aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* Version bump.Maxim Dounin2019-08-16
|
* HTTP/2: limited number of PRIORITY frames.Ruslan Ermilov2019-08-13
| | | | | Fixed excessive CPU usage caused by a peer that continuously shuffles priority of streams. Fix is to limit the number of PRIORITY frames.
* HTTP/2: limited number of DATA frames.Ruslan Ermilov2019-08-13
| | | | | | Fixed excessive memory growth and CPU usage if stream windows are manipulated in a way that results in generating many small DATA frames. Fix is to limit the number of simultaneously allocated DATA frames.
* HTTP/2: reject zero length headers with PROTOCOL_ERROR.Sergey Kandaurov2019-08-13
| | | | | | Fixed uncontrolled memory growth if peer sends a stream of headers with a 0-length header name and 0-length header value. Fix is to reject headers with zero name length.
* Mail: fixed duplicate resolving.Maxim Dounin2019-08-01
| | | | | | | | | | | | When using SMTP with SSL and resolver, read events might be enabled during address resolving, leading to duplicate ngx_mail_ssl_handshake_handler() calls if something arrives from the client, and duplicate session initialization - including starting another resolving. This can lead to a segmentation fault if the session is closed after first resolving finished. Fix is to block read events while resolving. Reported by Robert Norris, http://mailman.nginx.org/pipermail/nginx/2019-July/058204.html.
* Gzip: fixed "zero size buf" alerts after ac5a741d39cf.Maxim Dounin2019-07-31
| | | | | | | | | | | | | | | | After ac5a741d39cf it is now possible that after zstream.avail_out reaches 0 and we allocate additional buffer, there will be no more data to put into this buffer, triggering "zero size buf" alert. Fix is to reset b->temporary flag in this case. Additionally, an optimization added to avoid allocating additional buffer in this case, by checking if last deflate() call returned Z_STREAM_END. Note that checking for Z_STREAM_END by itself is not enough to fix alerts, as deflate() can return Z_STREAM_END without producing any output if the buffer is smaller than gzip trailer. Reported by Witold Filipczyk, http://mailman.nginx.org/pipermail/nginx-devel/2019-July/012469.html.
* Version bump.Maxim Dounin2019-07-31
|
* Core: fixed memory leak on error, missed in c3f60d618c17.Maxim Dounin2019-07-19
| | | | Found by Coverity (CID 1451664).
* Xslt: fixed potential buffer overflow with null character.Maxim Dounin2019-07-18
| | | | | | | | | | Due to shortcomings of the ccv->zero flag implementation in complex value interface, length of the resulting string from ngx_http_complex_value() might either not include terminating null character or include it, so the only safe way to work with the result is to use it as a null-terminated string. Reported by Patrick Wollgast.
* SSI: avoid potential buffer overflow.Maxim Dounin2019-07-18
| | | | | | | | | | When "-" follows a parameter of maximum length, a single byte buffer overflow happens, since the error branch does not check parameter length. Fix is to avoid saving "-" to the parameter key, and instead use an error message with "-" explicitly written. The message is mostly identical to one used in similar cases in the preequal state. Reported by Patrick Wollgast.
* Upstream: fixed EOF handling in unbuffered and upgraded modes.Maxim Dounin2019-07-18
| | | | | | | | With level-triggered event methods it is important to specify the NGX_CLOSE_EVENT flag to ngx_handle_read_event(), otherwise the event won't be removed, resulting in CPU hog. Reported by Patrick Wollgast.
* HTTP/2: return error on output on closed stream.Maxim Dounin2019-07-18
| | | | | Without this, an (incorrect) output on a closed stream could result in a socket leak.
* Core: fixed segfault with too large bucket sizes (ticket #1806).Maxim Dounin2019-07-18
| | | | | | | | | | To save memory hash code uses u_short to store resulting bucket sizes, so maximum bucket size is limited to 65536 minus ngx_cacheline_size (larger values will be aligned to 65536 which will overflow u_short). However, there were no checks to enforce this, and using larger bucket sizes resulted in overflows and segmentation faults. Appropriate safety checks to enforce this added to ngx_hash_init().
* Perl: removed unused variable, forgotten in 975d7ab37b39.Maxim Dounin2019-07-17
|
* Gzip: use zlib to write header and trailer.Ilya Leoshkevich2019-07-12
| | | | | | | | | | | | | | | | | | | | | When nginx is used with zlib patched with [1], which provides integration with the future IBM Z hardware deflate acceleration, it ends up computing CRC32 twice: one time in hardware, which always does this, and one time in software by explicitly calling crc32(). crc32() calls were added in changesets 133:b27548f540ad ("nginx-0.0.1- 2003-09-24-23:51:12 import") and 134:d57c6835225c ("nginx-0.0.1- 2003-09-26-09:45:21 import") as part of gzip wrapping feature - back then zlib did not support it. However, since then gzip wrapping was implemented in zlib v1.2.0.4, and it's already being used by nginx for log compression. This patch replaces hand-written gzip wrapping with the one provided by zlib. It simplifies the code, and makes it avoid computing CRC32 twice when using hardware acceleration. [1] https://github.com/madler/zlib/pull/410
* Perl: named locations in $r->internal_redirect().Maxim Dounin2019-07-12
|
* Perl: expect escaped URIs in $r->internal_redirect().Maxim Dounin2019-07-12
| | | | | | Similarly to the change in 5491:74bfa803a5aa (1.5.9), we should accept properly escaped URIs and unescape them as needed, else it is not possible to handle URIs with question marks.
* Perl: additional ctx->header_sent checks.Maxim Dounin2019-07-12
| | | | | | | | | As we now have ctx->header_sent flag, it is further used to prevent duplicate $r->send_http_header() calls, prevent output before sending header, and $r->internal_redirect() after sending header. Further, $r->send_http_header() protected from calls after $r->internal_redirect().
* Perl: avoid returning 500 if header was already sent.Maxim Dounin2019-07-12
| | | | | | | Returning NGX_HTTP_INTERNAL_SERVER_ERROR if a perl code died after sending header will lead to a "header already sent" alert. To avoid it, we now check if header was already sent, and return NGX_ERROR instead if it was.
* Perl: avoid redirects on errors.Maxim Dounin2019-07-12
| | | | | | Previously, redirects scheduled with $r->internal_redirect() were followed even if the code then died. Now these are ignored and nginx will return an error instead.
* Perl: disabled unrelated calls from variable handlers.Maxim Dounin2019-07-12
| | | | | | Variable handlers are not expected to send anything to the client, cannot sleep or read body, and are not expected to modify the request. Added appropriate protection to prevent accidental foot shooting.
* Perl: protection against duplicate $r->sleep() calls.Maxim Dounin2019-07-12
| | | | | | Duplicate $r->sleep() and/or $r->has_request_body() calls result in undefined behaviour (in practice, connection leaks were observed). To prevent this, croak() added in appropriate places.
* Perl: handling of allocation errors.Maxim Dounin2019-07-12
| | | | | | | | | | | Previously, allocation errors in nginx.xs were more or less ignored, potentially resulting in incorrect code execution in specific low-memory conditions. This is changed to use ctx->error bit and croak(), similarly to how output errors are now handled. Note that this is mostly a cosmetic change, as Perl itself exits on memory allocation errors, and hence nginx with Perl is hardly usable in low-memory conditions.
* Perl: propagate errors.Maxim Dounin2019-07-12
| | | | | | | | | | | | | | | | | | When an error happens, the ctx->error bit is now set, and croak() is called to terminate further processing. The ctx->error bit is checked in ngx_http_perl_call_handler() to cancel further processing, and is also checked in various output functions - to make sure these won't be called if croak() was handled by an eval{} in perl code. In particular, this ensures that output chain won't be called after errors, as filters might not expect this to happen. This fixes some segmentation faults under low memory conditions. Also this stops request processing after filter finalization or request body reading errors. For cases where an HTTP error status can be additionally returned (for example, 416 (Requested Range Not Satisfiable) from the range filter), the ctx->status field is also added.
* Perl: reworked perl module to pass ctx instead of request.Maxim Dounin2019-07-12
| | | | | | | | | | | | | | | | | | | | | | This ensures that correct ctx is always available, including after filter finalization. In particular, this fixes a segmentation fault with the following configuration: location / { image_filter test; perl 'sub { my $r = shift; $r->send_http_header(); $r->print("foo\n"); $r->print("bar\n"); }'; } This also seems to be the only way to correctly handle filter finalization in various complex cases, for example, when embedded perl is used both in the original handler and in an error page called after filter finalization.
* Perl: removed unneeded NGX_DONE test.Maxim Dounin2019-07-11
| | | | | | | The NGX_DONE test in ngx_http_perl_handle_request() was introduced in 1702:86bb52e28ce0, which also modified ngx_http_perl_call_handler() to return NGX_DONE with c->destroyed. The latter part was then removed in 3050:f54b02dbb12b, so NGX_DONE test is no longer needed.
* Version bump.Maxim Dounin2019-07-09
|
* Perl: disabled not_modified filter (ticket #1786).Maxim Dounin2019-06-17
| | | | | | | | | | | | | | | | Embedded perl does not set any request fields needed for conditional requests processing. Further, filter finalization in the not_modified filter can cause segmentation faults due to cleared ctx as in ticket #1786. Before 5fb1e57c758a (1.7.3) the not_modified filter was implicitly disabled for perl responses, as r->headers_out.last_modified_time was -1. This change restores this behaviour by using the explicit r->disable_not_modified flag. Note that this patch doesn't try to address perl module robustness against filter finalization and other errors returned from filter chains. It should be eventually reworked to handle errors instead of ignoring them.
* Limit req: limit_req_dry_run directive.Roman Arutyunyan2019-06-05
| | | | | | A new directive limit_req_dry_run allows enabling the dry run mode. In this mode requests are neither rejected nor delayed, but reject/delay status is logged as usual.
* Upstream: background cache update before cache send (ticket #1782).Roman Arutyunyan2019-06-03
| | | | | | | | | | | | | | | | | | | | | | In case of filter finalization, essential request fields like r->uri, r->args etc could be changed, which affected the cache update subrequest. Also, after filter finalization r->cache could be set to NULL, leading to null pointer dereference in ngx_http_upstream_cache_background_update(). The fix is to create background cache update subrequest before sending the cached response. Since initial introduction in 1aeaae6e9446 (1.11.10) background cache update subrequest was created after sending the cached response because otherwise it blocked the parent request output. In 9552758a786e (1.13.1) background subrequests were introduced to eliminate the delay before sending the final part of the cached response. This also made it possible to create the background cache update subrequest before sending the response. Note that creating the subrequest earlier does not change the fact that in case of filter finalization the background cache update subrequest will likely not have enough time to successfully update the cache entry. Filter finalization leads to the main request termination as soon the current iteration of request processing is complete.
* Upstream hash: fall back to round-robin if hash key is empty.Niklas Keller2019-05-23
|
* Version bump.Roman Arutyunyan2019-05-27
|
* SSL: removed OpenSSL 0.9.7 compatibility.Sergey Kandaurov2016-04-11
|
* Range filter: fixed duplicate last buffers.Maxim Dounin2019-05-13
| | | | | | | | | | | | | | | | | | | | | | | In ngx_http_range_singlepart_body() special buffers where passed unmodified, including ones after the end of the range. As such, if the last buffer of a response was sent separately as a special buffer, two buffers with b->last_buf set were present in the response. In particular, this might result in a duplicate final chunk when using chunked transfer encoding (normally range filter and chunked transfer encoding are not used together, but this may happen if there are trailers in the response). This also likely to cause problems in HTTP/2. Fix is to skip all special buffers after we've sent the last part of the range requested. These special buffers are not meaningful anyway, since we set b->last_buf in the buffer with the last part of the range, and everything is expected to be flushed due to it. Additionally, ngx_http_next_body_filter() is now called even if no buffers are to be passed to it. This ensures that various write events are properly propagated through the filter chain. In particular, this fixes test failures observed with the above change and aio enabled.
* Range filter: fixed loss of incoming chain links.Maxim Dounin2019-05-13
| | | | | | | | | | | | | | | | | | Filters are not allowed to change incoming chain links, and should allocate their own links if any modifications are needed. Nevertheless ngx_http_range_singlepart_body() modified incoming chain links in some cases, notably at the end of the requested range. No problems caused by this are currently known, mostly because of limited number of possible modifications and the position of the range body filter in the filter chain. Though this behaviour is clearly incorrect and tests demonstrate that it can at least cause some proxy buffers being lost when using proxy_force_ranges, leading to less effective handling of responses. Fix is to always allocate new chain links in ngx_http_range_singlepart_body(). Links are explicitly freed to ensure constant memory usage with long-lived requests.
* Variables support in proxy_upload_rate and proxy_download_rate.Ruslan Ermilov2019-04-24
|
* Variables support in limit_rate and limit_rate_after (ticket #293).Ruslan Ermilov2019-04-24
|
* Added ngx_http_set_complex_value_size_slot().Ruslan Ermilov2019-04-24
| | | | | | | | | | If a complex value is expected to be of type size_t, and the compiled value is constant, the constant size_t value is remembered at compile time. The value is accessed through ngx_http_complex_value_size() which either returns the remembered constant or evaluates the expression and parses it as size_t.
* Core: enabled "include" in any context (ticket #1615).Vladimir Homutov2019-04-09
|
* Version bump.Vladimir Homutov2019-04-24
|
* Fixed incorrect length handling in ngx_utf8_length().Maxim Dounin2019-04-15
| | | | | | | | | | | | | Previously, ngx_utf8_decode() was called from ngx_utf8_length() with incorrect length, potentially resulting in out-of-bounds read when handling invalid UTF-8 strings. In practice out-of-bounds reads are not possible though, as autoindex, the only user of ngx_utf8_length(), provides null-terminated strings, and ngx_utf8_decode() anyway returns an errors when it sees a null in the middle of an UTF-8 sequence. Reported by Yunbin Liu.
* OCSP stapling: fixed segfault with dynamic certificate loading.Maxim Dounin2019-04-15
| | | | | | | | | | | | | If OCSP stapling was enabled with dynamic certificate loading, with some OpenSSL versions (1.0.2o and older, 1.1.0h and older; fixed in 1.0.2p, 1.1.0i, 1.1.1) a segmentation fault might happen. The reason is that during an abbreviated handshake the certificate callback is not called, but the certificate status callback was called (https://github.com/openssl/openssl/issues/1662), leading to NULL being returned from SSL_get_certificate(). Fix is to explicitly check SSL_get_certificate() result.
* Version bump.Maxim Dounin2019-04-15
|
* OCSP stapling: open ssl_stapling_file in binary-mode.Sergey Kandaurov2019-04-03
| | | | | OCSP response uses the DER format and as such needs to be opened in binary-mode. This only has any effect under Win32.
* SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn.Nikolay Morozov2019-03-26
| | | | | | | | If X509_get_issuer_name() or X509_get_subject_name() returned NULL, this could lead to a certificate reference leak. It cannot happen in practice though, since each function returns an internal pointer to a mandatory subfield of the certificate successfully decoded by d2i_X509() during certificate message processing (closes #1751).
* Version bump.Sergey Kandaurov2019-03-26
|
* Listen port ranges.Roman Arutyunyan2019-03-06
| | | | | | | | | | A range is specified with a dash. For each port in a range a separate listen socket is created. Examples: listen 8080-9000; listen example.com:80-88;
* Removed sorting of getaddrinfo() results.Roman Arutyunyan2019-03-20
| | | | | | | | | | Previously the ngx_inet_resolve_host() function sorted addresses in a way that IPv4 addresses came before IPv6 addresses. This was implemented in eaf95350d75c (1.3.10) along with the introduction of getaddrinfo() which could resolve host names to IPv6 addresses. Since the "listen" directive only used the first address, sorting allowed to preserve "listen" compatibility with the previous behavior and with the behavior of nginx built without IPv6 support. Now "listen" uses all resolved addresses which makes sorting pointless.
* Multiple addresses in "listen".Roman Arutyunyan2019-03-15
| | | | | | Previously only one address was used by the listen directive handler even if host name resolved to multiple addresses. Now a separate listening socket is created for each address.
* SSL: support for parsing PEM certificates from memory.Maxim Dounin2019-03-09
| | | | | | This makes it possible to provide certificates directly via variables in ssl_certificate / ssl_certificate_key directives, without using intermediate files.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-22 00:35:24 +0000