aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* SSL: removed redundant "pkey" variable.Maxim Dounin2019-03-09
| | | | | | | | | It was accidentally introduced in 77436d9951a1 (1.15.9). In MSVC 2015 and more recent MSVC versions it triggers warning C4456 (declaration of 'pkey' hides previous local declaration). Previously, all such warnings were resolved in 2a621245f4cf. Reported by Steve Stevenson.
* SSL: moved c->ssl->handshaked check in server name callback.Maxim Dounin2019-03-05
| | | | | | | | | Server name callback is always called by OpenSSL, even if server_name extension is not present in ClientHello. As such, checking c->ssl->handshaked before the SSL_get_servername() result should help to more effectively prevent renegotiation in OpenSSL 1.1.0 - 1.1.0g, where neither SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS nor SSL_OP_NO_RENEGOTIATION is available.
* SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.Maxim Dounin2019-03-03
| | | | | | The SSL_OP_NO_CLIENT_RENEGOTIATION option was introduced in LibreSSL 2.5.1. Unlike OpenSSL's SSL_OP_NO_RENEGOTIATION, it only disables client-initiated renegotiation, and hence can be safely used on all SSL contexts.
* SSL: fixed potential leak on memory allocation errors.Maxim Dounin2019-03-03
| | | | | | | | | If ngx_pool_cleanup_add() fails, we have to clean just created SSL context manually, thus appropriate call added. Additionally, ngx_pool_cleanup_add() moved closer to ngx_ssl_create() in the ngx_http_ssl_module, to make sure there are no leaks due to intermediate code.
* SSL: server name callback changed to return fatal errors.Maxim Dounin2019-03-03
| | | | | | | | | Notably this affects various allocation errors, and should generally improve things if an allocation error actually happens during a callback. Depending on the OpenSSL version, returning an error can result in either SSL_R_CALLBACK_FAILED or SSL_R_CLIENTHELLO_TLSEXT error from SSL_do_handshake(), so both errors were switched to the "info" level.
* SSL: server name callback changed to return SSL_TLSEXT_ERR_OK.Maxim Dounin2019-03-03
| | | | | | | | | | | | | | OpenSSL 1.1.1 does not save server name to the session if server name callback returns anything but SSL_TLSEXT_ERR_OK, thus breaking the $ssl_server_name variable in resumed sessions. Since $ssl_server_name can be used even if we've selected the default server and there are no other servers, it looks like the only viable solution is to always return SSL_TLSEXT_ERR_OK regardless of the actual result. To fix things in the stream module as well, added a dummy server name callback which always returns SSL_TLSEXT_ERR_OK.
* Version bump.Maxim Dounin2019-03-03
|
* SSL: fixed possible segfault with dynamic certificates.Maxim Dounin2019-02-25
| | | | | | | | | | A virtual server may have no SSL context if it does not have certificates defined, so we have to use config of the ngx_http_ssl_module from the SSL context in the certificate callback. To do so, it is now passed as the argument of the callback. The stream module doesn't really need any changes, but was modified as well to match http code.
* SSL: adjusted session id context with dynamic certificates.Maxim Dounin2019-02-25
| | | | | | | | | | | | Dynamic certificates re-introduce problem with incorrect session reuse (AKA "virtual host confusion", CVE-2014-3616), since there are no server certificates to generate session id context from. To prevent this, session id context is now generated from ssl_certificate directives as specified in the configuration. This approach prevents incorrect session reuse in most cases, while still allowing sharing sessions across multiple machines with ssl_session_ticket_key set as long as configurations are identical.
* SSL: dynamic certificate loading in the stream module.Maxim Dounin2019-02-25
|
* SSL: passwords support for dynamic certificate loading.Maxim Dounin2019-02-25
| | | | | | | | | | Passwords have to be copied to the configuration pool to be used at runtime. Also, to prevent blocking on stdin (with "daemon off;") an empty password list is provided. To make things simpler, password handling was modified to allow an empty array (with 0 elements and elts set to NULL) as an equivalent of an array with 1 empty password.
* SSL: variables support in ssl_certificate and ssl_certificate_key.Maxim Dounin2019-02-25
| | | | | | | | | | To evaluate variables, a request is created in the certificate callback, and then freed. To do this without side effects on the stub_status counters and connection state, an additional function was introduced, ngx_http_alloc_request(). Only works with OpenSSL 1.0.2+, since there is no SSL_CTX_set_cert_cb() in older versions.
* SSL: loading of connection-specific certificates.Maxim Dounin2019-02-25
|
* SSL: reworked ngx_ssl_certificate().Maxim Dounin2019-02-25
| | | | | | | | | This makes it possible to reuse certificate loading at runtime, as introduced in the following patches. Additionally, this improves error logging, so nginx will now log human-friendly messages "cannot load certificate" instead of only referring to sometimes cryptic names of OpenSSL functions.
* SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().Maxim Dounin2019-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "(SSL:)" snippet currently appears in logs when nginx code uses ngx_ssl_error() to log an error, but OpenSSL's error queue is empty. This can happen either because the error wasn't in fact from OpenSSL, or because OpenSSL did not indicate the error in the error queue for some reason. In particular, currently "(SSL:)" can be seen in errors at least in the following cases: - When SSL_write() fails due to a syscall error, "[info] ... SSL_write() failed (SSL:) (32: Broken pipe)...". - When loading a certificate with no data in it, "[emerg] PEM_read_bio_X509_AUX(...) failed (SSL:)". This can easily happen due to an additional empty line before the end line, so all lines of the certificate are interpreted as header lines. - When trying to configure an unknown curve, "[emerg] SSL_CTX_set1_curves_list("foo") failed (SSL:)". Likely there are other cases as well. With this change, "(SSL:...)" will be only added to the error message if there is something in the error queue. This is expected to make logs more readable in the above cases. Additionally, with this change it is now possible to use ngx_ssl_error() to log errors when some of the possible errors are not from OpenSSL and not expected to have anything in the error queue.
* Style.Maxim Dounin2019-02-25
|
* Slab: removed redundant page calculation (ticket #1721).Maxim Dounin2019-02-12
|
* Upstream: fixed logging of required buffer size (ticket #1722).Chanhun Jeong2019-02-11
|
* SSL: fixed EVP_DigestFinal_ex() error message.Sergey Kandaurov2019-02-07
|
* SSL: separate checks for errors in ngx_ssl_read_password_file().Maxim Dounin2019-01-31
| | | | | | | | Checking multiple errors at once is a bad practice, as in general it is not guaranteed that an object can be used after the error. In this particular case, checking errors after multiple allocations can result in excessive errors being logged when there is no memory available.
* SSL: explicitly zero out session ticket keys.Ruslan Ermilov2019-01-31
|
* Modules compatibility: down flag in ngx_peer_connection_t.Roman Arutyunyan2019-01-31
|
* Use %s for errors returned from configuration parsing handlers.Ruslan Ermilov2018-12-25
|
* Removed --test-build-eventport workaround for old FreeBSD versions.Sergey Kandaurov2019-01-28
|
* Fixed portability issues with union sigval.Sergey Kandaurov2019-01-28
| | | | | | | | | | | | | | | | | | AIO support in nginx was originally developed against FreeBSD versions 4-6, where the sival_ptr field was named as sigval_ptr (seemingly by mistake[1]), which made nginx use the only name available then. The standard-complaint name was restored in 2005 (first appeared in FreeBSD 7.0, 2008), retaining compatibility with previous versions[2][3]. In DragonFly, similar changes were committed in 2009[4], with backward compatibility recently removed[5]. The change switches to the standard name, retaining compatibility with old FreeBSD versions. [1] https://svnweb.freebsd.org/changeset/base/48621 [2] https://svnweb.freebsd.org/changeset/base/152029 [3] https://svnweb.freebsd.org/changeset/base/174003 [4] https://gitweb.dragonflybsd.org/dragonfly.git/commit/3693401 [5] https://gitweb.dragonflybsd.org/dragonfly.git/commit/7875042
* Win32: detection of connect() errors in select().Maxim Dounin2019-01-24
| | | | | | | | | | | | | | | | On Windows, connect() errors are only reported via exceptfds descriptor set from select(). Previously exceptfds was set to NULL, and connect() errors were not detected at all, so connects to closed ports were waiting till a timeout occurred. Since ongoing connect() means that there will be a write event active, except descriptor set is copied from the write one. While it is possible to construct except descriptor set as a concatenation of both read and write descriptor sets, this looks unneeded. With this change, connect() errors are properly detected now when using select(). Note well that it is not possible to detect connect() errors with WSAPoll() (see https://daniel.haxx.se/blog/2012/10/10/wsapoll-is-broken/).
* Win32: added WSAPoll() support.Maxim Dounin2019-01-24
| | | | | | | | | | | | WSAPoll() is only available with Windows Vista and newer (and only available during compilation if _WIN32_WINNT >= 0x0600). To make sure the code works with Windows XP, we do not redefine _WIN32_WINNT, but instead load WSAPoll() dynamically if it is not available during compilation. Also, sockets are not guaranteed to be small integers on Windows. So an index array is used instead of NGX_USE_FD_EVENT to map events to connections.
* Events: fixed copying of old events in poll init.Maxim Dounin2019-01-24
| | | | | | | Previously, the code incorrectly assumed "ngx_event_t *" elements instead of "struct pollfd". This is mostly cosmetic change, as this code is never called now.
* Stream: do not split datagrams when limiting proxy rate.Roman Arutyunyan2018-12-27
| | | | | | | | | | | Previously, when using proxy_upload_rate and proxy_download_rate, the buffer size for reading from a socket could be reduced as a result of rate limiting. For connection-oriented protocols this behavior is normal since unread data will normally be read at the next iteration. But for datagram-oriented protocols this is not the case, and unread part of the datagram is lost. Now buffer size is not limited for datagrams. Rate limiting still works in this case by delaying the next reading event.
* Prevented scheduling events on a shared connection.Roman Arutyunyan2019-01-14
| | | | | | | | | | | | | | | | A shared connection does not own its file descriptor, which means that ngx_handle_read_event/ngx_handle_write_event calls should do nothing for it. Currently the c->shared flag is checked in several places in the stream proxy module prior to calling these functions. However it was not done everywhere. Missing checks could lead to calling ngx_handle_read_event/ngx_handle_write_event on shared connections. The problem manifested itself when using proxy_upload_rate and resulted in either duplicate file descriptor error (e.g. with epoll) or incorrect further udp packet processing (e.g. with kqueue). The fix is to set and reset the event active flag in a way that prevents ngx_handle_read_event/ngx_handle_write_event from scheduling socket events.
* Added the ngx_http_test_required_predicates() function.Vladimir Homutov2019-01-17
| | | | | In contrast to ngx_http_test_predicates(), it requires all values to be non-empty and not equal to "0".
* Version bump.Vladimir Homutov2019-01-17
|
* Autoindex: fixed possible integer overflow on 32-bit systems.Vladimir Homutov2018-12-25
|
* Win32: removed NGX_DIR_MASK concept.Maxim Dounin2018-12-24
| | | | | | | | | | | | Previous interface of ngx_open_dir() assumed that passed directory name has a room for NGX_DIR_MASK at the end (NGX_DIR_MASK_LEN bytes). While all direct users of ngx_dir_open() followed this interface, this also implied similar requirements for indirect uses - in particular, via ngx_walk_tree(). Currently none of ngx_walk_tree() uses provides appropriate space, and fixing this does not look like a right way to go. Instead, ngx_dir_open() interface was changed to not require any additional space and use appropriate allocations instead.
* Userid: using stub for AF_UNIX addresses.Sergey Kandaurov2018-12-24
| | | | | Previously, AF_UNIX addresses misbehaved as AF_INET, which typically resulted in $uid_set composed from the middle of sun_path.
* SSL: avoid reading on pending SSL_write_early_data().Sergey Kandaurov2018-12-18
| | | | | | | | | If SSL_write_early_data() returned SSL_ERROR_WANT_WRITE, stop further reading using a newly introduced c->ssl->write_blocked flag, as otherwise this would result in SSL error "ssl3_write_bytes:bad length". Eventually, normal reading will be restored by read event posted from successful SSL_write_early_data(). While here, place "SSL_write_early_data: want write" debug on the path.
* Geo: fixed handling of AF_UNIX client addresses (ticket #1684).Maxim Dounin2018-12-14
| | | | | Previously, AF_UNIX client addresses were handled as AF_INET, leading to unexpected results.
* Upstream: implemented $upstream_bytes_sent.Ruslan Ermilov2018-12-13
|
* Resolver: report SRV resolve failure if all A resolves failed.Roman Arutyunyan2018-12-11
| | | | | | | | | | Previously, if an SRV record was successfully resolved, but all of its A records failed to resolve, NXDOMAIN was returned to the caller, which is considered a successful resolve rather than an error. This could result in losing the result of a previous successful resolve by the caller. Now NXDOMAIN is only returned if at least one A resolve completed with this code. Otherwise the error state of the first A resolve is returned.
* Copy regex unnamed captures to cloned subrequests.Roman Arutyunyan2018-12-11
| | | | | | | | | | | | Previously, unnamed regex captures matched in the parent request, were not available in a cloned subrequest. Now 3 fields related to unnamed captures are copied to a cloned subrequest: r->ncaptures, r->captures and r->captures_data. Since r->captures cannot be changed by either request after creating a clone, a new flag r->realloc_captures is introduced to force reallocation of r->captures. The issue was reported as a proxy_cache_background_update misbehavior in http://mailman.nginx.org/pipermail/nginx/2018-December/057251.html.
* Version bump.Roman Arutyunyan2018-12-11
|
* Negative size buffers detection.Maxim Dounin2018-11-26
| | | | | | | | | | In the past, there were several security issues which resulted in worker process memory disclosure due to buffers with negative size. It looks reasonable to check for such buffers in various places, much like we already check for zero size buffers. While here, removed "#if 1 / #endif" around zero size buffer checks. It looks highly unlikely that we'll disable these checks anytime soon.
* Mp4: fixed possible pointer overflow on 32-bit platforms.Maxim Dounin2018-11-21
| | | | | | | | | | | On 32-bit platforms mp4->buffer_pos might overflow when a large enough (close to 4 gigabytes) atom is being skipped, resulting in incorrect memory addesses being read further in the code. In most cases this results in harmless errors being logged, though may also result in a segmentation fault if hitting unmapped pages. To address this, ngx_mp4_atom_next() now only increments mp4->buffer_pos up to mp4->buffer_end. This ensures that overflow cannot happen.
* Limit req: "delay=" parameter.Maxim Dounin2018-11-21
| | | | | | | | | | | This parameter specifies an additional "soft" burst limit at which requests become delayed (but not yet rejected as it happens if "burst=" limit is exceeded). Defaults to 0, i.e., all excess requests are delayed. Originally inspired by Vladislav Shabanov (http://mailman.nginx.org/pipermail/nginx-devel/2016-April/008126.html). Further improved based on a patch by Peter Shchuchkin (http://mailman.nginx.org/pipermail/nginx-devel/2018-October/011522.html).
* Limit req: fixed error message wording.Maxim Dounin2018-11-21
|
* Upstream: revised upstream response time variables.Vladimir Homutov2018-11-21
| | | | | | | | | Variables now do not depend on presence of the HTTP status code in response. If the corresponding event occurred, variables contain time between request creation and the event, and "-" otherwise. Previously, intermediate value of the $upstream_response_time variable held unix timestamp.
* Upstream: removed unused ngx_http_upstream_t.timeout field.Vladimir Homutov2018-11-21
|
* Core: ngx_explicit_memzero().Maxim Dounin2018-11-15
|
* Core: free shared memory on cycle initialization failure.Ruslan Ermilov2018-11-15
|
* Stream: proxy_requests directive.Vladimir Homutov2018-11-12
| | | | | | | | | | | The directive allows to drop binding between a client and existing UDP stream session after receiving a specified number of packets. First packet from the same client address and port will start a new session. Old session continues to exist and will terminate at moment defined by configuration: either after receiving the expected number of responses, or after timeout, as specified by the "proxy_responses" and/or "proxy_timeout" directives. By default, proxy_requests is zero (disabled).
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-22 05:35:29 +0000