aboutsummaryrefslogtreecommitdiff
path: root/src/http/ngx_http_request.c
Commit message (Collapse)AuthorAge
* Added server-side support for PROXY protocol v1 (ticket #355).Roman Arutyunyan2014-03-17
| | | | | | | | Client address specified in the PROXY protocol header is now saved in the $proxy_protocol_addr variable and can be used in the realip module. This is currently not implemented for mail.
* Use ngx_socket_errno where appropriate.Piotr Sikora2014-02-03
| | | | Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
* Fixed false compiler warning.Vladimir Homutov2014-01-31
| | | | | Newer gcc versions (4.7+) report possible use of uninitialized variable if nginx is being compiled with -O3.
* Fixed a compile warning introduced by 01e2a5bcdd8f.Ruslan Ermilov2014-01-30
| | | | | | On systems with OpenSSL that has NPN support but lacks ALPN support, some compilers emitted a warning about possibly uninitialized "data" variable.
* SSL: support ALPN (IETF's successor to NPN).Piotr Sikora2014-01-28
| | | | Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
* Fixed TCP_DEFER_ACCEPT handling (ticket #353).Maxim Dounin2014-01-28
| | | | | | | | | | | | | | | | | Backed out 05a56ebb084a, as it turns out that kernel can return connections without any delay if syncookies are used. This basically means we can't assume anything about connections returned with deferred accept set. To solve original problem the 05a56ebb084a tried to solve, i.e. to don't wait longer than needed if a connection was accepted after deferred accept timeout, this patch changes a timeout set with setsockopt(TCP_DEFER_ACCEPT) to 1 second, unconditionally. This is believed to be enough for speed improvements, and doesn't imply major changes to timeouts used. Note that before 2.6.32 connections were dropped after a timeout. Though it is believed that 1s is still appropriate for kernels before 2.6.32, as previously tcp_synack_retries controlled the actual timeout and 1s results in more than 1 minute actual timeout by default.
* Use EPOLLRDHUP in ngx_http_test_reading() (ticket #320).Valentin Bartenev2013-09-16
| | | | | This allows to detect client connection close with pending data when the ngx_http_test_reading() request event handler is set.
* Request cleanup code unified, no functional changes.Maxim Dounin2013-09-04
| | | | | Additionally, detaching a cleanup chain from a request is a bit more resilent to various bugs if any.
* Assume the HTTP/1.0 version by default.Valentin Bartenev2013-09-02
| | | | | | | | | | | It is believed to be better than fallback to HTTP/0.9, because most of the clients at present time support HTTP/1.0. It allows nginx to return error response code for them in cases when it fail to parse request line, and therefore fail to detect client protocol version. Even if the client does not support HTTP/1.0, this assumption should not cause any harm, since from the HTTP/0.9 point of view it still a valid response.
* Fixed ngx_http_test_reading() to finalize request properly.Maxim Dounin2013-06-14
| | | | | | | Previous code called ngx_http_finalize_request() with rc = 0. This is ok if a response status was already set, but resulted in "000" being logged if it wasn't. In particular this happened with limit_req if a connection was prematurely closed during limit_req delay.
* Fixed lingering_time check.Maxim Dounin2013-05-13
| | | | | | | | | | | | | There are two significant changes in this patch: 1) The <= 0 comparison is done with a signed type. This fixes the case of ngx_time() being larger than r->lingering_time. 2) Calculation of r->lingering_time - ngx_time() is now always done in the ngx_msec_t type. This ensures the calculation is correct even if time_t is unsigned and differs in size from ngx_msec_t. Thanks to Lanshun Zhou.
* Fixed build with --with-mail_ssl_module.Maxim Dounin2013-05-11
| | | | | | | | | If nginx was compiled without --with-http_ssl_module, but with some other module which uses OpenSSL (e.g. --with-mail_ssl_module), insufficient preprocessor check resulted in build failure. The problem was introduced by e0a3714a36f8 (1.3.14). Reported by Roman Arutyunyan.
* Preliminary experimental support for SPDY draft 2.Valentin Bartenev2013-03-20
|
* URI processing code moved to a separate function.Valentin Bartenev2013-03-20
| | | | This allows to reuse it in the upcoming SPDY module.
* Allow to reuse connections that wait their first request.Valentin Bartenev2013-03-15
| | | | | | | | This should improve behavior under deficiency of connections. Since SSL handshake usually takes significant amount of time, we exclude connections from reusable queue during this period to avoid premature flush of them.
* Fixed logging in ngx_http_wait_request_handler().Maxim Dounin2013-03-12
| | | | | | | | If c->recv() returns 0 there is no sense in using ngx_socket_errno for logging, its value meaningless. (The code in question was copied from ngx_http_keepalive_handler(), but ngx_socket_errno makes sense there as it's used as a part of ECONNRESET handling, and the c->recv() call is preceeded by the ngx_set_socket_errno(0) call.)
* Refactored ngx_http_init_request().Valentin Bartenev2013-03-07
| | | | | Now it can be used as the request object factory with minimal impact on the connection object. Therefore it was renamed to ngx_http_create_request().
* Removed c->single_connection flag.Valentin Bartenev2013-03-07
| | | | | | | The c->single_connection was intended to be used as lock mechanism to serialize modifications of request object from several threads working with client and upstream connections. The flag is redundant since threads in nginx have never been used that way.
* Respect the new behavior of TCP_DEFER_ACCEPT.Valentin Bartenev2013-03-07
| | | | | | | | | In Linux 2.6.32, TCP_DEFER_ACCEPT was changed to accept connections after the deferring period is finished without any data available. (Reading from the socket returns EAGAIN in this case.) Since in nginx TCP_DEFER_ACCEPT is set to "post_accept_timeout", we do not need to wait longer if deferred accept returns with no data.
* Use "client_header_timeout" for all requests in a connection.Valentin Bartenev2013-03-07
| | | | | | | | | | | Previously, only the first request in a connection used timeout value from the "client_header_timeout" directive while reading header. All subsequent requests used "keepalive_timeout" for that. It happened because timeout of the read event was set to the value of "keepalive_timeout" in ngx_http_set_keepalive(), but was not removed when the next request arrived.
* Create request object only after the first byte was received.Valentin Bartenev2013-03-07
| | | | | | | | | | | | | Previously, we always created an object and logged 400 (Bad Request) in access log if a client closed connection without sending any data. Such a connection was counted as "reading". Since it's common for modern browsers to behave like this, it's no longer considered an error if a client closes connection without sending any data, and such a connection will be counted as "waiting". Now, we do not log 400 (Bad Request) and keep memory footprint as small as possible.
* Allocate request object from its own pool.Valentin Bartenev2013-03-01
| | | | | | | | Previously, it was allocated from a connection pool and was selectively freed for an idle keepalive connection. The goal is to put coupled things in one chunk of memory, and to simplify handling of request objects.
* SNI: added restriction on requesting host other than negotiated.Valentin Bartenev2013-02-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to RFC 6066, client is not supposed to request a different server name at the application layer. Server implementations that rely upon these names being equal must validate that a client did not send a different name in HTTP request. Current versions of Apache HTTP server always return 400 "Bad Request" in such cases. There exist implementations however (e.g., SPDY) that rely on being able to request different host names in one connection. Given this, we only reject requests with differing host names if verification of client certificates is enabled in a corresponding server configuration. An example of configuration that might not work as expected: server { listen 433 ssl default; return 404; } server { listen 433 ssl; server_name example.org; ssl_client_certificate org.cert; ssl_verify_client on; } server { listen 433 ssl; server_name example.com; ssl_client_certificate com.cert; ssl_verify_client on; } Previously, a client was able to request example.com by presenting a certificate for example.org, and vice versa.
* SNI: reset to default server if requested host was not found.Valentin Bartenev2013-02-27
| | | | | | | | | | | | | | | | | | | | | | | | | Not only this is consistent with a case without SNI, but this also prevents abusing configurations that assume that the $host variable is limited to one of the configured names for a server. An example of potentially unsafe configuration: server { listen 443 ssl default_server; ... } server { listen 443; server_name example.com; location / { proxy_pass http://$host; } } Note: it is possible to negotiate "example.com" by SNI, and to request arbitrary host name that does not exist in the configuration above.
* SNI: avoid surplus lookup of virtual server if SNI was used.Valentin Bartenev2013-02-27
|
* Apply server configuration as soon as host is known.Valentin Bartenev2013-02-27
| | | | | | | | | | | | | | | | | | Previously, this was done only after the whole request header was parsed, and if an error occurred earlier then the request was processed in the default server (or server chosen by SNI), while r->headers_in.server might be set to the value from the Host: header or host from request line. r->headers_in.server is in turn used for $host variable and in HTTP redirects if "server_name_in_redirect" is disabled. Without the change, configurations that rely on this during error handling are potentially unsafe if SNI is used. This change also allows to use server specific settings of "underscores_in_headers", "ignore_invalid_headers", and "large_client_header_buffers" directives for HTTP requests and HTTPS requests without SNI.
* SSL: do not treat SSL handshake as request.Valentin Bartenev2013-02-27
| | | | | | | | | | | | | | | | | | The request object will not be created until SSL handshake is complete. This simplifies adding another connection handler that does not need request object right after handshake (e.g., SPDY). There are also a few more intentional effects: - the "client_header_buffer_size" directive will be taken from the server configuration that was negotiated by SNI; - SSL handshake errors and timeouts are not logged into access log as bad requests; - ngx_ssl_create_connection() is not called until the first byte of ClientHello message was received. This also decreases memory consumption if plain HTTP request is sent to SSL socket.
* Status: do not count connection as reading right after accept().Valentin Bartenev2013-02-27
| | | | | | | Before we receive the first bytes, the connection is counted as waiting. This change simplifies further code changes.
* SNI: reuse selected configuration for all requests in a connection.Valentin Bartenev2013-02-27
| | | | | | | | | | | | | | | | | | Previously, only the first request in a connection was assigned the configuration selected by SNI. All subsequent requests initially used the default server's configuration, ignoring SNI, which was wrong. Now all subsequent requests in a connection will initially use the configuration selected by SNI. This is done by storing a pointer to configuration in http connection object. It points to default server's configuration initially, but changed upon receipt of SNI. (The request's configuration can be further refined when parsing the request line and Host: header.) This change was not made specific to SNI as it also allows slightly faster access to configuration without the request object.
* SNI: ignore captures in server_name regexes when matching by SNI.Valentin Bartenev2013-02-27
| | | | | | | | This change helps to decouple ngx_http_ssl_servername() from the request object. Note: now we close connection in case of error during server name lookup for request. Previously, we did so only for HTTP/0.9 requests.
* Changed interface of ngx_http_validate_host().Valentin Bartenev2013-02-27
|
* Introduced the ngx_http_set_connection_log() macro.Valentin Bartenev2013-02-27
| | | | No functional changes.
* The default server lookup is now done only once per connection.Valentin Bartenev2013-02-27
| | | | Previously, it was done for every request in a connection.
* Correctly handle multiple X-Forwarded-For headers (ticket #106).Ruslan Ermilov2013-02-27
|
* Fixed potential segfault in ngx_http_keepalive_handler().Valentin Bartenev2013-02-23
| | | | | | | | In case of error in the read event handling we close a connection by calling ngx_http_close_connection(), that also destroys connection pool. Thereafter, an attempt to free a buffer (added in r4892) that was allocated from the pool could cause SIGSEGV and is meaningless as well (the buffer already freed with the pool).
* Proxy: support for connection upgrade (101 Switching Protocols).Maxim Dounin2013-02-18
| | | | | | | | | | | | | | This allows to proxy WebSockets by using configuration like this: location /chat/ { proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } Connection upgrade is allowed as long as it was requested by a client via the Upgrade request header.
* Request body: chunked transfer encoding support.Maxim Dounin2012-11-21
|
* ngx_http_keepalive_handler() is now trying to not keep c->buffer's memory forValentin Bartenev2012-10-23
| | | | | | | idle connections. This behaviour is consistent with the ngx_http_set_keepalive() function and it should decrease memory usage in some cases (especially if epoll/rtsig is used).
* SSL: the "ssl_verify_client" directive parameter "optional_no_ca".Maxim Dounin2012-10-03
| | | | | | | | | | | This parameter allows to don't require certificate to be signed by a trusted CA, e.g. if CA certificate isn't known in advance, like in WebID protocol. Note that it doesn't add any security unless the certificate is actually checked to be trusted by some external means (e.g. by a backend). Patch by Mike Kazantsev, Eric O'Connor.
* ngx_http_find_virtual_server() should return NGX_DECLINED if virtual server notValentin Bartenev2012-07-30
| | | | found.
* Entity tags: basic support in not modified filter.Maxim Dounin2012-07-07
| | | | | | | | | | | This includes handling of ETag headers (if present in a response) with basic support for If-Match, If-None-Match conditionals in not modified filter. Note that the "r->headers_out.last_modified_time == -1" check in the not modified filter is left as is intentionally. It's to prevent handling of If-* headers in case of proxy without cache (much like currently done with If-Modified-Since).
* Corrected $request_length calculation for pipelined requests.Andrey Belov2012-07-06
|
* Fixed compile-time conditionals used to detect if X-Forwarded-For supportRuslan Ermilov2012-06-21
| | | | is needed.
* Win32: uris with ":$" are now rejected.Maxim Dounin2012-06-05
| | | | | | | | | There are too many problems with special NTFS streams, notably "::$data", "::$index_allocation" and ":$i30:$index_allocation". For now we don't reject all URIs with ":" like Apache does as there are no good reasons seen yet, and there are multiple programs using it in URLs (e.g. MediaWiki).
* Fixed segfault with filter_finalize introduced in r4621 (1.3.0).Maxim Dounin2012-05-17
| | | | | | | | | | | | | | | | | | Example configuration to reproduce: location /image/ { error_page 415 = /zero; image_filter crop 100 100; proxy_pass http://127.0.0.1:8080; proxy_store on; } location /zero { return 204; } The problem appeared if upstream returned (big enough) non-image file, causing 415 to be generated by image filter.
* Fixed possible request hang with filter finalization.Maxim Dounin2012-05-14
| | | | | | | | | | | | With r->filter_finalize set the ngx_http_finalize_connection() wasn't called from ngx_http_finalize_request() called with NGX_OK, resulting in r->main->count not being decremented, thus causing request hang in some rare situations. See here for more details: http://mailman.nginx.org/pipermail/nginx-devel/2012-May/002190.html Patch by Yichun Zhang (agentzh).
* Removed surplus condition.Valentin Bartenev2012-04-27
|
* Fixed log->action after ssl handshake.Maxim Dounin2012-04-16
|
* Fixed grammar in error messages.Ruslan Ermilov2012-04-12
|
* Restricted keepalive_disable safari to OS X only.Maxim Dounin2012-03-22
| | | | | | | The problem doesn't affect non-Apple systems for sure, and many pretend to be Safari now. Prodded by Piotr Sikora.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-20 11:17:28 +0000