > > > ############################################################################### > > > > sub get { > > - my ($type, $cert, %extra) = @_; > > - $type = 'PSS' if $type eq 'RSA' && $version > 0x0303; > > - my ($s, $ssl) = get_ssl_socket($type, $cert, %extra); > > + my ($cert, %extra) = @_; > > + my ($s, $ssl) = get_ssl_socket($cert, %extra); > > my $cipher = Net::SSLeay::get_cipher($ssl); > > Test::Nginx::log_core('||', "cipher: $cipher"); > > my $host = $extra{sni} ? $extra{sni} : 'localhost'; > > @@ -428,7 +423,7 @@ sub get { > > } > > > > sub get_ssl_socket { > > - my ($type, $cert, %extra) = @_; > > + my ($cert, %extra) = @_; > > my $ses = $extra{ses}; > > my $sni = $extra{sni}; > > my $port = $extra{port} || 8443; > > @@ -450,18 +445,6 @@ sub get_ssl_socket { > > > > my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); > > > > - if (defined $type) { > > - my $ssleay = Net::SSLeay::SSLeay(); > > - if ($ssleay < 0x1000200f || $ssleay == 0x20000000) { > > - Net::SSLeay::CTX_set_cipher_list($ctx, $type) > > - or die("Failed to set cipher list"); > > - } else { > > - # SSL_CTRL_SET_SIGALGS_LIST > > - Net::SSLeay::CTX_ctrl($ctx, 98, 0, $type . '+SHA256') > > - or die("Failed to set sigalgs"); > > - } > > - } > > - > > Net::SSLeay::set_cert_and_key($ctx, "$d/$cert.crt", "$d/$cert.key") > > or die if $cert; > > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:17:43 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:17:43 +0300 Subject: [PATCH 03 of 20] Tests: separate SSL session reuse tests in mail In-Reply-To: References: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> Message-ID: Hello! On Wed, Mar 22, 2023 at 01:20:25PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679107816 -10800 > > # Sat Mar 18 05:50:16 2023 +0300 > > # Node ID 97b09b6633f69747c0d6ef13c76739bdd6b7f3bb > > # Parent 125fb8461d88a81a62ccb40d0e205a01ecc759f5 > > Tests: separate SSL session reuse tests in mail. > > > > Instead of being mixed with generic SSL tests, session reuse variants > > are now tested in a separate file. > > > > diff --git a/mail_ssl.t b/mail_ssl.t > > --- a/mail_ssl.t > > +++ b/mail_ssl.t > > @@ -37,7 +37,7 @@ eval { exists &Net::SSLeay::P_alpn_selec > > plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; > > > > my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) > > - ->has_daemon('openssl')->plan(22); > > + ->has_daemon('openssl')->plan(18); > > > > $t->write_file_expand('nginx.conf', <<'EOF'); > > > > @@ -51,44 +51,25 @@ events { > > mail { > > ssl_certificate_key localhost.key; > > ssl_certificate localhost.crt; > > - ssl_session_tickets off; > > > > ssl_password_file password; > > > > auth_http http://127.0.0.1:8080; # unused > > > > - ssl_session_cache none; > > - > > server { > > listen 127.0.0.1:8143; > > listen 127.0.0.1:8145 ssl; > > protocol imap; > > - > > - ssl_session_cache builtin; > > } > > > > server { > > - listen 127.0.0.1:8146 ssl; > > - protocol imap; > > - > > - ssl_session_cache off; > > - } > > - > > - server { > > - listen 127.0.0.1:8147; > > + listen 127.0.0.1:8148; > > protocol imap; > > > > # Special case for enabled "ssl" directive. > > > > ssl on; > > - ssl_session_cache builtin:1000; > > - } > > > > - server { > > - listen 127.0.0.1:8148 ssl; > > - protocol imap; > > - > > - ssl_session_cache shared:SSL:1m; > > ssl_certificate_key inherits.key; > > ssl_certificate inherits.crt; > > } > > @@ -169,46 +150,16 @@ open STDERR, ">&", \*OLDERR; > > > > ############################################################################### > > > > +my ($s, $ssl, $ses); > > + > > $ses is no longer used there, and other cleanup on top off this change: > > diff --git a/mail_ssl.t b/mail_ssl.t > --- a/mail_ssl.t > +++ b/mail_ssl.t > @@ -150,7 +150,7 @@ open STDERR, ">&", \*OLDERR; > > ############################################################################### > > -my ($s, $ssl, $ses); > +my ($s, $ssl); > > # simple tests to ensure that nothing broke with ssl_password_file directive > > @@ -170,7 +170,7 @@ like(Net::SSLeay::dump_peer_certificate( > > # alpn > > -ok(get_ssl_socket(8148, undef, ['imap']), 'alpn'); > +ok(get_ssl_socket(8148, ['imap']), 'alpn'); > > SKIP: { > $t->{_configure_args} =~ /LibreSSL ([\d\.]+)/; > @@ -181,7 +181,7 @@ skip 'OpenSSL too old', 1 if defined $1 > TODO: { > local $TODO = 'not yet' unless $t->has_version('1.21.4'); > > -ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected'); > +ok(!get_ssl_socket(8148, ['unknown']), 'alpn rejected'); > > } > > @@ -268,11 +268,10 @@ ok(!get_ssl_socket(8148, undef, ['unknow > ############################################################################### > > sub get_ssl_socket { > - my ($port, $ses, $alpn) = @_; > + my ($port, $alpn) = @_; > > my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); > my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); > - Net::SSLeay::set_session($ssl, $ses) if defined $ses; > Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; > Net::SSLeay::set_fd($ssl, fileno($s)); > Net::SSLeay::connect($ssl) == 1 or return; > diff --git a/mail_ssl_session_reuse.t b/mail_ssl_session_reuse.t > --- a/mail_ssl_session_reuse.t > +++ b/mail_ssl_session_reuse.t > @@ -132,8 +132,6 @@ my $ctx = Net::SSLeay::CTX_new() or die( > > ############################################################################### > > -my ($ssl, $ses); > - > # session reuse: > # > # - only tickets, the default Applied, thanks. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:18:14 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:18:14 +0300 Subject: [PATCH 20 of 20] Tests: fixed ssl_ocsp.t with LibreSSL and TLSv1.3 In-Reply-To: References:

Message-ID: Hello! On Wed, Mar 22, 2023 at 03:11:44PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:15, Maxim Dounin wrote: > > > > # HG changeset patch > > # User Maxim Dounin > > # Date 1679148869 -10800 > > # Sat Mar 18 17:14:29 2023 +0300 > > # Node ID f6f6a21b1c2a0d88cb2a4993f4c0113a3fb1e019 > > # Parent 782531c3cd79dcf700276e10bef00e524de009d1 > > Tests: fixed ssl_ocsp.t with LibreSSL and TLSv1.3. > > > > LibreSSL does not support session reuse with TLSv1.3. > > Since LibreSSL is so broken wrt TLSv1.3, I don't think > it deserves annotating every test in separate changed. > The LibreSSL changes could be easily combined: > this is at least p11, p12, p13, p16, p17, p20. That's more about logic of the patch series, see previous responses. Combining some patches is certainly possible, though it will be much harder to manage without per-test logic universally applied to all changes. > > Other broken or missing functionality such as signature > algorithms and certificate authorities can be skipped > in separate commits, though. > > > > > diff --git a/ssl_ocsp.t b/ssl_ocsp.t > > --- a/ssl_ocsp.t > > +++ b/ssl_ocsp.t > > @@ -371,9 +371,15 @@ like(get('ec-end'), qr/200 OK.*SUCCESS/s > > my ($s, $ssl) = get('ec-end'); > > my $ses = Net::SSLeay::get_session($ssl); > > > > +TODO: { > > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > > + if $t->has_module('LibreSSL') and $version > 0x303; > > + > > like(get('ec-end', ses => $ses), > > qr/200 OK.*SUCCESS:r/s, 'session reused'); > > > > +} > > + > > # revoke with saved session > > > > system("openssl ca -config $d/ca.conf -revoke $d/ec-end.crt " > > @@ -393,9 +399,15 @@ system("openssl ocsp -index $d/certindex > > > > # reusing session with revoked certificate > > > > +TODO: { > > +local $TODO = 'no TLSv1.3 sessions in LibreSSL' > > + if $t->has_module('LibreSSL') and $version > 0x303; > > + > > like(get('ec-end', ses => $ses), > > qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); > > > > +} > > + > > # regression test for self-signed > > > > like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 14:18:30 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 17:18:30 +0300 Subject: [PATCH 00 of 20] tests suite fixes for TLSv1.3 In-Reply-To: References:

Message-ID: Hello! On Wed, Mar 22, 2023 at 03:43:12PM +0400, Sergey Kandaurov wrote: > > On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > > > > Hello! > > > > Here are patch series for the test suite to address test failures > > observed with TLSv1.3 enabled with BoringSSL and LibreSSL. > > > > Short summary of the issues seen: > > > > - BoringSSL with TLSv1.3 does not support session reuse via server-side > > session cache, only with tickets. > > > > - BoringSSL with TLSv1.3 does not provide $ssl_session_id. > > > > - LibreSSL with TLSv1.3 does not support session reuse. > > > > - LibreSSL with TLSv1.3 fails to negotiate certificates based on > > signature algorithms supported by the client, and fails with > > "missing rsa certificate" and "unknown pkey type" errors. > > > > - LibreSSL with TLSv1.3 does not send CA lists to the client. > > > > Missing peaces that allow me to run with LibreSSL: > > # HG changeset patch > # User Sergey Kandaurov > # Date 1679485246 -14400 > # Wed Mar 22 15:40:46 2023 +0400 > # Node ID dfe434f295d3da7e3b67bbbafeab245bb591f397 > # Parent 826e00e7c037d617781239963e8b868b6b0de225 > Tests: fixed upstream zone tests with LibreSSL and TLSv1.3. > > LibreSSL does not support session reuse with TLSv1.3. > > diff --git a/stream_upstream_zone_ssl.t b/stream_upstream_zone_ssl.t > --- a/stream_upstream_zone_ssl.t > +++ b/stream_upstream_zone_ssl.t Thanks. I've happen to compile nginx without upstream zone modules as a leftover from some previous tests, and missed these. Added a similar change with TODOs. Full series with all the fixes: # HG changeset patch # User Maxim Dounin # Date 1679498636 -10800 # Wed Mar 22 18:23:56 2023 +0300 # Node ID 8fb46a1a0f3e6ca94e2c59ce50e3043a67cde674 # Parent 1f125771f1a1014dcceb8b765f3dd3153d4552f9 Tests: separate SSL session reuse tests. Instead of being mixed with generic SSL tests, session reuse variants are now tested in a separate file. In the generic SSL tests only basic session reuse is now tested, notably with session tickets enabled and a shared SSL session cache. This should make it possible to reuse sessions in all cases (except when it's not supported, such as with LibreSSL with TLSv1.3). Note that session reuse with tickets implies that $ssl_session_id is selected by the client and therefore is not available on the initial connection. Relevant test is modified to handle this. Further, BoringSSL does not use legacy session ID with TLSv1.3 even if it is sent by the client. In contrast, OpenSSL always generates an unique legacy session id, so it is available with TLSv1.3 even if session resumption does not work (such as with old Net::SSLeay and IO::Socket::SSL modules). diff --git a/ssl.t b/ssl.t --- a/ssl.t +++ b/ssl.t @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( plan(skip_all => 'IO::Socket::SSL too old') if $@; my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) - ->has_daemon('openssl')->plan(28); + ->has_daemon('openssl')->plan(21); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -47,7 +47,6 @@ http { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; log_format ssl $ssl_protocol; @@ -59,6 +58,7 @@ http { ssl_certificate_key inner.key; ssl_certificate inner.crt; ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; ssl_verify_client optional_no_ca; keepalive_requests 1000; @@ -100,57 +100,11 @@ http { } server { - listen 127.0.0.1:8081; - server_name localhost; - - # Special case for enabled "ssl" directive. - - ssl on; - ssl_session_cache builtin; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8082 ssl; - server_name localhost; - - ssl_session_cache builtin:1000; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8083 ssl; - server_name localhost; - - ssl_session_cache none; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { - listen 127.0.0.1:8084 ssl; - server_name localhost; - - ssl_session_cache off; - - location / { - return 200 "body $ssl_session_reused"; - } - } - - server { listen 127.0.0.1:8086 ssl; server_name localhost; ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; ssl_session_timeout 1; location / { @@ -216,59 +170,34 @@ foreach my $name ('localhost', 'inner') or die "Can't create certificate for $name: $!\n"; } -# suppress deprecation warning - -open OLDERR, ">&", \*STDERR; close STDERR; $t->run(); -open STDERR, ">&", \*OLDERR; ############################################################################### -my $ctx; +# ssl session reuse -SKIP: { -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); +my $ctx = get_ssl_context(); -$ctx = get_ssl_context(); +like(get('/', 8085, $ctx), qr/^body \.$/m, 'session'); -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); - -$ctx = get_ssl_context(); +TODO: { +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); +like(get('/', 8085, $ctx), qr/^body r$/m, 'session reused'); } -$ctx = get_ssl_context(); - -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); - # ssl certificate inheritance -my $s = get_ssl_socket(8081); +my $s = get_ssl_socket(8086); like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); -$s->close(); - $s = get_ssl_socket(8085); like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); -$s->close(); - # session timeout $ctx = get_ssl_context(); @@ -280,8 +209,12 @@ like(get('/', 8086, $ctx), qr/^body \.$/ # embedded variables -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); +$ctx = get_ssl_context(); +like(get('/id', 8085, $ctx), qr/^body (\w{64})?$/m, 'session id'); +like(get('/id', 8085, $ctx), qr/^body \w{64}$/m, 'session id reused'); + unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); + like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); SKIP: { @@ -334,6 +267,10 @@ like(`grep -F '[crit]' ${\($t->testdir() ############################################################################### +sub test_tls13 { + return get('/protocol', 8085) =~ /TLSv1.3/; +} + sub get { my ($uri, $port, $ctx) = @_; my $s = get_ssl_socket($port, $ctx) or return; diff --git a/ssl.t b/ssl_session_reuse.t copy from ssl.t copy to ssl_session_reuse.t --- a/ssl.t +++ b/ssl_session_reuse.t @@ -1,10 +1,10 @@ #!/usr/bin/perl -# (C) Sergey Kandaurov # (C) Andrey Zelenkov +# (C) Maxim Dounin # (C) Nginx, Inc. -# Tests for http ssl module. +# Tests for http ssl module, session reuse. ############################################################################### @@ -13,8 +13,6 @@ use strict; use Test::More; -use Socket qw/ CRLF /; - BEGIN { use FindBin; chdir($FindBin::Bin); } use lib 'lib'; @@ -30,8 +28,8 @@ plan(skip_all => 'IO::Socket::SSL not in eval { IO::Socket::SSL::SSL_VERIFY_NONE(); }; plan(skip_all => 'IO::Socket::SSL too old') if $@; -my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) - ->has_daemon('openssl')->plan(28); +my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite/) + ->has_daemon('openssl')->plan(8); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -47,66 +45,37 @@ http { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; - - log_format ssl $ssl_protocol; server { - listen 127.0.0.1:8085 ssl; - listen 127.0.0.1:8080; + listen 127.0.0.1:8443 ssl; server_name localhost; - ssl_certificate_key inner.key; - ssl_certificate inner.crt; - ssl_session_cache shared:SSL:1m; - ssl_verify_client optional_no_ca; - - keepalive_requests 1000; - location / { return 200 "body $ssl_session_reused"; } - location /id { - return 200 "body $ssl_session_id"; - } - location /cipher { - return 200 "body $ssl_cipher"; - } - location /ciphers { - return 200 "body $ssl_ciphers"; - } - location /client_verify { - return 200 "body $ssl_client_verify"; - } location /protocol { return 200 "body $ssl_protocol"; } - location /issuer { - return 200 "body $ssl_client_i_dn:$ssl_client_i_dn_legacy"; - } - location /subject { - return 200 "body $ssl_client_s_dn:$ssl_client_s_dn_legacy"; - } - location /time { - return 200 "body $ssl_client_v_start!$ssl_client_v_end!$ssl_client_v_remain"; - } - - location /body { - add_header X-Body $request_body always; - proxy_pass http://127.0.0.1:8080/; - - access_log %%TESTDIR%%/ssl.log ssl; - } } server { - listen 127.0.0.1:8081; + listen 127.0.0.1:8444 ssl; server_name localhost; - # Special case for enabled "ssl" directive. + ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; - ssl on; - ssl_session_cache builtin; + location / { + return 200 "body $ssl_session_reused"; + } + } + + server { + listen 127.0.0.1:8445 ssl; + server_name localhost; + + ssl_session_cache shared:SSL:1m; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -114,10 +83,11 @@ http { } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8446 ssl; server_name localhost; - ssl_session_cache builtin:1000; + ssl_session_cache builtin; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -125,10 +95,11 @@ http { } server { - listen 127.0.0.1:8083 ssl; + listen 127.0.0.1:8447 ssl; server_name localhost; - ssl_session_cache none; + ssl_session_cache builtin:1000; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -136,10 +107,11 @@ http { } server { - listen 127.0.0.1:8084 ssl; + listen 127.0.0.1:8448 ssl; server_name localhost; - ssl_session_cache off; + ssl_session_cache none; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -147,11 +119,11 @@ http { } server { - listen 127.0.0.1:8086 ssl; + listen 127.0.0.1:8449 ssl; server_name localhost; - ssl_session_cache shared:SSL:1m; - ssl_session_timeout 1; + ssl_session_cache off; + ssl_session_tickets off; location / { return 200 "body $ssl_session_reused"; @@ -171,44 +143,7 @@ EOF my $d = $t->testdir(); -$t->write_file('ca.conf', <write_file('certserial', '1000'); -$t->write_file('certindex', ''); - -system('openssl req -x509 -new ' - . "-config $d/openssl.conf -subj /CN=issuer/ " - . "-out $d/issuer.crt -keyout $d/issuer.key " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't create certificate for issuer: $!\n"; - -system("openssl req -new " - . "-config $d/openssl.conf -subj /CN=subject/ " - . "-out $d/subject.csr -keyout $d/subject.key " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't create certificate for subject: $!\n"; - -system("openssl ca -batch -config $d/ca.conf " - . "-keyfile $d/issuer.key -cert $d/issuer.crt " - . "-subj /CN=subject/ -in $d/subject.csr -out $d/subject.crt " - . ">>$d/openssl.out 2>&1") == 0 - or die "Can't sign certificate for subject: $!\n"; - -foreach my $name ('localhost', 'inner') { +foreach my $name ('localhost') { system('openssl req -x509 -new ' . "-config $d/openssl.conf -subj /CN=$name/ " . "-out $d/$name.crt -keyout $d/$name.key " @@ -216,124 +151,54 @@ foreach my $name ('localhost', 'inner') or die "Can't create certificate for $name: $!\n"; } -# suppress deprecation warning - -open OLDERR, ">&", \*STDERR; close STDERR; $t->run(); -open STDERR, ">&", \*OLDERR; ############################################################################### -my $ctx; - -SKIP: { -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); - -$ctx = get_ssl_context(); +# session reuse: +# +# - only tickets, the default +# - tickets and shared cache, should work always +# - only shared cache +# - only builtin cache +# - only builtin cache with explicitly configured size +# - only cache none +# - only cache off -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); - -$ctx = get_ssl_context(); +TODO: { +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); -like(get('/', 8081, $ctx), qr/^body \.$/m, 'cache builtin'); -like(get('/', 8081, $ctx), qr/^body r$/m, 'cache builtin reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8082, $ctx), qr/^body \.$/m, 'cache builtin size'); -like(get('/', 8082, $ctx), qr/^body r$/m, 'cache builtin size reused'); +is(test_reuse(8443), 1, 'tickets reused'); +is(test_reuse(8444), 1, 'tickets and cache reused'); +is(test_reuse(8445), 1, 'cache shared reused'); +is(test_reuse(8446), 1, 'cache builtin reused'); +is(test_reuse(8447), 1, 'cache builtin size reused'); } -$ctx = get_ssl_context(); - -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none'); -like(get('/', 8083, $ctx), qr/^body \.$/m, 'cache none not reused'); - -$ctx = get_ssl_context(); - -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off'); -like(get('/', 8084, $ctx), qr/^body \.$/m, 'cache off not reused'); - -# ssl certificate inheritance - -my $s = get_ssl_socket(8081); -like($s->dump_peer_certificate(), qr/CN=localhost/, 'CN'); - -$s->close(); - -$s = get_ssl_socket(8085); -like($s->dump_peer_certificate(), qr/CN=inner/, 'CN inner'); - -$s->close(); - -# session timeout - -$ctx = get_ssl_context(); - -get('/', 8086, $ctx); -select undef, undef, undef, 2.1; - -like(get('/', 8086, $ctx), qr/^body \.$/m, 'session timeout'); - -# embedded variables - -like(get('/id', 8085), qr/^body \w{64}$/m, 'session id'); -unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); -like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); - -SKIP: { -skip 'BoringSSL', 1 if $t->has_module('BoringSSL'); - -like(get('/ciphers', 8085), qr/^body [:\w-]+$/m, 'ciphers'); - -} - -like(get('/client_verify', 8085), qr/^body NONE$/m, 'client verify'); -like(get('/protocol', 8085), qr/^body (TLS|SSL)v(\d|\.)+$/m, 'protocol'); -like(cert('/issuer', 8085), qr!^body CN=issuer:/CN=issuer$!m, 'issuer'); -like(cert('/subject', 8085), qr!^body CN=subject:/CN=subject$!m, 'subject'); -like(cert('/time', 8085), qr/^body [:\s\w]+![:\s\w]+![23]$/m, 'time'); - -# c->read->ready handling bug in ngx_ssl_recv(), triggered with chunked body - -like(get_body('/body', '0123456789', 20, 5), qr/X-Body: (0123456789){100}/, - 'request body chunked'); - -# pipelined requests - -$s = get_ssl_socket(8085); -my $req = < $s) || ""; -$s = undef; -is(() = $r =~ /(200 OK)/g, 1000, 'pipelined requests'); - -# OpenSSL 3.0 error "unexpected eof while reading" seen as a critical error - -ok(get_ssl_socket(8085), 'ssl unexpected eof'); - -# close_notify is sent before lingering close - -is(get_ssl_shutdown(8085), 1, 'ssl shutdown on lingering close'); +is(test_reuse(8448), 0, 'cache none not reused'); +is(test_reuse(8449), 0, 'cache off not reused'); $t->stop(); -like($t->read_file('ssl.log'), qr/^(TLS|SSL)v(\d|\.)+$/m, - 'log ssl variable on lingering close'); - like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); ############################################################################### +sub test_tls13 { + return get('/protocol', 8443) =~ /TLSv1.3/; +} + +sub test_reuse { + my ($port) = @_; + my $ctx = get_ssl_context(); + get('/', $port, $ctx); + return (get('/', $port, $ctx) =~ qr/^body r$/m) ? 1 : 0; +} + sub get { my ($uri, $port, $ctx) = @_; my $s = get_ssl_socket($port, $ctx) or return; @@ -342,30 +207,6 @@ sub get { return $r; } -sub get_body { - my ($uri, $body, $len, $n) = @_; - my $s = get_ssl_socket(8085) or return; - http("GET /body HTTP/1.1" . CRLF - . "Host: localhost" . CRLF - . "Connection: close" . CRLF - . "Transfer-Encoding: chunked" . CRLF . CRLF, - socket => $s, start => 1); - my $chs = unpack("H*", pack("C", length($body) * $len)); - http($chs . CRLF . $body x $len . CRLF, socket => $s, start => 1) - for 1 .. $n; - my $r = http("0" . CRLF . CRLF, socket => $s); - $s->close(); - return $r; -} - -sub cert { - my ($uri, $port) = @_; - my $s = get_ssl_socket($port, undef, - SSL_cert_file => "$d/subject.crt", - SSL_key_file => "$d/subject.key") or return; - http_get($uri, socket => $s); -} - sub get_ssl_context { return IO::Socket::SSL::SSL_Context->new( SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(), @@ -402,18 +243,4 @@ sub get_ssl_socket { return $s; } -sub get_ssl_shutdown { - my ($port) = @_; - - my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); - my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_fd($ssl, fileno($s)); - Net::SSLeay::connect($ssl) or die("ssl connect"); - Net::SSLeay::write($ssl, 'GET /' . CRLF . 'extra'); - Net::SSLeay::read($ssl); - Net::SSLeay::set_shutdown($ssl, 1); - Net::SSLeay::shutdown($ssl); -} - ############################################################################### # HG changeset patch # User Maxim Dounin # Date 1679518794 -10800 # Wed Mar 22 23:59:54 2023 +0300 # Node ID 670dec53c4cd9ad2f64ff09d9094c44d49998726 # Parent 8fb46a1a0f3e6ca94e2c59ce50e3043a67cde674 Tests: LibreSSL and BoringSSL session reuse with TLSv1.3. LibreSSL does not support session reuse with TLSv1.3 at all. BoringSSL with TLSv1.3 only supports session tickets, but not server-side session cache. diff --git a/ssl.t b/ssl.t --- a/ssl.t +++ b/ssl.t @@ -185,6 +185,8 @@ local $TODO = 'no TLSv1.3 sessions, old if $Net::SSLeay::VERSION < 1.88 && test_tls13(); local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); like(get('/', 8085, $ctx), qr/^body r$/m, 'session reused'); @@ -211,8 +213,17 @@ like(get('/', 8086, $ctx), qr/^body \.$/ $ctx = get_ssl_context(); like(get('/id', 8085, $ctx), qr/^body (\w{64})?$/m, 'session id'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); +local $TODO = 'no TLSv1.3 sessions ids in BoringSSL' + if $t->has_module('BoringSSL') && test_tls13(); + like(get('/id', 8085, $ctx), qr/^body \w{64}$/m, 'session id reused'); +} + unlike(http_get('/id'), qr/body \w/, 'session id no ssl'); like(get('/cipher', 8085), qr/^body [\w-]+$/m, 'cipher'); diff --git a/ssl_session_reuse.t b/ssl_session_reuse.t --- a/ssl_session_reuse.t +++ b/ssl_session_reuse.t @@ -170,14 +170,22 @@ local $TODO = 'no TLSv1.3 sessions, old if $Net::SSLeay::VERSION < 1.88 && test_tls13(); local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); is(test_reuse(8443), 1, 'tickets reused'); is(test_reuse(8444), 1, 'tickets and cache reused'); + +TODO: { +local $TODO = 'no TLSv1.3 session cache in BoringSSL' + if $t->has_module('BoringSSL') && test_tls13(); + is(test_reuse(8445), 1, 'cache shared reused'); is(test_reuse(8446), 1, 'cache builtin reused'); is(test_reuse(8447), 1, 'cache builtin size reused'); } +} is(test_reuse(8448), 0, 'cache none not reused'); is(test_reuse(8449), 0, 'cache off not reused'); # HG changeset patch # User Maxim Dounin # Date 1679527437 -10800 # Thu Mar 23 02:23:57 2023 +0300 # Node ID ebef8c3ce0aee7886826da353e285c430ce949cd # Parent 670dec53c4cd9ad2f64ff09d9094c44d49998726 Tests: separate SSL session reuse tests in mail. Instead of being mixed with generic SSL tests, session reuse variants are now tested in a separate file. diff --git a/mail_ssl.t b/mail_ssl.t --- a/mail_ssl.t +++ b/mail_ssl.t @@ -37,7 +37,7 @@ eval { exists &Net::SSLeay::P_alpn_selec plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) - ->has_daemon('openssl')->plan(22); + ->has_daemon('openssl')->plan(18); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -51,44 +51,25 @@ events { mail { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; ssl_password_file password; auth_http http://127.0.0.1:8080; # unused - ssl_session_cache none; - server { listen 127.0.0.1:8143; listen 127.0.0.1:8145 ssl; protocol imap; - - ssl_session_cache builtin; } server { - listen 127.0.0.1:8146 ssl; - protocol imap; - - ssl_session_cache off; - } - - server { - listen 127.0.0.1:8147; + listen 127.0.0.1:8148; protocol imap; # Special case for enabled "ssl" directive. ssl on; - ssl_session_cache builtin:1000; - } - server { - listen 127.0.0.1:8148 ssl; - protocol imap; - - ssl_session_cache shared:SSL:1m; ssl_certificate_key inherits.key; ssl_certificate inherits.crt; } @@ -169,46 +150,16 @@ open STDERR, ">&", \*OLDERR; ############################################################################### +my ($s, $ssl); + # simple tests to ensure that nothing broke with ssl_password_file directive -my $s = Test::Nginx::IMAP->new(); +$s = Test::Nginx::IMAP->new(); $s->ok('greeting'); $s->send('1 AUTHENTICATE LOGIN'); $s->check(qr/\+ VXNlcm5hbWU6/, 'login'); -# ssl_session_cache - -my ($ssl, $ses); - -($s, $ssl) = get_ssl_socket(8145); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8145, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); - -($s, $ssl) = get_ssl_socket(8146); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8146, $ses); -is(Net::SSLeay::session_reused($ssl), 0, 'session not reused'); - -($s, $ssl) = get_ssl_socket(8147); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8147, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); - -($s, $ssl) = get_ssl_socket(8148); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8148, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); - # ssl_certificate inheritance ($s, $ssl) = get_ssl_socket(8145); @@ -219,7 +170,7 @@ like(Net::SSLeay::dump_peer_certificate( # alpn -ok(get_ssl_socket(8148, undef, ['imap']), 'alpn'); +ok(get_ssl_socket(8148, ['imap']), 'alpn'); SKIP: { $t->{_configure_args} =~ /LibreSSL ([\d\.]+)/; @@ -230,7 +181,7 @@ skip 'OpenSSL too old', 1 if defined $1 TODO: { local $TODO = 'not yet' unless $t->has_version('1.21.4'); -ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected'); +ok(!get_ssl_socket(8148, ['unknown']), 'alpn rejected'); } @@ -317,11 +268,10 @@ ok(!get_ssl_socket(8148, undef, ['unknow ############################################################################### sub get_ssl_socket { - my ($port, $ses, $alpn) = @_; + my ($port, $alpn) = @_; my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_session($ssl, $ses) if defined $ses; Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; Net::SSLeay::set_fd($ssl, fileno($s)); Net::SSLeay::connect($ssl) == 1 or return; diff --git a/mail_ssl.t b/mail_ssl_session_reuse.t copy from mail_ssl.t copy to mail_ssl_session_reuse.t --- a/mail_ssl.t +++ b/mail_ssl_session_reuse.t @@ -1,9 +1,10 @@ #!/usr/bin/perl # (C) Andrey Zelenkov +# (C) Maxim Dounin # (C) Nginx, Inc. -# Tests for mail ssl module. +# Tests for mail ssl module, session reuse. ############################################################################### @@ -16,9 +17,6 @@ BEGIN { use FindBin; chdir($FindBin::Bin use lib 'lib'; use Test::Nginx; -use Test::Nginx::IMAP; -use Test::Nginx::POP3; -use Test::Nginx::SMTP; ############################################################################### @@ -33,11 +31,8 @@ eval { }; plan(skip_all => 'Net::SSLeay not installed') if $@; -eval { exists &Net::SSLeay::P_alpn_selected or die; }; -plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@; - -my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/) - ->has_daemon('openssl')->plan(22); +my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap/) + ->has_daemon('openssl')->plan(7); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -49,90 +44,62 @@ events { } mail { - ssl_certificate_key localhost.key; - ssl_certificate localhost.crt; - ssl_session_tickets off; + auth_http http://127.0.0.1:8080; - ssl_password_file password; - - auth_http http://127.0.0.1:8080; # unused - - ssl_session_cache none; + ssl_certificate localhost.crt; + ssl_certificate_key localhost.key; server { - listen 127.0.0.1:8143; - listen 127.0.0.1:8145 ssl; - protocol imap; - - ssl_session_cache builtin; + listen 127.0.0.1:8993 ssl; + protocol imap; } server { - listen 127.0.0.1:8146 ssl; - protocol imap; + listen 127.0.0.1:8994 ssl; + protocol imap; - ssl_session_cache off; + ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; } server { - listen 127.0.0.1:8147; - protocol imap; + listen 127.0.0.1:8995 ssl; + protocol imap; - # Special case for enabled "ssl" directive. - - ssl on; - ssl_session_cache builtin:1000; + ssl_session_cache shared:SSL:1m; + ssl_session_tickets off; } server { - listen 127.0.0.1:8148 ssl; - protocol imap; - - ssl_session_cache shared:SSL:1m; - ssl_certificate_key inherits.key; - ssl_certificate inherits.crt; - } + listen 127.0.0.1:8996 ssl; + protocol imap; - server { - listen 127.0.0.1:8149; - protocol imap; - - starttls on; - } - - server { - listen 127.0.0.1:8150; - protocol imap; - - starttls only; + ssl_session_cache builtin; + ssl_session_tickets off; } server { - listen 127.0.0.1:8151; - protocol pop3; + listen 127.0.0.1:8997 ssl; + protocol imap; - starttls on; + ssl_session_cache builtin:1000; + ssl_session_tickets off; } server { - listen 127.0.0.1:8152; - protocol pop3; + listen 127.0.0.1:8998 ssl; + protocol imap; - starttls only; + ssl_session_cache none; + ssl_session_tickets off; } server { - listen 127.0.0.1:8153; - protocol smtp; - - starttls on; - } + listen 127.0.0.1:8999 ssl; + protocol imap; - server { - listen 127.0.0.1:8154; - protocol smtp; - - starttls only; + ssl_session_cache off; + ssl_session_tickets off; } } @@ -148,181 +115,55 @@ EOF my $d = $t->testdir(); -foreach my $name ('localhost', 'inherits') { - system("openssl genrsa -out $d/$name.key -passout pass:localhost " - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 - or die "Can't create private key: $!\n"; +foreach my $name ('localhost') { system('openssl req -x509 -new ' . "-config $d/openssl.conf -subj /CN=$name/ " - . "-out $d/$name.crt " - . "-key $d/$name.key -passin pass:localhost" + . "-out $d/$name.crt -keyout $d/$name.key " . ">>$d/openssl.out 2>&1") == 0 or die "Can't create certificate for $name: $!\n"; } my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); -$t->write_file('password', 'localhost'); -open OLDERR, ">&", \*STDERR; close STDERR; $t->run(); -open STDERR, ">&", \*OLDERR; ############################################################################### -# simple tests to ensure that nothing broke with ssl_password_file directive - -my $s = Test::Nginx::IMAP->new(); -$s->ok('greeting'); - -$s->send('1 AUTHENTICATE LOGIN'); -$s->check(qr/\+ VXNlcm5hbWU6/, 'login'); - -# ssl_session_cache - -my ($ssl, $ses); - -($s, $ssl) = get_ssl_socket(8145); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8145, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); - -($s, $ssl) = get_ssl_socket(8146); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8146, $ses); -is(Net::SSLeay::session_reused($ssl), 0, 'session not reused'); - -($s, $ssl) = get_ssl_socket(8147); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8147, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); - -($s, $ssl) = get_ssl_socket(8148); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(8148, $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); - -# ssl_certificate inheritance - -($s, $ssl) = get_ssl_socket(8145); -like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=localhost/, 'CN'); - -($s, $ssl) = get_ssl_socket(8148); -like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner'); - -# alpn - -ok(get_ssl_socket(8148, undef, ['imap']), 'alpn'); - -SKIP: { -$t->{_configure_args} =~ /LibreSSL ([\d\.]+)/; -skip 'LibreSSL too old', 1 if defined $1 and $1 lt '3.4.0'; -$t->{_configure_args} =~ /OpenSSL ([\d\.]+)/; -skip 'OpenSSL too old', 1 if defined $1 and $1 lt '1.1.0'; - -TODO: { -local $TODO = 'not yet' unless $t->has_version('1.21.4'); - -ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected'); - -} - -} - -# starttls imap - -$s = Test::Nginx::IMAP->new(PeerAddr => '127.0.0.1:' . port(8149)); -$s->read(); +# session reuse: +# +# - only tickets, the default +# - tickets and shared cache, should work always +# - only shared cache +# - only builtin cache +# - only builtin cache with explicitly configured size +# - only cache none +# - only cache off -$s->send('1 AUTHENTICATE LOGIN'); -$s->check(qr/\+ VXNlcm5hbWU6/, 'imap auth before startls on'); - -$s = Test::Nginx::IMAP->new(PeerAddr => '127.0.0.1:' . port(8149)); -$s->read(); - -$s->send('1 STARTTLS'); -$s->ok('imap starttls on'); - -$s = Test::Nginx::IMAP->new(PeerAddr => '127.0.0.1:' . port(8150)); -$s->read(); - -$s->send('1 AUTHENTICATE LOGIN'); -$s->check(qr/^\S+ BAD/, 'imap auth before startls only'); - -$s = Test::Nginx::IMAP->new(PeerAddr => '127.0.0.1:' . port(8150)); -$s->read(); - -$s->send('1 STARTTLS'); -$s->ok('imap starttls only'); - -# starttls pop3 - -$s = Test::Nginx::POP3->new(PeerAddr => '127.0.0.1:' . port(8151)); -$s->read(); - -$s->send('AUTH LOGIN'); -$s->check(qr/\+ VXNlcm5hbWU6/, 'pop3 auth before startls on'); - -$s = Test::Nginx::POP3->new(PeerAddr => '127.0.0.1:' . port(8151)); -$s->read(); - -$s->send('STLS'); -$s->ok('pop3 starttls on'); - -$s = Test::Nginx::POP3->new(PeerAddr => '127.0.0.1:' . port(8152)); -$s->read(); - -$s->send('AUTH LOGIN'); -$s->check(qr/^-ERR/, 'pop3 auth before startls only'); - -$s = Test::Nginx::POP3->new(PeerAddr => '127.0.0.1:' . port(8152)); -$s->read(); - -$s->send('STLS'); -$s->ok('pop3 starttls only'); - -# starttls smtp - -$s = Test::Nginx::SMTP->new(PeerAddr => '127.0.0.1:' . port(8153)); -$s->read(); - -$s->send('AUTH LOGIN'); -$s->check(qr/^334 VXNlcm5hbWU6/, 'smtp auth before startls on'); - -$s = Test::Nginx::SMTP->new(PeerAddr => '127.0.0.1:' . port(8153)); -$s->read(); - -$s->send('STARTTLS'); -$s->ok('smtp starttls on'); - -$s = Test::Nginx::SMTP->new(PeerAddr => '127.0.0.1:' . port(8154)); -$s->read(); - -$s->send('AUTH LOGIN'); -$s->check(qr/^5.. /, 'smtp auth before startls only'); - -$s = Test::Nginx::SMTP->new(PeerAddr => '127.0.0.1:' . port(8154)); -$s->read(); - -$s->send('STARTTLS'); -$s->ok('smtp starttls only'); +is(test_reuse(8993), 1, 'tickets reused'); +is(test_reuse(8994), 1, 'tickets and cache reused'); +is(test_reuse(8995), 1, 'cache shared reused'); +is(test_reuse(8996), 1, 'cache builtin reused'); +is(test_reuse(8997), 1, 'cache builtin size reused'); +is(test_reuse(8998), 0, 'cache none not reused'); +is(test_reuse(8999), 0, 'cache off not reused'); ############################################################################### +sub test_reuse { + my ($port) = @_; + my ($s, $ssl) = get_ssl_socket($port); + Net::SSLeay::read($ssl); + my $ses = Net::SSLeay::get_session($ssl); + ($s, $ssl) = get_ssl_socket($port, $ses); + return Net::SSLeay::session_reused($ssl); +} + sub get_ssl_socket { - my ($port, $ses, $alpn) = @_; + my ($port, $ses) = @_; my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); Net::SSLeay::set_session($ssl, $ses) if defined $ses; - Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; Net::SSLeay::set_fd($ssl, fileno($s)); Net::SSLeay::connect($ssl) == 1 or return; return ($s, $ssl); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 28de0345b5cf67a4956a84a8adcbd1c59078ea9e # Parent ebef8c3ce0aee7886826da353e285c430ce949cd Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in mail. LibreSSL does not support session reuse with TLSv1.3 at all. BoringSSL with TLSv1.3 only supports session tickets, but not server-side session cache. diff --git a/mail_ssl_session_reuse.t b/mail_ssl_session_reuse.t --- a/mail_ssl_session_reuse.t +++ b/mail_ssl_session_reuse.t @@ -139,16 +139,34 @@ my $ctx = Net::SSLeay::CTX_new() or die( # - only cache none # - only cache off +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + is(test_reuse(8993), 1, 'tickets reused'); is(test_reuse(8994), 1, 'tickets and cache reused'); + +TODO: { +local $TODO = 'no TLSv1.3 session cache in BoringSSL' + if $t->has_module('BoringSSL') && test_tls13(); + is(test_reuse(8995), 1, 'cache shared reused'); is(test_reuse(8996), 1, 'cache builtin reused'); is(test_reuse(8997), 1, 'cache builtin size reused'); + +} +} + is(test_reuse(8998), 0, 'cache none not reused'); is(test_reuse(8999), 0, 'cache off not reused'); ############################################################################### +sub test_tls13 { + my ($s, $ssl) = get_ssl_socket(8993); + return (Net::SSLeay::version($ssl) > 0x303); +} + sub test_reuse { my ($port) = @_; my ($s, $ssl) = get_ssl_socket($port); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 376c1b24119098b673c5ba1b1b7f09ad7d5511fd # Parent 28de0345b5cf67a4956a84a8adcbd1c59078ea9e Tests: separate SSL session reuse tests in stream. Instead of being mixed with generic SSL tests, session reuse variants are now tested in a separate file. diff --git a/stream_ssl.t b/stream_ssl.t --- a/stream_ssl.t +++ b/stream_ssl.t @@ -37,7 +37,7 @@ plan(skip_all => 'win32') if $^O eq 'MSW my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); -$t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); +$t->plan(5)->write_file_expand('nginx.conf', <<'EOF'); %%TEST_GLOBALS%% @@ -51,40 +51,35 @@ stream { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; - ssl_session_tickets off; # inherited by server "inherits" ssl_password_file password_stream; server { - listen 127.0.0.1:8080 ssl; + listen 127.0.0.1:8443 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache builtin; ssl_password_file password; } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8444 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache off; ssl_password_file password_many; } server { - listen 127.0.0.1:8083 ssl; + listen 127.0.0.1:8445 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache builtin:1000; ssl_password_file password_fifo; } server { - listen 127.0.0.1:8084 ssl; + listen 127.0.0.1:8446 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache shared:SSL:1m; ssl_certificate_key inherits.key; ssl_certificate inherits.crt; } @@ -115,7 +110,6 @@ foreach my $name ('localhost', 'inherits or die "Can't create certificate for $name: $!\n"; } - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); $t->write_file('password', 'localhost'); @@ -138,62 +132,35 @@ kill 'INT', $p if $@; ############################################################################### -my ($s, $ssl, $ses); +my ($s, $ssl); -($s, $ssl) = get_ssl_socket(port(8080)); +($s, $ssl) = get_ssl_socket(8443); Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl'); -# ssl_session_cache - -($s, $ssl) = get_ssl_socket(port(8080)); +($s, $ssl) = get_ssl_socket(8444); Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8080), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); - -($s, $ssl) = get_ssl_socket(port(8082)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password many'); -($s, $ssl) = get_ssl_socket(port(8082), $ses); -isnt(Net::SSLeay::session_reused($ssl), 1, 'session not reused'); - -($s, $ssl) = get_ssl_socket(port(8083)); +($s, $ssl) = get_ssl_socket(8445); Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8083), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); - -($s, $ssl) = get_ssl_socket(port(8084)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8084), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); +like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl password fifo'); # ssl_certificate inheritance -($s, $ssl) = get_ssl_socket(port(8080)); +($s, $ssl) = get_ssl_socket(8443); like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=localhost/, 'CN'); -($s, $ssl) = get_ssl_socket(port(8084)); +($s, $ssl) = get_ssl_socket(8446); like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner'); ############################################################################### sub get_ssl_socket { - my ($port, $ses) = @_; + my ($port) = @_; - my $s = IO::Socket::INET->new('127.0.0.1:' . $port); + my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); - Net::SSLeay::set_session($ssl, $ses) if defined $ses; Net::SSLeay::set_fd($ssl, fileno($s)); Net::SSLeay::connect($ssl) or die("ssl connect"); return ($s, $ssl); diff --git a/stream_ssl.t b/stream_ssl_session_reuse.t copy from stream_ssl.t copy to stream_ssl_session_reuse.t --- a/stream_ssl.t +++ b/stream_ssl_session_reuse.t @@ -1,9 +1,10 @@ #!/usr/bin/perl # (C) Sergey Kandaurov +# (C) Maxim Dounin # (C) Nginx, Inc. -# Tests for stream ssl module. +# Tests for stream ssl module, session reuse. ############################################################################### @@ -12,7 +13,6 @@ use strict; use Test::More; -use POSIX qw/ mkfifo /; use Socket qw/ $CRLF /; BEGIN { use FindBin; chdir($FindBin::Bin); } @@ -33,8 +33,6 @@ eval { }; plan(skip_all => 'Net::SSLeay not installed') if $@; -plan(skip_all => 'win32') if $^O eq 'MSWin32'; - my $t = Test::Nginx->new()->has(qw/stream stream_ssl/)->has_daemon('openssl'); $t->plan(7)->write_file_expand('nginx.conf', <<'EOF'); @@ -49,44 +47,60 @@ events { stream { %%TEST_GLOBALS_STREAM%% + ssl_certificate localhost.crt; ssl_certificate_key localhost.key; - ssl_certificate localhost.crt; - ssl_session_tickets off; - # inherited by server "inherits" - ssl_password_file password_stream; + server { + listen 127.0.0.1:8443 ssl; + proxy_pass 127.0.0.1:8081; + } server { - listen 127.0.0.1:8080 ssl; + listen 127.0.0.1:8444 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache builtin; - ssl_password_file password; + ssl_session_cache shared:SSL:1m; + ssl_session_tickets on; + } + + server { + listen 127.0.0.1:8445 ssl; + proxy_pass 127.0.0.1:8081; + + ssl_session_cache shared:SSL:1m; + ssl_session_tickets off; } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8446 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache off; - ssl_password_file password_many; + ssl_session_cache builtin; + ssl_session_tickets off; } server { - listen 127.0.0.1:8083 ssl; + listen 127.0.0.1:8447 ssl; proxy_pass 127.0.0.1:8081; ssl_session_cache builtin:1000; - ssl_password_file password_fifo; + ssl_session_tickets off; } server { - listen 127.0.0.1:8084 ssl; + listen 127.0.0.1:8448 ssl; proxy_pass 127.0.0.1:8081; - ssl_session_cache shared:SSL:1m; - ssl_certificate_key inherits.key; - ssl_certificate inherits.crt; + ssl_session_cache none; + ssl_session_tickets off; + } + + server { + listen 127.0.0.1:8449 ssl; + proxy_pass 127.0.0.1:8081; + + ssl_session_cache off; + ssl_session_tickets off; } } @@ -101,97 +115,59 @@ distinguished_name = req_distinguished_n EOF my $d = $t->testdir(); -mkfifo("$d/password_fifo", 0700); -foreach my $name ('localhost', 'inherits') { - system("openssl genrsa -out $d/$name.key -passout pass:$name " - . "-aes128 2048 >>$d/openssl.out 2>&1") == 0 - or die "Can't create private key: $!\n"; +foreach my $name ('localhost') { system('openssl req -x509 -new ' . "-config $d/openssl.conf -subj /CN=$name/ " - . "-out $d/$name.crt " - . "-key $d/$name.key -passin pass:$name" + . "-out $d/$name.crt -keyout $d/$name.key " . ">>$d/openssl.out 2>&1") == 0 or die "Can't create certificate for $name: $!\n"; } - my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); -$t->write_file('password', 'localhost'); -$t->write_file('password_many', "wrong$CRLF" . "localhost$CRLF"); -$t->write_file('password_stream', 'inherits'); - -my $p = fork(); -exec("echo localhost > $d/password_fifo") if $p == 0; - $t->run_daemon(\&http_daemon); -eval { - open OLDERR, ">&", \*STDERR; close STDERR; - $t->run(); - open STDERR, ">&", \*OLDERR; -}; -kill 'INT', $p if $@; +$t->run(); $t->waitforsocket('127.0.0.1:' . port(8081)); ############################################################################### -my ($s, $ssl, $ses); - -($s, $ssl) = get_ssl_socket(port(8080)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -like(Net::SSLeay::read($ssl), qr/200 OK/, 'ssl'); - -# ssl_session_cache - -($s, $ssl) = get_ssl_socket(port(8080)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8080), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused'); - -($s, $ssl) = get_ssl_socket(port(8082)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8082), $ses); -isnt(Net::SSLeay::session_reused($ssl), 1, 'session not reused'); +# session reuse: +# +# - only tickets, the default +# - tickets and shared cache, should work always +# - only shared cache +# - only builtin cache +# - only builtin cache with explicitly configured size +# - only cache none +# - only cache off -($s, $ssl) = get_ssl_socket(port(8083)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8083), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused'); - -($s, $ssl) = get_ssl_socket(port(8084)); -Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); -Net::SSLeay::read($ssl); -$ses = Net::SSLeay::get_session($ssl); - -($s, $ssl) = get_ssl_socket(port(8084), $ses); -is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused'); - -# ssl_certificate inheritance - -($s, $ssl) = get_ssl_socket(port(8080)); -like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=localhost/, 'CN'); - -($s, $ssl) = get_ssl_socket(port(8084)); -like(Net::SSLeay::dump_peer_certificate($ssl), qr/CN=inherits/, 'CN inner'); +is(test_reuse(8443), 1, 'tickets reused'); +is(test_reuse(8444), 1, 'tickets and cache reused'); +is(test_reuse(8445), 1, 'cache shared reused'); +is(test_reuse(8446), 1, 'cache builtin reused'); +is(test_reuse(8447), 1, 'cache builtin size reused'); +is(test_reuse(8448), 0, 'cache none not reused'); +is(test_reuse(8449), 0, 'cache off not reused'); ############################################################################### +sub test_reuse { + my ($port) = @_; + my ($s, $ssl) = get_ssl_socket($port); + Net::SSLeay::write($ssl, "GET / HTTP/1.0$CRLF$CRLF"); + Net::SSLeay::read($ssl); + my $ses = Net::SSLeay::get_session($ssl); + ($s, $ssl) = get_ssl_socket($port, $ses); + return Net::SSLeay::session_reused($ssl); +} + sub get_ssl_socket { my ($port, $ses) = @_; - my $s = IO::Socket::INET->new('127.0.0.1:' . $port); + my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); Net::SSLeay::set_session($ssl, $ses) if defined $ses; Net::SSLeay::set_fd($ssl, fileno($s)); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID b0db313bf025b7647e31355cb41c7fb3563a6c68 # Parent 376c1b24119098b673c5ba1b1b7f09ad7d5511fd Tests: LibreSSL and BoringSSL session reuse with TLSv1.3 in stream. LibreSSL does not support session reuse with TLSv1.3 at all. BoringSSL with TLSv1.3 only supports session tickets, but not server-side session cache. diff --git a/stream_ssl_session_reuse.t b/stream_ssl_session_reuse.t --- a/stream_ssl_session_reuse.t +++ b/stream_ssl_session_reuse.t @@ -144,16 +144,34 @@ my $ctx = Net::SSLeay::CTX_new() or die( # - only cache none # - only cache off +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + is(test_reuse(8443), 1, 'tickets reused'); is(test_reuse(8444), 1, 'tickets and cache reused'); + +TODO: { +local $TODO = 'no TLSv1.3 session cache in BoringSSL' + if $t->has_module('BoringSSL') && test_tls13(); + is(test_reuse(8445), 1, 'cache shared reused'); is(test_reuse(8446), 1, 'cache builtin reused'); is(test_reuse(8447), 1, 'cache builtin size reused'); + +} +} + is(test_reuse(8448), 0, 'cache none not reused'); is(test_reuse(8449), 0, 'cache off not reused'); ############################################################################### +sub test_tls13 { + my ($s, $ssl) = get_ssl_socket(8443); + return (Net::SSLeay::version($ssl) > 0x303); +} + sub test_reuse { my ($port) = @_; my ($s, $ssl) = get_ssl_socket($port); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 04ce263b25a6e591d39df2eaf2ff5c4ce0fa633e # Parent b0db313bf025b7647e31355cb41c7fb3563a6c68 Tests: BoringSSL does not provide session ids with TLSv1.3. diff --git a/stream_ssl_variables.t b/stream_ssl_variables.t --- a/stream_ssl_variables.t +++ b/stream_ssl_variables.t @@ -103,7 +103,7 @@ like(Net::SSLeay::read($ssl), qr/^\.:(\w my $ses = Net::SSLeay::get_session($ssl); ($s, $ssl) = get_ssl_socket(port(8081), $ses); -like(Net::SSLeay::read($ssl), qr/^r:\w{64}:[\w-]+:(TLS|SSL)v(\d|\.)+$/, +like(Net::SSLeay::read($ssl), qr/^r:(\w{64})?:[\w-]+:(TLS|SSL)v(\d|\.)+$/, 'ssl variables - session reused'); SKIP: { # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID dc59b11f23b2a0df9355efa614f47a21b8786e0e # Parent 04ce263b25a6e591d39df2eaf2ff5c4ce0fa633e Tests: enabled session reuse via TLS session tickets. This fixes tests with TLSv1.3 enabled when using BoringSSL, since for TLSv1.3 it only supports session reuse via TLS session tickets, and not server-side session cache. diff --git a/ssl_certificate.t b/ssl_certificate.t --- a/ssl_certificate.t +++ b/ssl_certificate.t @@ -71,7 +71,7 @@ http { add_header X-SSL $ssl_server_name:$ssl_session_reused; ssl_session_cache shared:SSL:1m; - ssl_session_tickets off; + ssl_session_tickets on; server { listen 127.0.0.1:8080 ssl; diff --git a/stream_ssl_certificate.t b/stream_ssl_certificate.t --- a/stream_ssl_certificate.t +++ b/stream_ssl_certificate.t @@ -68,7 +68,7 @@ stream { } ssl_session_cache shared:SSL:1m; - ssl_session_tickets off; + ssl_session_tickets on; server { listen 127.0.0.1:8080 ssl; # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 28bf82cdf8718b131510ee511812919626ac603c # Parent dc59b11f23b2a0df9355efa614f47a21b8786e0e Tests: restored proper port numbers in ssl_sni_sessions.t. While using port 8080 for SSL connection works, it's usually a bad idea, since 8080 implies plain HTTP, much like 80. For HTTPS we generally use port 8443 instead. Unfortunately, proper port numbers were lost in 952:e9064d691790 and 974:882267679006, while converting tests to run in parallel. diff --git a/ssl_sni_sessions.t b/ssl_sni_sessions.t --- a/ssl_sni_sessions.t +++ b/ssl_sni_sessions.t @@ -39,7 +39,7 @@ http { ssl_certificate localhost.crt; server { - listen 127.0.0.1:8080 ssl; + listen 127.0.0.1:8443 ssl; server_name default; ssl_session_tickets off; @@ -51,7 +51,7 @@ http { } server { - listen 127.0.0.1:8080; + listen 127.0.0.1:8443; server_name nocache; ssl_session_tickets off; @@ -63,7 +63,7 @@ http { } server { - listen 127.0.0.1:8081 ssl; + listen 127.0.0.1:8444 ssl; server_name default; ssl_session_ticket_key ticket1.key; @@ -74,7 +74,7 @@ http { } server { - listen 127.0.0.1:8081; + listen 127.0.0.1:8444; server_name tickets; ssl_session_ticket_key ticket2.key; @@ -128,7 +128,7 @@ foreach my $name ('localhost') { $t->run(); plan(skip_all => 'no TLS 1.3 sessions') - if get('default', port(8080), get_ssl_context()) =~ /TLSv1.3/ + if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/ && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); $t->plan(6); @@ -139,8 +139,8 @@ plan(skip_all => 'no TLS 1.3 sessions') my $ctx = get_ssl_context(); -like(get('default', port(8080), $ctx), qr!default:\.!, 'default server'); -like(get('default', port(8080), $ctx), qr!default:r!, 'default server reused'); +like(get('default', port(8443), $ctx), qr!default:\.!, 'default server'); +like(get('default', port(8443), $ctx), qr!default:r!, 'default server reused'); # check that sessions are still properly saved and restored # when using an SNI-based virtual server with different session cache; @@ -154,16 +154,16 @@ like(get('default', port(8080), $ctx), q $ctx = get_ssl_context(); -like(get('nocache', port(8080), $ctx), qr!nocache:\.!, 'without cache'); -like(get('nocache', port(8080), $ctx), qr!nocache:r!, 'without cache reused'); +like(get('nocache', port(8443), $ctx), qr!nocache:\.!, 'without cache'); +like(get('nocache', port(8443), $ctx), qr!nocache:r!, 'without cache reused'); # make sure tickets can be used if an SNI-based virtual server # uses a different set of session ticket keys explicitly set $ctx = get_ssl_context(); -like(get('tickets', port(8081), $ctx), qr!tickets:\.!, 'tickets'); -like(get('tickets', port(8081), $ctx), qr!tickets:r!, 'tickets reused'); +like(get('tickets', port(8444), $ctx), qr!tickets:\.!, 'tickets'); +like(get('tickets', port(8444), $ctx), qr!tickets:r!, 'tickets reused'); ############################################################################### # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 558bd1ebd0ef43b81484ad716ec25c349eee55e3 # Parent 28bf82cdf8718b131510ee511812919626ac603c Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL. With TLSv1.3, LibreSSL does not provide session reuse at all, and BoringSSL only supports session tickets, and not server-side session cache. Since the test is focused on session cache usage, it is now skipped. diff --git a/ssl_sni_sessions.t b/ssl_sni_sessions.t --- a/ssl_sni_sessions.t +++ b/ssl_sni_sessions.t @@ -130,6 +130,12 @@ foreach my $name ('localhost') { plan(skip_all => 'no TLS 1.3 sessions') if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/ && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); +plan(skip_all => 'no TLS 1.3 sessions in LibreSSL') + if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/ + && $t->has_module('LibreSSL'); +plan(skip_all => 'no TLS 1.3 session cache in BoringSSL') + if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/ + && $t->has_module('BoringSSL'); $t->plan(6); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 9b77114bf006d95f5a1984776a6b375a092cbdfe # Parent 558bd1ebd0ef43b81484ad716ec25c349eee55e3 Tests: fixed proxy_ssl.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/proxy_ssl.t b/proxy_ssl.t --- a/proxy_ssl.t +++ b/proxy_ssl.t @@ -46,6 +46,7 @@ http { location / { add_header X-Session $ssl_session_reused; + add_header X-Protocol $ssl_protocol; } } @@ -109,9 +110,16 @@ foreach my $name ('localhost') { like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl'); like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl 2'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: \./s, 'ssl session new'); + +TODO: { +local $TODO = 'no TLS 1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && http_get('/ssl') =~ /TLSv1.3/; + like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused 2'); +} + SKIP: { skip 'long test', 1 unless $ENV{TEST_NGINX_UNSAFE}; # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 5a58b9f2c5b33893dcdd67fbfe0231863a43846d # Parent 9b77114bf006d95f5a1984776a6b375a092cbdfe Tests: fixed ssl_session_ticket_key.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/ssl_session_ticket_key.t b/ssl_session_ticket_key.t --- a/ssl_session_ticket_key.t +++ b/ssl_session_ticket_key.t @@ -96,6 +96,10 @@ select undef, undef, undef, 0.5; is(get_ticket_key_name(), $key, 'ticket key match'); select undef, undef, undef, 2.5; + +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + cmp_ok(get_ticket_key_name(), 'ne', $key, 'ticket key next'); ############################################################################### @@ -107,7 +111,7 @@ sub get_ticket_key_name { next: # tag(10) | len{2} | OCTETSTRING(4) | len{2} | ticket(key_name|..) $asn =~ /\xaa\x81($any)\x04\x81($any)($any{16})/g; - return if !defined $3; + return '' if !defined $3; goto next if unpack("C", $1) - unpack("C", $2) != 3; my $key = unpack "H*", $3; Test::Nginx::log_core('||', "ticket key: $key"); @@ -126,6 +130,11 @@ EOF Net::SSLeay::get_session($ssl); } +sub test_tls13 { + my ($s, $ssl) = get_ssl_socket(); + return (Net::SSLeay::version($ssl) > 0x303); +} + sub get_ssl_socket { my $s = IO::Socket::INET->new('127.0.0.1:' . port(8080)); my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID ca3194d2a279bb9b468ce7a9e6628638d367fef1 # Parent 5a58b9f2c5b33893dcdd67fbfe0231863a43846d Tests: fixed ssl_sni.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/ssl_sni.t b/ssl_sni.t --- a/ssl_sni.t +++ b/ssl_sni.t @@ -148,9 +148,13 @@ my $ctx = new IO::Socket::SSL::SSL_Conte like(get('/', 'localhost', 8081, $ctx), qr/^\.:localhost$/m, 'ssl server name'); -SKIP: { -skip 'no TLS 1.3 sessions', 1 if get('/protocol', 'localhost') =~ /TLSv1.3/ - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); +TODO: { +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); like(get('/', 'localhost', 8081, $ctx), qr/^r:localhost$/m, 'ssl server name - reused'); @@ -159,6 +163,10 @@ like(get('/', 'localhost', 8081, $ctx), ############################################################################### +sub test_tls13 { + get('/protocol', 'localhost') =~ /TLSv1.3/; +} + sub get_ssl_socket { my ($host, $port, $ctx) = @_; my $s; # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 85e4f377674975634f1b2e34fc40a5d3b6e54fc0 # Parent ca3194d2a279bb9b468ce7a9e6628638d367fef1 Tests: LibreSSL certificate negotiation with TLSv1.3. LibreSSL fails to negotiate certificates based on signature algorithms when using TLSv1.3, and fails with "missing rsa certificate" and "unknown pkey type" errors. diff --git a/ssl_stapling.t b/ssl_stapling.t --- a/ssl_stapling.t +++ b/ssl_stapling.t @@ -38,7 +38,7 @@ my $t = Test::Nginx->new()->has(qw/http plan(skip_all => 'no OCSP stapling') if $t->has_module('BoringSSL'); -$t->plan(9)->write_file_expand('nginx.conf', <<'EOF'); +$t->plan(10)->write_file_expand('nginx.conf', <<'EOF'); %%TEST_GLOBALS%% @@ -259,11 +259,25 @@ staple(8449, 'ECDSA'); sleep 1; ok(!staple(8443, 'RSA'), 'staple revoked'); + +TODO: { +local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' + if $t->has_module('LibreSSL') && $version > 0x303; + ok(staple(8443, 'ECDSA'), 'staple success'); +} + ok(!staple(8444, 'RSA'), 'responder revoked'); + +TODO: { +local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' + if $t->has_module('LibreSSL') && $version > 0x303; + ok(staple(8444, 'ECDSA'), 'responder success'); +} + ok(!staple(8445, 'ECDSA'), 'verify - root not trusted'); ok(staple(8446, 'ECDSA', "$d/int.crt"), 'cert store'); @@ -273,6 +287,14 @@ is(staple(8448, 'ECDSA'), '1 0', 'file s ok(!staple(8449, 'ECDSA'), 'ocsp error'); +TODO: { +local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' + if $t->has_module('LibreSSL') && $version > 0x303; + +like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); + +} + ############################################################################### sub staple { # HG changeset patch # User Maxim Dounin # Date 1679527802 -10800 # Thu Mar 23 02:30:02 2023 +0300 # Node ID 647be9c9c22aea06c5a28aa280856edaebd26e21 # Parent 85e4f377674975634f1b2e34fc40a5d3b6e54fc0 Tests: LibreSSL does not send CA lists with TLSv1.3. diff --git a/ssl_verify_client.t b/ssl_verify_client.t --- a/ssl_verify_client.t +++ b/ssl_verify_client.t @@ -55,6 +55,7 @@ http { %%TEST_GLOBALS_HTTP%% add_header X-Verify x$ssl_client_verify:${ssl_client_cert}x; + add_header X-Protocol $ssl_protocol; ssl_session_cache shared:SSL:1m; ssl_session_tickets off; @@ -169,15 +170,24 @@ like(get('optional', '3.example.com'), q SKIP: { skip 'Net::SSLeay version >= 1.36 required', 1 if $Net::SSLeay::VERSION < 1.36; +TODO: { +local $TODO = 'broken TLSv1.3 CA list in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + my $ca = join ' ', get('optional', '3.example.com'); is($ca, '/CN=2.example.com', 'no trusted sent'); } +} like(get('optional', undef, 'localhost'), qr/421 Misdirected/, 'misdirected'); ############################################################################### +sub test_tls13 { + get('optional') =~ /TLSv1.3/; +} + sub get { my ($sni, $cert, $host) = @_; diff --git a/stream_ssl_verify_client.t b/stream_ssl_verify_client.t --- a/stream_ssl_verify_client.t +++ b/stream_ssl_verify_client.t @@ -86,6 +86,11 @@ stream { ssl_verify_client optional_no_ca; ssl_client_certificate 2.example.com.crt; } + + server { + listen 127.0.0.1:8084 ssl; + return $ssl_protocol; + } } EOF @@ -126,10 +131,15 @@ like(get(8082, '3.example.com'), qr/SUCC SKIP: { skip 'Net::SSLeay version >= 1.36 required', 1 if $Net::SSLeay::VERSION < 1.36; +TODO: { +local $TODO = 'broken TLSv1.3 CA list in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + my $ca = join ' ', get(8082, '3.example.com'); is($ca, '/CN=2.example.com', 'no trusted sent'); } +} $t->stop(); @@ -137,6 +147,10 @@ is($t->read_file('status.log'), "500\n20 ############################################################################### +sub test_tls13 { + get(8084) =~ /TLSv1.3/; +} + sub get { my ($port, $cert) = @_; # HG changeset patch # User Maxim Dounin # Date 1679531073 -10800 # Thu Mar 23 03:24:33 2023 +0300 # Node ID 5e7b95544014db80e0d8c94ca8b6a9b2f14b75cd # Parent 647be9c9c22aea06c5a28aa280856edaebd26e21 Tests: fixed stream_proxy_ssl.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/stream_proxy_ssl.t b/stream_proxy_ssl.t --- a/stream_proxy_ssl.t +++ b/stream_proxy_ssl.t @@ -78,6 +78,8 @@ http { ssl_certificate_key localhost.key; ssl_certificate localhost.crt; + + add_header X-Protocol $ssl_protocol; } } @@ -111,9 +113,16 @@ is(stream('127.0.0.1:' . port(8081))->re is(stream('127.0.0.1:' . port(8081))->read(), '.', 'ssl 2'); is(stream('127.0.0.1:' . port(8082))->read(), '.', 'ssl session new'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + is(stream('127.0.0.1:' . port(8082))->read(), 'r', 'ssl session reused'); is(stream('127.0.0.1:' . port(8082))->read(), 'r', 'ssl session reused 2'); +} + my $s = http('', start => 1); sleep 3; @@ -121,3 +130,9 @@ sleep 3; like(http_get('/', socket => $s), qr/200 OK/, 'proxy connect timeout'); ############################################################################### + +sub test_tls13 { + http_get('/') =~ /TLSv1.3/; +} + +############################################################################### # HG changeset patch # User Maxim Dounin # Date 1679531122 -10800 # Thu Mar 23 03:25:22 2023 +0300 # Node ID 8bec6f886e67e4b093112317cfdc4a97590e221a # Parent 5e7b95544014db80e0d8c94ca8b6a9b2f14b75cd Tests: fixed stream_ssl_variables.t.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/stream_ssl_variables.t b/stream_ssl_variables.t --- a/stream_ssl_variables.t +++ b/stream_ssl_variables.t @@ -101,11 +101,17 @@ is(stream('127.0.0.1:' . port(8080))->re like(Net::SSLeay::read($ssl), qr/^\.:(\w{64})?:[\w-]+:(TLS|SSL)v(\d|\.)+$/, 'ssl variables'); +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') && test_tls13(); + my $ses = Net::SSLeay::get_session($ssl); ($s, $ssl) = get_ssl_socket(port(8081), $ses); like(Net::SSLeay::read($ssl), qr/^r:(\w{64})?:[\w-]+:(TLS|SSL)v(\d|\.)+$/, 'ssl variables - session reused'); +} + SKIP: { skip 'no sni', 3 unless $t->has_module('sni'); @@ -123,6 +129,11 @@ is(Net::SSLeay::ssl_read_all($ssl), '', ############################################################################### +sub test_tls13 { + ($s, $ssl) = get_ssl_socket(port(8081)); + Net::SSLeay::read($ssl) =~ /TLSv1.3/; +} + sub get_ssl_socket { my ($port, $ses, $name) = @_; # HG changeset patch # User Maxim Dounin # Date 1679531124 -10800 # Thu Mar 23 03:25:24 2023 +0300 # Node ID 1813c2bd9429bff39b8108e58fc4c06f7afe38f5 # Parent 8bec6f886e67e4b093112317cfdc4a97590e221a Tests: cleaned up ssl_ocsp.t. Fixed verbose logging, added $SIG{PIPE} handling to avoid hangs if the server closes connection, fixed SKIP message for BoringSSL. diff --git a/ssl_ocsp.t b/ssl_ocsp.t --- a/ssl_ocsp.t +++ b/ssl_ocsp.t @@ -43,7 +43,8 @@ plan(skip_all => 'Net::SSLeay with OpenS my $t = Test::Nginx->new()->has(qw/http http_ssl sni/)->has_daemon('openssl'); -plan(skip_all => 'no OCSP stapling') if $t->has_module('BoringSSL'); +plan(skip_all => 'no OCSP support in BoringSSL') + if $t->has_module('BoringSSL'); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -416,9 +417,11 @@ sub get { my $cipher = Net::SSLeay::get_cipher($ssl); Test::Nginx::log_core('||', "cipher: $cipher"); my $host = $extra{sni} ? $extra{sni} : 'localhost'; + local $SIG{PIPE} = 'IGNORE'; + log_out("GET /serial HTTP/1.0\nHost: $host\n\n"); Net::SSLeay::write($ssl, "GET /serial HTTP/1.0\nHost: $host\n\n"); my $r = Net::SSLeay::read($ssl); - Test::Nginx::log_core($r); + log_in($r); $s->close(); return $r unless wantarray(); return ($s, $ssl); @@ -496,6 +499,7 @@ sub http_daemon { my $resp; while (<$client>) { + Test::Nginx::log_core('||', $_); $headers .= $_; last if (/^\x0d?\x0a?$/); } # HG changeset patch # User Maxim Dounin # Date 1679531124 -10800 # Thu Mar 23 03:25:24 2023 +0300 # Node ID 0661a3c11e0fccb07f46b4c2878bcd8ee0f77db0 # Parent 1813c2bd9429bff39b8108e58fc4c06f7afe38f5 Tests: removed multiple server certificates from ssl_ocsp.t. Multiple server certificates are not needed to test OCSP verification of client certificates (in contrast to OCSP stapling, where server certificates are verified, and different staples should be correctly returned with different server certificates). And using multiple server certificates causes issues when testing with LibreSSL due to broken sigalgs-based server certificate selection in LibreSSL with TLSv1.3. Accordingly, the test is simplified to do not use multiple server certificates. diff --git a/ssl_ocsp.t b/ssl_ocsp.t --- a/ssl_ocsp.t +++ b/ssl_ocsp.t @@ -63,11 +63,6 @@ http { ssl_verify_depth 2; ssl_client_certificate trusted.crt; - ssl_ciphers DEFAULT:ECCdraft; - - ssl_certificate_key ec.key; - ssl_certificate ec.crt; - ssl_certificate_key rsa.key; ssl_certificate rsa.crt; @@ -273,13 +268,8 @@ system("openssl ocsp -index $d/certindex # server cert/key -system("openssl ecparam -genkey -out $d/ec.key -name prime256v1 " - . ">>$d/openssl.out 2>&1") == 0 or die "Can't create EC pem: $!\n"; -system("openssl genrsa -out $d/rsa.key 2048 >>$d/openssl.out 2>&1") == 0 - or die "Can't create RSA pem: $!\n"; - -foreach my $name ('ec', 'rsa') { - system("openssl req -x509 -new -key $d/$name.key " +foreach my $name ('rsa') { + system('openssl req -x509 -new ' . "-config $d/openssl.conf -subj /CN=$name/ " . "-out $d/$name.crt -keyout $d/$name.key " . ">>$d/openssl.out 2>&1") == 0 @@ -288,7 +278,7 @@ foreach my $name ('ec', 'rsa') { $t->run_daemon(\&http_daemon, $t, port(8081)); $t->run_daemon(\&http_daemon, $t, port(8082)); -$t->run()->plan(14); +$t->run()->plan(15); $t->waitforsocket("127.0.0.1:" . port(8081)); $t->waitforsocket("127.0.0.1:" . port(8082)); @@ -297,17 +287,17 @@ my $version = get_version(); ############################################################################### -like(get('RSA', 'end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); +like(get('end'), qr/200 OK.*SUCCESS/s, 'ocsp leaf'); # demonstrate that ocsp int request is failed due to missing resolver -like(get('RSA', 'end', sni => 'resolver'), +like(get('end', sni => 'resolver'), qr/400 Bad.*FAILED:certificate status request failed/s, 'ocsp many failed request'); # demonstrate that ocsp int request is actually made by failing ocsp response -like(get('RSA', 'end', port => 8444), +like(get('end', port => 8444), qr/400 Bad.*FAILED:certificate status request failed/s, 'ocsp many failed'); @@ -323,11 +313,11 @@ system("openssl ocsp -index $d/certindex . ">>$d/openssl.out 2>&1") == 0 or die "Can't create OCSP response: $!\n"; -like(get('RSA', 'end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); +like(get('end', port => 8444), qr/200 OK.*SUCCESS/s, 'ocsp many'); # store into ssl_ocsp_cache -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache store'); # revoke @@ -346,23 +336,23 @@ system("openssl ocsp -index $d/certindex . ">>$d/openssl.out 2>&1") == 0 or die "Can't create OCSP response: $!\n"; -like(get('RSA', 'end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); +like(get('end'), qr/400 Bad.*FAILED:certificate revoked/s, 'revoked'); # with different responder where it's still valid -like(get('RSA', 'end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); +like(get('end', port => 8445), qr/200 OK.*SUCCESS/s, 'ocsp responder'); # with different context to responder where it's still valid -like(get('RSA', 'end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); +like(get('end', sni => 'sni'), qr/200 OK.*SUCCESS/s, 'ocsp context'); # with cached ocsp response it's still valid -like(get('RSA', 'end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); +like(get('end', port => 8446), qr/200 OK.*SUCCESS/s, 'cache lookup'); # ocsp end response signed with invalid (root) cert, expect HTTP 400 -like(get('ECDSA', 'ec-end'), +like(get('ec-end'), qr/400 Bad.*FAILED:certificate status request failed/s, 'root ca not trusted'); @@ -374,12 +364,12 @@ system("openssl ocsp -index $d/certindex . ">>$d/openssl.out 2>&1") == 0 or die "Can't create EC OCSP response: $!\n"; -like(get('ECDSA', 'ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); +like(get('ec-end'), qr/200 OK.*SUCCESS/s, 'ocsp ecdsa'); -my ($s, $ssl) = get('ECDSA', 'ec-end'); +my ($s, $ssl) = get('ec-end'); my $ses = Net::SSLeay::get_session($ssl); -like(get('ECDSA', 'ec-end', ses => $ses), +like(get('ec-end', ses => $ses), qr/200 OK.*SUCCESS:r/s, 'session reused'); # revoke with saved session @@ -401,19 +391,22 @@ system("openssl ocsp -index $d/certindex # reusing session with revoked certificate -like(get('ECDSA', 'ec-end', ses => $ses), +like(get('ec-end', ses => $ses), qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); # regression test for self-signed -like(get('RSA', 'root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); +like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); + +# check for errors + +like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit'); ############################################################################### sub get { - my ($type, $cert, %extra) = @_; - $type = 'PSS' if $type eq 'RSA' && $version > 0x0303; - my ($s, $ssl) = get_ssl_socket($type, $cert, %extra); + my ($cert, %extra) = @_; + my ($s, $ssl) = get_ssl_socket($cert, %extra); my $cipher = Net::SSLeay::get_cipher($ssl); Test::Nginx::log_core('||', "cipher: $cipher"); my $host = $extra{sni} ? $extra{sni} : 'localhost'; @@ -428,7 +421,7 @@ sub get { } sub get_ssl_socket { - my ($type, $cert, %extra) = @_; + my ($cert, %extra) = @_; my $ses = $extra{ses}; my $sni = $extra{sni}; my $port = $extra{port} || 8443; @@ -450,18 +443,6 @@ sub get_ssl_socket { my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!"); - if (defined $type) { - my $ssleay = Net::SSLeay::SSLeay(); - if ($ssleay < 0x1000200f || $ssleay == 0x20000000) { - Net::SSLeay::CTX_set_cipher_list($ctx, $type) - or die("Failed to set cipher list"); - } else { - # SSL_CTRL_SET_SIGALGS_LIST - Net::SSLeay::CTX_ctrl($ctx, 98, 0, $type . '+SHA256') - or die("Failed to set sigalgs"); - } - } - Net::SSLeay::set_cert_and_key($ctx, "$d/$cert.crt", "$d/$cert.key") or die if $cert; my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); # HG changeset patch # User Maxim Dounin # Date 1679531124 -10800 # Thu Mar 23 03:25:24 2023 +0300 # Node ID 77957615f50b6ae8ac8ef4ffc2c86813c04c16e6 # Parent 0661a3c11e0fccb07f46b4c2878bcd8ee0f77db0 Tests: fixed ssl_ocsp.t with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/ssl_ocsp.t b/ssl_ocsp.t --- a/ssl_ocsp.t +++ b/ssl_ocsp.t @@ -369,9 +369,15 @@ like(get('ec-end'), qr/200 OK.*SUCCESS/s my ($s, $ssl) = get('ec-end'); my $ses = Net::SSLeay::get_session($ssl); +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and $version > 0x303; + like(get('ec-end', ses => $ses), qr/200 OK.*SUCCESS:r/s, 'session reused'); +} + # revoke with saved session system("openssl ca -config $d/ca.conf -revoke $d/ec-end.crt " @@ -391,9 +397,15 @@ system("openssl ocsp -index $d/certindex # reusing session with revoked certificate +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and $version > 0x303; + like(get('ec-end', ses => $ses), qr/400 Bad.*FAILED:certificate revoked:r/s, 'session reused - revoked'); +} + # regression test for self-signed like(get('root', port => 8447), qr/200 OK.*SUCCESS/s, 'ocsp one'); # HG changeset patch # User Maxim Dounin # Date 1679531124 -10800 # Thu Mar 23 03:25:24 2023 +0300 # Node ID fa4dd181b78754d69ef3f90a414232d347ecd6cb # Parent 77957615f50b6ae8ac8ef4ffc2c86813c04c16e6 Tests: fixed upstream zone ssl tests with LibreSSL and TLSv1.3. LibreSSL does not support session reuse with TLSv1.3. diff --git a/stream_upstream_zone_ssl.t b/stream_upstream_zone_ssl.t --- a/stream_upstream_zone_ssl.t +++ b/stream_upstream_zone_ssl.t @@ -82,6 +82,19 @@ stream { ssl_certificate localhost.crt; ssl_session_cache builtin; } + + server { + listen 127.0.0.1:8085; + proxy_pass 127.0.0.1:8086; + } + + server { + listen 127.0.0.1:8086 ssl; + return $ssl_protocol; + + ssl_certificate_key localhost.key; + ssl_certificate localhost.crt; + } } EOF @@ -112,13 +125,33 @@ is(stream('127.0.0.1:' . port(8080))->re is(stream('127.0.0.1:' . port(8080))->read(), '.', 'ssl 2'); is(stream('127.0.0.1:' . port(8081))->read(), '.', 'ssl session new'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and test_tls13(); + is(stream('127.0.0.1:' . port(8081))->read(), 'r', 'ssl session reused'); is(stream('127.0.0.1:' . port(8081))->read(), 'r', 'ssl session reused 2'); +} + is(stream('127.0.0.1:' . port(8082))->read(), '.', 'backup ssl'); is(stream('127.0.0.1:' . port(8082))->read(), '.', 'backup ssl 2'); is(stream('127.0.0.1:' . port(8083))->read(), '.', 'backup ssl session new'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and test_tls13(); + is(stream('127.0.0.1:' . port(8083))->read(), 'r', 'backup ssl session reused'); +} + ############################################################################### + +sub test_tls13 { + stream('127.0.0.1:' . port(8085))->read() =~ /TLSv1.3/; +} + +############################################################################### diff --git a/upstream_zone_ssl.t b/upstream_zone_ssl.t --- a/upstream_zone_ssl.t +++ b/upstream_zone_ssl.t @@ -56,6 +56,7 @@ http { location / { add_header X-Session $ssl_session_reused; + add_header X-Protocol $ssl_protocol; } } @@ -114,12 +115,32 @@ foreach my $name ('localhost') { like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl'); like(http_get('/ssl'), qr/200 OK.*X-Session: \./s, 'ssl 2'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: \./s, 'ssl session new'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and test_tls13(); + like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused'); like(http_get('/ssl_reuse'), qr/200 OK.*X-Session: r/s, 'ssl session reused 2'); +} + like(http_get('/backup'), qr/200 OK.*X-Session: \./s, 'backup'); like(http_get('/backup'), qr/200 OK.*X-Session: \./s, 'backup 2'); like(http_get('/backup_reuse'), qr/200 OK.*X-Session: \./s, 'backup new'); + +TODO: { +local $TODO = 'no TLSv1.3 sessions in LibreSSL' + if $t->has_module('LibreSSL') and test_tls13(); + like(http_get('/backup_reuse'), qr/200 OK.*X-Session: r/s, 'backup reused'); +} + ############################################################################### + +sub test_tls13 { + http_get('/ssl') =~ /TLSv1.3/; +} + +############################################################################### -- Maxim Dounin http://mdounin.ru/ From pluknet at nginx.com Thu Mar 23 15:59:41 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Thu, 23 Mar 2023 19:59:41 +0400 Subject: [PATCH 01 of 20] Tests: separate SSL session reuse tests In-Reply-To: References: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> Message-ID: <735C14A7-4A60-43EA-8AF5-BD44812B1C9A@nginx.com> > On 23 Mar 2023, at 18:10, Maxim Dounin wrote: > > Hello! > > On Wed, Mar 22, 2023 at 12:57:56PM +0400, Sergey Kandaurov wrote: > >>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: >>> >>> # HG changeset patch >>> # User Maxim Dounin >>> # Date 1679105686 -10800 >>> # Sat Mar 18 05:14:46 2023 +0300 >>> # Node ID 86c394a226d2a7d463da7a1b7e88375c71c0c69b >>> # Parent 3c9aa6c23fc836725b96cf056d218217a5a81603 >>> Tests: separate SSL session reuse tests. >>> >>> Instead of being mixed with generic SSL tests, session reuse variants >>> are now tested in a separate file. >>> >>> In the generic SSL tests only basic session reuse is now tested, >>> notably with session tickets enabled and a shared SSL session cache. >>> This should make it possible to reuse sessions in all cases (except >>> when it's not supported, such as with LibreSSL with TLSv1.3). >>> >>> Note that session reuse with tickets implies that $ssl_session_id >>> is selected by the client and therefore is not available on the >>> initial connection. Relevant test is modified to handle this. >>> >>> Further, BoringSSL does not use legacy session ID with TLSv1.3 even >>> if it is sent by the client. In contrast, OpenSSL always generates >>> an unique legacy session id, so it is available with TLSv1.3 even if >>> session resumption does not work (such as with old Net::SSLeay and >>> IO::Socket::SSL modules). >> >> Note that TLSv1.3 has only ticket based session resumption. >> BoringSSL has a different notion on using legacy session IDs >> in TLSv1.3, see tls13_create_session_with_ticket() in sources: >> >> // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. >> // Envoy's tests depend on this, although perhaps they shouldn't. >> SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id); >> >> Later, SSL_SESSION_get_id() was additionally annotated in ssl.h: >> >> // As a workaround for some broken applications, BoringSSL sometimes synthesizes >> // arbitrary session IDs for non-ID-based sessions. This behavior may be >> // removed in the future. >> >> As for TLSv1.3 server context, BoringSSL doesn't seem to use "session ID" >> besides echoing the client's legacy_session_id field content in the >> legacy_session_id_echo field of ServerHello/HRR during handshake, >> as mandated in RFC 8446, 4.1.3. So it doesn't settle in the session. > > Yes, that's basically what "BoringSSL does not use legacy session > ID with TLSv1.3..." sentence describes. > >>> >>> diff --git a/ssl.t b/ssl.t >>> --- a/ssl.t >>> +++ b/ssl.t >>> @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( >>> plan(skip_all => 'IO::Socket::SSL too old') if $@; >>> >>> my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) >>> - ->has_daemon('openssl')->plan(28); >>> + ->has_daemon('openssl')->plan(21); >>> >>> $t->write_file_expand('nginx.conf', <<'EOF'); >>> >>> @@ -47,7 +47,6 @@ http { >>> >>> ssl_certificate_key localhost.key; >>> ssl_certificate localhost.crt; >>> - ssl_session_tickets off; >>> >>> log_format ssl $ssl_protocol; >>> >>> @@ -59,6 +58,7 @@ http { >>> ssl_certificate_key inner.key; >>> ssl_certificate inner.crt; >>> ssl_session_cache shared:SSL:1m; >>> + ssl_session_tickets on; >>> ssl_verify_client optional_no_ca; >>> >>> keepalive_requests 1000; >>> @@ -100,57 +100,11 @@ http { >>> } >>> >>> server { >>> - listen 127.0.0.1:8081; >>> - server_name localhost; >>> - >>> - # Special case for enabled "ssl" directive. >>> - >>> - ssl on; >> >> Removing tests for the "ssl" legacy directive doesn't feel right >> now and is out of scope of this change. Please put this back. >> Not being able to test it is fragile and can be left silently >> broken, especially with the upcoming quic merge. > > It used to be tested as a side effect of session reuse tests, and > hence it is now gone. You are correct, yet it's useful to have it in some sort. > It is also tested at least in > ssl_reject_handshake.t, so I tend to think it is enough. > It is, though not very useful, at least now. Currently the tested configuration in ssl_reject_handshake.t is supplemented with "listen .. ssl" in adjacent virtual servers. If the "ssl" directive gets broken and e.g. will stop doing its work, the SSL mode will remain enabled across servers of the listening socket, so this may be left unnoticed. To make it more useful, we can remove "listen .. ssl" on virtual servers. # HG changeset patch # User Sergey Kandaurov # Date 1679586784 -14400 # Thu Mar 23 19:53:04 2023 +0400 # Node ID 938f2657257c24ac2ceb8df39536d330bcc03930 # Parent 5abbc8e2d39dfda3913939a6ae293744f5f80933 Tests: removed ssl from virtual servers in ssl_reject_handshake.t. In particular, this allows to test that the "ssl" directive actually works. diff --git a/ssl_reject_handshake.t b/ssl_reject_handshake.t --- a/ssl_reject_handshake.t +++ b/ssl_reject_handshake.t @@ -59,8 +59,8 @@ http { } server { - listen 127.0.0.1:8080 ssl; - listen 127.0.0.1:8081 ssl; + listen 127.0.0.1:8080; + listen 127.0.0.1:8081; server_name virtual; ssl_certificate localhost.crt; @@ -76,12 +76,12 @@ http { } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8082; server_name virtual1; } server { - listen 127.0.0.1:8082 ssl; + listen 127.0.0.1:8082; server_name virtual2; ssl_reject_handshake on; BTW, the old documentation on the "ssl" directive stated that it "Enables the HTTPS protocol for the given *virtual* server", though it appears to be rather opposite (i.e. for the default one). >> On the other hand, I'm fine with finally removing this directive. >> It was made obsolete in version 1.15.0, released on 05 Jun 2018, >> with the "listen .. ssl" upgrade path available back to 0.7.14, >> released on 01 Sep 2008. > > I think we'll consider this in 1.25.x branch. > > [..] >>> server_name localhost; >>> >>> ssl_session_cache shared:SSL:1m; >>> + ssl_session_tickets on; >>> ssl_session_timeout 1; >>> >>> location / { >>> @@ -216,59 +170,34 @@ foreach my $name ('localhost', 'inner') >>> or die "Can't create certificate for $name: $!\n"; >>> } >>> >>> -# suppress deprecation warning >>> - >>> -open OLDERR, ">&", \*STDERR; close STDERR; >>> $t->run(); >>> -open STDERR, ">&", \*OLDERR; >>> >>> ############################################################################### >>> >>> -my $ctx; >>> +# ssl session reuse >>> >>> -SKIP: { >>> -skip 'no TLS 1.3 sessions', 6 if get('/protocol', 8085) =~ /TLSv1.3/ >>> - && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061); >>> +my $ctx = get_ssl_context(); >>> >>> -$ctx = get_ssl_context(); >>> +like(get('/', 8085, $ctx), qr/^body \.$/m, 'session'); >>> >>> -like(get('/', 8085, $ctx), qr/^body \.$/m, 'cache shared'); >>> -like(get('/', 8085, $ctx), qr/^body r$/m, 'cache shared reused'); >>> - >>> -$ctx = get_ssl_context(); >>> +TODO: { >>> +local $TODO = 'no TLSv1.3 sessions, old Net::SSLeay' >>> + if $Net::SSLeay::VERSION < 1.88 && test_tls13(); >>> +local $TODO = 'no TLSv1.3 sessions, old IO::Socket::SSL' >>> + if $IO::Socket::SSL::VERSION < 2.061 && test_tls13(); >> >> Not sure why do you convert this to TODO. >> >> TODO blocks are used for something we control or able to fix. >> SSL libraries are not something like that, so using SKIP there >> is more appropriate and follows other platform-specific tests. >> Besides that, TODOs plagues diagnostic output for no purpose. >> >> See also Test::More documentation: >> >> When do I use SKIP vs. TODO? >> If it's something the user might not be able to do, use SKIP. This >> includes optional modules that aren't installed, running under an OS >> that doesn't have some feature (like "fork()" or symlinks), or maybe >> you need an Internet connection and one isn't available. >> >> If it's something the programmer hasn't done yet, use TODO. This is >> for any code you haven't written yet, or bugs you have yet to fix, >> but want to put tests in your testing script (always a good idea). > > As you can see from the Test::More documentation, the main > distinction is: SKIP is to be used when something cannot be > tested, and TODO is to use when something doesn't work (but we can > test it). > > In this particular case, things can be tested - but tests will > fail due to lack of support in IO::Socket::SSL / Net::SSLeay. > > Immediate benefits of using TODO here is that a) test output > provides good indication of what actually happens with these > module versions (that is, it does not unexpectedly die or > segfault, but session reuse does not work), b) tests are actually > run and it can be easily spotted if they unexpectedly succeed, and > c) it combines nicely with LibreSSL / BoringSSL TODOs (which are > TODO for similar reasons, see the following patches). > > As the code in question is not under our control, it might be good > enough to use SKIP instead of TODO (and the patch series does this > at least once). But I tend to think that at least in case of > LibreSSL it would be much better to use TODOs, so we'll be able to > see when things are finally fixed in LibreSSL - I would expect > this to happen in a foreseeable future. > Ok, I am partially agree with you (item "a" is the most prominent). Let's leave TODOs. -- Sergey Kandaurov From pluknet at nginx.com Thu Mar 23 15:59:47 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Thu, 23 Mar 2023 19:59:47 +0400 Subject: [PATCH 03 of 20] Tests: separate SSL session reuse tests in mail In-Reply-To: References: <97b09b6633f69747c0d6.1679148898@vm-bsd.mdounin.ru> Message-ID: <42C1FBC3-044C-4206-8669-1C9C4A4211A8@nginx.com> > On 23 Mar 2023, at 18:15, Maxim Dounin wrote: > > Hello! > > On Wed, Mar 22, 2023 at 01:46:33PM +0400, Sergey Kandaurov wrote: > >>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: >>> >>> # HG changeset patch >>> # User Maxim Dounin >>> # Date 1679107816 -10800 >>> # Sat Mar 18 05:50:16 2023 +0300 >>> # Node ID 97b09b6633f69747c0d6ef13c76739bdd6b7f3bb >>> # Parent 125fb8461d88a81a62ccb40d0e205a01ecc759f5 >>> Tests: separate SSL session reuse tests in mail. >>> >>> Instead of being mixed with generic SSL tests, session reuse variants >>> are now tested in a separate file. >>> >>> [..] >>> sub get_ssl_socket { >>> - my ($port, $ses, $alpn) = @_; >>> + my ($port, $ses) = @_; >>> >>> my $s = IO::Socket::INET->new('127.0.0.1:' . port($port)); >>> my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!"); >>> Net::SSLeay::set_session($ssl, $ses) if defined $ses; >>> - Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn; >>> Net::SSLeay::set_fd($ssl, fileno($s)); >>> Net::SSLeay::connect($ssl) == 1 or return; >> >> Since this won't fail anymore on ALPN checks, >> you can convert this back to die. > > Strictly speaking, it shouldn't die regardless of whether > connect() can legitimately fail during tests or not. If connect() > fails (for example, due to a bug in some of the session reuse > variants), it still should run other tests. > In general I agree with you. > Fixing this (and other issues, such as missing timeout and SIGPIPE > handling) is out of the scope of this patch series though. Yes, let's postpone this. -- Sergey Kandaurov From pluknet at nginx.com Thu Mar 23 16:01:09 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Thu, 23 Mar 2023 20:01:09 +0400 Subject: [PATCH 00 of 20] tests suite fixes for TLSv1.3 In-Reply-To: References:

Message-ID: > On 23 Mar 2023, at 18:18, Maxim Dounin wrote: > > Hello! > > On Wed, Mar 22, 2023 at 03:43:12PM +0400, Sergey Kandaurov wrote: > >>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: >>> >>> Hello! >>> >>> Here are patch series for the test suite to address test failures >>> observed with TLSv1.3 enabled with BoringSSL and LibreSSL. >>> >>> Short summary of the issues seen: >>> >>> - BoringSSL with TLSv1.3 does not support session reuse via server-side >>> session cache, only with tickets. >>> >>> - BoringSSL with TLSv1.3 does not provide $ssl_session_id. >>> >>> - LibreSSL with TLSv1.3 does not support session reuse. >>> >>> - LibreSSL with TLSv1.3 fails to negotiate certificates based on >>> signature algorithms supported by the client, and fails with >>> "missing rsa certificate" and "unknown pkey type" errors. >>> >>> - LibreSSL with TLSv1.3 does not send CA lists to the client. >>> >> >> Missing peaces that allow me to run with LibreSSL: >> >> # HG changeset patch >> # User Sergey Kandaurov >> # Date 1679485246 -14400 >> # Wed Mar 22 15:40:46 2023 +0400 >> # Node ID dfe434f295d3da7e3b67bbbafeab245bb591f397 >> # Parent 826e00e7c037d617781239963e8b868b6b0de225 >> Tests: fixed upstream zone tests with LibreSSL and TLSv1.3. >> >> LibreSSL does not support session reuse with TLSv1.3. >> >> diff --git a/stream_upstream_zone_ssl.t b/stream_upstream_zone_ssl.t >> --- a/stream_upstream_zone_ssl.t >> +++ b/stream_upstream_zone_ssl.t > > Thanks. I've happen to compile nginx without upstream zone > modules as a leftover from some previous tests, and missed these. > Added a similar change with TODOs. > > Full series with all the fixes: Looks good, thanks for your work. -- Sergey Kandaurov From mdounin at mdounin.ru Thu Mar 23 16:52:38 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 19:52:38 +0300 Subject: [PATCH 00 of 20] tests suite fixes for TLSv1.3 In-Reply-To: References:

Message-ID: Hello! On Thu, Mar 23, 2023 at 08:01:09PM +0400, Sergey Kandaurov wrote: > > On 23 Mar 2023, at 18:18, Maxim Dounin wrote: > > > > Hello! > > > > On Wed, Mar 22, 2023 at 03:43:12PM +0400, Sergey Kandaurov wrote: > > > >>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > >>> > >>> Hello! > >>> > >>> Here are patch series for the test suite to address test failures > >>> observed with TLSv1.3 enabled with BoringSSL and LibreSSL. > >>> > >>> Short summary of the issues seen: > >>> > >>> - BoringSSL with TLSv1.3 does not support session reuse via server-side > >>> session cache, only with tickets. > >>> > >>> - BoringSSL with TLSv1.3 does not provide $ssl_session_id. > >>> > >>> - LibreSSL with TLSv1.3 does not support session reuse. > >>> > >>> - LibreSSL with TLSv1.3 fails to negotiate certificates based on > >>> signature algorithms supported by the client, and fails with > >>> "missing rsa certificate" and "unknown pkey type" errors. > >>> > >>> - LibreSSL with TLSv1.3 does not send CA lists to the client. > >>> > >> > >> Missing peaces that allow me to run with LibreSSL: > >> > >> # HG changeset patch > >> # User Sergey Kandaurov > >> # Date 1679485246 -14400 > >> # Wed Mar 22 15:40:46 2023 +0400 > >> # Node ID dfe434f295d3da7e3b67bbbafeab245bb591f397 > >> # Parent 826e00e7c037d617781239963e8b868b6b0de225 > >> Tests: fixed upstream zone tests with LibreSSL and TLSv1.3. > >> > >> LibreSSL does not support session reuse with TLSv1.3. > >> > >> diff --git a/stream_upstream_zone_ssl.t b/stream_upstream_zone_ssl.t > >> --- a/stream_upstream_zone_ssl.t > >> +++ b/stream_upstream_zone_ssl.t > > > > Thanks. I've happen to compile nginx without upstream zone > > modules as a leftover from some previous tests, and missed these. > > Added a similar change with TODOs. > > > > Full series with all the fixes: > > Looks good, thanks for your work. Pushed to http://mdounin.ru/hg/nginx-tests, thanks for the review. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 17:24:18 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 20:24:18 +0300 Subject: [PATCH 01 of 20] Tests: separate SSL session reuse tests In-Reply-To: <735C14A7-4A60-43EA-8AF5-BD44812B1C9A@nginx.com> References: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> <735C14A7-4A60-43EA-8AF5-BD44812B1C9A@nginx.com> Message-ID: Hello! On Thu, Mar 23, 2023 at 07:59:41PM +0400, Sergey Kandaurov wrote: > > On 23 Mar 2023, at 18:10, Maxim Dounin wrote: > > > > On Wed, Mar 22, 2023 at 12:57:56PM +0400, Sergey Kandaurov wrote: > > > >>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: > >>> > >>> # HG changeset patch > >>> # User Maxim Dounin > >>> # Date 1679105686 -10800 > >>> # Sat Mar 18 05:14:46 2023 +0300 > >>> # Node ID 86c394a226d2a7d463da7a1b7e88375c71c0c69b > >>> # Parent 3c9aa6c23fc836725b96cf056d218217a5a81603 > >>> Tests: separate SSL session reuse tests. > >>> > >>> Instead of being mixed with generic SSL tests, session reuse variants > >>> are now tested in a separate file. > >>> > >>> In the generic SSL tests only basic session reuse is now tested, > >>> notably with session tickets enabled and a shared SSL session cache. > >>> This should make it possible to reuse sessions in all cases (except > >>> when it's not supported, such as with LibreSSL with TLSv1.3). > >>> > >>> Note that session reuse with tickets implies that $ssl_session_id > >>> is selected by the client and therefore is not available on the > >>> initial connection. Relevant test is modified to handle this. > >>> > >>> Further, BoringSSL does not use legacy session ID with TLSv1.3 even > >>> if it is sent by the client. In contrast, OpenSSL always generates > >>> an unique legacy session id, so it is available with TLSv1.3 even if > >>> session resumption does not work (such as with old Net::SSLeay and > >>> IO::Socket::SSL modules). > >> > >> Note that TLSv1.3 has only ticket based session resumption. > >> BoringSSL has a different notion on using legacy session IDs > >> in TLSv1.3, see tls13_create_session_with_ticket() in sources: > >> > >> // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. > >> // Envoy's tests depend on this, although perhaps they shouldn't. > >> SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id); > >> > >> Later, SSL_SESSION_get_id() was additionally annotated in ssl.h: > >> > >> // As a workaround for some broken applications, BoringSSL sometimes synthesizes > >> // arbitrary session IDs for non-ID-based sessions. This behavior may be > >> // removed in the future. > >> > >> As for TLSv1.3 server context, BoringSSL doesn't seem to use "session ID" > >> besides echoing the client's legacy_session_id field content in the > >> legacy_session_id_echo field of ServerHello/HRR during handshake, > >> as mandated in RFC 8446, 4.1.3. So it doesn't settle in the session. > > > > Yes, that's basically what "BoringSSL does not use legacy session > > ID with TLSv1.3..." sentence describes. > > > >>> > >>> diff --git a/ssl.t b/ssl.t > >>> --- a/ssl.t > >>> +++ b/ssl.t > >>> @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( > >>> plan(skip_all => 'IO::Socket::SSL too old') if $@; > >>> > >>> my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) > >>> - ->has_daemon('openssl')->plan(28); > >>> + ->has_daemon('openssl')->plan(21); > >>> > >>> $t->write_file_expand('nginx.conf', <<'EOF'); > >>> > >>> @@ -47,7 +47,6 @@ http { > >>> > >>> ssl_certificate_key localhost.key; > >>> ssl_certificate localhost.crt; > >>> - ssl_session_tickets off; > >>> > >>> log_format ssl $ssl_protocol; > >>> > >>> @@ -59,6 +58,7 @@ http { > >>> ssl_certificate_key inner.key; > >>> ssl_certificate inner.crt; > >>> ssl_session_cache shared:SSL:1m; > >>> + ssl_session_tickets on; > >>> ssl_verify_client optional_no_ca; > >>> > >>> keepalive_requests 1000; > >>> @@ -100,57 +100,11 @@ http { > >>> } > >>> > >>> server { > >>> - listen 127.0.0.1:8081; > >>> - server_name localhost; > >>> - > >>> - # Special case for enabled "ssl" directive. > >>> - > >>> - ssl on; > >> > >> Removing tests for the "ssl" legacy directive doesn't feel right > >> now and is out of scope of this change. Please put this back. > >> Not being able to test it is fragile and can be left silently > >> broken, especially with the upcoming quic merge. > > > > It used to be tested as a side effect of session reuse tests, and > > hence it is now gone. > > You are correct, yet it's useful to have it in some sort. > > > It is also tested at least in > > ssl_reject_handshake.t, so I tend to think it is enough. > > > > It is, though not very useful, at least now. > Currently the tested configuration in ssl_reject_handshake.t is > supplemented with "listen .. ssl" in adjacent virtual servers. > If the "ssl" directive gets broken and e.g. will stop doing its work, > the SSL mode will remain enabled across servers of the listening socket, > so this may be left unnoticed. > To make it more useful, we can remove "listen .. ssl" on virtual servers. > > # HG changeset patch > # User Sergey Kandaurov > # Date 1679586784 -14400 > # Thu Mar 23 19:53:04 2023 +0400 > # Node ID 938f2657257c24ac2ceb8df39536d330bcc03930 > # Parent 5abbc8e2d39dfda3913939a6ae293744f5f80933 > Tests: removed ssl from virtual servers in ssl_reject_handshake.t. > > In particular, this allows to test that the "ssl" directive actually works. > > diff --git a/ssl_reject_handshake.t b/ssl_reject_handshake.t > --- a/ssl_reject_handshake.t > +++ b/ssl_reject_handshake.t > @@ -59,8 +59,8 @@ http { > } > > server { > - listen 127.0.0.1:8080 ssl; > - listen 127.0.0.1:8081 ssl; > + listen 127.0.0.1:8080; > + listen 127.0.0.1:8081; > server_name virtual; > > ssl_certificate localhost.crt; > @@ -76,12 +76,12 @@ http { > } > > server { > - listen 127.0.0.1:8082 ssl; > + listen 127.0.0.1:8082; > server_name virtual1; > } > > server { > - listen 127.0.0.1:8082 ssl; > + listen 127.0.0.1:8082; > server_name virtual2; > > ssl_reject_handshake on; Looks good (except the "virtual servers" term, see below). > BTW, the old documentation on the "ssl" directive stated that it > "Enables the HTTPS protocol for the given *virtual* server", though > it appears to be rather opposite (i.e. for the default one). The term "virtual server" includes everything virtual being run on a given physical server, including IP-based, port-based, and name-based virtual servers. The default server (for a listening socket) is still a virtual server. See, for example, description of the "server" directive: http://nginx.org/en/docs/http/ngx_http_core_module.html#server So, basically, the description of the "ssl" directive you are referring to is perfectly correct. Except the fact that it might additionally state that the directive only works if the server is the default virtual server for the listening socket in question, and does nothing in non-default virtual servers. So a better commit log for the above patch should say that it removes the "ssl" option from listening sockets in non-default [virtual] servers. Something like this should be good enough: : Tests: improved "ssl" directive test in ssl_reject_handshake.t. : : The "ssl" option was removed from listening sockets in non-default : servers. In particular, this allows to test that the "ssl" directive : actually works. [...] -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 17:44:42 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 23 Mar 2023 20:44:42 +0300 Subject: Configurable sleep period for connections In-Reply-To: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark> References: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark> Message-ID: Hello! On Thu, Mar 23, 2023 at 09:26:48AM +0100, Roy Teeuwen wrote: > We are using NGINX as a proxy / caching layer for a backend > application. Our backend has a relatively slow response time, > ranging between the 100 to 300ms. We want the NGINX proxy to be > as speedy as possible, to do this we have implemented the > following logic: > > - Cache all responses for 5 mins (based on cache control > headers) > - Use stale cache for error's on the backend > - Do a background update for stale cache > > The last part has an issue, namely if a first request reaches > nginx, it will trigger a background request, but other requests > for the same resource will be locked until this background > request is finished instead of still returning the stale cache > that is available. This is caused by the fact that there is a > keepalive on the connection, which locks all subsequent requests > until the background request is finished. Could you please clarify what you are trying to describe? Keepalive on the connection might delay handling of subsequent requests on the same connection (and not other requests to the same resource). Other requests to the same resource might be delayed by the proxy_cache_lock (https://nginx.org/r/proxy_cache_lock), but it is not something in your description, and it only works for new cache elements and has no effect when there is a stale cache item. > The issue that we are facing in this situation is that the > locking is very long, namely 500ms hardcoded. I think it is > caused by this: > https://github.com/nginx/nginx/blob/master/src/core/ngx_connection.c#L703 This looks completely unrelated. A 500ms delay can be seen with proxy_cache_lock as previously mentioned, see here: http://hg.nginx.org/nginx/file/tip/src/http/ngx_http_file_cache.c#l455 But again, it is not expected to appear in the use case you describe. > This means that our relatively slow backend of 100-200ms > actually gets worse than better. > > > Is it an option to make this 500ms a configurable setting > instead of 500ms? Are there any downsides to making this 500ms > lower? I'd be willing to see if we can contribute this. > > > Another option that I'd tried is to set the keepalive to 0, so > that every request is a new connection. In small amounts of > requests this actually seemed to solve the issue, but the moment > that we went to a real life situation, this degraded the > performance massively, so we had to revert this First of all, it might be a good idea to better understand what is the issue you are seeing. Also make sure that you have "proxy_cache_use_stale updating" enabled (https://nginx.org/r/proxy_cache_use_stale). It is designed exactly for the use case you describe, and works quite well in most use cases. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Thu Mar 23 23:56:56 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 24 Mar 2023 02:56:56 +0300 Subject: [PATCH] Mail: fixed handling of blocked client read events in proxy In-Reply-To: <20230322163852.yoqkx7aimwkvzrnf@N00W24XTQX> References: <20230322163852.yoqkx7aimwkvzrnf@N00W24XTQX> Message-ID: Hello! On Wed, Mar 22, 2023 at 08:38:52PM +0400, Roman Arutyunyan wrote: > On Sat, Mar 11, 2023 at 02:24:49PM +0300, Maxim Dounin wrote: > > # HG changeset patch > > # User Maxim Dounin > > # Date 1678533841 -10800 > > # Sat Mar 11 14:24:01 2023 +0300 > > # Node ID b97f2b983d1564d29280d03828503edca21a79ee > > # Parent 8771d35d55d0a2b1cefaab04401d6f837f5a05a2 > > Mail: fixed handling of blocked client read events in proxy. > > > > When establishing a connection to the backend, nginx blocks reading > > from the client with ngx_mail_proxy_block_read(). Previously, such > > events were lost, and in some cases this resulted in connection hangs. > > > > Notably, this affected mail_imap_ssl.t on Windows, since the test > > closes connections after requesting authentication, but without > > waiting for any responses (so the connection close events might be > > lost). > > The following patch alowed me to trigger the issue on my laptop. > It slows down the auth http backend and switches event processing to select. > > diff --git a/mail_imap_ssl.t b/mail_imap_ssl.t > --- a/mail_imap_ssl.t > +++ b/mail_imap_ssl.t > @@ -42,6 +42,7 @@ my $t = Test::Nginx->new()->has(qw/mail > daemon off; > > events { > + use select; > } > > mail { > @@ -104,6 +105,7 @@ http { > server { > listen 127.0.0.1:8080; > server_name localhost; > + limit_rate 100; > > location = /mail/auth { > access_log auth.log test; > > > Fix is to post an event to read from the client after connecting to > > the backend if there were blocked events. > > > > diff --git a/src/mail/ngx_mail_proxy_module.c b/src/mail/ngx_mail_proxy_module.c > > --- a/src/mail/ngx_mail_proxy_module.c > > +++ b/src/mail/ngx_mail_proxy_module.c > > @@ -327,7 +327,9 @@ ngx_mail_proxy_pop3_handler(ngx_event_t > > c->log->action = NULL; > > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > > > - if (s->buffer->pos < s->buffer->last) { > > + if (s->buffer->pos < s->buffer->last > > + || s->connection->read->ready) > > + { > > ngx_post_event(c->write, &ngx_posted_events); > > } > > > > @@ -486,7 +488,9 @@ ngx_mail_proxy_imap_handler(ngx_event_t > > c->log->action = NULL; > > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > > > - if (s->buffer->pos < s->buffer->last) { > > + if (s->buffer->pos < s->buffer->last > > + || s->connection->read->ready) > > + { > > ngx_post_event(c->write, &ngx_posted_events); > > } > > > > @@ -821,7 +825,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t > > c->log->action = NULL; > > ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); > > > > - if (s->buffer->pos < s->buffer->last) { > > + if (s->buffer->pos < s->buffer->last > > + || s->connection->read->ready) > > + { > > ngx_post_event(c->write, &ngx_posted_events); > > } > > Looks ok Thanks for the review, pushed to http://mdounin.ru/hg/nginx. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Fri Mar 24 00:15:18 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 24 Mar 2023 03:15:18 +0300 Subject: [PATCH] SSL: enabled TLSv1.3 by default In-Reply-To: <20230321131345.cd3hmxihqls46ovw@N00W24XTQX> References: <3496c963b43636104fa7.1679318394@vm-bsd.mdounin.ru> <20230321131345.cd3hmxihqls46ovw@N00W24XTQX> Message-ID: Hello! On Tue, Mar 21, 2023 at 05:13:45PM +0400, Roman Arutyunyan wrote: > Hi, > > On Mon, Mar 20, 2023 at 04:19:54PM +0300, Maxim Dounin wrote: > > # HG changeset patch > > # User Maxim Dounin > > # Date 1678891161 -10800 > > # Wed Mar 15 17:39:21 2023 +0300 > > # Node ID 3496c963b43636104fa794e84969eb077abec6b0 > > # Parent b97f2b983d1564d29280d03828503edca21a79ee > > SSL: enabled TLSv1.3 by default. > > > > diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c > > --- a/src/http/modules/ngx_http_grpc_module.c > > +++ b/src/http/modules/ngx_http_grpc_module.c > > @@ -4473,8 +4473,9 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c > > --- a/src/http/modules/ngx_http_proxy_module.c > > +++ b/src/http/modules/ngx_http_proxy_module.c > > @@ -3734,8 +3734,9 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c > > --- a/src/http/modules/ngx_http_ssl_module.c > > +++ b/src/http/modules/ngx_http_ssl_module.c > > @@ -632,8 +632,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * > > ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, > > NGX_SSL_BUFSIZE); > > diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c > > --- a/src/http/modules/ngx_http_uwsgi_module.c > > +++ b/src/http/modules/ngx_http_uwsgi_module.c > > @@ -1875,8 +1875,9 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c > > --- a/src/mail/ngx_mail_ssl_module.c > > +++ b/src/mail/ngx_mail_ssl_module.c > > @@ -360,8 +360,9 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, > > prev->prefer_server_ciphers, 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > > diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c > > --- a/src/stream/ngx_stream_proxy_module.c > > +++ b/src/stream/ngx_stream_proxy_module.c > > @@ -2163,8 +2163,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf > > prev->ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); > > > > diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c > > --- a/src/stream/ngx_stream_ssl_module.c > > +++ b/src/stream/ngx_stream_ssl_module.c > > @@ -703,8 +703,9 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf > > prev->prefer_server_ciphers, 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > > _______________________________________________ > > nginx-devel mailing list > > nginx-devel at nginx.org > > https://mailman.nginx.org/mailman/listinfo/nginx-devel > > Looks fine Thanks for the review, pushed to http://mdounin.ru/hg/nginx. -- Maxim Dounin http://mdounin.ru/ From roy at teeuwen.be Fri Mar 24 08:24:25 2023 From: roy at teeuwen.be (Roy Teeuwen) Date: Fri, 24 Mar 2023 09:24:25 +0100 Subject: Configurable sleep period for connections In-Reply-To: References: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark> Message-ID: Hey Maxim, You are absolutely right, I totally forgot about the cache_lock. I have listed our settings below. The reason we are using the cache_lock is to save the backend application to not get 100's of requests when a stale item is invalid. Even if we have use_stale updating, we notice that only the first request will use the stale item, the following requests will do a new request even though there is already a background request going on to refresh the stale item. (This does not happen if we set keepalive to 0, where new connections are being used, but has the performance degradation as mentioned.) This was the reasoning for the cache_lock, but that gives the issue about the 500ms lock, while the item might already be refreshed after 100ms. So is there an option to make the 500ms in the ngx_http_file_cache.c configurable? Are there any downsides to that? Or is there a better alternative Our config: add_header X-Cache-Status $upstream_cache_status always; # tag::proxy_cache[] proxy_cache content-proxy-7b49d8c897-62gk9; proxy_cache_background_update on; proxy_cache_bypass $arg_nocache; proxy_cache_lock on; proxy_cache_use_stale updating error timeout invalid_header http_500 http_502 http_503 http_504; proxy_cache_valid 404 5m; # end::proxy_cache[] # tag::upstream[] proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; # end::upstream[] # This header will be used to indicate a request coming from nginx # With this header set we can return 503 only to nginx when a server is in maintenance mode proxy_set_header X-Content-Cache $hostname; proxy_ssl_server_name on; proxy_read_timeout 10; proxy_connect_timeout 10; proxy_send_timeout 10; Greets, Roy > On 23 Mar 2023, at 18:44, Maxim Dounin wrote: > > Hello! > > On Thu, Mar 23, 2023 at 09:26:48AM +0100, Roy Teeuwen wrote: > >> We are using NGINX as a proxy / caching layer for a backend >> application. Our backend has a relatively slow response time, >> ranging between the 100 to 300ms. We want the NGINX proxy to be >> as speedy as possible, to do this we have implemented the >> following logic: >> >> - Cache all responses for 5 mins (based on cache control >> headers) >> - Use stale cache for error's on the backend >> - Do a background update for stale cache >> >> The last part has an issue, namely if a first request reaches >> nginx, it will trigger a background request, but other requests >> for the same resource will be locked until this background >> request is finished instead of still returning the stale cache >> that is available. This is caused by the fact that there is a >> keepalive on the connection, which locks all subsequent requests >> until the background request is finished. > > Could you please clarify what you are trying to describe? > > Keepalive on the connection might delay handling of subsequent > requests on the same connection (and not other requests to the > same resource). > > Other requests to the same resource might be delayed by the > proxy_cache_lock (https://nginx.org/r/proxy_cache_lock), but it is > not something in your description, and it only works for new cache > elements and has no effect when there is a stale cache item. > >> The issue that we are facing in this situation is that the >> locking is very long, namely 500ms hardcoded. I think it is >> caused by this: >> https://github.com/nginx/nginx/blob/master/src/core/ngx_connection.c#L703 > > This looks completely unrelated. A 500ms delay can be seen with > proxy_cache_lock as previously mentioned, see here: > > http://hg.nginx.org/nginx/file/tip/src/http/ngx_http_file_cache.c#l455 > > But again, it is not expected to appear in the use case you > describe. > >> This means that our relatively slow backend of 100-200ms >> actually gets worse than better. >> >> >> Is it an option to make this 500ms a configurable setting >> instead of 500ms? Are there any downsides to making this 500ms >> lower? I'd be willing to see if we can contribute this. >> >> >> Another option that I'd tried is to set the keepalive to 0, so >> that every request is a new connection. In small amounts of >> requests this actually seemed to solve the issue, but the moment >> that we went to a real life situation, this degraded the >> performance massively, so we had to revert this > > First of all, it might be a good idea to better understand what > is the issue you are seeing. > > Also make sure that you have "proxy_cache_use_stale updating" > enabled (https://nginx.org/r/proxy_cache_use_stale). It is > designed exactly for the use case you describe, and works quite > well in most use cases. > > -- > Maxim Dounin > http://mdounin.ru/ > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > https://mailman.nginx.org/mailman/listinfo/nginx-devel -------------- next part -------------- An HTML attachment was scrubbed... URL: From mdounin at mdounin.ru Fri Mar 24 10:18:01 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 24 Mar 2023 13:18:01 +0300 Subject: Configurable sleep period for connections In-Reply-To: References: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark>

Message-ID: Hello! On Fri, Mar 24, 2023 at 09:24:25AM +0100, Roy Teeuwen wrote: > You are absolutely right, I totally forgot about the cache_lock. > I have listed our settings below. > > The reason we are using the cache_lock is to save the backend > application to not get 100's of requests when a stale item is > invalid. Even if we have use_stale updating, we notice that only > the first request will use the stale item, the following > requests will do a new request even though there is already a > background request going on to refresh the stale item. (This > does not happen if we set keepalive to 0, where new connections > are being used, but has the performance degradation as > mentioned.) This was the reasoning for the cache_lock, but that > gives the issue about the 500ms lock, while the item might > already be refreshed after 100ms. To re-iterate: proxy_cache_lock is not expected to affect requests if there is an existing cache item (and keepalive shouldn't affect proxy_cache_lock in any way; not to mention that the "keepalive" directive, which configures keepalive connections cache to upstream servers, does not accept the "0" value). You may want to dig further into what actually happens in your configuration. I would recommend to start with doing a debug log which shows the described behaviour, and then following the code to find out why the cache lock kicks in when it shouldn't. -- Maxim Dounin http://mdounin.ru/ From pluknet at nginx.com Fri Mar 24 12:38:23 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Fri, 24 Mar 2023 16:38:23 +0400 Subject: [PATCH 01 of 20] Tests: separate SSL session reuse tests In-Reply-To: References: <86c394a226d2a7d463da.1679148896@vm-bsd.mdounin.ru> <6B831977-21E8-402B-A254-ACA0A59E7387@nginx.com> <735C14A7-4A60-43EA-8AF5-BD44812B1C9A@nginx.com> Message-ID: > On 23 Mar 2023, at 21:24, Maxim Dounin wrote: > > Hello! > > On Thu, Mar 23, 2023 at 07:59:41PM +0400, Sergey Kandaurov wrote: > >>> On 23 Mar 2023, at 18:10, Maxim Dounin wrote: >>> >>> On Wed, Mar 22, 2023 at 12:57:56PM +0400, Sergey Kandaurov wrote: >>> >>>>> On 18 Mar 2023, at 18:14, Maxim Dounin wrote: >>>>> >>>>> # HG changeset patch >>>>> # User Maxim Dounin >>>>> # Date 1679105686 -10800 >>>>> # Sat Mar 18 05:14:46 2023 +0300 >>>>> # Node ID 86c394a226d2a7d463da7a1b7e88375c71c0c69b >>>>> # Parent 3c9aa6c23fc836725b96cf056d218217a5a81603 >>>>> Tests: separate SSL session reuse tests. >>>>> >>>>> Instead of being mixed with generic SSL tests, session reuse variants >>>>> are now tested in a separate file. >>>>> >>>>> In the generic SSL tests only basic session reuse is now tested, >>>>> notably with session tickets enabled and a shared SSL session cache. >>>>> This should make it possible to reuse sessions in all cases (except >>>>> when it's not supported, such as with LibreSSL with TLSv1.3). >>>>> >>>>> Note that session reuse with tickets implies that $ssl_session_id >>>>> is selected by the client and therefore is not available on the >>>>> initial connection. Relevant test is modified to handle this. >>>>> >>>>> Further, BoringSSL does not use legacy session ID with TLSv1.3 even >>>>> if it is sent by the client. In contrast, OpenSSL always generates >>>>> an unique legacy session id, so it is available with TLSv1.3 even if >>>>> session resumption does not work (such as with old Net::SSLeay and >>>>> IO::Socket::SSL modules). >>>> >>>> Note that TLSv1.3 has only ticket based session resumption. >>>> BoringSSL has a different notion on using legacy session IDs >>>> in TLSv1.3, see tls13_create_session_with_ticket() in sources: >>>> >>>> // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. >>>> // Envoy's tests depend on this, although perhaps they shouldn't. >>>> SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id); >>>> >>>> Later, SSL_SESSION_get_id() was additionally annotated in ssl.h: >>>> >>>> // As a workaround for some broken applications, BoringSSL sometimes synthesizes >>>> // arbitrary session IDs for non-ID-based sessions. This behavior may be >>>> // removed in the future. >>>> >>>> As for TLSv1.3 server context, BoringSSL doesn't seem to use "session ID" >>>> besides echoing the client's legacy_session_id field content in the >>>> legacy_session_id_echo field of ServerHello/HRR during handshake, >>>> as mandated in RFC 8446, 4.1.3. So it doesn't settle in the session. >>> >>> Yes, that's basically what "BoringSSL does not use legacy session >>> ID with TLSv1.3..." sentence describes. >>> >>>>> >>>>> diff --git a/ssl.t b/ssl.t >>>>> --- a/ssl.t >>>>> +++ b/ssl.t >>>>> @@ -31,7 +31,7 @@ eval { IO::Socket::SSL::SSL_VERIFY_NONE( >>>>> plan(skip_all => 'IO::Socket::SSL too old') if $@; >>>>> >>>>> my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite proxy/) >>>>> - ->has_daemon('openssl')->plan(28); >>>>> + ->has_daemon('openssl')->plan(21); >>>>> >>>>> $t->write_file_expand('nginx.conf', <<'EOF'); >>>>> >>>>> @@ -47,7 +47,6 @@ http { >>>>> >>>>> ssl_certificate_key localhost.key; >>>>> ssl_certificate localhost.crt; >>>>> - ssl_session_tickets off; >>>>> >>>>> log_format ssl $ssl_protocol; >>>>> >>>>> @@ -59,6 +58,7 @@ http { >>>>> ssl_certificate_key inner.key; >>>>> ssl_certificate inner.crt; >>>>> ssl_session_cache shared:SSL:1m; >>>>> + ssl_session_tickets on; >>>>> ssl_verify_client optional_no_ca; >>>>> >>>>> keepalive_requests 1000; >>>>> @@ -100,57 +100,11 @@ http { >>>>> } >>>>> >>>>> server { >>>>> - listen 127.0.0.1:8081; >>>>> - server_name localhost; >>>>> - >>>>> - # Special case for enabled "ssl" directive. >>>>> - >>>>> - ssl on; >>>> >>>> Removing tests for the "ssl" legacy directive doesn't feel right >>>> now and is out of scope of this change. Please put this back. >>>> Not being able to test it is fragile and can be left silently >>>> broken, especially with the upcoming quic merge. >>> >>> It used to be tested as a side effect of session reuse tests, and >>> hence it is now gone. >> >> You are correct, yet it's useful to have it in some sort. >> >>> It is also tested at least in >>> ssl_reject_handshake.t, so I tend to think it is enough. >>> >> >> It is, though not very useful, at least now. >> Currently the tested configuration in ssl_reject_handshake.t is >> supplemented with "listen .. ssl" in adjacent virtual servers. >> If the "ssl" directive gets broken and e.g. will stop doing its work, >> the SSL mode will remain enabled across servers of the listening socket, >> so this may be left unnoticed. >> To make it more useful, we can remove "listen .. ssl" on virtual servers. >> >> # HG changeset patch >> # User Sergey Kandaurov >> # Date 1679586784 -14400 >> # Thu Mar 23 19:53:04 2023 +0400 >> # Node ID 938f2657257c24ac2ceb8df39536d330bcc03930 >> # Parent 5abbc8e2d39dfda3913939a6ae293744f5f80933 >> Tests: removed ssl from virtual servers in ssl_reject_handshake.t. >> >> In particular, this allows to test that the "ssl" directive actually works. >> >> diff --git a/ssl_reject_handshake.t b/ssl_reject_handshake.t >> --- a/ssl_reject_handshake.t >> +++ b/ssl_reject_handshake.t >> @@ -59,8 +59,8 @@ http { >> } >> >> server { >> - listen 127.0.0.1:8080 ssl; >> - listen 127.0.0.1:8081 ssl; >> + listen 127.0.0.1:8080; >> + listen 127.0.0.1:8081; >> server_name virtual; >> >> ssl_certificate localhost.crt; >> @@ -76,12 +76,12 @@ http { >> } >> >> server { >> - listen 127.0.0.1:8082 ssl; >> + listen 127.0.0.1:8082; >> server_name virtual1; >> } >> >> server { >> - listen 127.0.0.1:8082 ssl; >> + listen 127.0.0.1:8082; >> server_name virtual2; >> >> ssl_reject_handshake on; > > Looks good (except the "virtual servers" term, see below). > >> BTW, the old documentation on the "ssl" directive stated that it >> "Enables the HTTPS protocol for the given *virtual* server", though >> it appears to be rather opposite (i.e. for the default one). > > The term "virtual server" includes everything virtual being run on > a given physical server, including IP-based, port-based, and > name-based virtual servers. The default server (for a listening > socket) is still a virtual server. See, for example, description > of the "server" directive: > > http://nginx.org/en/docs/http/ngx_http_core_module.html#server > > So, basically, the description of the "ssl" directive you are > referring to is perfectly correct. Except the fact that it might > additionally state that the directive only works if the server is > the default virtual server for the listening socket in question, > and does nothing in non-default virtual servers. > > So a better commit log for the above patch should say that it > removes the "ssl" option from listening sockets in non-default > [virtual] servers. Something like this should be good enough: > > : Tests: improved "ssl" directive test in ssl_reject_handshake.t. > : > : The "ssl" option was removed from listening sockets in non-default > : servers. In particular, this allows to test that the "ssl" directive > : actually works. > Thanks, applied and pushed, together with the whole series. -- Sergey Kandaurov From pluknet at nginx.com Fri Mar 24 13:18:09 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Fri, 24 Mar 2023 13:18:09 +0000 Subject: [nginx] Mail: fixed handling of blocked client read events in proxy. Message-ID: details: https://hg.nginx.org/nginx/rev/a5e6e8510634 branches: changeset: 8151:a5e6e8510634 user: Maxim Dounin date: Fri Mar 24 02:53:21 2023 +0300 description: Mail: fixed handling of blocked client read events in proxy. When establishing a connection to the backend, nginx blocks reading from the client with ngx_mail_proxy_block_read(). Previously, such events were lost, and in some cases this resulted in connection hangs. Notably, this affected mail_imap_ssl.t on Windows, since the test closes connections after requesting authentication, but without waiting for any responses (so the connection close events might be lost). Fix is to post an event to read from the client after connecting to the backend if there were blocked events. diffstat: src/mail/ngx_mail_proxy_module.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-) diffs (36 lines): diff -r 8771d35d55d0 -r a5e6e8510634 src/mail/ngx_mail_proxy_module.c --- a/src/mail/ngx_mail_proxy_module.c Fri Mar 10 07:43:50 2023 +0300 +++ b/src/mail/ngx_mail_proxy_module.c Fri Mar 24 02:53:21 2023 +0300 @@ -327,7 +327,9 @@ ngx_mail_proxy_pop3_handler(ngx_event_t c->log->action = NULL; ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); - if (s->buffer->pos < s->buffer->last) { + if (s->buffer->pos < s->buffer->last + || s->connection->read->ready) + { ngx_post_event(c->write, &ngx_posted_events); } @@ -486,7 +488,9 @@ ngx_mail_proxy_imap_handler(ngx_event_t c->log->action = NULL; ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); - if (s->buffer->pos < s->buffer->last) { + if (s->buffer->pos < s->buffer->last + || s->connection->read->ready) + { ngx_post_event(c->write, &ngx_posted_events); } @@ -821,7 +825,9 @@ ngx_mail_proxy_smtp_handler(ngx_event_t c->log->action = NULL; ngx_log_error(NGX_LOG_INFO, c->log, 0, "client logged in"); - if (s->buffer->pos < s->buffer->last) { + if (s->buffer->pos < s->buffer->last + || s->connection->read->ready) + { ngx_post_event(c->write, &ngx_posted_events); } From pluknet at nginx.com Fri Mar 24 13:18:12 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Fri, 24 Mar 2023 13:18:12 +0000 Subject: [nginx] SSL: enabled TLSv1.3 by default. Message-ID: details: https://hg.nginx.org/nginx/rev/d1cf09451ae8 branches: changeset: 8152:d1cf09451ae8 user: Maxim Dounin date: Fri Mar 24 02:57:43 2023 +0300 description: SSL: enabled TLSv1.3 by default. diffstat: src/http/modules/ngx_http_grpc_module.c | 5 +++-- src/http/modules/ngx_http_proxy_module.c | 5 +++-- src/http/modules/ngx_http_ssl_module.c | 5 +++-- src/http/modules/ngx_http_uwsgi_module.c | 5 +++-- src/mail/ngx_mail_ssl_module.c | 5 +++-- src/stream/ngx_stream_proxy_module.c | 5 +++-- src/stream/ngx_stream_ssl_module.c | 5 +++-- 7 files changed, 21 insertions(+), 14 deletions(-) diffs (105 lines): diff -r a5e6e8510634 -r d1cf09451ae8 src/http/modules/ngx_http_grpc_module.c --- a/src/http/modules/ngx_http_grpc_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_grpc_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -4473,8 +4473,9 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); diff -r a5e6e8510634 -r d1cf09451ae8 src/http/modules/ngx_http_proxy_module.c --- a/src/http/modules/ngx_http_proxy_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_proxy_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -3734,8 +3734,9 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); diff -r a5e6e8510634 -r d1cf09451ae8 src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -632,8 +632,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, NGX_SSL_BUFSIZE); diff -r a5e6e8510634 -r d1cf09451ae8 src/http/modules/ngx_http_uwsgi_module.c --- a/src/http/modules/ngx_http_uwsgi_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_uwsgi_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -1875,8 +1875,9 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); diff -r a5e6e8510634 -r d1cf09451ae8 src/mail/ngx_mail_ssl_module.c --- a/src/mail/ngx_mail_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/mail/ngx_mail_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -360,8 +360,9 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); diff -r a5e6e8510634 -r d1cf09451ae8 src/stream/ngx_stream_proxy_module.c --- a/src/stream/ngx_stream_proxy_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/stream/ngx_stream_proxy_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -2163,8 +2163,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf prev->ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT"); diff -r a5e6e8510634 -r d1cf09451ae8 src/stream/ngx_stream_ssl_module.c --- a/src/stream/ngx_stream_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/stream/ngx_stream_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -703,8 +703,9 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); From maxim at nginx.com Fri Mar 24 15:30:33 2023 From: maxim at nginx.com (Maxim Konovalov) Date: Fri, 24 Mar 2023 08:30:33 -0700 Subject: [PATCH] Added TLSv1.3 to the default value of ssl_protocols and friends In-Reply-To: <477d0fe1e6cb95533ffb.1679383149@ORK-ML-00007151> References: <477d0fe1e6cb95533ffb.1679383149@ORK-ML-00007151> Message-ID: Hi Yar, On 21.03.2023 00:19, Yaroslav Zhuravlev wrote: > diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml > --- a/xml/en/docs/http/ngx_http_grpc_module.xml > +++ b/xml/en/docs/http/ngx_http_grpc_module.xml [...] > @@ -633,7 +633,7 @@ > [TLSv1.1] > [TLSv1.2] > [TLSv1.3] > -TLSv1 TLSv1.1 TLSv1.2 > +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 > http > server > location It makes sense to add a history note here and in other modules that have ssl_protocol directive. Maxim -- Maxim Konovalov From claireecf at gmail.com Sat Mar 25 03:59:16 2023 From: claireecf at gmail.com (claire liu) Date: Fri, 24 Mar 2023 22:59:16 -0500 Subject: Question about stream multiplexing in Nginx and Nginx-quic Message-ID: Hello Dev Team, Would you mind confirming if Nginx and Nginx-quic support stream multiplexing? How does Nginx handle multiplexed-object webpages? Does it respond data to client from multiple streams simultaneously? Thank you very much. Cheers, Claire -------------- next part -------------- An HTML attachment was scrubbed... URL: From mdounin at mdounin.ru Sat Mar 25 11:25:16 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Sat, 25 Mar 2023 14:25:16 +0300 Subject: Question about stream multiplexing in Nginx and Nginx-quic In-Reply-To: References: Message-ID: Hello! On Fri, Mar 24, 2023 at 10:59:16PM -0500, claire liu wrote: > Hello Dev Team, > > Would you mind confirming if Nginx and Nginx-quic support stream > multiplexing? How does Nginx handle multiplexed-object webpages? Does it > respond data to client from multiple streams simultaneously? Thank you very > much. For user-level questions please use the nginx@ mailing list instead. Thank you for understanding. -- Maxim Dounin http://mdounin.ru/ From u5.horie at gmail.com Mon Mar 27 00:25:56 2023 From: u5.horie at gmail.com (u5h) Date: Mon, 27 Mar 2023 09:25:56 +0900 Subject: Configurable sleep period for connections In-Reply-To: References: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark>

Message-ID: Hi, I had a same issue in those days. Did you try the proxy_cache_lock_timeout? https://forum.nginx.org/read.php?2,276344,276349#msg-276349 But the below article said if you reduce simply the once busy loop time, it may not resolve this problem for which based on the nginx event notification mechanism in case it has many concurrently same content request. https://blog.lumen.com/pulling-back-the-curtain-development-and-testing-for-low-latency-dash-support/ By the way, we might have been better to use nginx at mailing such a user level discussion. — Yugo Horie On Fri, Mar 24, 2023 at 19:18 Maxim Dounin wrote: > Hello! > > On Fri, Mar 24, 2023 at 09:24:25AM +0100, Roy Teeuwen wrote: > > > You are absolutely right, I totally forgot about the cache_lock. > > I have listed our settings below. > > > > The reason we are using the cache_lock is to save the backend > > application to not get 100's of requests when a stale item is > > invalid. Even if we have use_stale updating, we notice that only > > the first request will use the stale item, the following > > requests will do a new request even though there is already a > > background request going on to refresh the stale item. (This > > does not happen if we set keepalive to 0, where new connections > > are being used, but has the performance degradation as > > mentioned.) This was the reasoning for the cache_lock, but that > > gives the issue about the 500ms lock, while the item might > > already be refreshed after 100ms. > > To re-iterate: proxy_cache_lock is not expected to affect requests > if there is an existing cache item (and keepalive shouldn't affect > proxy_cache_lock in any way; not to mention that the "keepalive" > directive, which configures keepalive connections cache to > upstream servers, does not accept the "0" value). > > You may want to dig further into what actually happens in your > configuration. I would recommend to start with doing a debug log > which shows the described behaviour, and then following the code > to find out why the cache lock kicks in when it shouldn't. > > -- > Maxim Dounin > http://mdounin.ru/ > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > https://mailman.nginx.org/mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From roy at teeuwen.be Mon Mar 27 06:59:02 2023 From: roy at teeuwen.be (Roy Teeuwen) Date: Mon, 27 Mar 2023 08:59:02 +0200 Subject: Configurable sleep period for connections In-Reply-To: References: <40c63798-3ab7-472b-bf85-ef154b4fc9b3@Spark>

Message-ID: <6EA0B072-953A-4097-9402-162D62DC7E64@teeuwen.be> I'm going to try to and create an integration test for it so that I can show the setup doing the unexpected 500ms locking for stale+1 requests. I can then set the debug level and if I can't figure it out I will post back here with the integration tests. The reason I posted on the devel list was because I wanted to adjusted the 500ms lock / sleep period to be configurable, but seeing as I made the wrong assumption it turned into a user discussion, sorry! Greets, Roy > On 27 Mar 2023, at 02:25, u5h wrote: > > Hi, I had a same issue in those days. > Did you try the proxy_cache_lock_timeout? > > https://forum.nginx.org/read.php?2,276344,276349#msg-276349 > > But the below article said if you reduce simply the once busy loop time, it may not resolve this problem for which based on the nginx event notification mechanism in case it has many concurrently same content request. > > https://blog.lumen.com/pulling-back-the-curtain-development-and-testing-for-low-latency-dash-support/ > > By the way, we might have been better to use nginx at mailing such a user level discussion. > > — > Yugo Horie > > On Fri, Mar 24, 2023 at 19:18 Maxim Dounin > wrote: >> Hello! >> >> On Fri, Mar 24, 2023 at 09:24:25AM +0100, Roy Teeuwen wrote: >> >> > You are absolutely right, I totally forgot about the cache_lock. >> > I have listed our settings below. >> > >> > The reason we are using the cache_lock is to save the backend >> > application to not get 100's of requests when a stale item is >> > invalid. Even if we have use_stale updating, we notice that only >> > the first request will use the stale item, the following >> > requests will do a new request even though there is already a >> > background request going on to refresh the stale item. (This >> > does not happen if we set keepalive to 0, where new connections >> > are being used, but has the performance degradation as >> > mentioned.) This was the reasoning for the cache_lock, but that >> > gives the issue about the 500ms lock, while the item might >> > already be refreshed after 100ms. >> >> To re-iterate: proxy_cache_lock is not expected to affect requests >> if there is an existing cache item (and keepalive shouldn't affect >> proxy_cache_lock in any way; not to mention that the "keepalive" >> directive, which configures keepalive connections cache to >> upstream servers, does not accept the "0" value). >> >> You may want to dig further into what actually happens in your >> configuration. I would recommend to start with doing a debug log >> which shows the described behaviour, and then following the code >> to find out why the cache lock kicks in when it shouldn't. >> >> -- >> Maxim Dounin >> http://mdounin.ru/ >> _______________________________________________ >> nginx-devel mailing list >> nginx-devel at nginx.org >> https://mailman.nginx.org/mailman/listinfo/nginx-devel > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > https://mailman.nginx.org/mailman/listinfo/nginx-devel -------------- next part -------------- An HTML attachment was scrubbed... URL: From Michael.Kourlas at solace.com Mon Mar 27 16:19:27 2023 From: Michael.Kourlas at solace.com (Michael Kourlas) Date: Mon, 27 Mar 2023 16:19:27 +0000 Subject: [PATCH] HTTP: Add new uri_normalization_percent_decode option Message-ID: Hello, Thanks for your comments! Sorry for the delay in responding -- I was on vacation. > As far as I understand, it will irreversibly corrupt URIs with > double-encoded reserved characters. For example, "%252F" will > become "%2F" when proxying in the following configuration: > > location /foo/ { > proxy_pass http://upstream/foo/; > } I believe you are correct. When the "all-except-reserved" option is used, nginx will not recognize, during the re-encoding step, that the "%" in "%2F" was originally percent-encoded and not part of a percent-encoded "/". However, I think this issue can be addressed by renaming "all-except-reserved" to "all-except-percent-and-reserved" and adding "%" to the corresponding set of characters that is not decoded or encoded automatically when that option is used. "%252F" will then be left untouched throughout the entire process. > Further, requests to static files with (properly escaped) reserved > characters will simply fail, because nginx won't decode these > characters. For example, in the following trivial configuration a > request to "/foo%3Fbar" won't be decoded to match "/foo?bar" file > under the document root: > > location / { > # static files > } Yes, I agree it doesn't make sense to keep "%" and reserved characters percent-encoded when performing a filesystem lookup, because at that point we can be certain they're not being used as delimiters or anything other than data. However, I think this issue can be addressed by decoding any remaining percent-encoded characters at the point of filesystem lookup, as well as any other place where you think it is appropriate. (Of course, this should only be done when using the "all-except-percent-and-reserved" option, and only with "%" and reserved characters, to avoid double-decoding double-encoded characters.) > Please also note that the configuration directive you've > introduced in this patch applies to URI parsing from not-yet-final > server block (see [1] for details), but the configuration from the > final server block will be used for URI escaping. These > configuration can be different, and this might result in various > additional issues. I think this issue can be addressed by making the new directive available only in http blocks. This ensures that all virtual servers share the same configuration. If you agree with these suggestions, I'd be happy to submit an updated patch. Reserved characters are often used as delimiters in APIs, and I believe it is important that nginx be able to distinguish between usages as delimiters and usages as data. Thanks, Michael Kourlas ________________________________ Confidentiality notice This e-mail message and any attachment hereto contain confidential information which may be privileged and which is intended for the exclusive use of its addressee(s). If you receive this message in error, please inform sender immediately and destroy any copy thereof. Furthermore, any disclosure, distribution or copying of this message and/or any attachment hereto without the consent of the sender is strictly prohibited. Thank you. From pluknet at nginx.com Mon Mar 27 19:35:13 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Mon, 27 Mar 2023 19:35:13 +0000 Subject: [nginx] Gzip: compatibility with recent zlib-ng versions. Message-ID: details: https://hg.nginx.org/nginx/rev/fcb2333c9982 branches: changeset: 8153:fcb2333c9982 user: Maxim Dounin date: Mon Mar 27 21:25:05 2023 +0300 description: Gzip: compatibility with recent zlib-ng versions. It now uses custom alloc_aligned() wrapper for all allocations, therefore all allocations are larger than expected by (64 + sizeof(void*)). Further, they are seen as allocations of 1 element. Relevant calculations were adjusted to reflect this, and state allocation is now protected with a flag to avoid misinterpreting other allocations as the zlib deflate_state allocation. Further, it no longer forces window bits to 13 on compression level 1, so the comment was adjusted to reflect this. diffstat: src/http/modules/ngx_http_gzip_filter_module.c | 18 ++++++++++++------ 1 files changed, 12 insertions(+), 6 deletions(-) diffs (54 lines): diff -r d1cf09451ae8 -r fcb2333c9982 src/http/modules/ngx_http_gzip_filter_module.c --- a/src/http/modules/ngx_http_gzip_filter_module.c Fri Mar 24 02:57:43 2023 +0300 +++ b/src/http/modules/ngx_http_gzip_filter_module.c Mon Mar 27 21:25:05 2023 +0300 @@ -57,6 +57,7 @@ typedef struct { unsigned nomem:1; unsigned buffering:1; unsigned zlib_ng:1; + unsigned state_allocated:1; size_t zin; size_t zout; @@ -514,9 +515,10 @@ ngx_http_gzip_filter_memory(ngx_http_req } else { /* * Another zlib variant, https://github.com/zlib-ng/zlib-ng. - * It forces window bits to 13 for fast compression level, - * uses 16-byte padding in one of window-sized buffers, and - * uses 128K hash. + * It used to force window bits to 13 for fast compression level, + * uses (64 + sizeof(void*)) additional space on all allocations + * for alignment, 16-byte padding in one of window-sized buffers, + * and 128K hash. */ if (conf->level == 1) { @@ -524,7 +526,8 @@ ngx_http_gzip_filter_memory(ngx_http_req } ctx->allocated = 8192 + 16 + (1 << (wbits + 2)) - + 131072 + (1 << (memlevel + 8)); + + 131072 + (1 << (memlevel + 8)) + + 4 * (64 + sizeof(void*)); ctx->zlib_ng = 1; } } @@ -926,13 +929,16 @@ ngx_http_gzip_filter_alloc(void *opaque, alloc = items * size; - if (items == 1 && alloc % 512 != 0 && alloc < 8192) { - + if (items == 1 && alloc % 512 != 0 && alloc < 8192 + && !ctx->state_allocated) + { /* * The zlib deflate_state allocation, it takes about 6K, * we allocate 8K. Other allocations are divisible by 512. */ + ctx->state_allocated = 1; + alloc = 8192; } From thresh at nginx.com Mon Mar 27 23:27:14 2023 From: thresh at nginx.com (=?iso-8859-1?q?Konstantin_Pavlov?=) Date: Mon, 27 Mar 2023 16:27:14 -0700 Subject: [PATCH] Linux packages: specified priority for Amazon Linux Message-ID: <9741a500247ec50eaf5a.1679959634@QGCD7XG9R9> # HG changeset patch # User Konstantin Pavlov # Date 1679959544 25200 # Mon Mar 27 16:25:44 2023 -0700 # Node ID 9741a500247ec50eaf5a4043a270fc097e0345c1 # Parent 23d3cabaab95fb09ea40f113759f4eaed99ec9d7 Linux packages: specified priority for Amazon Linux. This makes nginx.org repositories preferred when installing nginx packages. Currently, both Amazon Linux 2 and 2023 repositories have a priority of 10, so any number lower than that makes our packages preferred. diff -r 23d3cabaab95 -r 9741a500247e xml/en/linux_packages.xml --- a/xml/en/linux_packages.xml Mon Mar 20 11:20:57 2023 -0700 +++ b/xml/en/linux_packages.xml Mon Mar 27 16:25:44 2023 -0700 @@ -7,7 +7,7 @@

+ rev="84">

@@ -548,6 +548,7 @@ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 [nginx-mainline] name=nginx mainline repo @@ -556,6 +557,7 @@ gpgcheck=1 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 To set up the yum repository for Amazon Linux 2023, create the file named @@ -570,6 +572,7 @@ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 [nginx-mainline] name=nginx mainline repo @@ -578,6 +581,7 @@ gpgcheck=1 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 By default, the repository for stable nginx packages is used. diff -r 23d3cabaab95 -r 9741a500247e xml/ru/linux_packages.xml --- a/xml/ru/linux_packages.xml Mon Mar 20 11:20:57 2023 -0700 +++ b/xml/ru/linux_packages.xml Mon Mar 27 16:25:44 2023 -0700 @@ -7,7 +7,7 @@

+ rev="84">

@@ -545,6 +545,7 @@ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 [nginx-mainline] name=nginx mainline repo @@ -553,6 +554,7 @@ gpgcheck=1 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 Для подключения yum-репозитория для Amazon Linux 2023 создайте файл с именем @@ -567,6 +569,7 @@ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 [nginx-mainline] name=nginx mainline repo @@ -575,6 +578,7 @@ gpgcheck=1 enabled=0 gpgkey=https://nginx.org/keys/nginx_signing.key module_hotfixes=true +priority=9 По умолчанию используется репозиторий для стабильной версии nginx. From arut at nginx.com Tue Mar 28 13:36:47 2023 From: arut at nginx.com (=?iso-8859-1?q?Roman_Arutyunyan?=) Date: Tue, 28 Mar 2023 17:36:47 +0400 Subject: [PATCH] QUIC: style Message-ID: <24daeb3703817af6fc17.1680010607@arut-laptop> # HG changeset patch # User Roman Arutyunyan # Date 1678895835 -14400 # Wed Mar 15 19:57:15 2023 +0400 # Branch quic # Node ID 24daeb3703817af6fc17d7281fa06c7dc1c4f0a5 # Parent 13d43a278510f131101c7b19d87455a0171ebe2f QUIC: style. diff --git a/src/event/quic/ngx_event_quic_transport.c b/src/event/quic/ngx_event_quic_transport.c --- a/src/event/quic/ngx_event_quic_transport.c +++ b/src/event/quic/ngx_event_quic_transport.c @@ -576,7 +576,7 @@ ngx_quic_payload_size(ngx_quic_header_t { size_t len; - if ngx_quic_short_pkt(pkt->flags) { + if (ngx_quic_short_pkt(pkt->flags)) { len = 1 + pkt->dcid.len + pkt->num_len + EVP_GCM_TLS_TAG_LEN; if (len > pkt_len) { From pluknet at nginx.com Tue Mar 28 13:48:39 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Tue, 28 Mar 2023 17:48:39 +0400 Subject: [PATCH] QUIC: style In-Reply-To: <24daeb3703817af6fc17.1680010607@arut-laptop> References: <24daeb3703817af6fc17.1680010607@arut-laptop> Message-ID: <156C34A2-8192-40CD-8F99-938A1A954A9C@nginx.com> > On 28 Mar 2023, at 17:36, Roman Arutyunyan wrote: > > # HG changeset patch > # User Roman Arutyunyan > # Date 1678895835 -14400 > # Wed Mar 15 19:57:15 2023 +0400 > # Branch quic > # Node ID 24daeb3703817af6fc17d7281fa06c7dc1c4f0a5 > # Parent 13d43a278510f131101c7b19d87455a0171ebe2f > QUIC: style. > > diff --git a/src/event/quic/ngx_event_quic_transport.c b/src/event/quic/ngx_event_quic_transport.c > --- a/src/event/quic/ngx_event_quic_transport.c > +++ b/src/event/quic/ngx_event_quic_transport.c > @@ -576,7 +576,7 @@ ngx_quic_payload_size(ngx_quic_header_t > { > size_t len; > > - if ngx_quic_short_pkt(pkt->flags) { > + if (ngx_quic_short_pkt(pkt->flags)) { > > len = 1 + pkt->dcid.len + pkt->num_len + EVP_GCM_TLS_TAG_LEN; > if (len > pkt_len) { Looks good. -- Sergey Kandaurov From mdounin at mdounin.ru Tue Mar 28 14:08:52 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 28 Mar 2023 17:08:52 +0300 Subject: [PATCH] HTTP: Add new uri_normalization_percent_decode option In-Reply-To: References: Message-ID: Hello! On Mon, Mar 27, 2023 at 04:19:27PM +0000, Michael Kourlas via nginx-devel wrote: > > As far as I understand, it will irreversibly corrupt URIs with > > double-encoded reserved characters. For example, "%252F" will > > become "%2F" when proxying in the following configuration: > > > > location /foo/ { > > proxy_pass http://upstream/foo/; > > } > > I believe you are correct. When the "all-except-reserved" option is used, nginx > will not recognize, during the re-encoding step, that the "%" in "%2F" was > originally percent-encoded and not part of a percent-encoded "/". > > However, I think this issue can be addressed by renaming "all-except-reserved" > to "all-except-percent-and-reserved" and adding "%" to the corresponding set of > characters that is not decoded or encoded automatically when that option is > used. "%252F" will then be left untouched throughout the entire process. So it will prevent access to the files with "%", such as in "foo%bar", unless specifically handled (see below). > > Further, requests to static files with (properly escaped) reserved > > characters will simply fail, because nginx won't decode these > > characters. For example, in the following trivial configuration a > > request to "/foo%3Fbar" won't be decoded to match "/foo?bar" file > > under the document root: > > > > location / { > > # static files > > } > > Yes, I agree it doesn't make sense to keep "%" and reserved characters > percent-encoded when performing a filesystem lookup, because at that point we > can be certain they're not being used as delimiters or anything other than > data. > > However, I think this issue can be addressed by decoding any remaining > percent-encoded characters at the point of filesystem lookup, as well as any > other place where you think it is appropriate. (Of course, this should only be > done when using the "all-except-percent-and-reserved" option, and only with "%" > and reserved characters, to avoid double-decoding double-encoded characters.) This implies, basically, that there are 3 forms of the request URI: 1) fully encoded, as in $request_uri, 2) fully decoded, as in $uri now, and 3) "all-except-percent-and-reserved". To implement this correctly, it needs clear definition when each form is used, and it is going to be a non-trivial task to do this safely. For example, using fully decoded form for file system lookups while using "all-except-percent-and-reserved" form for location matching is going to be unsafe: restrictions like "location /private/ { deny all; }" can be easily bypassed. The same issue applies to other cases not involving file system access directly in nginx: for example, consider $fastcgi_script_name in FastCGI proxying. > > Please also note that the configuration directive you've > > introduced in this patch applies to URI parsing from not-yet-final > > server block (see [1] for details), but the configuration from the > > final server block will be used for URI escaping. These > > configuration can be different, and this might result in various > > additional issues. > > I think this issue can be addressed by making the new directive available only > in http blocks. This ensures that all virtual servers share the same > configuration. This approach basically precludes using different settings in different server blocks, even completely independent, such as IP-based virtual servers, and is not generally the way to go. Instead, this should be implemented correctly, if at all. > If you agree with these suggestions, I'd be happy to submit an updated patch. > > Reserved characters are often used as delimiters in APIs, and I believe it is > important that nginx be able to distinguish between usages as delimiters and > usages as data. First of all, you may want to focus on the logic you are going to implement. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Tue Mar 28 14:14:46 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 28 Mar 2023 17:14:46 +0300 Subject: nginx 1.23.4 changes draft Message-ID: Hello! Changes with nginx 1.23.4 28 Mar 2023 *) Change: now TLSv1.3 protocol is enabled by default. *) Change: now nginx issues a warning if protocol parameters of a listening socket are redefined. *) Change: now nginx closes connections with lingering if pipelining was used by the client. *) Feature: byte ranges support in the ngx_http_gzip_static_module. *) Bugfix: port ranges in the "listen" directive did not work; the bug had appeared in 1.23.3. Thanks to Valentin Bartenev. *) Bugfix: incorrect location might be chosen to process a request if a prefix location longer than 255 characters was used in the configuration. *) Bugfix: non-ASCII characters in file names on Windows were not supported by the ngx_http_autoindex_module, the ngx_http_dav_module, and the "include" directive. *) Change: the logging level of the "data length too long", "length too short", "bad legacy version", "no shared signature algorithms", "bad digest length", "missing sigalgs extension", "encrypted length too long", "bad length", "bad key update", "mixed handshake and non handshake data", "ccs received early", "data between ccs and finished", "packet length too long", "too many warn alerts", "record too small", and "got a fin before a ccs" SSL errors has been lowered from "crit" to "info". *) Bugfix: a socket leak might occur when using HTTP/2 and the "error_page" directive to redirect errors with code 400. *) Bugfix: messages about logging to syslog errors did not contain information that the errors happened while logging to syslog. Thanks to Safar Safarly. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: in the mail proxy server. Изменения в nginx 1.23.4 28.03.2023 *) Изменение: теперь протокол TLSv1.3 разрешён по умолчанию. *) Изменение: теперь nginx выдаёт предупреждение при переопределении параметров listen-сокета, задающих используемые протоколы. *) Изменение: теперь, если клиент использует pipelining, nginx закрывает соединения с ожиданием дополнительных данных (lingering close). *) Добавление: поддержка byte ranges для ответов модуля ngx_http_gzip_static_module. *) Исправление: диапазоны портов в директиве listen не работали; ошибка появилась в nginx 1.23.3. Спасибо Валентину Бартеневу. *) Исправление: для обработки запроса мог быть выбран неверный location, если в конфигурации использовался префиксный location длиннее 255 символов. *) Исправление: не-ASCII символы в именах файлов на Windows не поддерживались модулями ngx_http_autoindex_module и ngx_http_dav_module, а также директивой include. *) Изменение: уровень логгирования ошибок SSL "data length too long", "length too short", "bad legacy version", "no shared signature algorithms", "bad digest length", "missing sigalgs extension", "encrypted length too long", "bad length", "bad key update", "mixed handshake and non handshake data", "ccs received early", "data between ccs and finished", "packet length too long", "too many warn alerts", "record too small", и "got a fin before a ccs" понижен с уровня crit до info. *) Исправление: при использовании HTTP/2 и директивы error_page для перенаправления ошибок с кодом 400 могла происходить утечка сокетов. *) Исправление: сообщения об ошибках записи в syslog не содержали информации о том, ошибки происходили в процессе записи в syslog. Спасибо Safar Safarly. *) Изменение: при использовании zlib-ng в логах появлялись сообщения "gzip filter failed to use preallocated memory". *) Исправление: в почтовом прокси-сервере. -- Maxim Dounin http://mdounin.ru/ From yar at nginx.com Tue Mar 28 14:37:31 2023 From: yar at nginx.com (Yaroslav Zhuravlev) Date: Tue, 28 Mar 2023 15:37:31 +0100 Subject: [PATCH] Added TLSv1.3 to the default value of ssl_protocols and friends In-Reply-To: References: <477d0fe1e6cb95533ffb.1679383149@ORK-ML-00007151> Message-ID: <23389F73-D1F7-4042-A2F4-B4E1AB47143E@nginx.com> > On 24 Mar 2023, at 15:30, Maxim Konovalov wrote: > > Hi Yar, > > On 21.03.2023 00:19, Yaroslav Zhuravlev wrote: >> diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml >> --- a/xml/en/docs/http/ngx_http_grpc_module.xml >> +++ b/xml/en/docs/http/ngx_http_grpc_module.xml > [...] >> @@ -633,7 +633,7 @@ >> [TLSv1.1] >> [TLSv1.2] >> [TLSv1.3] >> -TLSv1 TLSv1.1 TLSv1.2 >> +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 >> http >> server >> location > > It makes sense to add a history note here and in other modules that have ssl_protocol directive. [...] Hi Maxim, Thank you for the feedback, the patch was accordingly updated: # HG changeset patch # User Yaroslav Zhuravlev # Date 1678486627 0 # Fri Mar 10 22:17:07 2023 +0000 # Node ID 6096d51ff4d2abecc67b47bc09cfbf03be69f7b0 # Parent ac7518a1fe1c74daba708e30405a9b5d33f606e1 Added TLSv1.3 to the default value of ssl_protocols and friends. diff --git a/xml/en/docs/http/configuring_https_servers.xml b/xml/en/docs/http/configuring_https_servers.xml --- a/xml/en/docs/http/configuring_https_servers.xml +++ b/xml/en/docs/http/configuring_https_servers.xml @@ -8,7 +8,7 @@

@@ -31,7 +31,7 @@ server_name www.example.com; ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ... } @@ -59,7 +59,7 @@ can be used to limit connections to include only the strong versions and ciphers of SSL/TLS. By default nginx uses -“ssl_protocols TLSv1 TLSv1.1 TLSv1.2” +“ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3” and “ssl_ciphers HIGH:!aNULL:!MD5”, so configuring them explicitly is generally not needed. Note that default values of these directives were @@ -110,7 +110,7 @@ ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ... @@ -446,6 +446,11 @@ +Version 1.23.4 and later: the default SSL protocols are TLSv1, +TLSv1.1, TLSv1.2, and TLSv1.3 (if supported by the OpenSSL library). + + + Version 1.9.1 and later: the default SSL protocols are TLSv1, TLSv1.1, and TLSv1.2 (if supported by the OpenSSL library). diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml --- a/xml/en/docs/http/ngx_http_grpc_module.xml +++ b/xml/en/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="9">

@@ -633,7 +633,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -642,6 +642,13 @@ Enables the specified protocols for requests to a gRPC SSL server. + + +The TLSv1.3 parameter is used by default +since 1.23.4. + + + diff --git a/xml/en/docs/http/ngx_http_proxy_module.xml b/xml/en/docs/http/ngx_http_proxy_module.xml --- a/xml/en/docs/http/ngx_http_proxy_module.xml +++ b/xml/en/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="76">

@@ -2096,7 +2096,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -2106,6 +2106,13 @@ Enables the specified protocols for requests to a proxied HTTPS server. + + +The TLSv1.3 parameter is used by default +since 1.23.4. + + + diff --git a/xml/en/docs/http/ngx_http_ssl_module.xml b/xml/en/docs/http/ngx_http_ssl_module.xml --- a/xml/en/docs/http/ngx_http_ssl_module.xml +++ b/xml/en/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="60">

@@ -76,7 +76,7 @@ listen 443 ssl; keepalive_timeout 70; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ssl_certificate_key /usr/local/nginx/conf/cert.key; @@ -595,7 +595,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server @@ -609,6 +609,10 @@ The TLSv1.3 parameter (1.13.0) works only when OpenSSL 1.1.1 or higher is used. + +The TLSv1.3 parameter is used by default +since 1.23.4. + diff --git a/xml/en/docs/http/ngx_http_uwsgi_module.xml b/xml/en/docs/http/ngx_http_uwsgi_module.xml --- a/xml/en/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/en/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="50">

@@ -1546,7 +1546,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -1556,6 +1556,13 @@ Enables the specified protocols for requests to a secured uwsgi server. + + +The TLSv1.3 parameter is used by default +since 1.23.4. + + + diff --git a/xml/en/docs/mail/ngx_mail_ssl_module.xml b/xml/en/docs/mail/ngx_mail_ssl_module.xml --- a/xml/en/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/en/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="27">

@@ -69,7 +69,7 @@ server { listen 993 ssl; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ssl_certificate_key /usr/local/nginx/conf/cert.key; @@ -420,7 +420,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 mail server @@ -434,6 +434,10 @@ The TLSv1.3 parameter (1.13.0) works only when OpenSSL 1.1.1 or higher is used. + +The TLSv1.3 parameter is used by default +since 1.23.4. + diff --git a/xml/en/docs/stream/ngx_stream_proxy_module.xml b/xml/en/docs/stream/ngx_stream_proxy_module.xml --- a/xml/en/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/en/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="32">

@@ -543,7 +543,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 stream server @@ -551,6 +551,13 @@ Enables the specified protocols for connections to a proxied server. + + +The TLSv1.3 parameter is used by default +since 1.23.4. + + + diff --git a/xml/en/docs/stream/ngx_stream_ssl_module.xml b/xml/en/docs/stream/ngx_stream_ssl_module.xml --- a/xml/en/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/en/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="32">

@@ -30,7 +30,7 @@ server_name www.example.com; ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ... } @@ -58,7 +58,7 @@ можно ограничить соединения использованием только “сильных” версий и шифров SSL/TLS. По умолчанию nginx использует -“ssl_protocols TLSv1 TLSv1.1 TLSv1.2” и +“ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3” и “ssl_ciphers HIGH:!aNULL:!MD5”, поэтому их явная настройка в общем случае не требуется. Следует отметить, что значения по умолчанию этих директив несколько раз @@ -108,7 +108,7 @@ ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ... @@ -445,6 +445,11 @@ +Версия 1.23.4 и более поздние: протоколами SSL по умолчанию являются +TLSv1, TLSv1.1, TLSv1.2 и TLSv1.3 (если поддерживается библиотекой OpenSSL). + + + Версия 1.9.1 и более поздние: протоколами SSL по умолчанию являются TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL). diff --git a/xml/ru/docs/http/ngx_http_grpc_module.xml b/xml/ru/docs/http/ngx_http_grpc_module.xml --- a/xml/ru/docs/http/ngx_http_grpc_module.xml +++ b/xml/ru/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="9">

@@ -632,7 +632,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -641,6 +641,13 @@ Разрешает указанные протоколы для запросов к gRPC SSL-серверу. + + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + + + diff --git a/xml/ru/docs/http/ngx_http_proxy_module.xml b/xml/ru/docs/http/ngx_http_proxy_module.xml --- a/xml/ru/docs/http/ngx_http_proxy_module.xml +++ b/xml/ru/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="76">

@@ -2098,7 +2098,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -2108,6 +2108,13 @@ Разрешает указанные протоколы для запросов к проксируемому HTTPS-серверу. + + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + + + diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml --- a/xml/ru/docs/http/ngx_http_ssl_module.xml +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="60">

@@ -76,7 +76,7 @@ listen 443 ssl; keepalive_timeout 70; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ssl_certificate_key /usr/local/nginx/conf/cert.key; @@ -600,7 +600,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server @@ -614,6 +614,10 @@ Параметр TLSv1.3 (1.13.0) работает только при использовании OpenSSL 1.1.1 и выше. + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + diff --git a/xml/ru/docs/http/ngx_http_uwsgi_module.xml b/xml/ru/docs/http/ngx_http_uwsgi_module.xml --- a/xml/ru/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/ru/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="50">

@@ -1542,7 +1542,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 http server location @@ -1552,6 +1552,13 @@ Разрешает указанные протоколы для запросов к suwsgi-серверу. + + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + + + diff --git a/xml/ru/docs/mail/ngx_mail_ssl_module.xml b/xml/ru/docs/mail/ngx_mail_ssl_module.xml --- a/xml/ru/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/ru/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="27">

@@ -69,7 +69,7 @@ server { listen 993 ssl; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ssl_certificate_key /usr/local/nginx/conf/cert.key; @@ -422,7 +422,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 mail server @@ -436,6 +436,10 @@ Параметр TLSv1.3 (1.13.0) работает только при использовании OpenSSL 1.1.1 и выше. + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + diff --git a/xml/ru/docs/stream/ngx_stream_proxy_module.xml b/xml/ru/docs/stream/ngx_stream_proxy_module.xml --- a/xml/ru/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/ru/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="32">

@@ -543,7 +543,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 stream server @@ -551,6 +551,13 @@ Разрешает указанные протоколы для соединений с проксируемым сервером. + + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + + + diff --git a/xml/ru/docs/stream/ngx_stream_ssl_module.xml b/xml/ru/docs/stream/ngx_stream_ssl_module.xml --- a/xml/ru/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/ru/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="32">

@@ -62,7 +62,7 @@ server { listen 12345 ssl; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ssl_certificate /usr/local/nginx/conf/cert.pem; ssl_certificate_key /usr/local/nginx/conf/cert.key; @@ -447,7 +447,7 @@ [TLSv1.1] [TLSv1.2] [TLSv1.3] -TLSv1 TLSv1.1 TLSv1.2 +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 stream server @@ -461,6 +461,10 @@ Параметр TLSv1.3 (1.13.0) работает только при использовании OpenSSL 1.1.1 и выше. + +Параметр TLSv1.3 используется по умолчанию +начиная с 1.23.4. + From pluknet at nginx.com Tue Mar 28 14:39:41 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Tue, 28 Mar 2023 18:39:41 +0400 Subject: nginx 1.23.4 changes draft In-Reply-To: References: Message-ID: <86F4BD59-693D-4810-9694-B671A99E2C28@nginx.com> > On 28 Mar 2023, at 18:14, Maxim Dounin wrote: > > Hello! > > Changes with nginx 1.23.4 28 Mar 2023 > > *) Change: now TLSv1.3 protocol is enabled by default. > > *) Change: now nginx issues a warning if protocol parameters of a > listening socket are redefined. > > *) Change: now nginx closes connections with lingering if pipelining was > used by the client. > > *) Feature: byte ranges support in the ngx_http_gzip_static_module. > > *) Bugfix: port ranges in the "listen" directive did not work; the bug > had appeared in 1.23.3. > Thanks to Valentin Bartenev. > > *) Bugfix: incorrect location might be chosen to process a request if a > prefix location longer than 255 characters was used in the > configuration. > > *) Bugfix: non-ASCII characters in file names on Windows were not > supported by the ngx_http_autoindex_module, the ngx_http_dav_module, > and the "include" directive. > > *) Change: the logging level of the "data length too long", "length too > short", "bad legacy version", "no shared signature algorithms", "bad > digest length", "missing sigalgs extension", "encrypted length too > long", "bad length", "bad key update", "mixed handshake and non > handshake data", "ccs received early", "data between ccs and > finished", "packet length too long", "too many warn alerts", "record > too small", and "got a fin before a ccs" SSL errors has been lowered > from "crit" to "info". > > *) Bugfix: a socket leak might occur when using HTTP/2 and the > "error_page" directive to redirect errors with code 400. > > *) Bugfix: messages about logging to syslog errors did not contain > information that the errors happened while logging to syslog. > Thanks to Safar Safarly. > > *) Workaround: "gzip filter failed to use preallocated memory" alerts > appeared in logs when using zlib-ng. > > *) Bugfix: in the mail proxy server. > > > Изменения в nginx 1.23.4 28.03.2023 > > *) Изменение: теперь протокол TLSv1.3 разрешён по умолчанию. > > *) Изменение: теперь nginx выдаёт предупреждение при переопределении > параметров listen-сокета, задающих используемые протоколы. > > *) Изменение: теперь, если клиент использует pipelining, nginx закрывает > соединения с ожиданием дополнительных данных (lingering close). > > *) Добавление: поддержка byte ranges для ответов модуля > ngx_http_gzip_static_module. > > *) Исправление: диапазоны портов в директиве listen не работали; ошибка > появилась в nginx 1.23.3. "nginx" is usually omitted here (per changes grep) > Спасибо Валентину Бартеневу. > > *) Исправление: для обработки запроса мог быть выбран неверный location, > если в конфигурации использовался префиксный location длиннее 255 > символов. > > *) Исправление: не-ASCII символы в именах файлов на Windows не > поддерживались модулями ngx_http_autoindex_module и > ngx_http_dav_module, а также директивой include. > > *) Изменение: уровень логгирования ошибок SSL "data length too long", > "length too short", "bad legacy version", "no shared signature > algorithms", "bad digest length", "missing sigalgs extension", > "encrypted length too long", "bad length", "bad key update", "mixed > handshake and non handshake data", "ccs received early", "data > between ccs and finished", "packet length too long", "too many warn > alerts", "record too small", и "got a fin before a ccs" понижен с > уровня crit до info. > > *) Исправление: при использовании HTTP/2 и директивы error_page для > перенаправления ошибок с кодом 400 могла происходить утечка сокетов. > > *) Исправление: сообщения об ошибках записи в syslog не содержали > информации о том, ошибки происходили в процессе записи в syslog. "о том, что" > Спасибо Safar Safarly. > > *) Изменение: при использовании zlib-ng в логах появлялись сообщения > "gzip filter failed to use preallocated memory". > > *) Исправление: в почтовом прокси-сервере. > Otherwise, looks good. -- Sergey Kandaurov From arut at nginx.com Tue Mar 28 14:51:37 2023 From: arut at nginx.com (=?iso-8859-1?q?Roman_Arutyunyan?=) Date: Tue, 28 Mar 2023 18:51:37 +0400 Subject: [PATCH 0 of 3] QUIC path MTU discovery Message-ID: This implementation does not rely on ICMP PTB messages. Instead, QUIC packet acknowledgement is used to make sure the MTU is suppored by the path ([1], [2]). A lost packet, as detected by QUIC, indicates the MTU is too big. Existing QUIC implementations use different approaches to size selection while probing MTU. Options are: - hardcoded MTU values array - linear search - binary search A review of size search methods is available in [3]. The algorithm implemented first tries local MTU, followed by a binary search in case the local MTU was too big. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-datagram-packetization-laye [2] https://datatracker.ietf.org/doc/html/rfc8899 [3] https://www.youtube.com/watch?v=5kIe3pbK84A From arut at nginx.com Tue Mar 28 14:51:38 2023 From: arut at nginx.com (=?iso-8859-1?q?Roman_Arutyunyan?=) Date: Tue, 28 Mar 2023 18:51:38 +0400 Subject: [PATCH 1 of 3] QUIC: changed path validation timeout In-Reply-To: References: Message-ID: # HG changeset patch # User Roman Arutyunyan # Date 1679925333 -14400 # Mon Mar 27 17:55:33 2023 +0400 # Branch quic # Node ID f76e83412133085a6c82fce2c3e15b2c34a6e959 # Parent 5fd628b89bb7fb5c95afa1dc914385f7ab79f6a3 QUIC: changed path validation timeout. Path validation packets containing PATH_CHALLENGE frames are sent separately from regular frame queue, because of the need to use a decicated path and pad the packets. The packets are also resent separately from the regular probe/lost detection mechanism. A path validation packet is resent 3 times, each time after PTO expiration. Assuming constant PTO, the overall maximum waiting time is 3 * PTO. According to RFC 9000, 8.2.4. Failed Path Validation, the following value is recommended as a validation timeout: A value of three times the larger of the current PTO or the PTO for the new path (using kInitialRtt, as defined in [QUIC-RECOVERY]) is RECOMMENDED. The change adds PTO of the new path to the equation as the lower bound. Also, max_ack_delay is now always accounted for, unlike previously, when it was only used when there are packets in flight. As mentioned before, PACH_CHALLENGE is not considered in-flight by nginx since it's processed separately, but technically it is. diff --git a/src/event/quic/ngx_event_quic_migration.c b/src/event/quic/ngx_event_quic_migration.c --- a/src/event/quic/ngx_event_quic_migration.c +++ b/src/event/quic/ngx_event_quic_migration.c @@ -14,6 +14,7 @@ static void ngx_quic_set_connection_path ngx_quic_path_t *path); static ngx_int_t ngx_quic_validate_path(ngx_connection_t *c, ngx_quic_path_t *path); +static ngx_msec_t ngx_quic_path_pto(ngx_connection_t *c); static ngx_int_t ngx_quic_send_path_challenge(ngx_connection_t *c, ngx_quic_path_t *path); static ngx_quic_path_t *ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag); @@ -487,7 +488,6 @@ static ngx_int_t ngx_quic_validate_path(ngx_connection_t *c, ngx_quic_path_t *path) { ngx_msec_t pto; - ngx_quic_send_ctx_t *ctx; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); @@ -509,8 +509,7 @@ ngx_quic_validate_path(ngx_connection_t return NGX_ERROR; } - ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application); - pto = ngx_quic_pto(c, ctx); + pto = ngx_quic_path_pto(c); path->expires = ngx_current_msec + pto; path->tries = NGX_QUIC_PATH_RETRIES; @@ -523,6 +522,33 @@ ngx_quic_validate_path(ngx_connection_t } +static ngx_msec_t +ngx_quic_path_pto(ngx_connection_t *c) +{ + + ngx_msec_t duration; + ngx_quic_connection_t *qc; + + /* + * RFC 9000, 8.2.4. Failed Path Validation + * + * A value of three times the larger of the current PTO + * or the PTO for the new path (using kInitialRtt, as defined + * in [QUIC-RECOVERY]) is RECOMMENDED. + */ + + qc = ngx_quic_get_connection(c); + + duration = qc->avg_rtt + 4 * qc->rttvar; + + if (duration < 1000) { + duration = 1000; + } + + return duration + qc->ctp.max_ack_delay; +} + + static ngx_int_t ngx_quic_send_path_challenge(ngx_connection_t *c, ngx_quic_path_t *path) { @@ -571,14 +597,12 @@ ngx_quic_path_validation_handler(ngx_eve ngx_msec_int_t left, next, pto; ngx_quic_path_t *path, *bkp; ngx_connection_t *c; - ngx_quic_send_ctx_t *ctx; ngx_quic_connection_t *qc; c = ev->data; qc = ngx_quic_get_connection(c); - ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application); - pto = ngx_quic_pto(c, ctx); + pto = ngx_quic_path_pto(c); next = -1; now = ngx_current_msec; From arut at nginx.com Tue Mar 28 14:51:39 2023 From: arut at nginx.com (=?iso-8859-1?q?Roman_Arutyunyan?=) Date: Tue, 28 Mar 2023 18:51:39 +0400 Subject: [PATCH 2 of 3] QUIC: allowed ngx_quic_frame_sendto() to return NGX_AGAIN In-Reply-To: References: Message-ID: # HG changeset patch # User Roman Arutyunyan # Date 1679920727 -14400 # Mon Mar 27 16:38:47 2023 +0400 # Branch quic # Node ID c686c97f4abd6e1ca9a2cc2324d5a24f3d035c58 # Parent f76e83412133085a6c82fce2c3e15b2c34a6e959 QUIC: allowed ngx_quic_frame_sendto() to return NGX_AGAIN. Previously, NGX_AGAIN returned by ngx_send() was treated by ngx_quic_frame_sendto() as error, which triggered errors in its callers. However, a blocked socket is not an error. Now NGX_AGAIN is passed as is to the ngx_quic_frame_sendto() callers, which can safely ignore it. diff --git a/src/event/quic/ngx_event_quic_migration.c b/src/event/quic/ngx_event_quic_migration.c --- a/src/event/quic/ngx_event_quic_migration.c +++ b/src/event/quic/ngx_event_quic_migration.c @@ -46,7 +46,7 @@ ngx_quic_handle_path_challenge_frame(ngx * An endpoint MUST expand datagrams that contain a PATH_RESPONSE frame * to at least the smallest allowed maximum datagram size of 1200 bytes. */ - if (ngx_quic_frame_sendto(c, &frame, 1200, pkt->path) != NGX_OK) { + if (ngx_quic_frame_sendto(c, &frame, 1200, pkt->path) == NGX_ERROR) { return NGX_ERROR; } @@ -575,13 +575,13 @@ ngx_quic_send_path_challenge(ngx_connect */ /* same applies to PATH_RESPONSE frames */ - if (ngx_quic_frame_sendto(c, &frame, 1200, path) != NGX_OK) { + if (ngx_quic_frame_sendto(c, &frame, 1200, path) == NGX_ERROR) { return NGX_ERROR; } ngx_memcpy(frame.u.path_challenge.data, path->challenge2, 8); - if (ngx_quic_frame_sendto(c, &frame, 1200, path) != NGX_OK) { + if (ngx_quic_frame_sendto(c, &frame, 1200, path) == NGX_ERROR) { return NGX_ERROR; } diff --git a/src/event/quic/ngx_event_quic_output.c b/src/event/quic/ngx_event_quic_output.c --- a/src/event/quic/ngx_event_quic_output.c +++ b/src/event/quic/ngx_event_quic_output.c @@ -1269,7 +1269,7 @@ ngx_quic_frame_sendto(ngx_connection_t * sent = ngx_quic_send(c, res.data, res.len, path->sockaddr, path->socklen); if (sent < 0) { - return NGX_ERROR; + return sent; } path->sent += sent; From arut at nginx.com Tue Mar 28 14:51:40 2023 From: arut at nginx.com (=?iso-8859-1?q?Roman_Arutyunyan?=) Date: Tue, 28 Mar 2023 18:51:40 +0400 Subject: [PATCH 3 of 3] QUIC: path MTU discovery In-Reply-To: References: Message-ID: <13d43a278510f131101c.1680015100@arut-laptop> # HG changeset patch # User Roman Arutyunyan # Date 1679993500 -14400 # Tue Mar 28 12:51:40 2023 +0400 # Branch quic # Node ID 13d43a278510f131101c7b19d87455a0171ebe2f # Parent c686c97f4abd6e1ca9a2cc2324d5a24f3d035c58 QUIC: path MTU discovery. MTU selection starts by probing the maximum allowed MTU first. After that, binary search is used to find the path MTU. Maximum allowed MTU is calculated as the minimum of max_udp_payload for client and server, and local interface MTU. diff --git a/auto/unix b/auto/unix --- a/auto/unix +++ b/auto/unix @@ -448,6 +448,54 @@ ngx_feature_test="setsockopt(0, IPPROTO_ . auto/feature +# IP packet fragmentation flags + +ngx_feature="IP_DONTFRAG" +ngx_feature_name="NGX_HAVE_IP_DONTFRAG" +ngx_feature_run=no +ngx_feature_incs="#include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test="getsockopt(0, IPPROTO_IP, IP_DONTFRAG, NULL, 0)" +. auto/feature + + +ngx_feature="IPV6_DONTFRAG" +ngx_feature_name="NGX_HAVE_IPV6_DONTFRAG" +ngx_feature_run=no +ngx_feature_incs="#include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test="getsockopt(0, IPPROTO_IPV6, IPV6_DONTFRAG, NULL, 0)" +. auto/feature + + +# Linux MTU flags + +ngx_feature="IP_PMTUDISC_DO" +ngx_feature_name="NGX_HAVE_IP_PMTUDISC_DO" +ngx_feature_run=no +ngx_feature_incs="#include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test="getsockopt(0, IPPROTO_IP, IP_PMTUDISC_DO, NULL, 0)" +. auto/feature + + +ngx_feature="IPV6_PMTUDISC_DO" +ngx_feature_name="NGX_HAVE_IPV6_PMTUDISC_DO" +ngx_feature_run=no +ngx_feature_incs="#include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test="getsockopt(0, IPPROTO_IPV6, IPV6_PMTUDISC_DO, NULL, 0)" +. auto/feature + + ngx_feature="TCP_DEFER_ACCEPT" ngx_feature_name="NGX_HAVE_DEFERRED_ACCEPT" ngx_feature_run=no @@ -920,6 +968,19 @@ ngx_feature_test="int i = FIONREAD; prin . auto/feature +ngx_feature="ioctl(SIOCGIFMTU)" +ngx_feature_name="NGX_HAVE_SIOCGIFMTU" +ngx_feature_run=no +ngx_feature_incs="#include + #include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test="int i = SIOCGIFMTU; struct ifreq ifr; + ifr.ifr_name[0] = 'e'; printf(\"%d\", i)" +. auto/feature + + ngx_feature="struct tm.tm_gmtoff" ngx_feature_name="NGX_HAVE_GMTOFF" ngx_feature_run=no @@ -1002,3 +1063,17 @@ ngx_feature_test='struct addrinfo *res; if (getaddrinfo("localhost", NULL, NULL, &res) != 0) return 1; freeaddrinfo(res)' . auto/feature + + +ngx_feature="getifaddrs()" +ngx_feature_name="NGX_HAVE_GETIFADDRS" +ngx_feature_run=no +ngx_feature_incs="#include + #include + #include " +ngx_feature_path= +ngx_feature_libs= +ngx_feature_test='struct ifaddrs *ifaddr; + if (getifaddrs(&ifaddr) != 0) return 1; + freeifaddrs(ifaddr)' +. auto/feature diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c --- a/src/core/ngx_connection.c +++ b/src/core/ngx_connection.c @@ -1010,6 +1010,74 @@ ngx_configure_listening_sockets(ngx_cycl } #endif + +#if (NGX_HAVE_IP_PMTUDISC_DO) + + if (ls[i].quic && ls[i].sockaddr->sa_family == AF_INET) { + value = 1; + + if (setsockopt(ls[i].fd, IPPROTO_IP, IP_PMTUDISC_DO, + (const void *) &value, sizeof(int)) + == -1) + { + ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno, + "setsockopt(IP_PMTUDISC_DO) " + "for %V failed, ignored", + &ls[i].addr_text); + } + } + +#elif (NGX_HAVE_IP_DONTFRAG) + + if (ls[i].quic && ls[i].sockaddr->sa_family == AF_INET) { + value = 1; + + if (setsockopt(ls[i].fd, IPPROTO_IP, IP_DONTFRAG, + (const void *) &value, sizeof(int)) + == -1) + { + ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno, + "setsockopt(IP_DONTFRAG) " + "for %V failed, ignored", + &ls[i].addr_text); + } + } + +#endif + +#if (NGX_HAVE_INET6 && NGX_HAVE_IPV6_PMTUDISC_DO) + + if (ls[i].quic && ls[i].sockaddr->sa_family == AF_INET6) { + value = 1; + + if (setsockopt(ls[i].fd, IPPROTO_IPV6, IPV6_PMTUDISC_DO, + (const void *) &value, sizeof(int)) + == -1) + { + ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno, + "setsockopt(IPV6_PMTUDISC_DO) " + "for %V failed, ignored", + &ls[i].addr_text); + } + } + +#elif (NGX_HAVE_INET6 && NGX_HAVE_IPV6_DONTFRAG) + + if (ls[i].quic && ls[i].sockaddr->sa_family == AF_INET6) { + value = 1; + + if (setsockopt(ls[i].fd, IPPROTO_IPV6, IPV6_DONTFRAG, + (const void *) &value, sizeof(int)) + == -1) + { + ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno, + "setsockopt(IPV6_DONTFRAG) " + "for %V failed, ignored", + &ls[i].addr_text); + } + } + +#endif } return; @@ -1507,6 +1575,10 @@ ngx_connection_error(ngx_connection_t *c } #endif + if (err == NGX_EMSGSIZE && c->log_error == NGX_ERROR_IGNORE_EMSGSIZE) { + return 0; + } + if (err == 0 || err == NGX_ECONNRESET #if (NGX_WIN32) @@ -1524,6 +1596,7 @@ ngx_connection_error(ngx_connection_t *c { switch (c->log_error) { + case NGX_ERROR_IGNORE_EMSGSIZE: case NGX_ERROR_IGNORE_EINVAL: case NGX_ERROR_IGNORE_ECONNRESET: case NGX_ERROR_INFO: diff --git a/src/core/ngx_connection.h b/src/core/ngx_connection.h --- a/src/core/ngx_connection.h +++ b/src/core/ngx_connection.h @@ -97,7 +97,8 @@ typedef enum { NGX_ERROR_ERR, NGX_ERROR_INFO, NGX_ERROR_IGNORE_ECONNRESET, - NGX_ERROR_IGNORE_EINVAL + NGX_ERROR_IGNORE_EINVAL, + NGX_ERROR_IGNORE_EMSGSIZE } ngx_connection_log_error_e; diff --git a/src/event/quic/ngx_event_quic.c b/src/event/quic/ngx_event_quic.c --- a/src/event/quic/ngx_event_quic.c +++ b/src/event/quic/ngx_event_quic.c @@ -10,8 +10,17 @@ #include +#define NGX_QUIC_UDP4_MAX_PACKET 65535 +#define NGX_QUIC_UDP4_HEADER_SIZE 28 + +#define NGX_QUIC_UDP6_MAX_PAYLOAD 65535 +#define NGX_QUIC_UDP6_HEADER_SIZE 48 + + static ngx_quic_connection_t *ngx_quic_new_connection(ngx_connection_t *c, ngx_quic_conf_t *conf, ngx_quic_header_t *pkt); +static ssize_t ngx_quic_get_local_mtu(ngx_connection_t *c, + struct sockaddr *sockaddr); static ngx_int_t ngx_quic_handle_stateless_reset(ngx_connection_t *c, ngx_quic_header_t *pkt); static void ngx_quic_input_handler(ngx_event_t *rev); @@ -149,11 +158,6 @@ ngx_quic_apply_transport_params(ngx_conn ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic maximum packet size is invalid"); return NGX_ERROR; - - } else if (ctp->max_udp_payload_size > ngx_quic_max_udp_payload(c)) { - ctp->max_udp_payload_size = ngx_quic_max_udp_payload(c); - ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, - "quic client maximum packet size truncated"); } if (ctp->active_connection_id_limit < 2) { @@ -228,6 +232,7 @@ static ngx_quic_connection_t * ngx_quic_new_connection(ngx_connection_t *c, ngx_quic_conf_t *conf, ngx_quic_header_t *pkt) { + ssize_t mtu; ngx_uint_t i; ngx_quic_tp_t *ctp; ngx_quic_connection_t *qc; @@ -297,7 +302,7 @@ ngx_quic_new_connection(ngx_connection_t ctp = &qc->ctp; /* defaults to be used before actual client parameters are received */ - ctp->max_udp_payload_size = ngx_quic_max_udp_payload(c); + ctp->max_udp_payload_size = NGX_QUIC_MAX_UDP_PAYLOAD_SIZE; ctp->ack_delay_exponent = NGX_QUIC_DEFAULT_ACK_DELAY_EXPONENT; ctp->max_ack_delay = NGX_QUIC_DEFAULT_MAX_ACK_DELAY; ctp->active_connection_id_limit = 2; @@ -317,6 +322,18 @@ ngx_quic_new_connection(ngx_connection_t qc->congestion.ssthresh = (size_t) -1; qc->congestion.recovery_start = ngx_current_msec; + qc->max_mtu = ngx_min(qc->tp.max_udp_payload_size, + qc->ctp.max_udp_payload_size); + + mtu = ngx_quic_get_local_mtu(c, c->local_sockaddr); + if (mtu == NGX_ERROR) { + return NULL; + } + + if (mtu > 0 && (size_t) mtu < qc->max_mtu) { + qc->max_mtu = mtu; + } + if (pkt->validated && pkt->retried) { qc->tp.retry_scid.len = pkt->dcid.len; qc->tp.retry_scid.data = ngx_pstrdup(c->pool, &pkt->dcid); @@ -347,6 +364,90 @@ ngx_quic_new_connection(ngx_connection_t } +static ssize_t +ngx_quic_get_local_mtu(ngx_connection_t *c, struct sockaddr *sockaddr) +{ +#if (NGX_HAVE_GETIFADDRS && NGX_HAVE_SIOCGIFMTU) + + size_t mtu; + struct ifreq ifr; + struct ifaddrs *ifaddrs, *ifa; + + if (sockaddr->sa_family != AF_INET +#if (NGX_HAVE_INET6) + && sockaddr->sa_family != AF_INET6 +#endif + ) + { + return NGX_DECLINED; + } + + if (getifaddrs(&ifaddrs) == -1) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, "getifaddrs() failed"); + return NGX_ERROR; + } + + for (ifa = ifaddrs; ifa; ifa = ifa->ifa_next) { + if (ifa->ifa_addr == NULL) { + continue; + } + + if (ngx_cmp_sockaddr(sockaddr, 0, ifa->ifa_addr, 0, 0) != NGX_OK) { + continue; + } + + ngx_memzero(&ifr, sizeof(struct ifreq)); + strcpy(ifr.ifr_name, ifa->ifa_name); + + freeifaddrs(ifaddrs); + + if (ioctl(c->fd, SIOCGIFMTU, &ifr)) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, "ioctl(SIOCGIFMTU) failed"); + return NGX_ERROR; + } + + mtu = ifr.ifr_mtu; + + if (sockaddr->sa_family == AF_INET) { + if (mtu > NGX_QUIC_UDP4_MAX_PACKET) { + mtu = NGX_QUIC_UDP4_MAX_PACKET; + } + + if (mtu <= NGX_QUIC_UDP4_HEADER_SIZE) { + return NGX_DECLINED; + } + + mtu -= NGX_QUIC_UDP4_HEADER_SIZE; + +#if (NGX_HAVE_INET6) + } else { /* sockaddr->sa_family == AF_INET6 */ + + if (mtu <= NGX_QUIC_UDP6_HEADER_SIZE) { + return NGX_DECLINED; + } + + mtu -= NGX_QUIC_UDP6_HEADER_SIZE; + + if (mtu > NGX_QUIC_UDP6_MAX_PAYLOAD) { + mtu = NGX_QUIC_UDP6_MAX_PAYLOAD; + } +#endif + } + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic local mtu:%uz", mtu); + + return mtu; + } + + freeifaddrs(ifaddrs); + +#endif + + return NGX_DECLINED; +} + + static ngx_int_t ngx_quic_handle_stateless_reset(ngx_connection_t *c, ngx_quic_header_t *pkt) { diff --git a/src/event/quic/ngx_event_quic_ack.c b/src/event/quic/ngx_event_quic_ack.c --- a/src/event/quic/ngx_event_quic_ack.c +++ b/src/event/quic/ngx_event_quic_ack.c @@ -229,6 +229,12 @@ ngx_quic_handle_ack_frame_range(ngx_conn qc = ngx_quic_get_connection(c); + if (ctx->level == ssl_encryption_application) { + if (ngx_quic_handle_path_mtu_ack(c, qc->path, min, max) != NGX_OK) { + return NGX_ERROR; + } + } + st->max_pn = NGX_TIMER_INFINITE; found = 0; diff --git a/src/event/quic/ngx_event_quic_connection.h b/src/event/quic/ngx_event_quic_connection.h --- a/src/event/quic/ngx_event_quic_connection.h +++ b/src/event/quic/ngx_event_quic_connection.h @@ -89,14 +89,21 @@ struct ngx_quic_path_s { ngx_sockaddr_t sa; socklen_t socklen; ngx_quic_client_id_t *cid; - ngx_msec_t expires; - ngx_uint_t tries; + ngx_msec_t valid_expires; + ngx_msec_t mtu_expires; + ngx_uint_t valid_tries; + ngx_uint_t mtu_tries; + ngx_uint_t mtu_steps; ngx_uint_t tag; + size_t mtu; + size_t mtud; + size_t max_mtu; off_t sent; off_t received; u_char challenge1[8]; u_char challenge2[8]; uint64_t seqnum; + uint64_t mtu_pnum[NGX_QUIC_PATH_RETRIES]; ngx_str_t addr_text; u_char text[NGX_SOCKADDR_STRLEN]; unsigned validated:1; @@ -206,6 +213,8 @@ struct ngx_quic_connection_s { uint64_t server_seqnum; uint64_t path_seqnum; + size_t max_mtu; + ngx_quic_tp_t tp; ngx_quic_tp_t ctp; diff --git a/src/event/quic/ngx_event_quic_migration.c b/src/event/quic/ngx_event_quic_migration.c --- a/src/event/quic/ngx_event_quic_migration.c +++ b/src/event/quic/ngx_event_quic_migration.c @@ -10,6 +10,10 @@ #include +#define NGX_QUIC_MAX_MTU_STEPS 7 +#define NGX_QUIC_MTU_PRECISION 4 + + static void ngx_quic_set_connection_path(ngx_connection_t *c, ngx_quic_path_t *path); static ngx_int_t ngx_quic_validate_path(ngx_connection_t *c, @@ -17,7 +21,13 @@ static ngx_int_t ngx_quic_validate_path( static ngx_msec_t ngx_quic_path_pto(ngx_connection_t *c); static ngx_int_t ngx_quic_send_path_challenge(ngx_connection_t *c, ngx_quic_path_t *path); +static ngx_int_t ngx_quic_expire_path_mtu(ngx_connection_t *c, + ngx_quic_path_t *path, ngx_msec_int_t *next); +static ngx_int_t ngx_quic_expire_path(ngx_connection_t *c, + ngx_quic_path_t *path, ngx_msec_int_t *next); static ngx_quic_path_t *ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag); +static ngx_int_t ngx_quic_send_path_mtu_probe(ngx_connection_t *c, + ngx_quic_path_t *path); ngx_int_t @@ -170,6 +180,10 @@ valid: path->validating = 0; path->limited = 0; + if (ngx_quic_discover_path_mtu(c, path) != NGX_OK) { + return NGX_ERROR; + } + return NGX_OK; } @@ -208,6 +222,8 @@ ngx_quic_new_path(ngx_connection_t *c, path->limited = 1; + path->mtu = NGX_QUIC_MIN_INITIAL_SIZE; + path->seqnum = qc->path_seqnum++; path->sockaddr = &path->sa.sockaddr; @@ -505,14 +521,14 @@ ngx_quic_validate_path(ngx_connection_t return NGX_ERROR; } + path->valid_tries = 0; + if (ngx_quic_send_path_challenge(c, path) != NGX_OK) { return NGX_ERROR; } pto = ngx_quic_path_pto(c); - - path->expires = ngx_current_msec + pto; - path->tries = NGX_QUIC_PATH_RETRIES; + path->valid_expires = ngx_current_msec + pto; if (!qc->path_validation.timer_set) { ngx_add_timer(&qc->path_validation, pto); @@ -556,7 +572,7 @@ ngx_quic_send_path_challenge(ngx_connect ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic path seq:%uL send path_challenge tries:%ui", - path->seqnum, path->tries); + path->seqnum, path->valid_tries); ngx_memzero(&frame, sizeof(ngx_quic_frame_t)); @@ -592,20 +608,16 @@ ngx_quic_send_path_challenge(ngx_connect void ngx_quic_path_validation_handler(ngx_event_t *ev) { - ngx_msec_t now; ngx_queue_t *q; - ngx_msec_int_t left, next, pto; - ngx_quic_path_t *path, *bkp; + ngx_msec_int_t next; + ngx_quic_path_t *path; ngx_connection_t *c; ngx_quic_connection_t *qc; c = ev->data; qc = ngx_quic_get_connection(c); - pto = ngx_quic_path_pto(c); - next = -1; - now = ngx_current_msec; q = ngx_queue_head(&qc->paths); @@ -614,76 +626,12 @@ ngx_quic_path_validation_handler(ngx_eve path = ngx_queue_data(q, ngx_quic_path_t, queue); q = ngx_queue_next(q); - if (!path->validating) { - continue; - } - - left = path->expires - now; - - if (left > 0) { - - if (next == -1 || left < next) { - next = left; - } - - continue; - } - - if (--path->tries) { - path->expires = ngx_current_msec + pto; - - if (next == -1 || pto < next) { - next = pto; - } - - /* retransmit */ - (void) ngx_quic_send_path_challenge(c, path); - - continue; + if (ngx_quic_expire_path_mtu(c, path, &next) != NGX_OK) { + ngx_quic_close_connection(c, NGX_ERROR); + return; } - ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ev->log, 0, - "quic path seq:%uL validation failed", path->seqnum); - - /* found expired path */ - - path->validated = 0; - path->validating = 0; - path->limited = 1; - - - /* RFC 9000, 9.3.2. On-Path Address Spoofing - * - * To protect the connection from failing due to such a spurious - * migration, an endpoint MUST revert to using the last validated - * peer address when validation of a new peer address fails. - */ - - if (qc->path == path) { - /* active path validation failed */ - - bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP); - - if (bkp == NULL) { - qc->error = NGX_QUIC_ERR_NO_VIABLE_PATH; - qc->error_reason = "no viable path"; - ngx_quic_close_connection(c, NGX_ERROR); - return; - } - - qc->path = bkp; - qc->path->tag = NGX_QUIC_PATH_ACTIVE; - - ngx_quic_set_connection_path(c, qc->path); - - ngx_log_error(NGX_LOG_INFO, c->log, 0, - "quic path seq:%uL addr:%V is restored from backup", - qc->path->seqnum, &qc->path->addr_text); - - ngx_quic_path_dbg(c, "is active", qc->path); - } - - if (ngx_quic_free_path(c, path) != NGX_OK) { + if (ngx_quic_expire_path(c, path, &next) != NGX_OK) { ngx_quic_close_connection(c, NGX_ERROR); return; } @@ -693,3 +641,290 @@ ngx_quic_path_validation_handler(ngx_eve ngx_add_timer(&qc->path_validation, next); } } + + +static ngx_int_t +ngx_quic_expire_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path, + ngx_msec_int_t *next) +{ + ngx_int_t rc; + ngx_msec_t now; + ngx_msec_int_t left, pto; + + if (!path->mtud) { + return NGX_OK; + } + + now = ngx_current_msec; + + left = path->mtu_expires - now; + + if (left > 0) { + + if (*next == -1 || left < *next) { + *next = left; + } + + return NGX_OK; + } + + if (++path->mtu_tries < NGX_QUIC_PATH_RETRIES) { + pto = ngx_quic_path_pto(c); + + path->mtu_expires = ngx_current_msec + pto; + + if (*next == -1 || pto < *next) { + *next = pto; + } + + rc = ngx_quic_send_path_mtu_probe(c, path); + if (rc != NGX_DECLINED) { + return rc; + } + } + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic path seq:%uL mtu probe failed", path->seqnum); + + path->max_mtu = path->mtud; + path->mtud = 0; + + return ngx_quic_discover_path_mtu(c, path); +} + + +static ngx_int_t +ngx_quic_expire_path(ngx_connection_t *c, ngx_quic_path_t *path, + ngx_msec_int_t *next) +{ + ngx_msec_t now; + ngx_msec_int_t left, pto; + ngx_quic_path_t *bkp; + ngx_quic_connection_t *qc; + + if (!path->validating) { + return NGX_OK; + } + + qc = ngx_quic_get_connection(c); + + now = ngx_current_msec; + + left = path->valid_expires - now; + + if (left > 0) { + + if (*next == -1 || left < *next) { + *next = left; + } + + return NGX_OK; + } + + if (++path->valid_tries < NGX_QUIC_PATH_RETRIES) { + pto = ngx_quic_path_pto(c); + + path->valid_expires = ngx_current_msec + pto; + + if (*next == -1 || pto < *next) { + *next = pto; + } + + /* retransmit */ + (void) ngx_quic_send_path_challenge(c, path); + + return NGX_OK; + } + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic path seq:%uL validation failed", path->seqnum); + + /* found expired path */ + + path->validated = 0; + path->validating = 0; + path->limited = 1; + + + /* RFC 9000, 9.3.2. On-Path Address Spoofing + * + * To protect the connection from failing due to such a spurious + * migration, an endpoint MUST revert to using the last validated + * peer address when validation of a new peer address fails. + */ + + if (qc->path == path) { + /* active path validation failed */ + + bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP); + + if (bkp == NULL) { + qc->error = NGX_QUIC_ERR_NO_VIABLE_PATH; + qc->error_reason = "no viable path"; + return NGX_ERROR; + } + + qc->path = bkp; + qc->path->tag = NGX_QUIC_PATH_ACTIVE; + + ngx_quic_set_connection_path(c, qc->path); + + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "quic path seq:%uL addr:%V is restored from backup", + qc->path->seqnum, &qc->path->addr_text); + + ngx_quic_path_dbg(c, "is active", qc->path); + } + + if (ngx_quic_free_path(c, path) != NGX_OK) { + return NGX_ERROR; + } + + return NGX_OK; +} + + +ngx_int_t +ngx_quic_discover_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path) +{ + ngx_int_t rc; + ngx_uint_t i; + ngx_msec_t pto; + ngx_quic_connection_t *qc; + + qc = ngx_quic_get_connection(c); + +again: + + if (path->mtu_steps == 0) { + path->max_mtu = qc->max_mtu; + path->mtud = path->max_mtu; + + } else if (path->mtu_steps >= NGX_QUIC_MAX_MTU_STEPS + || (path->max_mtu - path->mtu) <= NGX_QUIC_MTU_PRECISION) + { + return NGX_OK; + + } else { + path->mtud = (path->mtu + path->max_mtu) / 2; + } + + path->mtu_steps++; + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic initiated mtu discovery of path seq:%uL", + path->seqnum); + + for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) { + path->mtu_pnum[i] = NGX_QUIC_UNSET_PN; + } + + path->mtu_tries = 0; + + rc = ngx_quic_send_path_mtu_probe(c, path); + + if (rc == NGX_DECLINED) { + path->max_mtu = path->mtud; + path->mtud = 0; + goto again; + } + + if (rc == NGX_ERROR) { + path->mtud = 0; + return NGX_ERROR; + } + + /* rc == NGX_OK */ + + pto = ngx_quic_path_pto(c); + path->mtu_expires = ngx_current_msec + pto; + + if (!qc->path_validation.timer_set) { + ngx_add_timer(&qc->path_validation, pto); + } + + return NGX_OK; +} + + +static ngx_int_t +ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path) +{ + ngx_int_t rc; + ngx_uint_t log_error; + ngx_quic_frame_t frame; + ngx_quic_send_ctx_t *ctx; + ngx_quic_connection_t *qc; + + ngx_memzero(&frame, sizeof(ngx_quic_frame_t)); + + frame.level = ssl_encryption_application; + frame.type = NGX_QUIC_FT_PING; + + qc = ngx_quic_get_connection(c); + ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application); + path->mtu_pnum[path->mtu_tries] = ctx->pnum; + + ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic path seq:%uL send mtu probe " + "size:%uz pnum:%uL tries:%ui", + path->seqnum, path->mtud, ctx->pnum, path->mtu_tries); + + log_error = c->log_error; + c->log_error = NGX_ERROR_IGNORE_EMSGSIZE; + + rc = ngx_quic_frame_sendto(c, &frame, path->mtud, path); + c->log_error = log_error; + + if (rc == NGX_ERROR) { + if (c->write->error) { + c->write->error = 0; + + ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic rejected mtu probe of path seq:%uL", + path->seqnum); + + return NGX_DECLINED; + } + + return NGX_ERROR; + } + + return NGX_OK; +} + + +ngx_int_t +ngx_quic_handle_path_mtu_ack(ngx_connection_t *c, ngx_quic_path_t *path, + uint64_t min, uint64_t max) +{ + uint64_t pnum; + ngx_uint_t i; + + if (!path->mtud) { + return NGX_OK; + } + + for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) { + pnum = path->mtu_pnum[i]; + + if (pnum == NGX_QUIC_UNSET_PN) { + break; + } + + if (pnum < min || pnum > max) { + continue; + } + + path->mtu = path->mtud; + path->mtud = 0; + + ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, + "quic path seq:%uL mtu ack size:%uz", + path->seqnum, path->mtu); + + return ngx_quic_discover_path_mtu(c, path); + } + + return NGX_OK; +} diff --git a/src/event/quic/ngx_event_quic_migration.h b/src/event/quic/ngx_event_quic_migration.h --- a/src/event/quic/ngx_event_quic_migration.h +++ b/src/event/quic/ngx_event_quic_migration.h @@ -39,4 +39,9 @@ ngx_int_t ngx_quic_handle_migration(ngx_ void ngx_quic_path_validation_handler(ngx_event_t *ev); +ngx_int_t ngx_quic_discover_path_mtu(ngx_connection_t *c, + ngx_quic_path_t *path); +ngx_int_t ngx_quic_handle_path_mtu_ack(ngx_connection_t *c, + ngx_quic_path_t *path, uint64_t min, uint64_t max); + #endif /* _NGX_EVENT_QUIC_MIGRATION_H_INCLUDED_ */ diff --git a/src/event/quic/ngx_event_quic_output.c b/src/event/quic/ngx_event_quic_output.c --- a/src/event/quic/ngx_event_quic_output.c +++ b/src/event/quic/ngx_event_quic_output.c @@ -10,9 +10,6 @@ #include -#define NGX_QUIC_MAX_UDP_PAYLOAD_OUT 1252 -#define NGX_QUIC_MAX_UDP_PAYLOAD_OUT6 1232 - #define NGX_QUIC_MAX_UDP_SEGMENT_BUF 65487 /* 65K - IPv6 header */ #define NGX_QUIC_MAX_SEGMENTS 64 /* UDP_MAX_SEGMENTS */ @@ -61,21 +58,6 @@ static size_t ngx_quic_path_limit(ngx_co size_t size); -size_t -ngx_quic_max_udp_payload(ngx_connection_t *c) -{ - /* TODO: path MTU discovery */ - -#if (NGX_HAVE_INET6) - if (c->sockaddr->sa_family == AF_INET6) { - return NGX_QUIC_MAX_UDP_PAYLOAD_OUT6; - } -#endif - - return NGX_QUIC_MAX_UDP_PAYLOAD_OUT; -} - - ngx_int_t ngx_quic_output(ngx_connection_t *c) { @@ -142,10 +124,7 @@ ngx_quic_create_datagrams(ngx_connection p = dst; - len = ngx_min(qc->ctp.max_udp_payload_size, - NGX_QUIC_MAX_UDP_PAYLOAD_SIZE); - - len = ngx_quic_path_limit(c, path, len); + len = ngx_quic_path_limit(c, path, path->mtu); pad = ngx_quic_get_padding_level(c); @@ -271,17 +250,19 @@ ngx_quic_allow_segmentation(ngx_connecti { size_t bytes, len; ngx_queue_t *q; + ngx_quic_path_t *path; ngx_quic_frame_t *f; ngx_quic_send_ctx_t *ctx; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); + path = qc->path; if (!qc->conf->gso_enabled) { return 0; } - if (qc->path->limited) { + if (path->limited) { /* don't even try to be faster on non-validated paths */ return 0; } @@ -299,9 +280,7 @@ ngx_quic_allow_segmentation(ngx_connecti ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application); bytes = 0; - - len = ngx_min(qc->ctp.max_udp_payload_size, - NGX_QUIC_MAX_UDP_SEGMENT_BUF); + len = path->mtu; for (q = ngx_queue_head(&ctx->frames); q != ngx_queue_sentinel(&ctx->frames); @@ -345,8 +324,7 @@ ngx_quic_create_segments(ngx_connection_ return NGX_ERROR; } - segsize = ngx_min(qc->ctp.max_udp_payload_size, - NGX_QUIC_MAX_UDP_SEGMENT_BUF); + segsize = ngx_min(path->mtu, NGX_QUIC_MAX_UDP_SEGMENT_BUF); p = dst; end = dst + sizeof(dst); diff --git a/src/event/quic/ngx_event_quic_output.h b/src/event/quic/ngx_event_quic_output.h --- a/src/event/quic/ngx_event_quic_output.h +++ b/src/event/quic/ngx_event_quic_output.h @@ -12,8 +12,6 @@ #include -size_t ngx_quic_max_udp_payload(ngx_connection_t *c); - ngx_int_t ngx_quic_output(ngx_connection_t *c); ngx_int_t ngx_quic_negotiate_version(ngx_connection_t *c, diff --git a/src/event/quic/ngx_event_quic_ssl.c b/src/event/quic/ngx_event_quic_ssl.c --- a/src/event/quic/ngx_event_quic_ssl.c +++ b/src/event/quic/ngx_event_quic_ssl.c @@ -499,6 +499,10 @@ ngx_quic_crypto_input(ngx_connection_t * return NGX_ERROR; } + if (ngx_quic_discover_path_mtu(c, qc->path) != NGX_OK) { + return NGX_ERROR; + } + if (ngx_quic_init_streams(c) != NGX_OK) { return NGX_ERROR; } diff --git a/src/os/unix/ngx_darwin_config.h b/src/os/unix/ngx_darwin_config.h --- a/src/os/unix/ngx_darwin_config.h +++ b/src/os/unix/ngx_darwin_config.h @@ -47,6 +47,8 @@ #include #include #include +#include +#include #include #include diff --git a/src/os/unix/ngx_errno.h b/src/os/unix/ngx_errno.h --- a/src/os/unix/ngx_errno.h +++ b/src/os/unix/ngx_errno.h @@ -54,6 +54,7 @@ typedef int ngx_err_t; #define NGX_ENOMOREFILES 0 #define NGX_ELOOP ELOOP #define NGX_EBADF EBADF +#define NGX_EMSGSIZE EMSGSIZE #if (NGX_HAVE_OPENAT) #define NGX_EMLINK EMLINK diff --git a/src/os/unix/ngx_freebsd_config.h b/src/os/unix/ngx_freebsd_config.h --- a/src/os/unix/ngx_freebsd_config.h +++ b/src/os/unix/ngx_freebsd_config.h @@ -48,6 +48,9 @@ #include /* setproctitle() before 4.1 */ #include #include +#include +#include +#include #include diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h --- a/src/os/unix/ngx_linux_config.h +++ b/src/os/unix/ngx_linux_config.h @@ -54,6 +54,8 @@ #include #include #include /* uname() */ +#include +#include #include diff --git a/src/os/unix/ngx_posix_config.h b/src/os/unix/ngx_posix_config.h --- a/src/os/unix/ngx_posix_config.h +++ b/src/os/unix/ngx_posix_config.h @@ -140,6 +140,17 @@ typedef struct aiocb ngx_aiocb_t; #endif +#if (NGX_HAVE_SIOCGIFMTU) +#include +#include +#endif + + +#if (NGX_HAVE_GETIFADDRS) +#include +#endif + + #define NGX_LISTEN_BACKLOG 511 #define ngx_debug_init() diff --git a/src/os/unix/ngx_solaris_config.h b/src/os/unix/ngx_solaris_config.h --- a/src/os/unix/ngx_solaris_config.h +++ b/src/os/unix/ngx_solaris_config.h @@ -88,6 +88,17 @@ #endif +#if (NGX_HAVE_SIOCGIFMTU) +#include +#include +#endif + + +#if (NGX_HAVE_GETIFADDRS) +#include +#endif + + #define NGX_LISTEN_BACKLOG 511 From mdounin at mdounin.ru Tue Mar 28 15:11:24 2023 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 28 Mar 2023 18:11:24 +0300 Subject: nginx 1.23.4 changes draft In-Reply-To: <86F4BD59-693D-4810-9694-B671A99E2C28@nginx.com> References: <86F4BD59-693D-4810-9694-B671A99E2C28@nginx.com> Message-ID: Hello! On Tue, Mar 28, 2023 at 06:39:41PM +0400, Sergey Kandaurov wrote: > > On 28 Mar 2023, at 18:14, Maxim Dounin wrote: > > > > Hello! > > > > Changes with nginx 1.23.4 28 Mar 2023 > > > > *) Change: now TLSv1.3 protocol is enabled by default. > > > > *) Change: now nginx issues a warning if protocol parameters of a > > listening socket are redefined. > > > > *) Change: now nginx closes connections with lingering if pipelining was > > used by the client. > > > > *) Feature: byte ranges support in the ngx_http_gzip_static_module. > > > > *) Bugfix: port ranges in the "listen" directive did not work; the bug > > had appeared in 1.23.3. > > Thanks to Valentin Bartenev. > > > > *) Bugfix: incorrect location might be chosen to process a request if a > > prefix location longer than 255 characters was used in the > > configuration. > > > > *) Bugfix: non-ASCII characters in file names on Windows were not > > supported by the ngx_http_autoindex_module, the ngx_http_dav_module, > > and the "include" directive. > > > > *) Change: the logging level of the "data length too long", "length too > > short", "bad legacy version", "no shared signature algorithms", "bad > > digest length", "missing sigalgs extension", "encrypted length too > > long", "bad length", "bad key update", "mixed handshake and non > > handshake data", "ccs received early", "data between ccs and > > finished", "packet length too long", "too many warn alerts", "record > > too small", and "got a fin before a ccs" SSL errors has been lowered > > from "crit" to "info". > > > > *) Bugfix: a socket leak might occur when using HTTP/2 and the > > "error_page" directive to redirect errors with code 400. > > > > *) Bugfix: messages about logging to syslog errors did not contain > > information that the errors happened while logging to syslog. > > Thanks to Safar Safarly. > > > > *) Workaround: "gzip filter failed to use preallocated memory" alerts > > appeared in logs when using zlib-ng. > > > > *) Bugfix: in the mail proxy server. > > > > > > Изменения в nginx 1.23.4 28.03.2023 > > > > *) Изменение: теперь протокол TLSv1.3 разрешён по умолчанию. > > > > *) Изменение: теперь nginx выдаёт предупреждение при переопределении > > параметров listen-сокета, задающих используемые протоколы. > > > > *) Изменение: теперь, если клиент использует pipelining, nginx закрывает > > соединения с ожиданием дополнительных данных (lingering close). > > > > *) Добавление: поддержка byte ranges для ответов модуля > > ngx_http_gzip_static_module. > > > > *) Исправление: диапазоны портов в директиве listen не работали; ошибка > > появилась в nginx 1.23.3. > > "nginx" is usually omitted here (per changes grep) Thanks, fixed. > > Спасибо Валентину Бартеневу. > > > > *) Исправление: для обработки запроса мог быть выбран неверный location, > > если в конфигурации использовался префиксный location длиннее 255 > > символов. > > > > *) Исправление: не-ASCII символы в именах файлов на Windows не > > поддерживались модулями ngx_http_autoindex_module и > > ngx_http_dav_module, а также директивой include. > > > > *) Изменение: уровень логгирования ошибок SSL "data length too long", > > "length too short", "bad legacy version", "no shared signature > > algorithms", "bad digest length", "missing sigalgs extension", > > "encrypted length too long", "bad length", "bad key update", "mixed > > handshake and non handshake data", "ccs received early", "data > > between ccs and finished", "packet length too long", "too many warn > > alerts", "record too small", и "got a fin before a ccs" понижен с > > уровня crit до info. > > > > *) Исправление: при использовании HTTP/2 и директивы error_page для > > перенаправления ошибок с кодом 400 могла происходить утечка сокетов. > > > > *) Исправление: сообщения об ошибках записи в syslog не содержали > > информации о том, ошибки происходили в процессе записи в syslog. > > "о том, что" Fixed, thanks. > > Спасибо Safar Safarly. > > > > *) Изменение: при использовании zlib-ng в логах появлялись сообщения > > "gzip filter failed to use preallocated memory". > > > > *) Исправление: в почтовом прокси-сервере. > > > > Otherwise, looks good. Thanks, pushed to: http://mdounin.ru/hg/nginx http://mdounin.ru/hg/nginx.org Release files: http://mdounin.ru/temp/nginx-1.23.4.tar.gz http://mdounin.ru/temp/nginx-1.23.4.tar.gz.asc http://mdounin.ru/temp/nginx-1.23.4.zip http://mdounin.ru/temp/nginx-1.23.4.zip.asc -- Maxim Dounin http://mdounin.ru/ From thresh at nginx.com Tue Mar 28 16:04:58 2023 From: thresh at nginx.com (Konstantin Pavlov) Date: Tue, 28 Mar 2023 16:04:58 +0000 Subject: [nginx] Updated OpenSSL used for win32 builds. Message-ID: details: https://hg.nginx.org/nginx/rev/09affff4fd35 branches: changeset: 8154:09affff4fd35 user: Maxim Dounin date: Tue Mar 28 02:25:55 2023 +0300 description: Updated OpenSSL used for win32 builds. diffstat: misc/GNUmakefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diffs (12 lines): diff -r fcb2333c9982 -r 09affff4fd35 misc/GNUmakefile --- a/misc/GNUmakefile Mon Mar 27 21:25:05 2023 +0300 +++ b/misc/GNUmakefile Tue Mar 28 02:25:55 2023 +0300 @@ -6,7 +6,7 @@ TEMP = tmp CC = cl OBJS = objs.msvc8 -OPENSSL = openssl-1.1.1s +OPENSSL = openssl-1.1.1t ZLIB = zlib-1.2.13 PCRE = pcre2-10.39 From thresh at nginx.com Tue Mar 28 16:05:01 2023 From: thresh at nginx.com (Konstantin Pavlov) Date: Tue, 28 Mar 2023 16:05:01 +0000 Subject: [nginx] nginx-1.23.4-RELEASE Message-ID: details: https://hg.nginx.org/nginx/rev/ac779115ed6e branches: changeset: 8155:ac779115ed6e user: Maxim Dounin date: Tue Mar 28 18:01:53 2023 +0300 description: nginx-1.23.4-RELEASE diffstat: docs/xml/nginx/changes.xml | 157 +++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 157 insertions(+), 0 deletions(-) diffs (167 lines): diff -r 09affff4fd35 -r ac779115ed6e docs/xml/nginx/changes.xml --- a/docs/xml/nginx/changes.xml Tue Mar 28 02:25:55 2023 +0300 +++ b/docs/xml/nginx/changes.xml Tue Mar 28 18:01:53 2023 +0300 @@ -5,6 +5,163 @@ + + + + +теперь протокол TLSv1.3 разрешён по умолчанию. + + +now TLSv1.3 protocol is enabled by default. + + + + + +теперь nginx выдаёт предупреждение +при переопределении параметров listen-сокета, задающих используемые протоколы. + + +now nginx issues a warning +if protocol parameters of a listening socket are redefined. + + + + + +теперь, если клиент использует pipelining, +nginx закрывает соединения с ожиданием дополнительных данных (lingering close). + + +now nginx closes connections with lingering +if pipelining was used by the client. + + + + + +поддержка byte ranges для ответов модуля ngx_http_gzip_static_module. + + +byte ranges support in the ngx_http_gzip_static_module. + + + + + +диапазоны портов в директиве listen не работали; +ошибка появилась в 1.23.3.
+Спасибо Валентину Бартеневу. + + +port ranges in the "listen" directive did not work; +the bug had appeared in 1.23.3.
+Thanks to Valentin Bartenev. + + + + + +для обработки запроса мог быть выбран неверный location, +если в конфигурации использовался +префиксный location длиннее 255 символов. + + +incorrect location might be chosen to process a request +if a prefix location longer than 255 characters +was used in the configuration. + + + + + +не-ASCII символы в именах файлов на Windows +не поддерживались модулями ngx_http_autoindex_module и +ngx_http_dav_module, а также директивой include. + + +non-ASCII characters in file names on Windows were not supported +by the ngx_http_autoindex_module, the ngx_http_dav_module, +and the "include" directive. + + + + + +уровень логгирования ошибок SSL +"data length too long", "length too short", "bad legacy version", +"no shared signature algorithms", "bad digest length", +"missing sigalgs extension", "encrypted length too long", +"bad length", "bad key update", "mixed handshake and non handshake data", +"ccs received early", "data between ccs and finished", +"packet length too long", "too many warn alerts", "record too small", +и "got a fin before a ccs" +понижен с уровня crit до info. + + +the logging level of the +"data length too long", "length too short", "bad legacy version", +"no shared signature algorithms", "bad digest length", +"missing sigalgs extension", "encrypted length too long", +"bad length", "bad key update", "mixed handshake and non handshake data", +"ccs received early", "data between ccs and finished", +"packet length too long", "too many warn alerts", "record too small", +and "got a fin before a ccs" SSL errors +has been lowered from "crit" to "info". + + + + + +при использовании HTTP/2 и директивы error_page +для перенаправления ошибок с кодом 400 +могла происходить утечка сокетов. + + +a socket leak might occur +when using HTTP/2 and the "error_page" directive +to redirect errors with code 400. + + + + + +сообщения об ошибках записи в syslog +не содержали информации о том, что +ошибки происходили в процессе записи в syslog.
+Спасибо Safar Safarly. + + +messages about logging to syslog errors +did not contain information +that the errors happened while logging to syslog.
+Thanks to Safar Safarly. + + + + + +при использовании zlib-ng +в логах появлялись сообщения "gzip filter failed to use preallocated memory". + + +"gzip filter failed to use preallocated memory" alerts appeared in logs +when using zlib-ng. + + + + + +в почтовом прокси-сервере. + + +in the mail proxy server. + + + + + + From thresh at nginx.com Tue Mar 28 16:05:04 2023 From: thresh at nginx.com (Konstantin Pavlov) Date: Tue, 28 Mar 2023 16:05:04 +0000 Subject: [nginx] release-1.23.4 tag Message-ID: details: https://hg.nginx.org/nginx/rev/5f1d05a21287 branches: changeset: 8156:5f1d05a21287 user: Maxim Dounin date: Tue Mar 28 18:01:54 2023 +0300 description: release-1.23.4 tag diffstat: .hgtags | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diffs (8 lines): diff -r ac779115ed6e -r 5f1d05a21287 .hgtags --- a/.hgtags Tue Mar 28 18:01:53 2023 +0300 +++ b/.hgtags Tue Mar 28 18:01:54 2023 +0300 @@ -471,3 +471,4 @@ 5da2c0902e8e2aa4534008a582a60c61c135960e a63d0a70afea96813ba6667997bc7d68b5863f0d release-1.23.1 aa901551a7ebad1e8b0f8c11cb44e3424ba29707 release-1.23.2 ff3afd1ce6a6b65057741df442adfaa71a0e2588 release-1.23.3 +ac779115ed6ee4f3039e9aea414a54e560450ee2 release-1.23.4 From pluknet at nginx.com Tue Mar 28 16:37:02 2023 From: pluknet at nginx.com (Sergey Kandaurov) Date: Tue, 28 Mar 2023 20:37:02 +0400 Subject: [PATCH] Added TLSv1.3 to the default value of ssl_protocols and friends In-Reply-To: <23389F73-D1F7-4042-A2F4-B4E1AB47143E@nginx.com> References: <477d0fe1e6cb95533ffb.1679383149@ORK-ML-00007151> <23389F73-D1F7-4042-A2F4-B4E1AB47143E@nginx.com> Message-ID: <270BD3ED-74F2-433B-BFB6-8E200EBDDC67@nginx.com> > On 28 Mar 2023, at 18:37, Yaroslav Zhuravlev wrote: > > > >> On 24 Mar 2023, at 15:30, Maxim Konovalov wrote: >> >> Hi Yar, >> >> On 21.03.2023 00:19, Yaroslav Zhuravlev wrote: >>> diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml >>> --- a/xml/en/docs/http/ngx_http_grpc_module.xml >>> +++ b/xml/en/docs/http/ngx_http_grpc_module.xml >> [...] >>> @@ -633,7 +633,7 @@ >>> [TLSv1.1] >>> [TLSv1.2] >>> [TLSv1.3] >>> -TLSv1 TLSv1.1 TLSv1.2 >>> +TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 >>> http >>> server >>> location >> >> It makes sense to add a history note here and in other modules that have ssl_protocol directive. > > [...] > > Hi Maxim, > > Thank you for the feedback, the patch was accordingly updated: > > # HG changeset patch > # User Yaroslav Zhuravlev > # Date 1678486627 0 > # Fri Mar 10 22:17:07 2023 +0000 > # Node ID 6096d51ff4d2abecc67b47bc09cfbf03be69f7b0 > # Parent ac7518a1fe1c74daba708e30405a9b5d33f606e1 > Added TLSv1.3 to the default value of ssl_protocols and friends. > > diff --git a/xml/en/docs/http/configuring_https_servers.xml b/xml/en/docs/http/configuring_https_servers.xml > --- a/xml/en/docs/http/configuring_https_servers.xml > +++ b/xml/en/docs/http/configuring_https_servers.xml > @@ -8,7 +8,7 @@ >

link="/en/docs/http/configuring_https_servers.html" > lang="en" > - rev="13" > + rev="14" > author="Igor Sysoev" > editor="Brian Mercer"> > > @@ -31,7 +31,7 @@ > server_name www.example.com; > ssl_certificate www.example.com.crt; > ssl_certificate_key www.example.com.key; > - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; > + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; > ssl_ciphers HIGH:!aNULL:!MD5; > ... > } > @@ -59,7 +59,7 @@ > can be used to limit connections > to include only the strong versions and ciphers of SSL/TLS. > By default nginx uses > -“ssl_protocols TLSv1 TLSv1.1 TLSv1.2” > +“ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3” > and “ssl_ciphers HIGH:!aNULL:!MD5”, > so configuring them explicitly is generally not needed. > Note that default values of these directives were > @@ -110,7 +110,7 @@ > > ssl_certificate www.example.com.crt; > ssl_certificate_key www.example.com.key; > - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; > + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; > ssl_ciphers HIGH:!aNULL:!MD5; > ... > > @@ -446,6 +446,11 @@ > > > > +Version 1.23.4 and later: the default SSL protocols are TLSv1, > +TLSv1.1, TLSv1.2, and TLSv1.3 (if supported by the OpenSSL library). > + > + > + > Version 1.9.1 and later: the default SSL protocols are TLSv1, > TLSv1.1, and TLSv1.2 (if supported by the OpenSSL library). > > diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml > --- a/xml/en/docs/http/ngx_http_grpc_module.xml > +++ b/xml/en/docs/http/ngx_http_grpc_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/http/ngx_http_grpc_module.html" > lang="en" > - rev="8"> > + rev="9"> > >