We have released nghttp2 v1.38.0.
This release fixes the bug that on_header callback is still called after stream is closed.
http-parser is upgraded to v2.9.1.
This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
It also fixes the bug that HTTP/1.1 chunked request stalls.
Now nghttpx does not log authorization request header field value with -LINFO.
Now nghttpx can be built with modern LibreSSL.
We have released nghttp2 v1.37.0.
CMake build explicitly sets install location when building shared library.
This release fixes possible backend stall when header and request body are sent in their own packets.
The backend option gets weight parameter to influence backend selection.
This release fixes compile error with BoringSSL.
We have released nghttp2 v1.36.0.
CMake build disables shared library if ENABLE_SHARED_LIB is OFF.
http-parser has been upgraded to v2.9.0.
mruby has been upgraded to v2.0.0.
nghttpx now pools h1 backend connection per address and uses it when the round robin index points to the address.
nghttpx now randomizes backend address round robin order per thread.
The bug that long certificate serial numbers cannot be handled has been fixed.
An option to write per-request logs has been added.
The API to get the current server port has been added.
We have released nghttp2 v1.35.1.
This release fixes the broken trailing slash handling when routing a request. nghttpx allows a pattern which ends “/” to match the request path which just lacks the trailing “/”. Previously, this special handling did not work if certain patterns were registered.
We have released nghttp2 v1.35.0.
Use __has_declspec_attribute in order to check that
dllexport/dllimport can be used.
libevent detection with cmake has been improved.
C++14 language features are now required.
mruby send_info non-final response is now written early.
Fix assertion failure on mruby send_info with HTTP/1.1 frontend.
HTTP/1.1 non-final response is now handled correctly.
Clarify that time for connect includes TLS handshake.
We have released nghttp2 v1.34.0.
libnghttp2 now supports extended CONNECT method and :protocol pseudo
header field defined in RFC 8441.
To enable this functionality on server side, send
NGHTTP2_SETTINGS_ENABLE_CONNECT_PROTOCOL using
nghttp2_submit_settings().
nghttpx now supports “Bootstrapping WebSockets with HTTP/2” defined in RFC 8441 for both frontend and backend HTTP/2 connections.
read-timeout and write-timeout parameters have been added to
--backend option to specify read/write timeouts per pattern which
override values set by --backend-read-timeout and
--backend-write-timeout options.
This release fixes stability issues in neverbleed with OpenSSL 1.1.1.
mruby has been updated to version 1.4.1.
env.tls_handshake_finished has been added to mruby scripting to know
whether TLS handshake has been completed or not. This might be useful
to decide that 0-RTT data should be processed or not.
--tls13-ciphers and --tls-client-ciphers options have been added
to configure TLSv1.3 ciphers.
nghttpx now adds Early-Data header field to the request header field when request is included in 0-RTT packet, and TLS handshake has not been completed yet. Early-Data header field is defined in RFC 8470.
nghttpx now supports TLSv1.3 0-RTT data. By default, it accepts 0-RTT
data, but postpones the request until TLS handshake completes. The
new option --tls-no-postpone-early-data makes nghttpx not to
postpone request and adds Early-Data header field to backend request.
It is important to make sure that all backends must recognize
Early-Data header field to mitigate reply attack.
To enable 0-RTT data and most of the TLSv1.3 features, OpenSSL 1.1.1 is required.
We have released nghttp2 v1.33.0.
RFC 8336 ORIGIN frame support has been added.
The value of SETTINGS_MAX_CONCURRENT_STREAMS is now set to unlimited if a remote peer does not explicitly include it in SETTINGS frame. Previously, it remains the initial value, 100.
Configuring local address for cleartext connection has been added.
mruby parameter has been added to backend option. mruby
parameter specifies the path to mruby script file which is executed
when the particular pattern is selected.
Fix bug which causes worker process to abort if neverbleed daemon process is killed before deleting SSL_CTX object.
Fix bug that stream is reset if request body is arrived before backend is selected.
We have released nghttp2 v1.32.1.
nghttp2_session_set_stream_user_data now works for a stream which is
not created yet, but the request which creates the stream is queued.
We have released nghttp2 v1.32.0.
The incorrect validation of padding against frame boundary has been fixed.
Now once nghttp2_session went terminal state, it ignores all inputs.
The incoming HTTP status code 101 is now disallowed.
ENABLE_STATIC_LIB option is added to cmake build in order to build
static library.
neverbleed has been updated to compile with LibreSSL 2.7.
Now client sends TLS SNI extension.
The nghttp2 applications can now compile with LibreSSL 2.7 and without TLS NPN extension support.
h2load now exits early with the error if --rate and --duration are
used at the same time.
We have released nghttp2 v1.31.1.
This release addresses following security issue.
CVE-2018-1000168: Denial of service due to NULL pointer dereference.
If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault.
ALTSVC frame is defined by RFC 7838.
The largest frame size libnghttp2 accept is by default 16384 bytes.
Receiving ALTSVC frame is disabled by default. Application has to
enable it explicitly by calling
nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).
Transmission of ALTSVC is always enabled, and it does not cause this vulnerability.
ALTSVC frame is expected to be sent by server, and received by client as defined in RFC 7838.
Client and server are both affected by this vulnerability if the reception of ALTSVC frame is enabled. As written earlier, it is useless to enable reception of ALTSVC frame on server side. So, server is generally safe unless application accidentally enabled the reception of ALTSVC frame.
Upgrade to nghttp2 v1.31.1.
If the upgrade cannot be possible:
For client, disable ALTSVC, removing the call to
nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC)
For server, because it is never expected to receive ALTSVC, just
remove nghttp2_option_set_builtin_recv_extension_type(opt,
NGHTTP2_ALTSVC).
It was first reported to the nghttp2 team April 4 2018.
nghttp2 v1.31.1 was released on April 12 2018.
Reported by Jordan Zebor at F5 Networks, and James M Snell from Node.js project. Fixed by the nghttp2 team.
Thank you for all who involved.
This security advisory format is inspired from curl/libcurl project.