aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Gunzip: added missing ngx_http_clear_etag().Maxim Dounin2012-11-26
|
* Core: fixed ngx_write_chain_to_file() with IOV_MAX reached.Maxim Dounin2012-11-26
| | | | | | | Catched by dav_chunked.t on Solaris. In released versions this might potentially result in corruption of complex protocol responses if they were written to disk and there were more distinct buffers than IOV_MAX in a single write.
* Request body: block write events while reading body.Maxim Dounin2012-11-26
| | | | | | | | | | | | | | | | If write events are not blocked, an extra write event might happen for various reasons (e.g. as a result of a http pipelining), resulting in incorrect body being passed to a post handler. The problem manifested itself with the dav module only, as this is the only module which reads the body from a content phase handler (in contrast to exclusive content handlers like proxy). Additionally, dav module used to dump core in such situations due to ticket #238. See reports here: http://mailman.nginx.org/pipermail/nginx-devel/2012-November/002981.html http://serverfault.com/questions/449195/nginx-webdav-server-with-auth-request
* Request body: error checking fixes, negative rb->rest handling.Maxim Dounin2012-11-26
| | | | | | | Negative rb->rest can't happen with current code, but it's good to have it handled anyway. Found by Coverity (CID 744846, 744847, 744848).
* Request body: improved handling of incorrect chunked request body.Maxim Dounin2012-11-26
| | | | | | | | | | | While discarding chunked request body in some cases after detecting request body corruption no error was returned, while it was possible to correctly return 400 Bad Request. If error is detected too late, make sure to properly close connection. Additionally, in ngx_http_special_response_handler() don't return body of 500 Internal Server Error to a client if ngx_http_discard_request_body() fails, but disable keepalive and continue.
* Request body: fixed discard of chunked request body.Maxim Dounin2012-11-26
| | | | | | Even if there is no preread data, make sure to always call ngx_http_discard_request_body_filter() in case of chunked request body to initialize r->headers_in.content_length_n for later use.
* Core: don't reuse shared memory zone that changed ownership (ticket #210).Ruslan Ermilov2012-11-23
| | | | | | | nginx doesn't allow the same shared memory zone to be used for different purposes, but failed to check this on reconfiguration. If a shared memory zone was used for another purpose in the new configuration, nginx attempted to reuse it and crashed.
* Fixed location of debug message in ngx_shmtx_lock().Ruslan Ermilov2012-11-21
|
* Request body: unbreak build without debug.Maxim Dounin2012-11-21
|
* Request body: chunked transfer encoding support.Maxim Dounin2012-11-21
|
* Request body: recalculate size of a request body in scgi module.Maxim Dounin2012-11-21
| | | | | This allows to handle requests with chunked body by scgi module, and also simplifies handling of various request body modifications.
* Request body: $content_length variable to honor real body size.Maxim Dounin2012-11-21
| | | | | This allows to handle requests with chunked body by fastcgi and uwsgi modules, and also simplifies handling of various request body modifications.
* Request body: always use calculated size of a request body in proxy.Maxim Dounin2012-11-21
| | | | | This allows to handle requests with chunked body, and also simplifies handling of various request body modifications.
* Request body: adjust b->pos when chunked parsing done.Maxim Dounin2012-11-21
| | | | | This is a nop for the current code, though will allow to correctly parse pipelined requests.
* Request body: chunked parsing moved to ngx_http_parse.c from proxy.Maxim Dounin2012-11-21
| | | | No functional changes.
* Request body: properly handle events while discarding body.Maxim Dounin2012-11-21
| | | | | | An attempt to call ngx_handle_read_event() before actually reading data from a socket might result in read event being disabled, which is wrong. Catched by body.t test on Solaris.
* Request body: fixed socket leak on errors.Maxim Dounin2012-11-21
| | | | | | The r->main->count reference counter was always incremented in ngx_http_read_client_request_body(), while it is only needs to be incremented on positive returns.
* Request body: code duplication reduced, no functional changes.Maxim Dounin2012-11-21
| | | | | The r->request_body_in_file_only with empty body case is now handled in ngx_http_write_request_body().
* Request body: $request_body variable generalization.Maxim Dounin2012-11-21
| | | | | | | The $request_body variable was assuming there can't be more than two buffers. While this is currently true due to request body reading implementation details, this is not a good thing to depend on and may change in the future.
* Request body: fixed "501 Not Implemented" error handling.Maxim Dounin2012-11-21
| | | | | | | | | It is not about "Method" but a generic message, and is expected to be used e.g. if specified Transfer-Encoding is not supported. Fixed message to match RFC 2616. Additionally, disable keepalive on such errors as we won't be able to read request body correctly if we don't understand Transfer-Encoding used.
* Core: added debug logging of writev() in ngx_write_chain_to_file().Maxim Dounin2012-11-21
|
* Dav: fixed segfault on PUT if body was already read (ticket #238).Maxim Dounin2012-11-21
| | | | | | | | If request body reading happens with different options it's possible that there will be no r->request_body->temp_file available (or even no r->request_body available if body was discarded). Return internal server error in this case instead of committing suicide by dereferencing a null pointer.
* Fixed failure to start cache manager and cache loader processesIgor Sysoev2012-11-20
| | | | if there were more than 512 listening sockets in configuration.
* Trailing whitespace fix.Maxim Dounin2012-11-17
|
* Upstream: better detection of connect() failures with kqueue.Maxim Dounin2012-11-16
| | | | | | | Pending EOF might be reported on both read and write events, whichever comes first, so check both of them. Patch by Yichun Zhang (agentzh), slightly modified.
* Upstream: honor the "down" flag for a single server.Ruslan Ermilov2012-11-16
| | | | | | | | | | | | | | If an upstream block was defined with the only server marked as "down", e.g. upstream u { server 127.0.0.1:8080 down; } an attempt was made to contact the server despite the "down" flag. It is believed that immediate 502 response is better in such a case, and it's also consistent with what is currently done in case of multiple servers all marked as "down".
* Variables $request_time and $msec.Ruslan Ermilov2012-11-16
| | | | Log module counterparts are preserved for efficiency.
* Fixed setting of CPU affinity on respawn of dead worker processes.Ruslan Ermilov2012-11-16
| | | | | Worker processes are now made aware of their sequential number needed to select CPU affinity mask. This replaces a workaround from r4865.
* Version bump.Ruslan Ermilov2012-11-16
|
* Event pipe: fixed handling of buf_to_file data.Maxim Dounin2012-10-30
| | | | | | | | | | | | | | | Input filter might free a buffer if there is no data in it, and in case of first buffer (used for cache header and request header, aka p->buf_to_file) this resulted in cache corruption. Buffer memory was reused to read upstream response before headers were written to disk. Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer start if we were asked to free a buffer used by p->buf_to_file. This fixes occasional cache file corruption, usually resulted in "cache file ... has md5 collision" alerts. Reported by Anatoli Marinov.
* Variables $connection and $connection_requests.Maxim Dounin2012-10-29
| | | | | Log module counterparts are removed as they aren't used often and there is no need to preserve them for efficiency.
* Resolver: added missing memory allocation error handling.Maxim Dounin2012-10-24
|
* ngx_http_keepalive_handler() is now trying to not keep c->buffer's memory forValentin Bartenev2012-10-23
| | | | | | | idle connections. This behaviour is consistent with the ngx_http_set_keepalive() function and it should decrease memory usage in some cases (especially if epoll/rtsig is used).
* Core: the "auto" parameter of the "worker_processes" directive.Andrey Belov2012-10-23
| | | | | The parameter will set the number of worker processes to the autodetected number of available CPU cores.
* Removed conditional compilation from waitpid() error test.Maxim Dounin2012-10-18
| | | | | | There are reports that call to a signal handler for an exited process despite waitpid() already called for the process may happen on Linux as well.
* Gunzip: fixed r->gzip_ok check.Maxim Dounin2012-10-18
|
* OCSP stapling: properly check if there is ssl.ctx.Maxim Dounin2012-10-05
| | | | | This fixes segfault if stapling was enabled in a server without a certificate configured (and hence no ssl.ctx).
* Variable $bytes_sent.Maxim Dounin2012-10-03
| | | | | | | It replicates variable $bytes_sent as previously available in log module only. Patch by Benjamin Grössing (with minor changes).
* Log: $apache_bytes_sent removed.Maxim Dounin2012-10-03
| | | | | It was renamed to $body_bytes_sent in nginx 0.3.10 and the old name is deprecated since then.
* SSL: the "ssl_verify_client" directive parameter "optional_no_ca".Maxim Dounin2012-10-03
| | | | | | | | | | | This parameter allows to don't require certificate to be signed by a trusted CA, e.g. if CA certificate isn't known in advance, like in WebID protocol. Note that it doesn't add any security unless the certificate is actually checked to be trusted by some external means (e.g. by a backend). Patch by Mike Kazantsev, Eric O'Connor.
* Version bump.Maxim Dounin2012-10-03
|
* OCSP stapling: build fixes.Maxim Dounin2012-10-01
| | | | | | | With the "ssl_stapling_verify" commit build with old OpenSSL libraries was broken due to incorrect prototype of the ngx_ssl_stapling() function. One incorrect use of ngx_log_debug() instead of ngx_log_debug2() slipped in and broke win32 build.
* OCSP stapling: ssl_stapling_verify directive.Maxim Dounin2012-10-01
| | | | | | | | | | OCSP response verification is now switched off by default to simplify configuration, and the ssl_stapling_verify allows to switch it on. Note that for stapling OCSP response verification isn't something required as it will be done by a client anyway. But doing verification on a server allows to mitigate some attack vectors, most notably stop an attacker from presenting some specially crafted data to all site clients.
* OCSP stapling: OCSP_basic_verify() OCSP_TRUSTOTHER flag now used.Maxim Dounin2012-10-01
| | | | | | This is expected to simplify configuration in a common case when OCSP response is signed by a certificate already present in ssl_certificate chain. This case won't need any extra trusted certificates.
* OCSP stapling: log error data in ngx_ssl_error().Maxim Dounin2012-10-01
| | | | | It's hard to debug OCSP_basic_verify() failures without the actual error string it records in the error data field.
* OCSP stapling: check Content-Type.Maxim Dounin2012-10-01
| | | | | | | | | | | | | | | | This will result in better error message in case of incorrect response from OCSP responder: ... OCSP responder sent invalid "Content-Type" header: "text/plain" while requesting certificate status, responder: ... vs. ... d2i_OCSP_RESPONSE() failed (SSL: error:0D07209B:asn1 encoding routines:ASN1_get_object:too long error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error) while requesting certificate status, responder: ...
* OCSP stapling: loading OCSP responses.Maxim Dounin2012-10-01
| | | | | | | | | | | | | This includes the ssl_stapling_responder directive (defaults to OCSP responder set in certificate's AIA extension). OCSP response for a given certificate is requested once we get at least one connection with certificate_status extension in ClientHello, and certificate status won't be sent in the connection in question. This due to limitations in the OpenSSL API (certificate status callback is blocking). Note: SSL_CTX_use_certificate_chain_file() was reimplemented as it doesn't allow to access the certificate loaded via SSL_CTX.
* OCSP stapling: the ngx_event_openssl_stapling.c file.Maxim Dounin2012-10-01
| | | | Missed in previous commit.
* OCSP stapling: ssl_stapling_file support.Maxim Dounin2012-10-01
| | | | | | | | | | Very basic version without any OCSP responder query code, assuming valid DER-encoded OCSP response is present in a ssl_stapling_file configured. Such file might be produced with openssl like this: openssl ocsp -issuer root.crt -cert domain.crt -respout domain.staple \ -url http://ocsp.example.com
* OCSP stapling: ssl_trusted_certificate directive.Maxim Dounin2012-10-01
| | | | | | | | | | | | | | The directive allows to specify additional trusted Certificate Authority certificates to be used during certificate verification. In contrast to ssl_client_certificate DNs of these cerificates aren't sent to a client during handshake. Trusted certificates are loaded regardless of the fact whether client certificates verification is enabled as the same certificates will be used for OCSP stapling, during construction of an OCSP request and for verification of an OCSP response. The same applies to a CRL (which is now always loaded).
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 10:04:10 +0000