aboutsummaryrefslogtreecommitdiff
path: root/src/http/ngx_http_core_module.c
Commit message (Collapse)AuthorAge
* Improved ngx_http_subrequest() error handling.Sergey Kandaurov2025-02-21
| | | | | | | | | | | Previously, request might be left in inconsistent state in case of error, which manifested in "http request count is zero" alerts when used by SSI filter. The fix is to reshuffle initialization order to postpone committing state changes until after any potentially failing parts. Found by bad memory allocator simulation.
* Added "keepalive_min_timeout" directive.Roman Arutyunyan2025-02-05
| | | | | | | | | | | | | | | | | The directive sets a timeout during which a keepalive connection will not be closed by nginx for connection reuse or graceful shutdown. The change allows clients that send multiple requests over the same connection without delay or with a small delay between them, to avoid receiving a TCP RST in response to one of them. This excludes network issues and non-graceful shutdown. As a side-effect, it also addresses the TCP reset problem described in RFC 9112, Section 9.6, when the last sent HTTP response could be damaged by a followup TCP RST. It is important for non-idempotent requests, which cannot be retried by client. It is not recommended to set keepalive_min_timeout to large values as this can introduce an additional delay during graceful shutdown and may restrict nginx from effective connection reuse.
* HTTP/3: added more compatibility checks for "listen ... quic".Sergey Kandaurov2024-01-30
| | | | | | | Now "fastopen", "backlog", "accept_filter", "deferred", and "so_keepalive" parameters are not allowed with "quic" in the "listen" directive. Reported by Izorkin.
* HTTP/2: "http2" directive.Roman Arutyunyan2023-05-16
| | | | | | | | | | | | | | | | The directive enables HTTP/2 in the current server. The previous way to enable HTTP/2 via "listen ... http2" is now deprecated. The new approach allows to share HTTP/2 and HTTP/0.9-1.1 on the same port. For SSL connections, HTTP/2 is now selected by ALPN callback based on whether the protocol is enabled in the virtual server chosen by SNI. This however only works since OpenSSL 1.0.2h, where ALPN callback is invoked after SNI callback. For older versions of OpenSSL, HTTP/2 is enabled based on the default virtual server configuration. For plain TCP connections, HTTP/2 is now auto-detected by HTTP/2 preface, if HTTP/2 is enabled in the default virtual server. If preface is not matched, HTTP/0.9-1.1 is assumed.
* HTTP/3: removed "http3" parameter of "listen" directive.Roman Arutyunyan2023-05-11
| | | | The parameter has been deprecated since c851a2ed5ce8.
* Merged with the default branch.Sergey Kandaurov2023-03-29
|\
| * Fixed "zero size buf" alerts with subrequests.Maxim Dounin2023-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since 4611:2b6cb7528409 responses from the gzip static, flv, and mp4 modules can be used with subrequests, though empty files were not properly handled. Empty gzipped, flv, and mp4 files thus resulted in "zero size buf in output" alerts. While valid corresponding files are not expected to be empty, such files shouldn't result in alerts. Fix is to set b->sync on such empty subrequest responses, similarly to what ngx_http_send_special() does. Additionally, the static module, the ngx_http_send_response() function, and file cache are modified to do the same instead of not sending the response body at all in such cases, since not sending the response body at all is believed to be at least questionable, and might break various filters which do not expect such behaviour.
* | HTTP/3: trigger more compatibility errors for "listen quic".Roman Arutyunyan2023-01-26
| | | | | | | | | | Now "ssl", "proxy_protocol" and "http2" are not allowed with "quic" in "listen" directive. Previously, only "ssl" was not allowed.
* | HTTP/3: "quic" parameter of "listen" directive.Roman Arutyunyan2023-02-27
| | | | | | | | | | | | | | | | | | Now "listen" directve has a new "quic" parameter which enables QUIC protocol for the address. Further, to enable HTTP/3, a new directive "http3" is introduced. The hq-interop protocol is enabled by "http3_hq" as before. Now application protocol is chosen by ALPN. Previously used "http3" parameter of "listen" is deprecated.
* | Merged with the default branch.Sergey Kandaurov2023-01-02
|\|
| * Fixed port ranges support in the listen directive.Valentin Bartenev2022-12-18
| | | | | | | | | | | | | | | | | | Ports difference must be respected when checking addresses for duplicates, otherwise configurations like this are broken: listen 127.0.0.1:6000-6005 It was broken by 4cc2bfeff46c (nginx 1.23.3).
* | Merged with the default branch.Sergey Kandaurov2022-12-15
|\|
| * Filtering duplicate addresses in listen (ticket #2400).Maxim Dounin2022-11-23
| | | | | | | | | | | | | | | | | | | | | | | | Due to the glibc bug[1], getaddrinfo("localhost") with AI_ADDRCONFIG on a typical host with glibc and without IPv6 returns two 127.0.0.1 addresses, and therefore "listen localhost:80;" used to result in "duplicate ... address and port pair" after 4f9b72a229c1. Fix is to explicitly filter out duplicate addresses returned during resolution of a name. [1] https://sourceware.org/bugzilla/show_bug.cgi?id=14969
* | Set default listen socket type in http.Roman Arutyunyan2022-11-01
| | | | | | | | | | | | The type field was added in 7999d3fbb765 at early stages of QUIC implementation and was not initialized for default listen. Missing initialization resulted in default listen socket creation error.
* | Merged with the default branch.Sergey Kandaurov2022-06-22
|\|
| * Multiple WWW-Authenticate headers with "satisfy any;".Maxim Dounin2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a module adds multiple WWW-Authenticate headers (ticket #485) to the response, linked in r->headers_out.www_authenticate, all headers are now cleared if another module later allows access. This change is a nop for standard modules, since the only access module which can add multiple WWW-Authenticate headers is the auth request module, and it is checked after other standard access modules. Though this might affect some third party access modules. Note that if a 3rd party module adds a single WWW-Authenticate header and not yet modified to set the header's next pointer to NULL, attempt to clear such a header with this change will result in a segmentation fault.
| * All known output headers can be linked lists now.Maxim Dounin2022-05-30
| | | | | | | | | | | | | | | | The h->next pointer properly provided as NULL in all cases where known output headers are added. Note that there are 3rd party modules which might not do this, and it might be risky to rely on this for arbitrary headers.
| * Reworked multi headers to use linked lists.Maxim Dounin2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Multi headers are now using linked lists instead of arrays. Notably, the following fields were changed: r->headers_in.cookies (renamed to r->headers_in.cookie), r->headers_in.x_forwarded_for, r->headers_out.cache_control, r->headers_out.link, u->headers_in.cache_control u->headers_in.cookies (renamed to u->headers_in.set_cookie). The r->headers_in.cookies and u->headers_in.cookies fields were renamed to r->headers_in.cookie and u->headers_in.set_cookie to match header names. The ngx_http_parse_multi_header_lines() and ngx_http_parse_set_cookie_lines() functions were changed accordingly. With this change, multi headers are now essentially equivalent to normal headers, and following changes will further make them equivalent.
| * FastCGI: combining headers with identical names (ticket #1724).Maxim Dounin2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | FastCGI responder is expected to receive CGI/1.1 environment variables in the parameters (see section "6.2 Responder" of the FastCGI specification). Obviously enough, there cannot be multiple environment variables with the same name. Further, CGI specification (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables") explicitly requires to combine headers: "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
* | Merged with the default branch.Sergey Kandaurov2021-12-29
|\|
| * Removed "aio sendfile", deprecated since 1.7.11.Maxim Dounin2021-12-27
| |
* | HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro.Roman Arutyunyan2021-12-04
| | | | | | | | Listen quic parameter is no longer supported.
* | HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module.Roman Arutyunyan2021-12-06
| |
* | Merged with the default branch.Sergey Kandaurov2021-11-03
|\|
| * Changed default value of sendfile_max_chunk to 2m.Maxim Dounin2021-10-29
| | | | | | | | | | | | | | The "sendfile_max_chunk" directive is important to prevent worker monopolization by fast connections. The 2m value implies maximum 200ms delay with 100 Mbps links, 20ms delay with 1 Gbps links, and 2ms on 10 Gbps links. It also seems to be a good value for disks.
* | Merged with the default branch.Sergey Kandaurov2021-05-28
|\|
| * Location header escaping in redirects (ticket #882).Ruslan Ermilov2021-05-24
| | | | | | | | | | The header is escaped in redirects based on request URI or location name (auto redirect).
| * Changed complex value slots to use NGX_CONF_UNSET_PTR.Maxim Dounin2021-05-06
| | | | | | | | | | | | | | | | | | | | | | With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge complex values. This change follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22), and the change in ngx_conf_set_keyval_slot() (7728:485dba3e2a01, 1.19.4). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.
* | Merged with the default branch.Sergey Kandaurov2021-04-16
|\|
| * Changed keepalive_requests default to 1000 (ticket #2155).Maxim Dounin2021-04-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turns out no browsers implement HTTP/2 GOAWAY handling properly, and large enough number of resources on a page results in failures to load some resources. In particular, Chrome seems to experience errors if loading of all resources requires more than 1 connection (while it is usually able to retry requests at least once, even with 2 connections there are occasional failures for some reason), Safari if loading requires more than 3 connections, and Firefox if loading requires more than 10 connections (can be configured with network.http.request.max-attempts, defaults to 10). It does not seem to be possible to resolve this on nginx side, even strict limiting of maximum concurrency does not help, and loading issues seems to be triggered by merely queueing of a request for a particular connection. The only available mitigation seems to use higher keepalive_requests value. The new default is 1000 and matches previously used default for http2_max_requests. It is expected to be enough for 99.98% of the pages (https://httparchive.org/reports/state-of-the-web?start=latest#reqTotal) even in Chrome.
| * Introduced the "keepalive_time" directive.Maxim Dounin2021-04-08
| | | | | | | | | | | | | | Similar to lingering_time, it limits total connection lifetime before keepalive is switched off. The default is 1 hour, which is close to the total maximum connection lifetime possible with default keepalive_requests and keepalive_timeout.
* | Merged with the default branch.Sergey Kandaurov2021-03-30
|\|
| * Fixed handling of already closed connections.Maxim Dounin2021-03-28
| | | | | | | | | | | | | | | | | | | | | | | | In limit_req, auth_delay, and upstream code to check for broken connections, tests for possible connection close by the client did not work if the connection was already closed when relevant event handler was set. This happened because there were no additional events in case of edge-triggered event methods, and read events were disabled in case of level-triggered ones. Fix is to explicitly post a read event if the c->read->ready flag is set.
* | Merged with the default branch.Sergey Kandaurov2021-02-17
|\|
| * HTTP/2: removed SPDY directives handling.Maxim Dounin2021-02-11
| | | | | | | | | | The spdy_* directives are not available since introduction of HTTP/2 module in nginx 1.9.5 more than five years ago.
| * Removed incorrect optimization of HEAD requests.Maxim Dounin2021-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The stub status module and ngx_http_send_response() (used by the empty gif module and the "return" directive) incorrectly assumed that responding to HEAD requests always results in r->header_only being set. This is not true, and results in incorrect behaviour, for example, in the following configuration: location / { image_filter size; return 200 test; } Fix is to remove this incorrect micro-optimization from both stub status module and ngx_http_send_response(). Reported by Chris Newton.
* | HTTP/3: reverted version check for keepalive flag.Roman Arutyunyan2021-02-02
| | | | | | | | | | | | The flag is used in ngx_http_finalize_connection() to switch client connection to the keepalive mode. Since eaea7dac3292 this code is not executed for HTTP/3 which allows us to revert the change and get back to the default branch code.
* | QUIC: added "quic" listen parameter.Roman Arutyunyan2020-07-21
| | | | | | | | | | | | The parameter allows processing HTTP/0.9-2 over QUIC. Also, introduced ngx_http_quic_module and moved QUIC settings there
* | Merged with the default branch.Sergey Kandaurov2020-04-14
|\|
| * The new auth_delay directive for delaying unauthorized requests.Ruslan Ermilov2020-04-08
| | | | | | | | | | | | | | | | | | | | | | | | The request processing is delayed by a timer. Since nginx updates internal time once at the start of each event loop iteration, this normally ensures constant time delay, adding a mitigation from time-based attacks. A notable exception to this is the case when there are no additional events before the timer expires. To ensure constant-time processing in this case as well, we trigger an additional event loop iteration by posting a dummy event for the next event loop iteration.
* | HTTP/3.Roman Arutyunyan2020-03-13
| |
* | Initial QUIC support in http.Sergey Kandaurov2020-02-28
| |
* | HTTP UDP layer, QUIC support autotest.Sergey Kandaurov2020-02-28
|/
* Added default overwrite in error_page 494.Maxim Dounin2020-02-28
| | | | | | | | | | | | | | | | | We used to have default error_page overwrite for 495, 496, and 497, so a configuration like error_page 495 /error; will result in error 400, much like without any error_page configured. The 494 status code was introduced later (in 3848:de59ad6bf557, nginx 0.9.4), and relevant changes to ngx_http_core_error_page() were missed, resulting in inconsistent behaviour of "error_page 494" - with error_page configured it results in 494 being returned instead of 400. Reported by Frank Liu, http://mailman.nginx.org/pipermail/nginx/2020-February/058957.html.
* Made ngx_http_get_forwarded_addr_internal() non-recursive.Vladimir Homutov2020-02-11
|
* Tolerate '\0' in URI when mapping URI to path.Ruslan Ermilov2019-12-16
| | | | | | | If a rewritten URI has the null character, only a part of URI was copied to a memory buffer allocated for path. In some setups this could be exploited to expose uninitialized memory via the Location header.
* Fixed "return" with discarding invalid chunked body.Sergey Kandaurov2019-09-04
| | | | | | | | | When ngx_http_discard_request_body() call was added to ngx_http_send_response(), there were no return codes other than NGX_OK and NGX_HTTP_INTERNAL_SERVER_ERROR. Now it can also return NGX_HTTP_BAD_REQUEST, but ngx_http_send_response() still incorrectly transforms it to NGX_HTTP_INTERNAL_SERVER_ERROR. The fix is to propagate ngx_http_discard_request_body() errors.
* Variables support in limit_rate and limit_rate_after (ticket #293).Ruslan Ermilov2019-04-24
|
* Multiple addresses in "listen".Roman Arutyunyan2019-03-15
| | | | | | Previously only one address was used by the listen directive handler even if host name resolved to multiple addresses. Now a separate listening socket is created for each address.
* Copy regex unnamed captures to cloned subrequests.Roman Arutyunyan2018-12-11
| | | | | | | | | | | | Previously, unnamed regex captures matched in the parent request, were not available in a cloned subrequest. Now 3 fields related to unnamed captures are copied to a cloned subrequest: r->ncaptures, r->captures and r->captures_data. Since r->captures cannot be changed by either request after creating a clone, a new flag r->realloc_captures is introduced to force reallocation of r->captures. The issue was reported as a proxy_cache_background_update misbehavior in http://mailman.nginx.org/pipermail/nginx/2018-December/057251.html.
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-20 17:02:11 +0000