details: https://hg.nginx.org/nginx/rev/61abb35bb8cf
branches:
changeset: 7934:61abb35bb8cf
user: Vladimir Homutov <vl@nginx.com>
date: Fri Oct 15 10:02:15 2021 +0300
description:
HTTP/2: removed support for NPN.

NPN was replaced with ALPN, published as RFC 7301 in July 2014.
It used to negotiate SPDY (and, in transition, HTTP/2).

NPN supported appeared in OpenSSL 1.0.1. It does not work with TLSv1.3 [1].
ALPN is supported since OpenSSL 1.0.2.

The NPN support was dropped in Firefox 53 [2] and Chrome 51 [3].

[1] https://github.com/openssl/openssl/issues/3665.
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1248198
[3] https://www.chromestatus.com/feature/5767920709795840

diffstat:

src/http/modules/ngx_http_ssl_module.c | 59 ++-------------------------------
src/http/ngx_http.c | 5 +-
src/http/ngx_http_request.c | 14 +-------
src/http/v2/ngx_http_v2.h | 3 +-
4 files changed, 9 insertions(+), 72 deletions(-)

diffs (166 lines):

diff -r 2f443cac3f1e -r 61abb35bb8cf src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c Mon Oct 18 16:46:59 2021 +0300
+++ b/src/http/modules/ngx_http_ssl_module.c Fri Oct 15 10:02:15 2021 +0300
@@ -17,7 +17,7 @@ typedef ngx_int_t (*ngx_ssl_variable_han
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
#define NGX_DEFAULT_ECDH_CURVE "auto"

-#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
+#define NGX_HTTP_ALPN_PROTO "\x08http/1.1"


#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
@@ -26,11 +26,6 @@ static int ngx_http_ssl_alpn_select(ngx_
const unsigned char *in, unsigned int inlen, void *arg);
#endif

-#ifdef TLSEXT_TYPE_next_proto_neg
-static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn,
- const unsigned char **out, unsigned int *outlen, void *arg);
-#endif
-
static ngx_int_t ngx_http_ssl_static_variable(ngx_http_request_t *r,
ngx_http_variable_value_t *v, uintptr_t data);
static ngx_int_t ngx_http_ssl_variable(ngx_http_request_t *r,
@@ -444,15 +439,14 @@ ngx_http_ssl_alpn_select(ngx_ssl_conn_t
hc = c->data;

if (hc->addr_conf->http2) {
- srv =
- (unsigned char *) NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE;
- srvlen = sizeof(NGX_HTTP_V2_ALPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1;
+ srv = (unsigned char *) NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTO;
+ srvlen = sizeof(NGX_HTTP_V2_ALPN_PROTO NGX_HTTP_ALPN_PROTO) - 1;

} else
#endif
{
- srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE;
- srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1;
+ srv = (unsigned char *) NGX_HTTP_ALPN_PROTO;
+ srvlen = sizeof(NGX_HTTP_ALPN_PROTO) - 1;
}

if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen,
@@ -471,44 +465,6 @@ ngx_http_ssl_alpn_select(ngx_ssl_conn_t
#endif


-#ifdef TLSEXT_TYPE_next_proto_neg
-
-static int
-ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn,
- const unsigned char **out, unsigned int *outlen, void *arg)
-{
-#if (NGX_HTTP_V2 || NGX_DEBUG)
- ngx_connection_t *c;
-
- c = ngx_ssl_get_connection(ssl_conn);
- ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "SSL NPN advertised");
-#endif
-
-#if (NGX_HTTP_V2)
- {
- ngx_http_connection_t *hc;
-
- hc = c->data;
-
- if (hc->addr_conf->http2) {
- *out =
- (unsigned char *) NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE;
- *outlen = sizeof(NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1;
-
- return SSL_TLSEXT_ERR_OK;
- }
- }
-#endif
-
- *out = (unsigned char *) NGX_HTTP_NPN_ADVERTISE;
- *outlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1;
-
- return SSL_TLSEXT_ERR_OK;
-}
-
-#endif
-
-
static ngx_int_t
ngx_http_ssl_static_variable(ngx_http_request_t *r,
ngx_http_variable_value_t *v, uintptr_t data)
@@ -792,11 +748,6 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *
SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL);
#endif

-#ifdef TLSEXT_TYPE_next_proto_neg
- SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx,
- ngx_http_ssl_npn_advertised, NULL);
-#endif
-
if (ngx_ssl_ciphers(cf, &conf->ssl, &conf->ciphers,
conf->prefer_server_ciphers)
!= NGX_OK)
diff -r 2f443cac3f1e -r 61abb35bb8cf src/http/ngx_http.c
--- a/src/http/ngx_http.c Mon Oct 18 16:46:59 2021 +0300
+++ b/src/http/ngx_http.c Fri Oct 15 10:02:15 2021 +0300
@@ -1338,13 +1338,12 @@ ngx_http_add_address(ngx_conf_t *cf, ngx
}

#if (NGX_HTTP_V2 && NGX_HTTP_SSL \
- && !defined TLSEXT_TYPE_application_layer_protocol_negotiation \
- && !defined TLSEXT_TYPE_next_proto_neg)
+ && !defined TLSEXT_TYPE_application_layer_protocol_negotiation)

if (lsopt->http2 && lsopt->ssl) {
ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
"nginx was built with OpenSSL that lacks ALPN "
- "and NPN support, HTTP/2 is not enabled for %V",
+ "support, HTTP/2 is not enabled for %V",
&lsopt->addr_text);
}

diff -r 2f443cac3f1e -r 61abb35bb8cf src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c Mon Oct 18 16:46:59 2021 +0300
+++ b/src/http/ngx_http_request.c Fri Oct 15 10:02:15 2021 +0300
@@ -806,8 +806,7 @@ ngx_http_ssl_handshake_handler(ngx_conne
c->ssl->no_wait_shutdown = 1;

#if (NGX_HTTP_V2 \
- && (defined TLSEXT_TYPE_application_layer_protocol_negotiation \
- || defined TLSEXT_TYPE_next_proto_neg))
+ && defined TLSEXT_TYPE_application_layer_protocol_negotiation)
{
unsigned int len;
const unsigned char *data;
@@ -817,19 +816,8 @@ ngx_http_ssl_handshake_handler(ngx_conne

if (hc->addr_conf->http2) {

-#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
SSL_get0_alpn_selected(c->ssl->connection, &data, &len);

-#ifdef TLSEXT_TYPE_next_proto_neg
- if (len == 0) {
- SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
- }
-#endif
-
-#else /* TLSEXT_TYPE_next_proto_neg */
- SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len);
-#endif
-
if (len == 2 && data[0] == 'h' && data[1] == '2') {
ngx_http_v2_init(c->read);
return;
diff -r 2f443cac3f1e -r 61abb35bb8cf src/http/v2/ngx_http_v2.h
--- a/src/http/v2/ngx_http_v2.h Mon Oct 18 16:46:59 2021 +0300
+++ b/src/http/v2/ngx_http_v2.h Fri Oct 15 10:02:15 2021 +0300
@@ -13,8 +13,7 @@
#include <ngx_http.h>


-#define NGX_HTTP_V2_ALPN_ADVERTISE "\x02h2"
-#define NGX_HTTP_V2_NPN_ADVERTISE NGX_HTTP_V2_ALPN_ADVERTISE
+#define NGX_HTTP_V2_ALPN_PROTO "\x02h2"

#define NGX_HTTP_V2_STATE_BUFFER_SIZE 16

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel