aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Core: sockaddr lengths now respected by ngx_cmp_sockaddr().Maxim Dounin2016-10-10
| | | | | | | | | Linux can return AF_UNIX sockaddrs with partially filled sun_path, resulting in spurious comparison failures and failed binary upgrades. Added proper checking of the lengths provided. Reported by Jan Seda, http://mailman.nginx.org/pipermail/nginx-devel/2016-September/008832.html.
* Core: ngx_conf_set_access_slot() user access (ticket #1096).Maxim Dounin2016-10-07
| | | | | | Previously, user access bits were always set to "rw" unconditionally, even with "user:r" explicitly specified. With this change we only add default user access bits (0600) if they weren't set explicitly.
* Realip: fixed duplicate processing on redirects (ticket #1098).Maxim Dounin2016-10-06
| | | | | | | | | | | | | Duplicate processing was possible if the address set by realip was listed in set_realip_from, and there was an internal redirect so module context was cleared. This resulted in exactly the same address being set, so this wasn't a problem before the $realip_remote_addr variable was introduced, though now results in incorrect $realip_remote_addr being picked. Fix is to use ngx_http_realip_get_module_ctx() to look up module context even if it was cleared. Additionally, the order of checks was switched to check the configuration first as it looks more effective.
* Stream ssl_preread: fixed $ssl_preread_server_name variable.Sergey Kandaurov2016-10-05
| | | | Made sure to set the variable length only after successful SNI parsing.
* Cache: cache manager limits.Dmitry Volyntsev2016-10-05
| | | | | | | | | The new parameters "manager_files", "manager_sleep" and "manager_threshold" were added to proxy_cache_path and friends. Note that ngx_path_manager_pt was changed to return ngx_msec_t instead of time_t (API change).
* Core: use c->log while closing connection.Ruslan Ermilov2016-10-05
| | | | c->pool is not destroyed here since c52408583801.
* SSL: use X509_check_host() with LibreSSL.Maxim Dounin2016-10-04
| | | | | | | Explicit checks for OPENSSL_VERSION_NUMBER replaced with checks for X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT, thus allowing X509_check_host() to be used with other libraries. In particular, X509_check_host() was introduced in LibreSSL 2.5.0.
* Configure: removed the --with-ipv6 option.Maxim Dounin2016-10-04
| | | | | | IPv6 now compiled-in automatically if support is found. If there is a need to disable it for some reason, --with-cc-opt="-DNGX_HAVE_INET6=0" can be used for this.
* Addition filter: set last_in_chain flag when clearing last_buf.Roman Arutyunyan2016-10-03
| | | | | | | | | | | When the last_buf flag is cleared for add_after_body to append more data from a subrequest, other filters may still have buffered data, which should be flushed at this point. For example, the sub_filter may have a partial match buffered, which will only be flushed after the subrequest is done, ending up with interleaved data in output. Setting last_in_chain instead of last_buf flushes the data and fixes the order of output buffers.
* Do not set last_buf flag in subrequests.Roman Arutyunyan2016-10-03
| | | | | | The last_buf flag should only be set in the last buffer of the main request. Otherwise, several last_buf flags can appear in output. This can, for example, break the chunked filter, which will include several final chunks in output.
* Modules compatibility: removed two NGX_HAVE_DEFERRED_ACCEPT checks.Ruslan Ermilov2016-10-03
| | | | | Removed (NGX_HAVE_DEFERRED_ACCEPT && defined TCP_DEFER_ACCEPT) from the signature accordingly.
* Modules compatibility: removed unneeded NGX_HAVE_REUSEPORT checks.Maxim Dounin2016-10-03
| | | | Removed NGX_HAVE_REUSEPORT from the signature accordingly.
* Modules compatibility: removed unneeded IPV6_V6ONLY checks.Maxim Dounin2016-10-03
| | | | | | | | | | The IPV6_V6ONLY macro is now checked only while parsing appropriate flag and when using the macro. The ipv6only field in listen structures is always initialized to 1, even if not supported on a given platform. This is expected to prevent a module compiled without IPV6_V6ONLY from accidentally creating dual sockets if loaded into main binary with proper IPV6_V6ONLY support.
* Modules compatibility: http2.Maxim Dounin2016-10-03
| | | | | HTTP/2-specific fields in structures are now available unconditionally. Removed NGX_HTTP_V2 from the signature accordingly.
* Modules compatibility: degradation fields now always present.Maxim Dounin2016-10-03
| | | | | There is no need to save these two bits as they are wasted anyway. Removed NGX_HTTP_DEGRADATION from the signature accordingly.
* Modules compatibility: --with-compat configure option.Maxim Dounin2016-10-03
|
* Introduced the NGX_COMPAT macro.Ruslan Ermilov2016-09-29
| | | | | When enabled, some structures are padded to be size compatible with their NGINX Plus versions.
* Resolver: introduced state field in ngx_resolver_srv_name_t.Dmitry Volyntsev2016-09-29
| | | | | | It keeps the actual state value of a DNS SRV subrequest and can be used to report a more detailed log for failed SRV records.
* Modules compatibility: down flag promoted to a bitmask.Maxim Dounin2016-09-29
| | | | | | It is to be used as a bitmask with various bits set/reset when appropriate. Any bit set means that the peer should not be used, that is, exactly what current checks do, no additional changes required.
* Modules compatibility: upstream config field.Maxim Dounin2016-09-29
| | | | | It is to be used to track version of an upstream configuration used for request processing.
* Modules compatibility: status fields.Maxim Dounin2016-09-29
|
* Modules compatibility: health check fields.Maxim Dounin2016-09-29
|
* Modules compatibility: cache purge fields.Maxim Dounin2016-09-29
|
* Modules compatibility: slow start fields.Maxim Dounin2016-09-29
|
* Modules compatibility: peer.notify.Maxim Dounin2016-09-29
| | | | | This callback can be used to notify balancer about various events. For now, it is only used in nginx-plus.
* Stream: style.Ruslan Ermilov2016-09-29
| | | | | Explicitly initialized peer's max_conns for upstreams created with variables similar to how it's done in http.
* Upstream: max_conns.Ruslan Ermilov2016-09-22
|
* Upstream: removed the quick recovery mechanism.Ruslan Ermilov2016-09-22
| | | | Its usefulness it questionable, and it interacts badly with max_conns.
* Upstream: introduced u->upstream.Maxim Dounin2016-09-22
| | | | | It holds upstream{} block configuration, including ones selected via run-time lookup using variables.
* Upstream: style.Maxim Dounin2016-09-22
|
* Upstream: style, ngx_http_upstream_rr_peer_t.next moved.Maxim Dounin2016-07-25
|
* Perl: pass additional linker options to perl module.Konstantin Pavlov2016-09-20
| | | | | | Previously flags passed by --with-ld-opt were not used when building perl module, which meant hardening flags provided by package build systems were not applied.
* Fixed log levels of configuration parsing errors.Valentin Bartenev2016-09-20
| | | | | | All the errors that prevent loading configuration must be printed on the "emerg" log level. Previously, nginx might silently fail to load configuration in some cases as the default log level is "error".
* Removed influence of some options on structures.Ruslan Ermilov2016-09-20
|
* Upstream hash: fixed missing upstream name initialization.Vladimir Homutov2016-09-16
|
* Stream ssl_preread: removed internal macro.Vladimir Homutov2016-09-15
| | | | The ngx_log_debug() macro is internal and should not be used.
* Stream: ssl_preread module.Vladimir Homutov2016-09-15
| | | | | | The ssl_preread module extracts information from the SSL Client Hello message without terminating SSL. Currently, only $ssl_preread_server_name variable is supported, which contains server name from the SNI extension.
* Stream: preread phase.Vladimir Homutov2016-09-15
| | | | | | | | | | | | In this phase, head of a stream is read and analysed before proceeding to the content phase. Amount of data read is controlled by the module implementing the phase, but not more than defined by the "preread_buffer_size" directive. The time spent on processing preread is controlled by the "preread_timeout" directive. The typical preread phase module will parse the beginning of a stream and set variable that may be used by the content phase, for example to make routing decision.
* Stream: phases.Roman Arutyunyan2016-09-15
|
* Stream: filters.Roman Arutyunyan2016-09-15
|
* Version bump.Vladimir Homutov2016-09-15
|
* release-1.11.4 tagMaxim Dounin2016-09-13
|
* nginx-1.11.4-RELEASErelease-1.11.4Maxim Dounin2016-09-13
|
* OCSP stapling: fixed using wrong responder with multiple certs.Maxim Dounin2016-09-12
|
* SSL: improved session ticket callback error handling.Sergey Kandaurov2016-09-12
| | | | Prodded by Guido Vranken.
* SSL: factored out digest and cipher in session ticket callback.Sergey Kandaurov2016-09-12
| | | | No functional changes.
* Stream: increase default value for proxy_protocol_timeout to 30s.Dmitry Volyntsev2016-09-08
|
* Stream: realip module.Dmitry Volyntsev2016-09-01
|
* Core: introduced ngx_cidr_match() function.Dmitry Volyntsev2016-09-07
|
* Stream: allow using the session context inside handlers.Dmitry Volyntsev2016-09-06
| | | | | | | Previously, it was not possible to use the stream context inside ngx_stream_init_connection() handlers. Now, limit_conn, access handlers, as well as those added later, can create their own contexts.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 19:03:00 +0000