aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Upstream: avoid duplicate finalization.Maxim Dounin2015-03-02
| | | | | | | | | | | | | | | | A request may be already finalized when ngx_http_upstream_finalize_request() is called, due to filter finalization: after filter finalization upstream can be finalized via ngx_http_upstream_cleanup(), either from ngx_http_terminate_request(), or because a new request was initiated to an upstream. Then the upstream code will see an error returned from the filter chain and will call the ngx_http_upstream_finalize_request() function again. To prevent corruption of various upstream data in this situation, make sure to do nothing but merely call ngx_http_finalize_request(). Prodded by Yichun Zhang, for details see the thread at http://nginx.org/pipermail/nginx-devel/2015-February/006539.html.
* SSL: reset ready flag if recv(MSG_PEEK) found no bytes in socket.Roman Arutyunyan2015-03-02
| | | | | | | | | | | Previously, connection hung after calling ngx_http_ssl_handshake() with rev->ready set and no bytes in socket to read. It's possible in at least the following cases: - when processing a connection with expired TCP_DEFER_ACCEPT on Linux - after parsing PROXY protocol header if it arrived in a separate TCP packet Thanks to James Hamlin.
* Cache: do not inherit last_modified and etag from stale response.Roman Arutyunyan2015-03-02
| | | | | | | | | | | | | | | | When replacing a stale cache entry, its last_modified and etag could be inherited from the old entry if the response code is not 200 or 206. Moreover, etag could be inherited with any response code if it's missing in the new response. As a result, the cache entry is left with invalid last_modified or etag which could lead to broken revalidation. For example, when a file is deleted from backend, its last_modified is copied to the new 404 cache entry and is used later for revalidation. Once the old file appears again with its original timestamp, revalidation succeeds and the cached 404 response is sent to client instead of the file. The problem appeared with etags in 44b9ab7752e3 (1.7.3) and affected last_modified in 1573fc7875fa (1.7.9).
* Upstream hash: speedup consistent hash init.Roman Arutyunyan2015-03-02
| | | | | | | | | | | | | Repeatedly calling ngx_http_upstream_add_chash_point() to create the points array in sorted order, is O(n^2) to the total weight. This can cause nginx startup and reconfigure to be substantially delayed. For example, when total weight is 1000, startup takes 5s on a modern laptop. Replace this with a linear insertion followed by QuickSort and duplicates removal. Startup for total weight of 1000 reduces to 40ms. Based on a patch by Wai Keen Woon.
* Mail: don't emit Auth-SSL-Verify with disabled ssl_verify_client.Sergey Kandaurov2015-02-27
| | | | | Previously, the Auth-SSL-Verify header with the "NONE" value was always passed to the auth_http script if verification of client certificates is disabled.
* Mail: client SSL certificates support.Maxim Dounin2015-02-25
| | | | | | | | | | | | | | | | | | The "ssl_verify_client", "ssl_verify_depth", "ssl_client_certificate", "ssl_trusted_certificate", and "ssl_crl" directives introduced to control SSL client certificate verification in mail proxy module. If there is a certificate, detail of the certificate are passed to the auth_http script configured via Auth-SSL-Verify, Auth-SSL-Subject, Auth-SSL-Issuer, Auth-SSL-Serial, Auth-SSL-Fingerprint headers. If the auth_http_pass_client_cert directive is set, client certificate in PEM format will be passed in the Auth-SSL-Cert header (urlencoded). If there is no required certificate provided during an SSL handshake or certificate verification fails then a protocol-specific error is returned after the SSL handshake and the connection is closed. Based on previous work by Sven Peter, Franck Levionnois and Filipe Da Silva.
* Mail: added Auth-SSL header to indicate SSL.Maxim Dounin2015-02-25
| | | | Based on a patch by Filipe da Silva.
* Mail: fixed buffer allocation for CRLF after Auth-SMTP-* headers.Maxim Dounin2015-02-25
| | | | | There were no buffer overruns in real life as there is extra space allocated for the Auth-Login-Attempt counter.
* SSL: account sent bytes in ngx_ssl_write().Ruslan Ermilov2015-02-24
|
* Core: fixed potential buffer overrun when initializing hash.Maxim Dounin2015-02-24
| | | | | | | Initial size as calculated from the number of elements may be bigger than max_size. If this happens, make sure to set size to max_size. Reported by Chris West.
* Cache: reduced diffs to the plus version of nginx.Ruslan Ermilov2015-02-17
| | | | No functional changes.
* Core: make ngx_connection_local_sockaddr() always assign address.Roman Arutyunyan2015-02-17
| | | | | | Previously, this function checked for connection local address existence and returned error if it was missing. Now a new address is assigned in this case making it possible to call this function not only for accepted connections.
* Unbreak building on FreeBSD without file AIO.Valentin Bartenev2015-02-11
| | | | | | | | | It appeared that the NGX_HAVE_AIO_SENDFILE macro was defined regardless of the "--with-file-aio" configure option and the NGX_HAVE_FILE_AIO macro. Now they are related. Additionally, fixed one macro.
* Refactored sendfile() AIO preload.Valentin Bartenev2015-02-11
| | | | | | | | This reduces layering violation and simplifies the logic of AIO preread, since it's now triggered by the send chain function itself without falling back to the copy filter. The context of AIO operation is now stored per file buffer, which makes it possible to properly handle cases when multiple buffers come from different locations, each with its own configuration.
* Mail: fixed the duplicate listen address detection.Ruslan Ermilov2015-01-23
|
* Mail: fixed a comment.Ruslan Ermilov2015-01-23
|
* Upstream: detect port absence in fastcgi_pass with IP literal.Ruslan Ermilov2015-01-22
| | | | | | | | | | | | | | | | | | | | | | | | If fastcgi_pass (or any look-alike that doesn't imply a default port) is specified as an IP literal (as opposed to a hostname), port absence was not detected at configuration time and could result in EADDRNOTAVAIL at run time. Fixed this in such a way that configs like http { server { location / { fastcgi_pass 127.0.0.1; } } upstream 127.0.0.1 { server 10.0.0.1:12345; } } still work. That is, port absence check is delayed until after we make sure there's no explicit upstream with such a name.
* Version bump.Ruslan Ermilov2015-02-11
|
* Core: fixed build on Tru64 UNIX.Sergey Kandaurov2015-02-10
| | | | | | There was a typo in NGX_EACCES. Reported by Goetz T. Fischer.
* Fixed try_files directory test to match only a directory.Damien Tournoud2015-01-21
| | | | | | | | | Historically, it was possible to match either a file or directory in the following configuration: location / { try_files $uri/ =404; }
* Core: fixed a race resulting in extra sem_post()'s.Roman Arutyunyan2015-02-04
| | | | | | | | | | | | | The mtx->wait counter was not decremented if we were able to obtain the lock right after incrementing it. This resulted in unneeded sem_post() calls, eventually leading to EOVERFLOW errors being logged, "sem_post() failed while wake shmtx (75: Value too large for defined data type)". To close the race, mtx->wait is now decremented if we obtain the lock right after incrementing it in ngx_shmtx_lock(). The result can become -1 if a concurrent ngx_shmtx_unlock() decrements mtx->wait before the added code does. However, that only leads to one extra iteration in the next call of ngx_shmtx_lock().
* Core: reverted prefix-based temp files (a9138c35120d).Roman Arutyunyan2015-02-02
| | | | | The use_temp_path http cache feature is now implemented using a separate temp hierarchy in cache directory. Prefix-based temp files are no longer needed.
* Cache: added temp_path to file cache.Roman Arutyunyan2015-02-02
| | | | | | If use_temp_path is set to off, a subdirectory "temp" is created in the cache directory. It's used instead of proxy_temp_path and friends for caching upstream response.
* Core: supported directory skipping in ngx_walk_tree().Roman Arutyunyan2015-02-02
| | | | If pre_tree_handler() returns NGX_DECLINED, the directory is ignored.
* Fixed AIO handling in the output chain.Valentin Bartenev2015-01-28
| | | | The ctx->aio flag must be taken into account in the short path too.
* A bounds check of %N format on Windows.Igor Sysoev2015-01-27
| | | | Thanks to Joe Bialek, Adam Zabrocki and Microsoft Vulnerability Research.
* Upstream: $upstream_header_time variable.Vladimir Homutov2015-01-14
| | | | | Keeps time spent on obtaining the header from an upstream server. The value is formatted similar to the $upstream_response_time variable.
* Core: added disk_full_time checks to error log.Maxim Dounin2015-01-13
|
* Fixed sendfile() trailers on OS X (8e903522c17a, 1.7.8).Maxim Dounin2015-01-13
| | | | | | | The trailer.count variable was not initialized if there was a header, resulting in "sendfile() failed (22: Invalid argument)" alerts on OS X if the "sendfile" directive was used. The bug was introduced in 8e903522c17a (1.7.8).
* Upstream: use_temp_path parameter of proxy_cache_path and friends.Valentin Bartenev2014-12-26
| | | | | When set to "off", temporary files for cacheable responses will be stored inside cache directory.
* Cache: update variant while setting header.Valentin Bartenev2014-12-26
| | | | | | Some parts of code related to handling variants of a resource moved into a separate function that is called earlier. This allows to use cache file name as a prefix for temporary file in the following patch.
* Core: added prefix-based temporary files.Valentin Bartenev2014-12-26
| | | | | Now, if the "path" parameter is NULL, ngx_create_temp_file() will use file->name as a predefined file path prefix.
* Unified handling of ngx_create_temp_file() return value.Valentin Bartenev2014-12-26
| | | | | | | The original check for NGX_AGAIN was surplus, since the function returns only NGX_OK or NGX_ERROR. Now it looks similar to other places. No functional changes.
* Fixed building with musl libc (ticket #685).Maxim Dounin2014-12-24
|
* Version bump.Maxim Dounin2014-12-24
|
* Upstream: added variables support to proxy_cache and friends.Valentin Bartenev2014-12-22
|
* Upstream: preset some cache configuration when bypassing.Valentin Bartenev2014-12-22
| | | | No functional changes.
* Upstream: refactored proxy_cache and friends.Valentin Bartenev2014-12-22
| | | | | | | | The configuration handling code has changed to look similar to the proxy_store directive and friends. This simplifies adding variable support in the following patch. No functional changes.
* Upstream: mutually exclusive inheritance of "cache" and "store".Valentin Bartenev2014-12-22
| | | | | | | | | | | | | | | | | | | | Currently, storing and caching mechanisms cannot work together, and a configuration error is thrown when the proxy_store and proxy_cache directives (as well as their friends) are configured on the same level. But configurations like in the example below were allowed and could result in critical errors in the error log: proxy_store on; location / { proxy_cache one; } Only proxy_store worked in this case. For more predictable and errorless behavior these directives now prevent each other from being inherited from the previous level.
* Upstream: simplified proxy_store and friends configuration code.Valentin Bartenev2014-12-22
| | | | | | | | | This changes internal API related to handling of the "store" flag in ngx_http_upstream_conf_t. Previously, a non-null value of "store_lengths" was enough to enable store functionality with custom path. Now, the "store" flag is also required to be set. No functional changes.
* SSL: safeguard use of SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS.Lukas Tribus2014-12-17
| | | | The flag was recently removed by BoringSSL.
* Autoindex: implemented XML output format.Valentin Bartenev2014-12-12
|
* Autoindex: implemented JSON output format.Valentin Bartenev2014-12-12
|
* Autoindex: rendering code moved to a separate function.Valentin Bartenev2014-12-12
| | | | No functional changes.
* Headers filter: variables support in expires (ticket #113).Maxim Dounin2014-12-11
|
* Headers filter: local variables for config, no functional changes.Maxim Dounin2014-12-11
|
* Upstream: fixed inheritance of proxy_store and friends.Valentin Bartenev2014-10-09
| | | | | | | | | | | | The proxy_store, fastcgi_store, scgi_store and uwsgi_store were inherited incorrectly if a directive with variables was defined, and then redefined to the "on" value, i.e. in configurations like: proxy_store /data/www$upstream_http_x_store; location / { proxy_store on; }
* Proxy: fixed incorrect URI change due to if (ticket #86).Maxim Dounin2014-12-09
| | | | | | | | | | | | | | | | | | In the following configuration request was sent to a backend without URI changed to '/' due to if: location /proxy-pass-uri { proxy_pass http://127.0.0.1:8080/; set $true 1; if ($true) { # nothing } } Fix is to inherit conf->location from the location where proxy_pass was configured, much like it's done with conf->vars.
* Upstream: fixed unexpected inheritance into limit_except blocks.Maxim Dounin2014-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | The proxy_pass directive and other handlers are not expected to be inherited into nested locations, but there is a special code to inherit upstream handlers into limit_except blocks, as well as a configuration into if{} blocks. This caused incorrect behaviour in configurations with nested locations and limit_except blocks, like this: location / { proxy_pass http://u; location /inner/ { # no proxy_pass here limit_except GET { # nothing } } } In such a configuration the limit_except block inside "location /inner/" unexpectedly used proxy_pass defined in "location /", while it shouldn't. Fix is to avoid inheritance of conf->upstream.upstream (and conf->proxy_lengths) into locations which don't have noname flag.
* Upstream: inheritance of proxy_pass and friends (ticket #645).Maxim Dounin2014-12-09
| | | | | | | | | Instead of independant inheritance of conf->upstream.upstream (proxy_pass without variables) and conf->proxy_lengths (proxy_pass with variables) we now test them both and inherit only if neither is set. Additionally, SSL context is also inherited only in this case now. Based on the patch by Alexey Radkov.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 02:23:29 +0000