aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* Core: removed post_accept_timeout.Maxim Dounin2021-01-19
| | | | | | | | | | Keeping post_accept_timeout in ngx_listening_t is no longer needed since we've switched to 1 second timeout for deferred accept in 5541:fdb67cfc957d. Further, using it in HTTP code can result in client_header_timeout being used from an incorrect server block, notably if address-specific virtual servers are used along with a wildcard listening socket, or if we've switched to a different server block based on SNI in SSL handshake.
* Removed incorrect optimization of HEAD requests.Maxim Dounin2021-01-19
| | | | | | | | | | | | | | | | | | The stub status module and ngx_http_send_response() (used by the empty gif module and the "return" directive) incorrectly assumed that responding to HEAD requests always results in r->header_only being set. This is not true, and results in incorrect behaviour, for example, in the following configuration: location / { image_filter size; return 200 test; } Fix is to remove this incorrect micro-optimization from both stub status module and ngx_http_send_response(). Reported by Chris Newton.
* Upstream: fixed zero size buf alerts on extra data (ticket #2117).Maxim Dounin2021-01-12
| | | | | | | | | | | | | | | | | | After 7675:9afa45068b8f and 7678:bffcc5af1d72 (1.19.1), during non-buffered simple proxying, responses with extra data might result in zero size buffers being generated and "zero size buf" alerts in writer. This bug is similar to the one with FastCGI proxying fixed in 7689:da8d758aabeb. In non-buffered mode, normally the filter function is not called if u->length is already 0, since u->length is checked after each call of the filter function. There is a case when this can happen though: if the response length is 0, and there are pre-read response body data left after reading response headers. As such, a check for u->length is needed at the start of non-buffered filter functions, similar to the one for p->length present in buffered filter functions. Appropriate checks added to the existing non-buffered copy filters in the upstream (used by scgi and uwsgi proxying) and proxy modules.
* Version bump.Maxim Dounin2021-01-11
|
* Fixed double close of non-regular files in flv and mp4.Maxim Dounin2020-12-11
| | | | | | | | | | | | | | With introduction of open_file_cache in 1454:f497ed7682a7, opening a file with ngx_open_cached_file() automatically adds a cleanup handler to close the file. As such, calling ngx_close_file() directly for non-regular files is no longer needed and will result in duplicate close() call. In 1454:f497ed7682a7 ngx_close_file() call for non-regular files was removed in the static module, but wasn't in the flv module. And the resulting incorrect code was later copied to the mp4 module. Fix is to remove the ngx_close_file() call from both modules. Reported by Chris Newton.
* Removed extra allocation for r->uri.Maxim Dounin2020-12-10
| | | | | | | The ngx_http_parse_complex_uri() function cannot make URI longer and does not null-terminate URI, so there is no need to allocate an extra byte. This allocation appears to be a leftover from changes in 461:a88a3e4e158f (0.1.5), where null-termination of r->uri and many other strings was removed.
* Fixed parsing of absolute URIs with empty path (ticket #2079).Maxim Dounin2020-12-10
| | | | | | | | | | | | | | | When the request line contains request-target in the absolute-URI form, it can contain path-empty instead of a single slash (see RFC 7230, RFC 3986). Previously, the ngx_http_parse_request_line() function only accepted empty path when there was no query string. With this change, non-empty query is also correctly handled. That is, request line "GET http://example.com?foo HTTP/1.1" is accepted and results in $uri "/" and $args "foo". Note that $request_uri remains "?foo", similarly to how spaces in URIs are handled. Providing "/?foo", similarly to how "/" is provided for "GET http://example.com HTTP/1.1", requires allocation.
* SSL: fixed SSL shutdown on lingering close.Ruslan Ermilov2020-12-08
| | | | | | | Ensure c->recv is properly reset to ngx_recv if SSL_shutdown() blocks on writing. The bug had appeared in 554c6ae25ffc.
* Upstream: excluded down servers from the next_upstream tries.Ruslan Ermilov2020-11-27
| | | | | | | Previously, the number of next_upstream tries included servers marked as "down", resulting in "no live upstreams" with the code 502 instead of the code derived from an attempt to connect to the last tried "up" server (ticket #2096).
* Version bump.Ruslan Ermilov2020-11-26
|
* gRPC: RST_STREAM(NO_ERROR) handling after "trailer only" responses.Pavel Pautov2020-11-18
| | | | | | | | | | | | | | | Similarly to the problem fixed in 2096b21fcd10 (ticket #1792), when a "trailer only" gRPC response (that is, a response with the END_STREAM flag in the HEADERS frame) was immediately followed by RST_STREAM(NO_ERROR) in the data preread along with the response header, RST_STREAM wasn't properly skipped and caused "upstream rejected request with error 0" errors. Observed with "unknown service" gRPC errors returned by grpc-go. Fix is to set ctx->done if we are going to parse additional data, so the RST_STREAM(NO_ERROR) is properly skipped. Additionally, now ngx_http_grpc_filter() will complain about frames sent for closed stream if there are any.
* Core: "-e" command line option.Igor Ippolitov2020-11-19
| | | | | | | | | When installing or running from a non-root user it is sometimes required to override default, compiled in error log path. There was no way to do this without rebuilding the binary (ticket #147). This patch introduced "-e" command line option which allows one to override compiled in error log path.
* Request body: removed error assumption (ticket #2058).Maxim Dounin2020-11-09
| | | | | | | | | | | | | Before introduction of request body filter in 42d9beeb22db, the only possible return code from the ngx_http_request_body_filter() call without actual buffers was NGX_HTTP_INTERNAL_SERVER_ERROR, and the code in ngx_http_read_client_request_body() hardcoded the only possible error to simplify the code of initial call to set rb->rest. This is no longer true after introduction of request body filters though, as a request body filter might need to return other errors, such as 403. Fix is to preserve the error code actually returned by the call instead of assuming 500.
* Request body: improved logging.Maxim Dounin2020-11-09
| | | | | | | Added logging before returning NGX_HTTP_INTERNAL_SERVER_ERROR if there are busy buffers after a request body flush. This should never happen with current code, though bugs can be introduced by 3rd party modules. Make sure debugging will be easy enough.
* SSL: fixed non-working SSL shutdown on lingering close.Ruslan Ermilov2020-11-06
| | | | | | | | When doing lingering close, the socket was first shut down for writing, so SSL shutdown initiated after lingering close was not able to send the close_notify alerts (ticket #2056). The fix is to call ngx_ssl_shutdown() before shutting down the socket.
* Removed dead code from ngx_http_set_keepalive().Ruslan Ermilov2020-11-06
| | | | | The code removed became dead after 98f03cd8d6cc (0.8.14), circa when the request reference counting was introduced.
* Core: added format specifiers to output binary data as hex.Vladimir Homutov2020-10-28
| | | | | | | Now "s", "V", and "v" format specifiers may be prefixed with "x" (lowercase) or "X" (uppercase) to output corresponding data in hexadecimal format. In collaboration with Maxim Dounin.
* Version bump.Vladimir Homutov2020-11-05
|
* SSL: ssl_reject_handshake directive (ticket #195).Maxim Dounin2020-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.
* Stream: proxy_ssl_conf_command directive.Maxim Dounin2020-10-22
| | | | | | | | | Similarly to ssl_conf_command, proxy_ssl_conf_command can be used to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later, when connecting to upstream servers with SSL. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).
* Upstream: proxy_ssl_conf_command and friends.Maxim Dounin2020-10-22
| | | | | | | | | Similarly to ssl_conf_command, proxy_ssl_conf_command (grpc_ssl_conf_command, uwsgi_ssl_conf_command) can be used to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later, when connecting to upstream servers with SSL. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).
* SSL: ssl_conf_command directive.Maxim Dounin2020-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | With the ssl_conf_command directive it is now possible to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html). In particular, this allows configuring PrioritizeChaCha option (ticket #1445): ssl_conf_command Options PrioritizeChaCha; It can be also used to configure TLSv1.3 ciphers in OpenSSL, which fails to configure them via the SSL_CTX_set_cipher_list() interface (ticket #1529): ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; Configuration commands are applied after nginx own configuration for SSL, so they can be used to override anything set by nginx. Note though that configuring OpenSSL directly with ssl_conf_command might result in a behaviour nginx does not expect, and should be done with care.
* Core: ngx_conf_set_keyval_slot() now accepts NGX_CONF_UNSET_PTR.Maxim Dounin2020-10-22
| | | | | | | | | | With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge keyval arrays. This change actually follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.
* Cpp test: added stream.Ruslan Ermilov2020-10-13
|
* Limit req: unlocking of nodes on complex value errors.Maxim Dounin2020-10-08
| | | | | | | | Previously, if there were multiple limits configured, errors in ngx_http_complex_value() during processing of a non-first limit resulted in reference count leak in shared memory nodes of already processed limits. Fix is to explicity unlock relevant nodes, much like we do when rejecting requests.
* Mail: proxy_smtp_auth directive.Maxim Dounin2020-10-03
| | | | | | | | | The proxy_smtp_auth directive instructs nginx to authenticate users on backend via the AUTH command (using the PLAIN SASL mechanism), similar to what is normally done for IMAP and POP3. If xclient is enabled along with proxy_smtp_auth, the XCLIENT command won't try to send the LOGIN parameter.
* Version bump.Maxim Dounin2020-10-03
|
* Proxy: error checking for array init, missed in 7716:d6a5e14aa3e4.Maxim Dounin2020-09-29
| | | | Found by Coverity (CID 1467637).
* Userid: userid_flags fixup.Maxim Dounin2020-09-29
| | | | | | | | In 7717:e3e8b8234f05, the 1st bit was incorrectly used. It shouldn't be used for bitmask values, as it is used by NGX_CONF_BITMASK_SET. Additionally, special value "off" added to make it possible to clear inherited userid_flags value.
* Resolver: improved error messages (ticket #2024).Maxim Dounin2020-09-28
|
* Userid: userid_flags directive to set cookie flags.Maxim Dounin2020-09-28
|
* Proxy: added the "proxy_cookie_flags" directive.Ruslan Ermilov2020-09-27
|
* Proxy: changed interface of some internal functions.Ruslan Ermilov2020-09-27
| | | | | | | This is in preparation for the next change. Also, moved optimization from ngx_http_proxy_rewrite_regex_handler() to ngx_http_proxy_rewrite().
* Proxy: strengthen syntax checking for some directives.Ruslan Ermilov2020-09-27
| | | | | | | | | | | | | | | | | | The "false" parameter of the proxy_redirect directive is deprecated. Warning has been emitted since c2230102df6f (0.7.54). The "off" parameter of the proxy_redirect, proxy_cookie_domain, and proxy_cookie_path directives tells nginx not to inherit the configuration from the previous configuration level. Previously, after specifying the directive with the "off" parameter, any other directives were ignored, and syntax checking was disabled. The syntax was enforced to allow either one directive with the "off" parameter, or several directives with other parameters. Also, specifying "proxy_redirect default foo" no longer works like "proxy_redirect default".
* Stream: set module.Pavel Pautov2020-08-28
| | | | Adds 'set' directive to the stream server context.
* SSL: abort handshake on SSL_set_SSL_CTX() errors.Sergey Kandaurov2020-09-24
| | | | | | In rare cases, such as memory allocation failure, SSL_set_SSL_CTX() returns NULL, which could mean that a different SSL configuration has not been set. Note that this new behaviour seemingly originated in OpenSSL-1.1.0 release.
* HTTP/2: run posted requests after reading body.Maxim Dounin2020-09-23
| | | | | | HTTP/2 code failed to run posted requests after calling the request body handler, and this resulted in connection hang if a subrequest was created in the body handler and no other actions were made.
* HTTP/2: fixed segfault on DATA frames after 400 errors.Maxim Dounin2020-09-23
| | | | | | | | | | | | | | | | | | | | If 400 errors were redirected to an upstream server using the error_page directive, DATA frames from the client might cause segmentation fault due to null pointer dereference. The bug had appeared in 6989:2c4dbcd6f2e4 (1.13.0). Fix is to skip such frames in ngx_http_v2_state_read_data() (similarly to 7561:9f1f9d6e056a). With the fix, behaviour of 400 errors in HTTP/2 is now similar to one in HTTP/1.x, that is, nginx doesn't try to read the request body. Note that proxying 400 errors, as well as other early stage errors, to upstream servers might not be a good idea anyway. These errors imply that reading and processing of the request (and the request headers) wasn't complete, and proxying of such incomplete request might lead to various errors. Reported by Chenglong Zhang.
* SSL: disabled shutdown when there are buffered data.Maxim Dounin2020-09-16
| | | | | | | This fixes "SSL_shutdown() failed (SSL: ... bad write retry)" errors as observed on the second SSL_shutdown() call after SSL shutdown fixes in 09fb2135a589 (1.19.2), notably when HTTP/2 connections are closed due to read timeouts while there are incomplete writes.
* SSL: disabled shutdown after connection errors.Maxim Dounin2020-09-16
| | | | | | | | | | | | | | This fixes "SSL_shutdown() failed (SSL: ... bad write retry)" errors as observed on the second SSL_shutdown() call after SSL shutdown fixes in 09fb2135a589 (1.19.2), notably when sending fails in ngx_http_test_expect(), similarly to ticket #1194. Note that there are some places where c->error is misused to prevent further output, such as ngx_http_v2_finalize_connection() if there are pending streams, or in filter finalization. These places seem to be extreme enough to don't care about missing shutdown though. For example, filter finalization currently prevents keepalive from being used.
* SSL: fixed event handling during shutdown.Maxim Dounin2020-09-16
| | | | | | | The c->read->ready and c->write->ready flags need to be cleared to ensure that appropriate read or write events will be reported by kernel. Without this, SSL shutdown might wait till the timeout after blocking on writing or reading even if there is a socket activity.
* SSL: workaround for incorrect SSL_write() errors in OpenSSL 1.1.1.Maxim Dounin2020-09-16
| | | | | | | | | | | | | | | | | | OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error happens during SSL_write() after close_notify alert from the peer, and returns SSL_ERROR_ZERO_RETURN instead. Broken by this commit, which removes the "i == 0" check around the SSL_RECEIVED_SHUTDOWN one: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2 In particular, if a client closed the connection without reading the response but with properly sent close_notify alert, this resulted in unexpected "SSL_write() failed while ..." critical log message instead of correct "SSL_write() failed (32: Broken pipe)" at the info level. Since SSL_ERROR_ZERO_RETURN cannot be legitimately returned after SSL_write(), the fix is to convert all SSL_ERROR_ZERO_RETURN errors after SSL_write() to SSL_ERROR_SYSCALL.
* Cache: keep c->body_start when Vary changes (ticket #2029).Sergey Kandaurov2020-09-09
| | | | | | | | If the variant hash doesn't match one we used as a secondary cache key, we switch back to the original key. In this case, c->body_start was kept updated from an existing cache node overwriting the new response value. After file cache update, it led to discrepancy between a cache node and cache file seen as critical errors "file cache .. has too long header".
* Cache: reset c->body_start when reading a variant on Vary mismatch.Sergey Kandaurov2017-08-04
| | | | | | Previously, a variant not present in shared memory and stored on disk using a secondary key was read using c->body_start from a variant stored with a main key. This could result in critical errors "cache file .. has too long header".
* HTTP/2: rejecting invalid stream identifiers with PROTOCOL_ERROR.Sergey Kandaurov2020-09-02
| | | | Prodded by Xu Yang.
* Cache: ignore stale-if-error for 4xx and 5xx codes.Roman Arutyunyan2020-07-29
| | | | | | | | | | | | | | | | | | | Previously the stale-if-error extension of the Cache-Control upstream header triggered the return of a stale response for all error conditions that can be specified in the proxy_cache_use_stale directive. The list of these errors includes both network/timeout/format errors, as well as some HTTP codes like 503, 504, 403, 429 etc. The latter prevented a cache entry from being updated by a response with any of these HTTP codes during the stale-if-error period. Now stale-if-error only works for network/timeout/format errors and ignores the upstream HTTP code. The return of a stale response for certain HTTP codes is still possible using the proxy_cache_use_stale directive. This change also applies to the stale-while-revalidate extension of the Cache-Control header, which triggers stale-if-error if it is missing. Reported at http://mailman.nginx.org/pipermail/nginx/2020-July/059723.html.
* Version bump.Roman Arutyunyan2020-08-14
|
* Core: reusing connections in advance.Maxim Dounin2020-08-10
| | | | | | | | | | | | | Reworked connections reuse, so closing connections is attempted in advance, as long as number of free connections is less than 1/16 of worker connections configured. This ensures that new connections can be handled even if closing a reusable connection requires some time, for example, for a lingering close (ticket #2017). The 1/16 ratio is selected to be smaller than 1/8 used for disabling accept when working with accept mutex, so nginx will try to balance new connections to different workers first, and will start reusing connections only if this won't help.
* Core: added a warning about reusing connections.Maxim Dounin2020-08-10
| | | | | | | | | | | Previously, reusing connections happened silently and was only visible in monitoring systems. This was shown to be not very user-friendly, and administrators often didn't realize there were too few connections available to withstand the load, and configured timeouts (keepalive_timeout and http2_idle_timeout) were effectively reduced to keep things running. To provide at least some information about this, a warning is now logged (at most once per second, to avoid flooding the logs).
* SSL: disabled sending shutdown after ngx_http_test_reading().Maxim Dounin2020-08-10
| | | | | | | | | | | | | Sending shutdown when ngx_http_test_reading() detects the connection is closed can result in "SSL_shutdown() failed (SSL: ... bad write retry)" critical log messages if there are blocked writes. Fix is to avoid sending shutdown via the c->ssl->no_send_shutdown flag, similarly to how it is done in ngx_http_keepalive_handler() for kqueue when pending EOF is detected. Reported by Jan Prachař (http://mailman.nginx.org/pipermail/nginx-devel/2018-December/011702.html).
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-21 07:13:11 +0000