]> git.kaiwu.me - nginx.git/commit
QUIC: disabled OpenSSL 3.5 QUIC API support by default.
authorSergey Kandaurov <pluknet@nginx.com>
Tue, 27 May 2025 17:56:40 +0000 (21:56 +0400)
committerpluknet <pluknet@nginx.com>
Mon, 23 Jun 2025 18:35:09 +0000 (22:35 +0400)
commitcedb855d75ceefd7fe513f9c27c9364678582786
treee3d52ce0577c97e58919961b12e74b1f793511d2
parentcdf7a9c6cb7f344efc80d790fbacdc1c94ab16e3
QUIC: disabled OpenSSL 3.5 QUIC API support by default.

In OpenSSL 3.5.0, the "quic_transport_parameters" extension set
internally by the QUIC API is cleared on the SSL context switch,
which disables sending QUIC transport parameters if switching to
a different server block on SNI.  See the initial report in [1].

This is fixed post OpenSSL 3.5.0 [2].  The fix is anticipated in
OpenSSL 3.5.1, which has not been released yet.  When building
with OpenSSL 3.5, OpenSSL compat layer is now used by default.
The OpenSSL 3.5 QUIC API support can be switched back using
--with-cc-opt='-DNGX_QUIC_OPENSSL_API=1'.

[1] https://github.com/nginx/nginx/issues/711
[2] https://github.com/openssl/openssl/commit/45bd3c3798
src/event/quic/ngx_event_quic.h