aboutsummaryrefslogtreecommitdiff
path: root/src/http/ngx_http_request.c
Commit message (Collapse)AuthorAge
* gRPC: special handling of the TE request header.Maxim Dounin2018-03-17
| | | | | | | | | | | According to the gRPC protocol specification, the "TE" header is used to detect incompatible proxies, and at least grpc-c server rejects requests without "TE: trailers". To preserve the logic, we have to pass "TE: trailers" to the backend if and only if the original request contains "trailers" in the "TE" header. Note that no other TE values are allowed in HTTP/2, so we have to remove anything else.
* Expose more headers with NGX_HTTP_HEADERS.Ruslan Ermilov2018-02-15
|
* SSL: using default server context in session remove (closes #1464).Sergey Kandaurov2018-01-30
| | | | | This fixes segfault in configurations with multiple virtual servers sharing the same port, where a non-default virtual server block misses certificate.
* Fixed worker_shutdown_timeout in various cases.Maxim Dounin2017-11-20
| | | | | | | | | | | | | | | | | | The ngx_http_upstream_process_upgraded() did not handle c->close request, and upgraded connections do not use the write filter. As a result, worker_shutdown_timeout did not affect upgraded connections (ticket #1419). Fix is to handle c->close in the ngx_http_request_handler() function, thus covering most of the possible cases in http handling. Additionally, mail proxying did not handle neither c->close nor c->error, and thus worker_shutdown_timeout did not work for mail connections. Fix is to add c->close handling to ngx_mail_proxy_handler(). Also, added explicit handling of c->close to stream proxy, ngx_stream_proxy_process_connection(). This improves worker_shutdown_timeout handling in stream, it will no longer wait for some data being transferred in a connection before closing it, and will also provide appropriate logging at the "info" level.
* Added support for trailers in HTTP responses.Piotr Sikora2017-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | Example: ngx_table_elt_t *h; h = ngx_list_push(&r->headers_out.trailers); if (h == NULL) { return NGX_ERROR; } ngx_str_set(&h->key, "Fun"); ngx_str_set(&h->value, "with trailers"); h->hash = ngx_hash_key_lc(h->key.data, h->key.len); The code above adds "Fun: with trailers" trailer to the response. Modules that want to emit trailers must set r->expect_trailers = 1 in header filter, otherwise they might not be emitted for HTTP/1.1 responses that aren't already chunked. This change also adds $sent_trailer_* variables. Signed-off-by: Piotr Sikora <piotrsikora@google.com>
* Fixed background requests with asynchronous operations.Roman Arutyunyan2017-05-29
| | | | | | | | | | | | | | | | | | | | | If the main request was finalized while a background request performed an asynchronous operation, the main request ended up in ngx_http_writer() and was not finalized until a network event or a timeout. For example, cache background update with aio enabled made nginx unable to process further client requests or close the connection, keeping it open until client closes it. Now regular finalization of the main request is not suspended because of an asynchronous operation in another request. If a background request was terminated while an asynchronous operation was in progress, background request's write event handler was changed to ngx_http_request_finalizer() and never called again. Now, whenever a request is terminated while an asynchronous operation is in progress, connection error flag is set to make further finalizations of any request with this connection lead to termination. These issues appeared in 1aeaae6e9446 (not yet released).
* SSL: set TCP_NODELAY on SSL connections before handshake.Maxim Dounin2017-05-29
| | | | | | | | | | | | With OpenSSL 1.1.0+, the workaround for handshake buffer size as introduced in a720f0b0e083 (ticket #413) no longer works, as OpenSSL no longer exposes handshake buffers, see https://github.com/openssl/openssl/commit/2e7dc7cd688. Moreover, it is no longer possible to adjust handshake buffers at all now. To avoid additional RTT if handshake uses more than 4k we now set TCP_NODELAY on SSL connections before handshake. While this still results in sub-optimal network utilization due to incomplete packets being sent, it seems to be better than nothing.
* Introduced ngx_tcp_nodelay().Ruslan Ermilov2017-05-26
|
* Background subrequests for cache updates.Roman Arutyunyan2017-05-25
| | | | | | | | | | Previously, cache background update might not work as expected, making client wait for it to complete before receiving the final part of a stale response. This could happen if the response could not be sent to the client socket in one filter chain call. Now background cache update is done in a background subrequest. This type of subrequest does not block any other subrequests or the main request.
* Don't pretend we support HTTP major versions >1 as HTTP/1.1.Ruslan Ermilov2017-04-25
|
* Fixed type.hucongcong2017-04-03
|
* Moved handling of wev->delayed to the connection event handler.Maxim Dounin2017-04-02
| | | | | | | | | | | With post_action or subrequests, it is possible that the timer set for wev->delayed will expire while the active subrequest write event handler is not ready to handle this. This results in request hangs as observed with limit_rate / sendfile_max_chunk and post_action (ticket #776) or subrequests (ticket #1228). Moving the handling to the connection event handler fixes the hangs observed, and also slightly simplifies the code.
* Fixed CPU hog while freeing hc->busy after e662cbf1b932 (1.11.11).Maxim Dounin2017-03-24
| | | | | Reported by Richard Stanway, http://mailman.nginx.org/pipermail/nginx/2017-March/053296.html.
* Converted hc->busy/hc->free to use chain links.Maxim Dounin2017-03-07
| | | | | | | | Most notably, this fixes possible buffer overflows if number of large client header buffers in a virtual server is different from the one in the default server. Reported by Daniil Bondarev.
* SSL: fixed ssl_buffer_size on SNI virtual hosts (ticket #1192).Maxim Dounin2017-02-02
| | | | | | | | | | Previously, buffer size was not changed from the one saved during initial ngx_ssl_create_connection(), even if the buffer itself was not yet created. Fix is to change c->ssl->buffer_size in the SNI callback. Note that it should be also possible to update buffer size even in non-SNI virtual hosts as long as the buffer is not yet allocated. This looks like an overcomplication though.
* Fixed an error log message.Valentin Bartenev2016-06-07
|
* HTTP/2: the "421 Misdirected Request" response (closes #848).Valentin Bartenev2016-05-20
| | | | | | | | | | | | | | | | | | | | | | | | Since 4fbef397c753 nginx rejects with the 400 error any attempts of requesting different host over the same connection, if the relevant virtual server requires verification of a client certificate. While requesting hosts other than negotiated isn't something legal in HTTP/1.x, the HTTP/2 specification explicitly permits such requests for connection reuse and has introduced a special response code 421. According to RFC 7540 Section 9.1.2 this code can be sent by a server that is not configured to produce responses for the combination of scheme and authority that are included in the request URI. And the client may retry the request over a different connection. Now this code is used for requests that aren't authorized in current connection. After receiving the 421 response a client will be able to open a new connection, provide the required certificate and retry the request. Unfortunately, not all clients currently are able to handle it well. Notably Chrome just shows an error, while at least the latest version of Firefox retries the request over a new connection.
* Dav: return 501 on PUT with ranges (ticket #948).Maxim Dounin2016-05-16
|
* Improved EPOLLRDHUP handling.Valentin Bartenev2016-05-13
| | | | | | | | | | | | | | | | | When it's known that the kernel supports EPOLLRDHUP, there is no need in additional recv() call to get EOF or error when the flag is absent in the event generated by the kernel. A special runtime test is done at startup to detect if EPOLLRDHUP is actually supported by the kernel because epoll_ctl() silently ignores unknown flags. With this knowledge it's now possible to drop the "ready" flag for partial read. Previously, the "ready" flag was kept until the recv() returned EOF or error. In particular, this change allows the lingering close heuristics (which relies on the "ready" flag state) to actually work on Linux, and not wait for more data in most cases. The "available" flag is now used in the read event with the semantics similar to the corresponding counter in kqueue.
* Fixed logging.Sergey Kandaurov2016-03-31
|
* HTTP/2: implemented per request timeouts (closes #626).Valentin Bartenev2016-02-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, there were only three timeouts used globally for the whole HTTP/2 connection: 1. Idle timeout for inactivity when there are no streams in processing (the "http2_idle_timeout" directive); 2. Receive timeout for incomplete frames when there are no streams in processing (the "http2_recv_timeout" directive); 3. Send timeout when there are frames waiting in the output queue (the "send_timeout" directive on a server level). Reaching one of these timeouts leads to HTTP/2 connection close. This left a number of scenarios when a connection can get stuck without any processing and timeouts: 1. A client has sent the headers block partially so nginx starts processing a new stream but cannot continue without the rest of HEADERS and/or CONTINUATION frames; 2. When nginx waits for the request body; 3. All streams are stuck on exhausted connection or stream windows. The first idea that was rejected was to detect when the whole connection gets stuck because of these situations and set the global receive timeout. The disadvantage of such approach would be inconsistent behaviour in some typical use cases. For example, if a user never replies to the browser's question about where to save the downloaded file, the stream will be eventually closed by a timeout. On the other hand, this will not happen if there's some activity in other concurrent streams. Now almost all the request timeouts work like in HTTP/1.x connections, so the "client_header_timeout", "client_body_timeout", and "send_timeout" are respected. These timeouts close the request. The global timeouts work as before. Previously, the c->write->delayed flag was abused to avoid setting timeouts on stream events. Now, the "active" and "ready" flags are manipulated instead to control the processing of individual streams.
* Fixed buffer over-read while logging invalid request headers.Valentin Bartenev2016-02-24
| | | | | | | | | | Since 667aaf61a778 (1.1.17) the ngx_http_parse_header_line() function can return NGX_HTTP_PARSE_INVALID_HEADER when a header contains NUL character. In this case the r->header_end pointer isn't properly initialized, but the log message in ngx_http_process_request_headers() hasn't been adjusted. It used the pointer in size calculation, which might result in up to 2k buffer over-read. Found with afl-fuzz.
* SSL: fixed possible segfault on renegotiation (ticket #845).Sergey Kandaurov2015-12-08
| | | | | | | | Skip SSL_CTX_set_tlsext_servername_callback in case of renegotiation. Do nothing in SNI callback as in this case it will be supplied with request in c->data which isn't expected and doesn't work this way. This was broken by b40af2fd1c16 (1.9.6) with OpenSSL master branch and LibreSSL.
* Style: unified request method checks.Ruslan Ermilov2015-11-06
|
* SSL: only select HTTP/2 using NPN if "http2" is enabled.Valentin Bartenev2015-11-05
| | | | | | OpenSSL doesn't check if the negotiated protocol has been announced. As a result, the client might force using HTTP/2 even if it wasn't enabled in configuration.
* The HTTP/2 implementation (RFC 7240, 7241).Valentin Bartenev2015-09-11
| | | | The SPDY support is removed, as it's incompatible with the new module.
* Limit recursive subrequests instead of simultaneous.Valentin Bartenev2015-08-23
|
* Core: renamed ngx_proxy_protocol_parse to ngx_proxy_protocol_read.Roman Arutyunyan2015-06-16
| | | | The new name is consistent with the ngx_proxy_protocol_write function.
* Core: the ngx_set_connection_log() macro.Vladimir Homutov2015-04-25
| | | | The http and stream versions of this macro were identical.
* Removed the obsolete rtsig module.Ruslan Ermilov2015-04-23
|
* Removed the obsolete aio module.Ruslan Ermilov2015-04-22
|
* Request body: unbuffered reading.Maxim Dounin2015-03-23
| | | | | | | | | | | The r->request_body_no_buffering flag was introduced. It instructs client request body reading code to avoid reading the whole body, and to call post_handler early instead. The caller should use the ngx_http_read_unbuffered_request_body() function to read remaining parts of the body. Upstream module is now able to use this mode, if configured with the proxy_request_buffering directive.
* SSL: reset ready flag if recv(MSG_PEEK) found no bytes in socket.Roman Arutyunyan2015-03-02
| | | | | | | | | | | Previously, connection hung after calling ngx_http_ssl_handshake() with rev->ready set and no bytes in socket to read. It's possible in at least the following cases: - when processing a connection with expired TCP_DEFER_ACCEPT on Linux - after parsing PROXY protocol header if it arrived in a separate TCP packet Thanks to James Hamlin.
* Upstream: improved subrequest logging.Maxim Dounin2014-12-02
| | | | | | | To ensure proper logging make sure to set current_request in all event handlers, including resolve, ssl handshake, cache lock wait timer and aio read handlers. A macro ngx_http_set_log_request() introduced to simplify this.
* Fixed possible buffer overrun in "too long header line" logging.Maxim Dounin2014-10-08
| | | | | | | Additionally, ellipsis now always added to make it clear that the header logged is incomplete. Reported by Daniil Bondarev.
* SPDY: avoid setting timeout on stream events in ngx_http_writer().Valentin Bartenev2014-08-27
| | | | | | | The SPDY module doesn't expect timers can be set on stream events for reasons other than delaying output. But ngx_http_writer() could add timer on write event if the delayed flag wasn't set and nginx is waiting for AIO completion. That could cause delays in sending response over SPDY when file AIO was used.
* Reset of r->uri.len on URI parsing errors.Maxim Dounin2014-07-18
| | | | | | | | This ensures that debug logging and the $uri variable (if used in 400 Bad Request processing) will not try to access uninitialized memory. Found by Sergey Bobrov.
* Added server-side support for PROXY protocol v1 (ticket #355).Roman Arutyunyan2014-03-17
| | | | | | | | Client address specified in the PROXY protocol header is now saved in the $proxy_protocol_addr variable and can be used in the realip module. This is currently not implemented for mail.
* Use ngx_socket_errno where appropriate.Piotr Sikora2014-02-03
| | | | Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
* Fixed false compiler warning.Vladimir Homutov2014-01-31
| | | | | Newer gcc versions (4.7+) report possible use of uninitialized variable if nginx is being compiled with -O3.
* Fixed a compile warning introduced by 01e2a5bcdd8f.Ruslan Ermilov2014-01-30
| | | | | | On systems with OpenSSL that has NPN support but lacks ALPN support, some compilers emitted a warning about possibly uninitialized "data" variable.
* SSL: support ALPN (IETF's successor to NPN).Piotr Sikora2014-01-28
| | | | Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
* Fixed TCP_DEFER_ACCEPT handling (ticket #353).Maxim Dounin2014-01-28
| | | | | | | | | | | | | | | | | Backed out 05a56ebb084a, as it turns out that kernel can return connections without any delay if syncookies are used. This basically means we can't assume anything about connections returned with deferred accept set. To solve original problem the 05a56ebb084a tried to solve, i.e. to don't wait longer than needed if a connection was accepted after deferred accept timeout, this patch changes a timeout set with setsockopt(TCP_DEFER_ACCEPT) to 1 second, unconditionally. This is believed to be enough for speed improvements, and doesn't imply major changes to timeouts used. Note that before 2.6.32 connections were dropped after a timeout. Though it is believed that 1s is still appropriate for kernels before 2.6.32, as previously tcp_synack_retries controlled the actual timeout and 1s results in more than 1 minute actual timeout by default.
* Use EPOLLRDHUP in ngx_http_test_reading() (ticket #320).Valentin Bartenev2013-09-16
| | | | | This allows to detect client connection close with pending data when the ngx_http_test_reading() request event handler is set.
* Request cleanup code unified, no functional changes.Maxim Dounin2013-09-04
| | | | | Additionally, detaching a cleanup chain from a request is a bit more resilent to various bugs if any.
* Assume the HTTP/1.0 version by default.Valentin Bartenev2013-09-02
| | | | | | | | | | | It is believed to be better than fallback to HTTP/0.9, because most of the clients at present time support HTTP/1.0. It allows nginx to return error response code for them in cases when it fail to parse request line, and therefore fail to detect client protocol version. Even if the client does not support HTTP/1.0, this assumption should not cause any harm, since from the HTTP/0.9 point of view it still a valid response.
* Fixed ngx_http_test_reading() to finalize request properly.Maxim Dounin2013-06-14
| | | | | | | Previous code called ngx_http_finalize_request() with rc = 0. This is ok if a response status was already set, but resulted in "000" being logged if it wasn't. In particular this happened with limit_req if a connection was prematurely closed during limit_req delay.
* Fixed lingering_time check.Maxim Dounin2013-05-13
| | | | | | | | | | | | | There are two significant changes in this patch: 1) The <= 0 comparison is done with a signed type. This fixes the case of ngx_time() being larger than r->lingering_time. 2) Calculation of r->lingering_time - ngx_time() is now always done in the ngx_msec_t type. This ensures the calculation is correct even if time_t is unsigned and differs in size from ngx_msec_t. Thanks to Lanshun Zhou.
* Fixed build with --with-mail_ssl_module.Maxim Dounin2013-05-11
| | | | | | | | | If nginx was compiled without --with-http_ssl_module, but with some other module which uses OpenSSL (e.g. --with-mail_ssl_module), insufficient preprocessor check resulted in build failure. The problem was introduced by e0a3714a36f8 (1.3.14). Reported by Roman Arutyunyan.
* Preliminary experimental support for SPDY draft 2.Valentin Bartenev2013-03-20
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 05:19:41 +0000