Re: TLS1.3

On 7/18/19 1:15 PM, Thomas Ward wrote: Might be helpful to point at https://trac.nginx.org/nginx/ticket/1654#comment:2 and other issues which have spurned the request to rebuild downstream. Which, given that NGINX built against 1.1.0 downstream and OpenSSL downstream in Ubuntu with 1.1.1 is s

Re: TLS1.3

Might be helpful to point at  https://trac.nginx.org/nginx/ticket/1654#comment:2 and other issues which have spurned the request to rebuild downstream. Which, given that NGINX built against 1.1.0 downstream and OpenSSL downstream in Ubuntu with 1.1.1 is set such that TLS 1.3 is "on by default" and

Re: TLS1.3

On 7/18/19 1:01 PM, Thomas Ward wrote: There's a few considerations here.  We need to make certain that such a rebuild to allow NGINX to control TLS 1.3 protocol or ciphers isn't going to introduce any additional TLS1.3 behaviors or feature functionality that otherwise would not be controlled b

TLS1.3

Hello. Downstream, in Ubuntu, we've got NGINX 1.14.0 in the repositories, and TLS 1.3 enabled in the bionic-updates repository due to OpenSSL being bumped to 1.1.1.  We don't currently have a mechanism This means that TLS1.3 is "on by default" with the standard config being rolled.  And nginx can

[nginx] Xslt: fixed potential buffer overflow with null character.

details: https://hg.nginx.org/nginx/rev/9a970c905045 branches: changeset: 7540:9a970c905045 user: Maxim Dounin date: Thu Jul 18 18:27:54 2019 +0300 description: Xslt: fixed potential buffer overflow with null character. Due to shortcomings of the ccv->zero flag implementation in com

[nginx] SSI: avoid potential buffer overflow.

details: https://hg.nginx.org/nginx/rev/d75153522557 branches: changeset: 7539:d75153522557 user: Maxim Dounin date: Thu Jul 18 18:27:53 2019 +0300 description: SSI: avoid potential buffer overflow. When "-" follows a parameter of maximum length, a single byte buffer overflow happen

[nginx] HTTP/2: return error on output on closed stream.

details: https://hg.nginx.org/nginx/rev/01e26357916a branches: changeset: 7537:01e26357916a user: Maxim Dounin date: Thu Jul 18 18:27:50 2019 +0300 description: HTTP/2: return error on output on closed stream. Without this, an (incorrect) output on a closed stream could result in a

[nginx] Upstream: fixed EOF handling in unbuffered and upgraded modes.

details: https://hg.nginx.org/nginx/rev/08ed570ad93c branches: changeset: 7538:08ed570ad93c user: Maxim Dounin date: Thu Jul 18 18:27:52 2019 +0300 description: Upstream: fixed EOF handling in unbuffered and upgraded modes. With level-triggered event methods it is important to speci

[nginx] Core: fixed segfault with too large bucket sizes (ticket #1806).

details: https://hg.nginx.org/nginx/rev/c3f60d618c17 branches: changeset: 7536:c3f60d618c17 user: Maxim Dounin date: Thu Jul 18 18:27:44 2019 +0300 description: Core: fixed segfault with too large bucket sizes (ticket #1806). To save memory hash code uses u_short to store resulting

[njs] Fixed typo in njs_parser_string_create() introduced in f1a70d67646d.

details: https://hg.nginx.org/njs/rev/57cf608a29b5 branches: changeset: 1058:57cf608a29b5 user: Alexander Borisov date: Thu Jul 18 16:18:19 2019 +0300 description: Fixed typo in njs_parser_string_create() introduced in f1a70d67646d. diffstat: njs/njs_parser_terminal.c | 2 +- 1 f