HTTP/3: fixed segfault when using SSL certificates with variables.

A QUIC connection doesn't have c->log->data and friends initialized to sensible
values.  Yet, a request can be created in the certificate callback with such an
assumption, which leads to a segmentation fault due to null pointer dereference
in ngx_http_free_request().  The fix is to adjust initializing the QUIC part of
a connection such that it has all of that in place.

Further, this appends logging error context for unsuccessful QUIC handshakes:
- cannot load certificate .. while handling frames
- SSL_do_handshake() failed .. while sending frames

2 files changed, 8 insertions, 10 deletions

diff --git a/src/http/modules/ngx_http_quic_module.c b/src/http/modules/ngx_http_quic_module.c
index b41c069b6..ce13a223f 100644
--- a/src/http/modules/ngx_http_quic_module.c
+++ b/src/http/modules/ngx_http_quic_module.c
@@ -198,8 +198,6 @@ ngx_http_quic_init(ngx_connection_t *c)
     hc->ssl = 1;
 
     if (c->quic == NULL) {
-        c->log->connection = c->number;
-
         qcf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_quic_module);
 
         ngx_quic_run(c, qcf);
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 2b838cfc3..6496a5400 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -299,14 +299,6 @@ ngx_http_init_connection(ngx_connection_t *c)
     /* the default server configuration for the address:port */
     hc->conf_ctx = hc->addr_conf->default_server->ctx;
 
-#if (NGX_HTTP_QUIC)
-    if (hc->addr_conf->quic) {
-        if (ngx_http_quic_init(c) == NGX_DONE) {
-            return;
-        }
-    }
-#endif
-
     ctx = ngx_palloc(c->pool, sizeof(ngx_http_log_ctx_t));
     if (ctx == NULL) {
         ngx_http_close_connection(c);
@@ -324,6 +316,14 @@ ngx_http_init_connection(ngx_connection_t *c)
 
     c->log_error = NGX_ERROR_INFO;
 
+#if (NGX_HTTP_QUIC)
+    if (hc->addr_conf->quic) {
+        if (ngx_http_quic_init(c) == NGX_DONE) {
+            return;
+        }
+    }
+#endif
+
     rev = c->read;
     rev->handler = ngx_http_wait_request_handler;
     c->write->handler = ngx_http_empty_handler;