Changeset 0bed0a0 in mod_gnutls

Timestamp:

Nov 7, 2018, 12:55:41 PM (23 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, master, proxy-ticket

Children:

dcaba46

Parents:

a939015

Message:

Update documentation on ALPN and HTTP/2

Files:

• CHANGELOG (modified) (1 diff)
• doc/mod_gnutls_manual.mdwn (modified) (3 diffs)

CHANGELOG

@@ -20 +20 @@
   mod_socache. Users may need to update their GnuTLSCache settings and
   load the appropriate socache modules.
-- Known issue: ALPN (required for HTTP/2) works correctly only if all
-  virtual hosts using mod_gnutls share the same Protocols setting,
-  reported by Vincent Tamet.
+- ALPN (required for HTTP/2) now works correctly with different
+  "Protocols" directives between virtual hosts if building with GnuTLS
+  3.6.3 or newer. Older versions require identical "Protocols"
+  directives for overlapping virtual hosts. Thanks to Vincent Tamet
+  for the bug report!
 - GnuTLSPriorities is optional now and defaults to "NORMAL" if
   missing. The same applies to GnuTLSProxyPriorities (if TLS proxy is

doc/mod_gnutls_manual.mdwn

@@ -51 +51 @@
 --------------
 
-HTTP/2 is supported with `mod_gnutls` but works correctly only if all
-virtual hosts using `mod_gnutls` share the same `Protocols`
-setting. This will be fixed in a future release, but will likely
-require GnuTLS 3.6 or later.
+HTTP/2 is supported with `mod_gnutls`. However, full support requires
+compiling with GnuTLS 3.6.3 or later. When using lower versions all
+virtual hosts using `mod_gnutls` with overlapping IP/port combinations
+need to use identical `Protocols` directives for protocol negotiation
+to work correctly.
 
 The technical reason is that using HTTP/2 requires ALPN (Application
 Layer Protocol Negotiation) to be set up before GnuTLS parses the TLS
 ClientHello message, but earlier hooks cannot use
-`gnutls_server_name_get()` to retrieve SNI data for virtual host
-selection.
+`gnutls_server_name_get()` to retrieve SNI (Server Name Indication)
+data for virtual host selection. Because of this `mod_gnutls` provides
+its own early SNI parser, which requires the `gnutls_ext_raw_parse()`
+function introduced in GnuTLS 3.6.3 to retrieve the extension data in
+a *pre* client hello hook.
 
 * * * * *
@@ -739 +743 @@
 -----------------------------------------
 
-`mod_gnutls` supports "Server Name Indication", as specified in [RFC
-6066, Section 3](https://tools.ietf.org/html/rfc6066#section-3). This
-allows hosting many TLS websites with a single IP address, you can
-just add the virtual host conigurations. All recent browsers support
+`mod_gnutls` supports Server Name Indication (SNI), as specified in
+[RFC 6066, Section 3](https://tools.ietf.org/html/rfc6066#section-3).
+This allows hosting many TLS websites with a single IP address, you
+can just add virtual host configurations. All recent browsers support
 this standard. Here is an example using SNI:
 
@@ -777 +781 @@
          GnuTLSCertificateFile conf/tls/site3.crt
          GnuTLSKeyFile conf/tls/site3.key
+         # Enable HTTP/2. With GnuTLS before version 3.6.3 all
+         # virtual hosts in this example would have to share this
+         # directive to work correctly.
+         Protocols h2 http/1.1
      </VirtualHost>