• Add nghttp2_session_set_local_window_size API function
• Add nghttp2_option_set_max_send_header_block_length API function (GH-613)
• Fix warning: declaration of 'free' shadows a global declaration (Patch from Alexis La Goutte)
• examples: Add ALPN support to tutorial client/server (GH-614)
• nghttpx: Reduce TTFB with large number of incoming connections
• nghttpx: Rewrite read timer handling
• nghttpx: Clean up neverbleed AF_UNIX socket
• nghttpx: Add --backend-max-backoff option
• nghttpx: Use 16KiB buffer for reading to match TLS record size
• nghttpx: Add healthmon parameter to -f option to enable health monitor mode
• nghttpx: Receive reference of std::mt19937, not making a copy
• nghttpx: Fix bug that backend never return to online (GH-615)
• nghttpx: Implement client IP based session affinity
• nghttpx: Add --api-max-request-body option to set maximum API request body size
• nghttpx: Add api parameter to --frontend option to mark API endpoint
• h2load: Add content-length header field for HTTP/2 and SPDY as well
• h2load: Implement HTTP/1 upload (GH-611)

• nghttpx: Fix bug that regular timeout on HTTP/1 backend makes that backend unavailable for load balancing

• lib: Add nghttp2_hd_inflate_hd2() and deprecate nghttp2_hd_inflate_hd()
• lib: Avoid 0-length DATA if NGHTTP2_DATA_FLAG_NO_END_STREAM is set
• lib: Fix bug that PING flags are ignored in nghttp2_submit_ping
• integration: Workaround runtime error: cgo argument has Go pointer to Go pointer
• src: Compile with OpenSSL 1.1.0-pre5
• h2load: Enable kqueue if it is available in the running platform
• h2load: Fix crash on exit on FreeBSD
• nghttp: Eliminate zero length DATA frame at the end if possible
• nghttpd: Enable kqueue if it is available on the running platform
• nghttpd: Set content-length in status response
• nghttpx: Add connection: close to mruby response in graceful shutdown period
• nghttpx: Add mruby env.server_addr and env.tls_used attributes
• nghttpx: Add mruby env.server_port to return frontend server side port
• nghttpx: Add sni keyword to --backend option
• nghttpx: Allow mixed protocol and TLS settings among backends under same pattern
• nghttpx: Don't add 0-length DATA when response HEADERS bears END_STREAM flag
• nghttpx: Don't add chunked encoded response body for HEAD request
• nghttpx: Don't use CN if we have dNSName or iPAddress field
• nghttpx: Enable kqueue by default
• nghttpx: Just call execv instead of execve to pass environ
• nghttpx: Make SETTINGS timeout value configurable
• nghttpx: Save PID file after it is ready to accept connections
• nghttpx: Treat backend failure if SETTINGS is not received within timeout
• nghttpx: Wait for SETTINGS ACK to make sure that backend h2 server is alive

• Pass unknown SETTINGS values to nghttp2_on_frame_recv_callback
• Add ALTSVC frame support
• Run error callback when peer does not send initial SETTINGS frame
• Update http-parser
• Update sphinx_rtd_theme
• nghttp: add an --expect-continue option (Patch from Jacob Champion)
• nghttpx: Fix downstream connect callback called early (Patch from Brian Suh)
• nghttpx: Truncate too long -b option signature
• nghttpx: Fix bug that server push from mruby script did not work
• nghttpx: Try next HTTP/1 backend address when connection cannot be made
• nghttpx: Retry next HTTP/2 backend address when connection cannot be made
• nghttpx: Enable link header field based push for non-final response
• nghttpx: Detect online/offline state of backend servers
• nghttpx: Better load balancing between backend HTTP/2 servers
• nghttpx: Fix crash with backend failure

• nghttpx: Fix crash with backend failure
• nghttpx: Better distribute load to backend h2 servers
• nghttpx: Fix error messages on deprecated mode (Patch from Jianqing Wang)
• nghttpx: Fix bug that logger wrote string which was not NULL-terminated
• nghttpx: Fix bug that proxy with HTTP/1.1 CONNECT did not work

• nghttpx: Fix bug that backend tls keyword did not work with -s option
• nghttpx: Fix handing stream after connection check was failed

• lib: Add nghttp2_error_callback to tell application human readable error message
• lib: Reference counted HPACK name/value pair, adding nghttp2_on_header_callback2
• lib: Add nghttp2_option_set_no_auto_ping_ack() option
• lib: Add nghttp2_http2_strerror() to return HTTP/2 error code string
• build: Makefile.msvc enhancements (Patch from Jan-E)
• build: Lower libev version requirement (Patch from Peter Wu)
• build: cmake build support (Patch from Peter Wu)
• asio: Fix bug that server event loop breaks with exception
• integration: Disable tests that sometimes break randomly on travis
• integration: do not use recursive target (Patch from Peter Wu)
• h2load: Fix bug that it did not try to connect to server again
• h2load: Fix bug that initial max concurrent streams was too large
• nghttpx: Memcached connection encryption with tls keyword
• nghttpx: Enable/disable TLS per frontend address
• nghttpx: Configure TLS per backend routing pattern
• nghttpx: Workaround for Ubuntu 15.04 which does not value-initialize on std::make_shared.
• nghttpx: Add --error-page option to set custom error pages
• nghttpx: Add wildcard host routing
• nghttpx: Change read timeout reset timing
• nghttpx: Don't push if Link header field includes nopush
• nghttpx: Deprecate backend-http1-connections-per-host in favor of backend-connections-per-host
• nghttpx: Restructure mode settings, removing --http2-bridge, --client, and --client-proxy options
• nghttpx: Deprecate backend-http1-connections-per-frontend in favor of backend-connections-per-frontend
• nghttpx: Don't share session which is already in draining state
• nghttpx: Effectively disable backend HTTP/2 connection flow control
• nghttpx: Add --frontend-http2-max-concurrent-streams and --backend-http2-max-concurrent-streams, and deprecate --http2-max-concurrent-streams option
• nghttpx: Deprecate --backend-http2-connections-per-worker option
• nghttpx: Share TLS session cache between HTTP/2 and HTTP/1 backend
• nghttpx: Rewrite backend HTTP/2 connection coalesce strategy

• Add Architecture documents (work in progress)
• List all contributors in AUTHORS
• doc: fix out-of-tree doc builds (Patch from Peter Wu)
• Wrap AM_PATH_XML2 by m4_ifdef to handle the case when AM_PATH_XML2 is not found
• Fix configure script for non-gcc, clang build
• Document compiling apps and include h2load in configure (Patch from David Beitey)
• Don't check for dlopen/libdl on *BSD (Patch from Bernard Spil)
• Don't taint CXXFLAGS from AX_CXX_COMPILE_STDCXX_11
• Fixing Windows Makefile version detection (Patch from Reza Tavakoli)
• lib: Tokenize extra HTTP header fields
• lib: Fix typo in HAVE_CONFIG_H name (Patch from Peter Wu)
• lib: Add HTTP/2 extension framework to send and receive non-critical frames
• tests: remove unused macros (Patch from Peter Wu)
• src: Update default cipher list
• src: Fix compile error with gcc-6 which enables C++14 by default
• asio: client: Fix connect timeout does not work, return from cb if session stopped, removing client::session::connect_timeout() functon
• nghttpd: Start SETTINGS timer after it is written to output buffer
• nghttpd: Add trailer header field to status responses
• nghttpd: Add -w and -W options to change window size
• nghttpx: Worker wide blocker which is used when socket(2) is failed
• nghttpx: ConnectBlocker per backend address
• nghttpx: Interleave text/html pushed resources with associated resource
• nghttpx: Add headers given in add-response-headers for mruby response
• nghttpx: Deprecate --backend-ipv4 and --backend-ipv6 in favor of --backend-address-family
• nghttpx: Add options to specify address family of memcached connections
• nghttpx: Add encryption support for TLS ticket key retrieval
• nghttpx: Add TLS support for session cache memcached connection
• nghttpx: Refactor blacklisted cipher suite check (Patch from Jay Satiro)
• nghttpx: Add TLS support for HTTP/1 backend
• nghttpx: Add request-header-field-buffer and max-request-header-fields options, deprecating header-field-buffer and max-header-fields options.
• nghttpx: Add --no-http2-cipher-black-list to allow black listed cipher suite
• nghttpx: Limit header fields from backend
• nghttpx: Fix bug that IPv6 address in Forwarded "for" is not quoted-string
• nghttpx: Support multiple frontend addresses
• integration-tests: support out-of-tree tests (Patch from Peter Wu)
• examples: fix compile warnings (Patch from Peter Wu)

Security Advisory

CVE-2016-1544: Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due
to unlimited incoming HTTP header fields.

Vulnerability

nghttpd, nghttp, and libnghttp2_asio applications do not limit the
memory usage for the incoming HTTP header field. If peer sends
specially crafted HTTP/2 HEADERS frames and CONTINUATION frames, they
will crash with out of memory error.

HTTP/2 uses HPACK to compress header fields. The basic idea is that
HTTP header field is stored in the receiver with the numeric index
number. The memory used by this storage is tightly constrained, and
it is 4KiB by default. When sender sends the same header field, it
just sends the corresponding numeric index number, which is usually 1
or 2 bytes. This means that after sender makes the receiver store the
relatively large header field (e.g., 4KiB), and it can send specially
crafted HEADERS/CONTINUATION frames which contain a lot of references
to the stored header field, sender easily effectively send lots of big
header fields to the receiver quite easily. nghttpd, nghttp, and
libnghttp2_asio applications do not limit the memory usage for
received header fields, so if the peer performs the procedure
described above, they will crash due to out of memory.

Note that libnghttp2 itself is not affected by this vulnerability.

Affected Versions

• Affected versions: nghttp2 <= 1.7.0
• Not affected versions: nghttp2 >= 1.7.1

The Solution

Install nghttp2 v1.7.1

Time Line

It was first reported to the nghttp2 team February 3 2016.

nghttp2 v1.7.1 was released on February 11 2016.

Credits

Reported by Noam Mazor. Fixed by the nghttp2 team.

Thank you for all who involved.

• Reset (RST_STREAM) stream if flow control window gets overflow
• Validate :authroity, host, and :scheme value more strictly
• Check request/response submission error based side of session
• Strict outgoing idle stream detection
• Return error from nghttp2_submit_{headers,request} when self dependency is made
• Add -ldl to APPLDFLAGS for static openssl linking
• asio: Stop acceptor on server::http2::stop
• asio: Rename http2::get_io_services() as http2::io_services()
• h2load: Support UNIX domain socket
• h2load: Improve readability of traffic numbers
• h2load: Remove "auto" for -m option
• h2load: Show progress in rate mode
• h2load: Perform sampling for request and connection timings to reduce memory consumption
• nghttpd: Add --no-content-length option to omit content-length in response
• nghttpx: Interleave pushed streams with the associated stream if pushed streams are javascript and CSS resources
• nghttpx: The initial value of request/response buffer is increased to 128K
• nghttpx: Fix bug that --listener-disable-timeout option is not used
• nghttpx: Don't emit :authority if request does not contain authority information
• nghttpx: Add clarification of quotes in configuration file
• nghttpx: Don't allow certain characters in host and :scheme header field
• nghttpx: Add RFC 7239 Forwarded header field support
• nghttpx: Fix crash when running on IPv6 only (Patch from Vernon Tang)
• nghttpx: Take into account of trailers when applying max_header_fields
• nghttpx: Don't apply max_header_fields and header_field_buffer limit to response
• nghttpx: Strict validation for header fields given in configuration
• nghttpx: header value should not be lower-cased (Patch from ayanamist)

• Fix heap-use-after-free bug when handling idle streams
• Strict error handling for frames which are not allowed after closed (remote)
• Set max number of outgoing concurrent streams to 100 by default
• Keep incoming streams only at server side
• Create stream object for pushed resource during nghttp2_submit_push_promise()
• Add nghttp2_session_create_idle_stream() API
• Handle response in nghttp2_on_begin_frame_callback
• Add --lib-only configure option
• Compile with OpenSSL 1.1.0-pre1
• Fix build when OpenSSL 1.0.2 is not available (patch from Sunpoet Po-Chuan Hsieh)
• asio: Add connect and read timeout to client API
• asio: Add TLS handshake and read timeout to server API
• asio: Added access to a requests remote endpoint (patch from Andreas Pohl)
• asio: libnghttp2_asio: Added io_service accessors (patch from Andreas Pohl)
• h2load: Add req/s min, max, mean and sd for clients
• h2load: Fix broken connection times

• Fix bug that nghttp2_session_find_stream(session, 0) returned NULL
• Add nghttp2_session_change_stream_priority() to change stream priority without sending PRIORITY frame
• Add nghttp2_session_check_server_session() API
• Consider to use CANCEL error code when closing streams with GOAWAY
• Don't send push response if GOAWAY has been received
• Use error code CANCEL to reset pushed reserved stream from remote
• Add nghttp2_session_upgrade2(), deprecate nghttp2_session_upgrade()
• Workaround HTTP upgrade with HEAD request in nghttp2_session_upgrade()
• Introduce NGHTTP2_NV_FLAG_NO_COPY_NAME and NGHTTP2_NV_FLAG_NO_COPY_VALUE
• Add nghttp2_session_check_request_allowed() API function
• Switch to clang-format-3.6
• Update mruby to 1.2.0
• tests: fix broken linkage with --disable-static (Patch from Kamil Dudka)
• python: Send RST_STREAM if remote side is not closed and response finished
• asio: client: call on_error when connection is dropped
• asio: ALPN support
• h2load: Add --h1 option to force http/1.1 for both http and https URI
• h2load: Fix crash when dealing with "connection: close" form HTTP/1.1 server
• h2load: h2load goes into infinite loop when timing script file starts with 0.0 in first line (Patch from Kit Chan)
• h2load: Override user-agent with -H option
• h2load: Print "space savings" to measure header compression efficiency
• h2load: Stream error should be counted toward errored
• h2load: Show application protocol with OpenSSL < 1.0.2
• nghttpx: Don't send RST_STREAM to h2 backend if backend is disconnected state
• nghttpx: Support server push from HTTP/2 backend
• nghttpx: Fix bug that causes connection failure with backend proxy URI
• nghttpx: Use --backend-tls-sni-field to verify certificate hostname
• nghttpx: Log :authority as $http_host if available
• nghttpd: Fix crash with CONNECT request
• nghttpd: Defered eviction of cached fd using timer
• nghttpd: Read /etc/mime.types to set content-type header field
• nghttp: Record request method to output it in har correctly
• nghttp: Use method given in -H with ":method" in HTTP Upgrade

• lib: Don't always expect dynamic table size update
• lib: Shrink to the minimum table size seen in local SETTINGS
• lib: Add new error code NGHTTP2_ERR_PAUSE to send_data_callback
• lib: Avoid excessive WINDOW_UPDATE queuing
• lib: Return fatal error if flooding is detected to close session immediately
• lib: Return type of nghttp2_submit_trailer is int
• lib: Don't send WINDOW_UPDATE with 0 increment
• lib: Fix bug that headers in CONTINUATION were ignored after HEADERS with padding
• package: Use -fvisibility=hidden for internal functions
• package: Show more information in configure summary
• package: Add PIDFile directive to systemd service (Patch from Tomasz Buchert)
• package: Fix daemon upgrade when running under systemd (Patch from Janusz Dziemidowicz)
• app: Compile with BoringSSL
• nghttp: Allow multiple -c option occurrence, and take min and last value
• nghttpd: Fix leak when server failed to listen to given port
• nghttpx: Add TLS dynamic record size behaviour command line options (Patch from Lucas Pardue)
• nghttpx: Reduce default timeouts for read sockets to 1m
• nghttpx: Fix bug that PUT is replaced with POST
• nghttpx: Change mruby script handling
• nghttpx: Added support for RFC 7413 (TCP Fast Open) on nghttpx proxy listening connections (Patch from Peeyush Aggarwal)
• nghttpx: Add neverbleed support
• h2load: Don't DOS our server!
• h2load: Use duration syntax for timeouts
• h2load: Support subsecond rate period
• h2load: Simplify rate mode
• h2load: Add option for user-definable rate period (Patch from Lucas Pardue)
• h2load: Reuse SSL/TLS session
• h2load: Reconnect server on connection: close
• h2load: Don't exit in the case of no ALPN protocol overlap
• integration: Update go's http2 package URI

• Make traditional init script fail if new config file is broken (Patch from Janusz Dziemidowicz)
• nghttpx-logrotate: Don't use killall since we have multiple processes
• nghttpx: Fix improper signal handling

• Fix bug in padding handling of DATA frame
• Use hash table for dynamic table lookup
• More warning flags for --enable-werror
• Update mruby
• h2load: HTTP/1.1 support (Patch from Lucas Pardue)
• nghttpx: Do not try to set TCP_NODELAY when frontend is an UNIX socket (Patch from Janusz Dziemidowicz)
• nghttpx: Chown UNIX domain socket to user specified as --user
• nghttpx: Split monolithic one process into control and worker processes
• nghttpx: Handle SSL/TLS data following PROXY protocol line

• Check header block limit after new stream is opened
• nghttp: Show error if HEADERS frame cannot be sent for whatever reason
• nghttpx: Fix assertion failure on TLS handshake
• nghttpx: Add x-http2-push header field for pushed resource
• nghttpx: Fix compile error with --disable-threads

• Avoid usage of typeof and replace __builtin_offsetof with offsetof
• Honor stream->weight even if stream->last_writelen is 0
• Compile third-party libraries if hpack-tools is enabled
• nghttpx-init: Start nghttpx with --daemon (Patch from Tomasz Buchert)
• Bundle sphinxcontrib.rubydomain
  https://bitbucket.org/birkenfeld/sphinx-contrib/src/default/rubydomain/
• Bundle mruby
• h2load: Record TTFB on first byte of response body, rather than first socket read
• h2load: Improve checking for timing script input, prevent false positive in certain situations (Patch from Lucas Pardue)
• nghttpx: Implement PROXY protocol version 1 (--accept-proxy-protocol option)
• nghttpx: Allow link header server push for HTTP/2 backend as well
• nghttpx: Don't initiate push if client disabled push
• nghttpx: Allow absolute URI in Link header field for push
• nghttpx: Fix crash with multi workers and QUIT signal
• nghttpx: Add mruby support which is disabled by default (use --with-mruby configure option to enable it)
• nghttpx: Drop connection before TLS finish if h2 requirement is not fulfilled

• Limit the number of incoming reserved (remote) streams
• Add stream public API
• Rewrite priority tree handling
• Fix parallel make distcheck
• Define it and itprep recursive target if AM_EXTRA_RECURSIVE_TARGETS is defined
• fetch-ocsp-response: Handle spurious openssl exist status 0
• nghttpx: Use nghttp2::ssl::DEFAULT_CIPHER_LIST for backend TLS connection
• nghttpx: Don't allow blacked listed cipher suites for HTTP/2 connection
• nghttpx: better handle /dev/stderr and /dev/stdout (Patch from Tomasz Buchert)
• nghttpd: GOAWAY if SSL/TLS requirements for HTTP/2 are not met
• nghttpd: Return date header field for 304
• nghttpd: Support HEAD request
• h2load: Add Timing-script and base URI support (Patch from Lucas Pardue)
• h2load: Add timeout options (Patch from Nora)

• doc: Reword the HPACK tutorial (Patch from Tom Harwood)
• nghttpx: Fix stability issues
• h2load: Fix crash if -r > -n

Since v1.2.1 release is basically intended to fix bugs of nghttpx, and most of the interesting stuff was done in v1.2.0 (which released 1 week ago), we also lists the changes made in v1.2.0:

• Fix crash if response or data is submitted to closing stream
• Header table size UINT32_MAX must be accepted
• Use PROTOCOL_ERROR against DATA sent to idle stream
• Allow multiple in-flight SETTINGS
• Strictly check occurrence of dynamic table size update
• Fix configure warning that 'missing' is missing or too old
• Fix rm: cannot remove ‘*.rst’: No such file or directory when "make clean" (Patch from Alexis La Goutte)
• doc: Reword some of the server and client tutorial (Patch from Tom Harwood)
• src: Remove monotonic_clock replacement macro for gcc-4.6
• nghttpx: Add TLS ticket key sharing among nghttpx instances using memcached
• nghttpx: Add shared session cache using memcached
• nghttpx: Set SSL/TLS session timeout to 12 hours
• nghttpx: Enable session resumption on HTTP/2 backend
• nghttpx: Don't rewrite host header field by default
• nghttpx: Generate new ticket key every 1hr and its life time is now 12hrs
• nghttpx: Don't reuse backend connection if it is not clean
• nghttpx: Add AES-256-CBC encryption for TLS session ticket
• nghttpd: Fix the bug that 304 response has non-empty body
• h2load: Add -r and -C options to h2load (Patch from Nora Shoemaker)

ATTENTION: We have some issues in nghttpx included in this release. #320 and #321. It is recommended to use v1.1.2 until these issues are resolved.

• Fix crash if response or data is submitted to closing stream
• Header table size UINT32_MAX must be accepted
• Use PROTOCOL_ERROR against DATA sent to idle stream
• Allow multiple in-flight SETTINGS
• Strictly check occurrence of dynamic table size update
• Fix configure warning that 'missing' is missing or too old
• Fix rm: cannot remove ‘*.rst’: No such file or directory when "make clean" (Patch from Alexis La Goutte)
• doc: Reword some of the server and client tutorial (Patch from Tom Harwood)
• src: Remove monotonic_clock replacement macro for gcc-4.6
• nghttpx: Add TLS ticket key sharing among nghttpx instances using memcached
• nghttpx: Add shared session cache using memcached
• nghttpx: Set SSL/TLS session timeout to 12 hours
• nghttpx: Enable session resumption on HTTP/2 backend
• nghttpx: Don't rewrite host header field by default
• nghttpx: Generate new ticket key every 1hr and its life time is now 12hrs
• nghttpx: Don't reuse backend connection if it is not clean
• nghttpx: Add AES-256-CBC encryption for TLS session ticket
• nghttpd: Fix the bug that 304 response has non-empty body
• h2load: Add -r and -C options to h2load (Patch from Nora Shoemaker)