> On 17 Oct 2022, at 17:31, Roman Arutyunyan <arut@nginx.com> wrote:
>
> Hi,
>
> On Tue, Oct 11, 2022 at 02:35:52PM +0400, Sergey Kandaurov wrote:
>> # HG changeset patch
>> # User Sergey Kandaurov <pluknet@nginx.com>
>> # Date 1665484414 -14400
>> # Tue Oct 11 14:33:34 2022 +0400
>> # Branch quic
>> # Node ID c0165ddcb1c6981f8e5230081f03a277f62d20c3
>> # Parent caced81ce0a9cb218ae8cdd6176c12e0614acee9
>> QUIC: support for setting QUIC methods with LibreSSL.
>>
>> Setting QUIC methods is converted to use C99 designated initializers
>> for simplicity, as LibreSSL 3.6.0 has different SSL_QUIC_METHOD layout.
>>
>> Additionally, it's stick with set_read_secret/set_write_secret callbacks.
>> LibreSSL prefers set_encryption_secrets over them but has unexpectedly
>> incompatible behaviour expressed in passing read and write secrets split
>> in separate calls, unlike this is documented in old BoringSSL sources.
>
> Why do you think it prefres set_encryption_secrets()? The source code
> references it as "old", see this comment from tls13_quic_set_read_traffic_key():
>
> /* Handle both the new (BoringSSL) and old (quictls) APIs. */
>

Tnx, looks like a false memory from before applying the patch.
Anyway, it's still worth to leave only the new API.

This updates the last paragraph of the change description:

: Additionally, only set_read_secret/set_write_secret callbacks are set.
: Although they are preferred in LibreSSL over set_encryption_secrets,
: better be on a safe side as LibreSSL has unexpectedly incompatible
: set_encryption_secrets calling convention expressed in passing read
: and write secrets split in separate calls, unlike this is documented
: in old BoringSSL sources. To avoid introducing further changes for
: the old API, it is simply disabled.

>>
>> diff --git a/src/event/quic/ngx_event_quic_ssl.c b/src/event/quic/ngx_event_quic_ssl.c
>> --- a/src/event/quic/ngx_event_quic_ssl.c
>> +++ b/src/event/quic/ngx_event_quic_ssl.c
>> @@ -18,7 +18,7 @@
>> #define NGX_QUIC_MAX_BUFFERED 65535
>>
>>
>> -#if BORINGSSL_API_VERSION >= 10
>> +#if BORINGSSL_API_VERSION >= 10 || defined LIBRESSL_VERSION_NUMBER
>> static int ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
>> enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
>> const uint8_t *secret, size_t secret_len);
>> @@ -40,19 +40,19 @@ static ngx_int_t ngx_quic_crypto_input(n
>>
>>
>> static SSL_QUIC_METHOD quic_method = {
>> -#if BORINGSSL_API_VERSION >= 10
>> - ngx_quic_set_read_secret,
>> - ngx_quic_set_write_secret,
>> +#if BORINGSSL_API_VERSION >= 10 || defined LIBRESSL_VERSION_NUMBER
>> + .set_read_secret = ngx_quic_set_read_secret,
>> + .set_write_secret = ngx_quic_set_write_secret,
>> #else
>> - ngx_quic_set_encryption_secrets,
>> + .set_encryption_secrets = ngx_quic_set_encryption_secrets,
>> #endif
>> - ngx_quic_add_handshake_data,
>> - ngx_quic_flush_flight,
>> - ngx_quic_send_alert,
>> + .add_handshake_data = ngx_quic_add_handshake_data,
>> + .flush_flight = ngx_quic_flush_flight,
>> + .send_alert = ngx_quic_send_alert,
>> };
>>
>>
>> -#if BORINGSSL_API_VERSION >= 10
>> +#if BORINGSSL_API_VERSION >= 10 || defined LIBRESSL_VERSION_NUMBER
>>
>> static int
>> ngx_quic_set_read_secret(ngx_ssl_conn_t *ssl_conn,
>>

--
Sergey Kandaurov

_______________________________________________
nginx-devel mailing list -- nginx-devel@nginx.org
To unsubscribe send an email to nginx-devel-leave@nginx.org