Mercurial > hg > nginx
changeset 8871:74b43926b470 quic
HTTP/3: fixed segfault when using SSL certificates with variables.
A QUIC connection doesn't have c->log->data and friends initialized to sensible
values. Yet, a request can be created in the certificate callback with such an
assumption, which leads to a segmentation fault due to null pointer dereference
in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of
a connection such that it has all of that in place.
Further, this appends logging error context for unsuccessful QUIC handshakes:
- cannot load certificate .. while handling frames
- SSL_do_handshake() failed .. while sending frames
| author | Sergey Kandaurov <pluknet@nginx.com> |
|---|---|
| date | Wed, 29 Sep 2021 15:01:59 +0300 |
| parents | a550d4fa3581 |
| children | 2706d27d2c76 |
| files | src/http/modules/ngx_http_quic_module.c src/http/ngx_http_request.c |
| diffstat | 2 files changed, 8 insertions(+), 10 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/modules/ngx_http_quic_module.c +++ b/src/http/modules/ngx_http_quic_module.c @@ -198,8 +198,6 @@ ngx_http_quic_init(ngx_connection_t *c) hc->ssl = 1; if (c->quic == NULL) { - c->log->connection = c->number; - qcf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_quic_module); ngx_quic_run(c, qcf);
--- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -299,14 +299,6 @@ ngx_http_init_connection(ngx_connection_ /* the default server configuration for the address:port */ hc->conf_ctx = hc->addr_conf->default_server->ctx; -#if (NGX_HTTP_QUIC) - if (hc->addr_conf->quic) { - if (ngx_http_quic_init(c) == NGX_DONE) { - return; - } - } -#endif - ctx = ngx_palloc(c->pool, sizeof(ngx_http_log_ctx_t)); if (ctx == NULL) { ngx_http_close_connection(c); @@ -324,6 +316,14 @@ ngx_http_init_connection(ngx_connection_ c->log_error = NGX_ERROR_INFO; +#if (NGX_HTTP_QUIC) + if (hc->addr_conf->quic) { + if (ngx_http_quic_init(c) == NGX_DONE) { + return; + } + } +#endif + rev = c->read; rev->handler = ngx_http_wait_request_handler; c->write->handler = ngx_http_empty_handler;