]> git.kaiwu.me - nginx.git/commit
QUIC: registering the compat extension in all SSL contexts
authorSergey Kandaurov <pluknet@nginx.com>
Tue, 8 Sep 2026 19:56:38 +0000 (19:56 +0000)
committerSergey Kandaurov <pluknet@nginx.com>
Tue, 15 Sep 2026 15:06:31 +0000 (19:06 +0400)
commit7c7363266d54bc3836c1d13d1ed1e1d93ee9ed98
tree368e411fc4f7b6fa64e99fa7aa3be3880fcfc639
parentf9c4264b6b48f4d9559dabd8ff2ff356e12d95fb
QUIC: registering the compat extension in all SSL contexts

With the OpenSSL compatibility layer, the transport parameters custom
TLS extension used to be registered only in SSL contexts of virtual
servers reachable over QUIC.

The ClientHello callback introduced in 0373fe5d9 (1.29.2) is called
by OpenSSL between collecting and parsing extensions, so the custom
extensions may not match the expected number if the SSL context was
replaced with SSL_set_SSL_CTX().

The fix is to register the extension in all SSL contexts, including
those that cannot be reached over QUIC, so that the array bounds are
preserved; the compatibility layer as a whole is initialized only
if the configuration has QUIC listeners.  The keylog callback,
meaningful for QUIC connections, is kept on QUIC addresses.

Reported by Banny Liao.
src/event/quic/ngx_event_quic_openssl_compat.c
src/event/quic/ngx_event_quic_openssl_compat.h
src/http/modules/ngx_http_ssl_module.c