nghttp2/nghttp2
1
0
Fork 0
mirror of https://github.com/nghttp2/nghttp2.git synced 2025-12-11 20:48:52 +08:00
Code Issues Projects Releases Wiki Activity
7,423 Commits 35 Branches 132 Tags
5d68d1dc7adbbbbe1dd9e56e23cecb735772bea8
Commit Graph

7423 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tatsuhiro Tsujikawa
e62ef924fb Merge pull request #1958 from nghttp2/nghttpx-fix 
nghttpx: Fix bug that --single-process does not work
 2023-10-01 15:39:23 +09:00
Tatsuhiro Tsujikawa
8bad736d48 nghttpx: Fix bug that --single-process does not work 2023-10-01 15:18:39 +09:00
Tatsuhiro Tsujikawa
e761014ca5 Merge pull request #1957 from nghttp2/apps-fix 
Apps fix
 2023-10-01 12:30:44 +09:00
Tatsuhiro Tsujikawa
e6ca4ff173 nghttpd: Do not read too greedy for TLS connection 2023-10-01 11:59:53 +09:00
Tatsuhiro Tsujikawa
62d58bdabc nghttpx: Fix the bug that TLS connection is not rate limited 2023-09-30 22:53:31 +09:00
Alexandr Vlasov
775e4f1bad ngtcp2 has merged BBR and BBRv2 under BBR 2023-09-29 14:07:52 +02:00
Tatsuhiro Tsujikawa
e37fe5543f Merge pull request #1945 from nghttp2/bump-quictls 
Bump quictls
 2023-09-23 16:25:54 +09:00
Tatsuhiro Tsujikawa
d54750b365 Merge pull request #1953 from nghttp2/nghttpx-field-name-lowercase 
nghttpx: Header field name must be lowercase
 2023-09-22 11:02:01 +09:00
Tatsuhiro Tsujikawa
8ebe7b10fc nghttpx: Header field name must be lowercase 2023-09-22 10:09:54 +09:00
Tatsuhiro Tsujikawa
5c1b0f261e Merge pull request #1951 from nghttp2/docker-debian12 
docker: Bump base image to debian 12
 2023-09-15 21:41:10 +09:00
Tatsuhiro Tsujikawa
0866ceffc7 Merge pull request #1947 from nghttp2/dependabot/github_actions/actions/upload-artifact-3 
Bump actions/upload-artifact from 1 to 3
 2023-09-15 20:41:41 +09:00
Tatsuhiro Tsujikawa
3c6f94258f Merge pull request #1949 from nghttp2/dependabot/github_actions/actions/checkout-4 
Bump actions/checkout from 3 to 4
 2023-09-15 19:36:46 +09:00
Tatsuhiro Tsujikawa
959a55f95f Merge pull request #1948 from nghttp2/dependabot/github_actions/actions/setup-go-4 
Bump actions/setup-go from 3 to 4
 2023-09-15 19:12:09 +09:00
dependabot[bot]
7d0d8775c9 Bump actions/setup-go from 3 to 4 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-15 09:50:01 +00:00
Tatsuhiro Tsujikawa
52cb8c35c8 Merge pull request #1950 from nghttp2/bump-golang.org/x/net 
Bump golang.org/x/net to v0.15.0
 2023-09-15 18:48:49 +09:00
Tatsuhiro Tsujikawa
d19bc4bb67 Bump golang.org/x/net to v0.15.0 2023-09-15 18:28:01 +09:00
Tatsuhiro Tsujikawa
1ee16fdeca docker: Bump base image to debian 12 2023-09-15 18:13:39 +09:00
dependabot[bot]
b809beacab Bump actions/checkout from 3 to 4 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-15 08:55:19 +00:00
dependabot[bot]
8cafb048be Bump actions/upload-artifact from 1 to 3 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 1 to 3.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v1...v3)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-15 08:55:00 +00:00
Tatsuhiro Tsujikawa
627b2408e5 Merge pull request #1946 from nghttp2/dependabot-actions 
Add dependabot to update actions
 2023-09-15 17:44:06 +09:00
Tatsuhiro Tsujikawa
0d36a2a050 Add dependabot to update actions 2023-09-15 17:13:09 +09:00
Tatsuhiro Tsujikawa
06da18089f Bump quictls 2023-09-12 18:52:06 +09:00
Tatsuhiro Tsujikawa
19697bd44a Merge pull request #1944 from nghttp2/bump-ngtcp2 
Bump ngtcp2
 2023-09-12 18:50:02 +09:00
Tatsuhiro Tsujikawa
2e6c8ddd15 Bump ngtcp2 2023-09-06 23:23:57 +09:00
Tatsuhiro Tsujikawa
b7f9853968 Bump package version 2023-09-04 18:32:43 +09:00
Tatsuhiro Tsujikawa
80d05fe917 Merge pull request #1943 from nghttp2/update-dockerfile 
Update Dockerfile
v1.56.0 		2023-09-04 18:27:04 +09:00
Tatsuhiro Tsujikawa
08c472230a Update Dockerfile 2023-09-04 18:11:18 +09:00
Tatsuhiro Tsujikawa
47ecf35737 Update manual pages 2023-09-04 18:04:09 +09:00
Tatsuhiro Tsujikawa
b48355b67e Bump package and library versions 2023-09-03 19:45:03 +09:00
Tatsuhiro Tsujikawa
0f768bdaab Merge pull request #1942 from nghttp2/bump-libbpf 
Bump libbpf to v1.2.2
 2023-09-03 19:44:37 +09:00
Tatsuhiro Tsujikawa
05f93ca729 Bump libbpf to v1.2.2 2023-09-03 19:26:17 +09:00
Tatsuhiro Tsujikawa
d70f0013d6 Merge pull request #1941 from nghttp2/bump-llhttp 
Bump llhttp to 926c982942eb53a13f01c1e9e6b19bd3b196e7dd
 2023-09-03 19:25:50 +09:00
Tatsuhiro Tsujikawa
d5cb882e62 Bump llhttp to 926c982942eb53a13f01c1e9e6b19bd3b196e7dd 2023-09-03 19:06:33 +09:00
Tatsuhiro Tsujikawa
2a382a2ce9 Merge pull request #1940 from nghttp2/simplify-unique_ptr-release 
nghttpx: Simplify std::unique_ptr get and release
 2023-09-03 18:29:37 +09:00
Tatsuhiro Tsujikawa
c13b08f861 nghttpx: Simplify std::unique_ptr get and release 2023-09-03 18:11:53 +09:00
Tatsuhiro Tsujikawa
298f71ce4e Merge pull request #1939 from nghttp2/bump-ngtcp2 
Bump ngtcp2 and its dependencies
 2023-09-03 15:02:54 +09:00
Tatsuhiro Tsujikawa
4114507587 Bump ngtcp2 and its dependencies 2023-09-03 13:17:39 +09:00
Tatsuhiro Tsujikawa
060d0ac455 Merge pull request #1937 from nghttp2/bump-quictls 
Bump quictls
 2023-08-05 19:35:12 +09:00
Tatsuhiro Tsujikawa
9a3c345f60 Bump quictls 2023-08-05 18:58:27 +09:00
Tatsuhiro Tsujikawa
98eb01aa3f Merge pull request #1935 from nghttp2/cmsg-data 
CMSG_DATA does not necessarily return an aligned pointer
 2023-08-02 21:06:45 +09:00
Tatsuhiro Tsujikawa
de47400a48 CMSG_DATA does not necessarily return an aligned pointer 2023-08-02 18:46:39 +09:00
Tatsuhiro Tsujikawa
871cf8e5a2 Merge pull request #1934 from nghttp2/ecn 
nghttpx: Rework sending and receiving ECN bits
 2023-08-02 18:46:07 +09:00
Tatsuhiro Tsujikawa
6ace578e5b nghttpx: Rework sending and receiving ECN bits 
Now ECN is sent along with sendmsg ancillary message.  With this
commit, ECN should work fine with the recent Mac OS.
 2023-08-02 17:47:51 +09:00
Tatsuhiro Tsujikawa
7273ec17d3 Merge pull request #1931 from nghttp2/return-void 
Return void
 2023-07-16 16:15:49 +09:00
Tatsuhiro Tsujikawa
07b69bb06f Make session_after_frame_sent2 return void 2023-07-15 16:27:38 +09:00
Tatsuhiro Tsujikawa
98df5b59e5 frame: Make functions that always succeed return void 2023-07-15 16:15:25 +09:00
Tatsuhiro Tsujikawa
cdfb517528 Make functions that always succeed return void 2023-07-15 15:36:50 +09:00
Tatsuhiro Tsujikawa
b16d4e951e Bump library version due to the patch release 2023-07-14 22:53:52 +09:00
Tatsuhiro Tsujikawa
feb5ff560a Merge pull request #1930 from nghttp2/fix-memory-leak 
Fix memory leak
 2023-07-14 21:56:30 +09:00
Tatsuhiro Tsujikawa
ce385d3f55 Fix memory leak 
This commit fixes memory leak that happens when PUSH_PROMISE or
HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback
fails with a fatal error.  For example, if GOAWAY frame has been
received, a HEADERS frame that opens new stream cannot be sent.

This issue has already been made public via CVE-2023-35945 [1] issued
by envoyproxy/envoy project.  During embargo period, the patch to fix
this bug was accidentally submitted to nghttp2/nghttp2 repository [2].
And they decided to disclose CVE early.  I was notified just 1.5 hours
before disclosure.  I had no time to respond.

PoC described in [1] is quite simple, but I think it is not enough to
trigger this bug.  While it is true that receiving GOAWAY prevents a
client from opening new stream, and nghttp2 enters error handling
branch, in order to cause the memory leak,
nghttp2_session_close_stream function must return a fatal error.
nghttp2 defines 2 fatal error codes:

- NGHTTP2_ERR_NOMEM
- NGHTTP2_ERR_CALLBACK_FAILURE

NGHTTP2_ERR_NOMEM, as its name suggests, indicates out of memory.  It
is unlikely that a process gets short of memory with this simple PoC
scenario unless application does something memory heavy processing.

NGHTTP2_ERR_CALLBACK_FAILURE is returned from application defined
callback function (nghttp2_on_stream_close_callback, in this case),
which indicates something fatal happened inside a callback, and a
connection must be closed immediately without any further action.  As
nghttp2_on_stream_close_error_callback documentation says, any error
code other than 0 or NGHTTP2_ERR_CALLBACK_FAILURE is treated as fatal
error code.  More specifically, it is treated as if
NGHTTP2_ERR_CALLBACK_FAILURE is returned.  I guess that envoy returns
NGHTTP2_ERR_CALLBACK_FAILURE or other error code which is translated
into NGHTTP2_ERR_CALLBACK_FAILURE.

[1] https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
[2] https://github.com/nghttp2/nghttp2/pull/1929
 2023-07-14 21:37:37 +09:00