aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* SSL: client certificate validation with OCSP (ticket #1534).Roman Arutyunyan2020-05-22
| | | | | | | | | OCSP validation for client certificates is enabled by the "ssl_ocsp" directive. OCSP responder can be optionally specified by "ssl_ocsp_responder". When session is reused, peer chain is not available for validation. If the verified chain contains certificates from the peer chain not available at the server, validation will fail.
* OCSP stapling: iterate over all responder addresses.Roman Arutyunyan2020-05-22
| | | | | | | | Previously only the first responder address was used per each stapling update. Now, in case of a network or parsing error, next address is used. This also fixes the issue with unsupported responder address families (ticket #1330).
* OCSP stapling: keep extra chain in the staple object.Roman Arutyunyan2020-05-17
|
* OCSP stapling: moved response verification to a separate function.Roman Arutyunyan2020-05-06
|
* Upstream: jump out of loop after matching the status code.Jinhua Tan2020-05-13
|
* Variables: fixed buffer over-read when evaluating "$arg_".Sergey Kandaurov2020-05-08
|
* gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov2020-04-23
| | | | | | As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
* gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov2020-04-23
| | | | | | | | | | | | | | | | | | | | | | | | | As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
* Version bump.Ruslan Ermilov2020-04-23
|
* The new auth_delay directive for delaying unauthorized requests.Ruslan Ermilov2020-04-08
| | | | | | | | | | | | The request processing is delayed by a timer. Since nginx updates internal time once at the start of each event loop iteration, this normally ensures constant time delay, adding a mitigation from time-based attacks. A notable exception to this is the case when there are no additional events before the timer expires. To ensure constant-time processing in this case as well, we trigger an additional event loop iteration by posting a dummy event for the next event loop iteration.
* Auth basic: explicitly zero out password buffer.Ruslan Ermilov2020-03-13
|
* Version bump.Ruslan Ermilov2020-03-16
|
* Simplified subrequest finalization.Roman Arutyunyan2020-02-28
| | | | | Now it looks similar to what it was before background subrequests were introduced in 9552758a786e.
* Fixed premature background subrequest finalization.Dmitry Volyntsev2020-03-02
| | | | | | | | | | | | | | | When "aio" or "aio threads" is used while processing the response body of an in-memory background subrequest, the subrequest could be finalized with an aio operation still in progress. Upon aio completion either parent request is woken or the old r->write_event_handler is called again. The latter may result in request errors. In either case post_subrequest handler is never called with the full response body, which is typically expected when using in-memory subrequests. Currently in nginx background subrequests are created by the upstream module and the mirror module. The issue does not manifest itself with these subrequests because they are header-only. But it can manifest itself with third-party modules which create in-memory background subrequests.
* Added default overwrite in error_page 494.Maxim Dounin2020-02-28
| | | | | | | | | | | | | | | | | We used to have default error_page overwrite for 495, 496, and 497, so a configuration like error_page 495 /error; will result in error 400, much like without any error_page configured. The 494 status code was introduced later (in 3848:de59ad6bf557, nginx 0.9.4), and relevant changes to ngx_http_core_error_page() were missed, resulting in inconsistent behaviour of "error_page 494" - with error_page configured it results in 494 being returned instead of 400. Reported by Frank Liu, http://mailman.nginx.org/pipermail/nginx/2020-February/058957.html.
* Mp4: fixed possible chunk offset overflow.Roman Arutyunyan2020-02-26
| | | | | | | | | | | | | | | | | | | | In "co64" atom chunk start offset is a 64-bit unsigned integer. When trimming the "mdat" atom, chunk offsets are casted to off_t values which are typically 64-bit signed integers. A specially crafted mp4 file with huge chunk offsets may lead to off_t overflow and result in negative trim boundaries. The consequences of the overflow are: - Incorrect Content-Length header value in the response. - Negative left boundary of the response file buffer holding the trimmed "mdat". This leads to pread()/sendfile() errors followed by closing the client connection. On rare systems where off_t is a 32-bit integer, this scenario is also feasible with the "stco" atom. The fix is to add checks which make sure data chunks referenced by each track are within the mp4 file boundaries. Additionally a few more checks are added to ensure mp4 file consistency and log errors.
* Disabled connection reuse while in SSL handshake.Sergey Kandaurov2020-02-27
| | | | | During SSL handshake, the connection could be reused in the OCSP stapling callback, if configured, which subsequently leads to a segmentation fault.
* Disabled duplicate "Host" headers (ticket #1724).Maxim Dounin2020-02-20
| | | | | | | | | Duplicate "Host" headers were allowed in nginx 0.7.0 (revision b9de93d804ea) as a workaround for some broken Motorola phones which used to generate requests with two "Host" headers[1]. It is believed that this workaround is no longer relevant. [1] http://mailman.nginx.org/pipermail/nginx-ru/2008-May/017845.html
* Removed "Transfer-Encoding: identity" support.Maxim Dounin2020-02-20
| | | | | | The "identity" transfer coding has been removed in RFC 7230. It is believed that it is not used in real life, and at the same time it provides a potential attack vector.
* Disabled multiple Transfer-Encoding headers.Maxim Dounin2020-02-20
| | | | | | | | | We anyway do not support more than one transfer encoding, so accepting requests with multiple Transfer-Encoding headers doesn't make sense. Further, we do not handle multiple headers, and ignore anything but the first header. Reported by Filippo Valsorda.
* Made ngx_http_get_forwarded_addr_internal() non-recursive.Vladimir Homutov2020-02-11
|
* HTTP/2: fixed socket leak with an incomplete HEADERS frame.Sergey Kandaurov2020-02-05
| | | | | | | | | | | A connection could get stuck without timers if a client has partially sent the HEADERS frame such that it was split on the individual header boundary. In this case, it cannot be processed without the rest of the HEADERS frame. The fix is to call ngx_http_v2_state_headers_save() in this case. Normally, it would be called from the ngx_http_v2_state_header_block() handler on the next iteration, when there is not enough data to continue processing. This isn't the case if recv_buffer became empty and there's no more data to read.
* Version bump.Sergey Kandaurov2020-02-05
|
* gRPC: variables support in the "grpc_pass" directive.Vladimir Homutov2020-01-17
|
* HTTP/2: removed ngx_debug_point() call.Daniil Bondarev2020-01-14
| | | | | | | |      With the recent change to prevent frames flood in d4448892a294, nginx will finalize the connection with NGX_HTTP_V2_INTERNAL_ERROR whenever flood is detected, causing nginx aborting or stopping if the debug_points directive is used in nginx config.
* SSL: reworked posted next events again.Maxim Dounin2019-12-27
| | | | | | | | | | | | | | Previous change 1ce3f01a4355 incorrectly introduced processing of the ngx_posted_next_events queue at the end of operation, effectively making posted next events a nop, since at the end of an event loop iteration the queue is always empty. Correct approach is to move events to the ngx_posted_events queue at an iteration start, as it was done previously. Further, in some cases the c->read event might be already in the ngx_posted_events queue, and calling ngx_post_event() with the ngx_posted_next_events queue won't do anything. To make sure the event will be correctly placed into the ngx_posted_next_events queue we now check if it is already posted.
* Version bump.Maxim Dounin2019-12-27
|
* SSL: reworked posted next events.Maxim Dounin2019-12-24
| | | | | | | | | | | | | | Introduced in 9d2ad2fb4423 available bytes handling in SSL relied on connection read handler being overwritten to set the ready flag and the amount of available bytes. This approach is, however, does not work properly when connection read handler is changed, for example, when switching to a next pipelined request, and can result in unexpected connection timeouts, see here: http://mailman.nginx.org/pipermail/nginx-devel/2019-December/012825.html Fix is to introduce ngx_event_process_posted_next() instead, which will set ready and available regardless of how event handler is set.
* HTTP/2: introduced separate handler to retry stream close.Maxim Dounin2019-12-23
| | | | | | | | When ngx_http_v2_close_stream_handler() is used to retry stream close after queued frames are sent, client timeouts on the stream can be logged multiple times and/or in addition to already happened errors. To resolve this, separate ngx_http_v2_retry_close_stream_handler() was introduced, which does not try to log timeouts.
* HTTP/2: fixed socket leak with queued frames (ticket #1689).Maxim Dounin2019-12-23
| | | | | | | | | | | | | If a stream is closed with queued frames, it is possible that no further write events will occur on the stream, leading to the socket leak. To fix this, the stream's fake connection read handler is set to ngx_http_v2_close_stream_handler(), to make sure that finalizing the connection with ngx_http_v2_finalize_connection() will be able to close the stream regardless of the current number of queued frames. Additionally, the stream's fake connection fc->error flag is explicitly set, so ngx_http_v2_handle_stream() will post a write event when queued frames are finally sent even if stream flow control window is exhausted.
* Dav: added checks for chunked to body presence conditions.Maxim Dounin2019-12-23
| | | | | | These checks were missed when chunked support was introduced. And also added an explicit error message to ngx_http_dav_copy_move_handler() (it was missed for some reason, in contrast to DELETE and MKCOL handlers).
* Discard request body when redirecting to a URL via error_page.Ruslan Ermilov2019-12-23
| | | | Reported by Bert JW Regeer and Francisco Oca Gonzalez.
* Rewrite: disallow empty replacements.Ruslan Ermilov2019-12-16
| | | | | | While empty replacements were caught at run-time, parsing code of the "rewrite" directive expects that a minimum length of the "replacement" argument is 1.
* Tolerate '\0' in URI when mapping URI to path.Ruslan Ermilov2019-12-16
| | | | | | | If a rewritten URI has the null character, only a part of URI was copied to a memory buffer allocated for path. In some setups this could be exploited to expose uninitialized memory via the Location header.
* Rewrite: fixed segfault with rewritten URI and "alias".Ruslan Ermilov2019-12-16
| | | | | | | | | | | | | | | | | | | The "alias" directive cannot be used in the same location where URI was rewritten. This has been detected in the "rewrite ... break" case, but not when the standalone "break" directive was used. This change also fixes proxy_pass with URI component in a similar case: location /aaa/ { rewrite ^ /xxx/yyy; break; proxy_pass http://localhost:8080/bbb/; } Previously, the "/bbb/yyy" would be sent to a backend instead of "/xxx/yyy". And if location's prefix was longer than the rewritten URI, a segmentation fault might occur.
* Fixed request finalization in ngx_http_index_handler().Ruslan Ermilov2019-12-16
| | | | | Returning 500 instead of NGX_ERROR is preferable here because header has not yet been sent to the client.
* Saved some memory allocations.Ruslan Ermilov2019-12-16
| | | | | In configurations when "root" has variables, some modules unnecessarily allocated memory for the "Location" header value.
* Dav: fixed Location in successful MKCOL response.Ruslan Ermilov2019-12-16
| | | | | Instead of reducing URI length to not include the terminating '\0' character in 6ddaac3e0bf7, restore the terminating '/' character.
* Upstream keepalive: clearing of c->data in cached connections.Maxim Dounin2019-12-05
| | | | | | | Previously, connections returned from keepalive cache had c->data pointing to the keepalive cache item. While this shouldn't be a problem for correct code, as c->data is not expected to be used before it is set, explicitly clearing it might help to avoid confusion.
* Version bump.Maxim Dounin2019-12-05
|
* Limit conn: added shared context.Roman Arutyunyan2019-11-18
| | | | | | | Previously only an rbtree was associated with a limit_conn. To make it possible to associate more data with a limit_conn, shared context is introduced similar to limit_req. Also, shared pool pointer is kept in a way similar to limit_req.
* Limit conn: $limit_conn_status variable.Roman Arutyunyan2019-11-18
| | | | The variable takes one of the values: PASSED, REJECTED or REJECTED_DRY_RUN.
* Limit conn: limit_conn_dry_run directive.Roman Arutyunyan2019-11-19
| | | | | A new directive limit_conn_dry_run allows enabling the dry run mode. In this mode connections are not rejected, but reject status is logged as usual.
* Updated comment after 776d1bebdca2.Roman Arutyunyan2019-11-18
|
* Limit req: $limit_req_status variable.Roman Arutyunyan2019-11-06
| | | | | The variable takes one of the values: PASSED, DELAYED, REJECTED, DELAYED_DRY_RUN or REJECTED_DRY_RUN.
* Parsing server PROXY protocol address and port (ticket #1206).Roman Arutyunyan2019-10-21
| | | | | New variables $proxy_protocol_server_addr and $proxy_protocol_server_port are added both to HTTP and Stream.
* Core: moved PROXY protocol fields out of ngx_connection_t.Roman Arutyunyan2019-10-21
| | | | | | Now a new structure ngx_proxy_protocol_t holds these fields. This allows to add more PROXY protocol fields in the future without modifying the connection structure.
* Version bump.Roman Arutyunyan2019-10-24
|
* Win32: silenced -Wcast-function-type GCC warning (ticket #1865).Maxim Dounin2019-10-21
| | | | | | | With MinGW-w64, building 64-bit nginx binary with GCC 8 and above results in warning due to cast of GetProcAddress() result to ngx_wsapoll_pt, which GCC thinks is incorrect. Added intermediate cast to "void *" to silence the warning.
* Win32: improved fallback on FormatMessage() errors.Maxim Dounin2019-10-21
| | | | | | | | | | | | FormatMessage() seems to return many errors which essentially indicate that the language in question is not available. At least the following were observed in the wild and during testing: ERROR_MUI_FILE_NOT_FOUND (15100) (ticket #1868), ERROR_RESOURCE_TYPE_NOT_FOUND (1813). While documentation says it should be ERROR_RESOURCE_LANG_NOT_FOUND (1815), this doesn't seem to be the case. As such, checking error code was removed, and as long as FormatMessage() returns an error, we now always try the default language.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 17:04:56 +0000