aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Disable symlinks: added explicit cast of AT_FDCWD (ticket #111).Maxim Dounin2012-02-20
| | | | | | Solaris has AT_FDCWD defined to unsigned value, and comparison of a file descriptor with it causes warnings in modern versions of gcc. Explicitly cast AT_FDCWD to ngx_fd_t to resolve these warnings.
* Disable symlinks: error handling cleanup again.Maxim Dounin2012-02-20
|
* Version bump.Maxim Dounin2012-02-20
|
* Disable symlinks: fixed edge cases of path handling.Maxim Dounin2012-02-15
| | | | | This includes non-absolute pathnames, multiple slashes and trailing slashes. In collaboration with Valentin Bartenev.
* Disable symlinks: cleanup error handling.Maxim Dounin2012-02-15
| | | | | Notably this fixes NGX_INVALID_FILE/NGX_FILE_ERROR mess, and adds logging of close() errors. In collaboration with Valentin Bartenev.
* Support for disable_symlinks in various modules.Andrey Belov2012-02-13
|
* Added disable_symlinks directive.Andrey Belov2012-02-13
| | | | | | | | | | | | | | | | | | To completely disable symlinks (disable_symlinks on) we use openat(O_NOFOLLOW) for each path component to avoid races. To allow symlinks with the same owner (disable_symlinks if_not_owner), use openat() (followed by fstat()) and fstatat(AT_SYMLINK_NOFOLLOW), and then compare uids between fstat() and fstatat(). As there is a race between openat() and fstatat() we don't know if openat() in fact opened symlink or not. Therefore, we have to compare uids even if fstatat() reports the opened component isn't a symlink (as we don't know whether it was symlink during openat() or not). Default value is off, i.e. symlinks are allowed.
* Changed ngx_open_and_stat_file() to use ngx_str_t.Andrey Belov2012-02-13
| | | | No functional changes.
* Added openat()/fstatat().Andrey Belov2012-02-13
|
* Time parsing cleanup.Maxim Dounin2012-02-13
| | | | | | | Nuke NGX_PARSE_LARGE_TIME, it's not used since 0.6.30. The only error ngx_parse_time() can currently return is NGX_ERROR, check it explicitly and make sure to cast it to appropriate type (either time_t or ngx_msec_t) to avoid signedness warnings on platforms with unsigned time_t (notably QNX).
* Fixed build with embedded perl and --with-openssl.Maxim Dounin2012-02-13
|
* Core: protection from cycles with named locations and post_action.Maxim Dounin2012-02-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Now redirects to named locations are counted against normal uri changes limit, and post_action respects this limit as well. As a result at least the following (bad) configurations no longer trigger infinite cycles: 1. Post action which recursively triggers post action: location / { post_action /index.html; } 2. Post action pointing to nonexistent named location: location / { post_action @nonexistent; } 3. Recursive error page for 500 (Internal Server Error) pointing to a nonexistent named location: location / { recursive_error_pages on; error_page 500 @nonexistent; return 500; }
* Core: protection from subrequest loops.Maxim Dounin2012-02-13
| | | | | | | | | | | | Without the protection, subrequest loop results in r->count overflow and SIGSEGV. Protection was broken in 0.7.25. Note that this also limits number of parallel subrequests. This wasn't exactly the case before 0.7.25 as local subrequests were completed directly. See here for details: http://nginx.org/pipermail/nginx-ru/2010-February/032184.html
* Variables: honor no_cacheable for not_found variables.Maxim Dounin2012-02-13
| | | | | | | | | | | | | Variables with the "not_found" flag set follow the same rules as ones with the "valid" flag set. Make sure ngx_http_get_flushed_variable() will flush non-cacheable variables with the "not_found" flag set. This fixes at least one known problem with $args not available in a subrequest (with args) when there were no args in the main request and $args variable was queried in the main request (reported by Laurence Rowe aka elro on irc). Also this eliminates unneeded call to ngx_http_get_indexed_variable() in cacheable case (as it will return cached value anyway).
* Fix for proxy_store leaving temporary files for subrequests.Maxim Dounin2012-02-13
| | | | | | | | | | | | | | Temporary files might not be removed if the "proxy_store" or "fastcgi_store" directives were used for subrequests (e.g. ssi includes) and client closed connection prematurely. Non-active subrequests are finalized out of the control of the upstream module when client closes a connection. As a result, the code to remove unfinished temporary files in ngx_http_upstream_process_request() wasn't executed. Fix is to move relevant code into ngx_http_upstream_finalize_request() which is called in all cases, either directly or via the cleanup handler.
* Gzip filter: handling of empty flush buffers.Maxim Dounin2012-02-13
| | | | | | | | | | | Empty flush buffers are legitimate and may happen e.g. due to $r->flush() calls in embedded perl. If there are no data buffered in zlib, deflate() will return Z_BUF_ERROR (i.e. no progress possible) without adding anything to output. Don't treat Z_BUF_ERROR as fatal and correctly send empty flush buffer if we have no data in output at all. See this thread for details: http://mailman.nginx.org/pipermail/nginx/2010-November/023693.html
* Removed r->cache/r->cached dependencies in range filter.Maxim Dounin2012-02-13
| | | | This is a layering violation, use correct offset calculations instead.
* Proxy: added the "proxy_cookie_path" directive.Valentin Bartenev2012-02-13
|
* Proxy: added the "proxy_cookie_domain" directive.Valentin Bartenev2012-02-13
|
* Upstream: added callback hook for the "Set-Cookie" header.Valentin Bartenev2012-02-13
| | | | No functional changes.
* Proxy: generic regex related code from the "proxy_redirect" directive movedValentin Bartenev2012-02-13
| | | | | | to a separate function. No functional changes.
* Proxy: generic rewrite code from the "proxy_redirect" handlers moved to aValentin Bartenev2012-02-13
| | | | | | separate function with trivial optimization. No functional changes.
* Proxy: renamed some "proxy_redirect" related declarations to a more general andValentin Bartenev2012-02-13
| | | | | | reusable. No functional changes.
* Upstream: fixed "too big header" check.Maxim Dounin2012-02-10
| | | | | | | | | | If header filter postponed processing of a header by returning NGX_AGAIN and not moved u->buffer->pos, previous check incorrectly assumed there is additional space and did another recv() with zero-size buffer. This resulted in "upstream prematurely closed connection" error instead of correct "upstream sent too big header" one. Patch by Feibo Li.
* Added ngx_ncpu detection for most *nix platforms.Valentin Bartenev2012-02-10
| | | | | This inaccurate detection by using sysconf(_SC_NPROCESSORS_ONLN) can improve usage of the mutex lock optimization on multicore systems.
* Limit conn: returned to the old behavior of using the first actual limit onValentin Bartenev2012-02-10
| | | | | | | the way. It was unintentionally changed in r4272, so that it could only limit the first location where the processing of the request has reached PREACCESS phase.
* Fixed module name in comment. It was forgotten in r4281.Valentin Bartenev2012-02-10
|
* Version bump.Maxim Dounin2012-02-09
|
* Limit req: unbreak compilation with MSVC.Maxim Dounin2012-01-30
|
* Fixed memory leak on HUP signal when PCRE JIT was used.Valentin Bartenev2012-01-30
| | | | | The PCRE JIT compiler uses mmap to allocate memory for its executable codes, so we have to explicitly call the pcre_free_study() function to free this memory.
* Fixed proxy_redirect off inheritance.Valentin Bartenev2012-01-30
| | | | | | | | | | | | | | | | | | | Example configuration to reproduce: server { proxy_redirect off; location / { proxy_pass http://localhost:8000; proxy_redirect http://localhost:8000/ /; location ~ \.php$ { proxy_pass http://localhost:8000; # proxy_redirect must be inherited from the level above, # but instead it was switched off here } } }
* Fixed error handling in ngx_event_connect_peer().Maxim Dounin2012-01-30
| | | | | | | | | Previously if ngx_add_event() failed a connection was freed two times (once in the ngx_event_connect_peer(), and again by a caller) as pc->connection was left set. Fix is to always use ngx_close_connection() to close connection properly and set pc->connection to NULL on errors. Patch by Piotr Sikora.
* Limit req: support for multiple "limit_req" limits.Valentin Bartenev2012-01-30
|
* Limit req: number of cleanup calls reduced.Valentin Bartenev2012-01-30
| | | | | | | | | Doing a cleanup before every lookup seems to be too aggressive. It can lead to premature removal of the nodes still usable, which increases the amount of work under a mutex lock and therefore decreases performance. In order to improve cleanup behavior, cleanup function call has been moved right before the allocation of a new node.
* Limit req: allocation and initialization of a new node moved to the lookupValentin Bartenev2012-01-30
| | | | | | function. No functional changes.
* Limit req: improved error handling when parsing "zone" parameter ofValentin Bartenev2012-01-30
| | | | | | | | | | "limit_req_zone" directive; minimum size of zone is increased. Previously an unsigned variable was used to keep the return value of ngx_parse_size() function, which led to an incorrect zone size if NGX_ERROR was returned. The new code has been taken from the "limit_conn_zone" directive.
* Limit req: error messages fixed.Valentin Bartenev2012-01-30
|
* Fixed AIO error handling on FreeBSD.Maxim Dounin2012-01-30
| | | | | | | | | The aio_return() must be called regardless of the error returned by aio_error(). Not calling it resulted in various problems up to segmentation faults (as AIO events are level-triggered and were reported again and again). Additionally, in "aio sendfile" case r->blocked was incremented in case of error returned from ngx_file_aio_read(), thus causing request hangs.
* Removed ENGINE_load_builtin_engines() call.Maxim Dounin2012-01-30
| | | | | | It's already called by OPENSSL_config(). Calling it again causes some openssl engines (notably GOST) to corrupt memory, as they don't expect to be created more than once.
* Fixed grammar in PCRE JIT error log message.Valentin Bartenev2012-01-24
|
* Copyright updated.Maxim Konovalov2012-01-18
|
* Version bump.Maxim Konovalov2012-01-18
|
* Version bump.Maxim Konovalov2012-01-18
|
* Fixed division by zero exception in ngx_hash_init().Valentin Bartenev2012-01-16
| | | | | | | | | | | | | | | | The ngx_hash_init() function did not expect call with zero elements count, which caused FPE error on configs with an empty "types" block in http context and "types_hash_max_size" > 10000. Example configuration to reproduce: events { } http { types_hash_max_size 10001; types {} server {} }
* Fixed sched_setaffinity(2) to correctly pass size.Maxim Dounin2012-01-16
| | | | | | Second argument (cpusetsize) is size in bytes, not in bits. Previously used constant 32 resulted in reading of uninitialized memory and caused EINVAL to be returned on some Linux kernels.
* Fixed handling of mp4 above 2G and 32bit offsets (ticket #84).Maxim Dounin2012-01-16
|
* Fixed proxy_cache_use_stale in "no live upstreams" case.Maxim Dounin2012-01-16
|
* Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.Maxim Dounin2012-01-11
| | | | | | Support for TLSv1.1 and TLSv1.2 protocols was introduced in OpenSSL 1.0.1 (-beta1 was recently released). This change makes it possible to disable these protocols and/or enable them without other protocols.
* Fixed limit_req burst/nodelay inheritance (ticket #76).Maxim Dounin2012-01-11
| | | | The problem was introduced in r4381 (1.1.12).
* Fixed: proxy_redirect with regex might broke Refresh header.Valentin Bartenev2012-01-10
| | | | | The problem was localized in ngx_http_proxy_rewrite_redirect_regex() handler function which did not take into account prefix when overwriting header value.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-18 16:15:33 +0000