aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* Version bump.Ruslan Ermilov2016-07-06
|
* Stream: return module.Roman Arutyunyan2016-05-18
|
* Stream: SSL-related variables.Vladimir Homutov2016-06-29
|
* Stream: got rid of pseudo variables.Vladimir Homutov2016-06-29
| | | | Stream limit_conn, upstream_hash and proxy modules now use complex values.
* Stream: map module.Vladimir Homutov2016-06-29
|
* Stream: core module variables.Vladimir Homutov2016-06-14
|
* Stream: variables and script.Vladimir Homutov2016-07-04
| | | | This is a port of corresponding http code with unrelated features excluded.
* Stream: added preconfiguration step.Vladimir Homutov2016-06-15
|
* Sub filter: eliminate unnecessary buffering.Roman Arutyunyan2016-07-02
| | | | | | | | | | | | | | | | Previously, when a buffer was processed by the sub filter, its final bytes could be buffered by the filter even if they don't match any pattern. This happened because the Boyer-Moore algorithm, employed by the sub filter since b9447fc457b4 (1.9.4), matches the last characters of patterns prior to checking other characters. If the last character is out of scope, initial bytes of a potential match are buffered until the last character is available. Now, after receiving a flush or recycled buffer, the filter performs additional checks to reduce the number of buffered bytes. The potential match is checked against the initial parts of all patterns. Non-matching bytes are not buffered. This improves processing of a chunked response from upstream by sending the entire chunks without buffering unless a partial match is found at the end of a chunk.
* Sub filter: introduced the ngx_http_sub_match() function.Roman Arutyunyan2016-07-02
| | | | No functional changes.
* Internal md5 and sha1 implementations are now always used.Maxim Dounin2016-06-30
| | | | | | This reduces the number of moving parts in ABI compatibility checks. Additionally, it also allows to use OpenSSL in FIPS mode while still using md5 for non-security tasks.
* Removed unused flag accept_context_updated from ngx_event_t.Ruslan Ermilov2016-06-29
| | | | | Also, removed practically unused flag accept_context_updated from ngx_connection_t.
* Style.Roman Arutyunyan2016-06-27
|
* HTTP/2: style.Piotr Sikora2016-06-22
| | | | Signed-off-by: Piotr Sikora <piotrsikora@google.com>
* Style.Roman Arutyunyan2016-06-22
|
* Stream: use ngx_pcalloc() in ngx_stream_proxy_bind().Roman Arutyunyan2016-06-22
|
* Fixed build on MSVC.Roman Arutyunyan2016-06-20
|
* Stream: set SO_REUSEADDR for UDP upstream sockets.Roman Arutyunyan2016-06-20
| | | | | | | | | The option is only set if the socket is bound to a specific port to allow several such sockets coexist at the same time. This is required, for example, when nginx acts as a transparent proxy and receives two datagrams from the same client in a short time. The feature is only implemented for Linux.
* Stream: support for $remote_port in proxy_bind.Roman Arutyunyan2016-06-20
| | | | | | | | | | The following two types of bind addresses are supported in addition to $remote_addr and address literals: - $remote_addr:$remote_port - [$remote_addr]:$remote_port In both cases client remote address with port is used in upstream socket bind.
* Upstream: support for port in proxy_bind and friends.Roman Arutyunyan2016-06-20
|
* Introduced ngx_inet_get_port() and ngx_inet_set_port() functions.Roman Arutyunyan2016-06-20
|
* Set IP_BIND_ADDRESS_NO_PORT socket option for upstream sockets.Andrei Belov2016-06-20
|
* SSL: ngx_ssl_ciphers() to set list of ciphers.Tim Taubert2016-06-15
| | | | | | This patch moves various OpenSSL-specific function calls into the OpenSSL module and introduces ngx_ssl_ciphers() to make nginx more crypto-library-agnostic.
* HTTP/2: fixed the "http request count is zero" alert.Valentin Bartenev2016-06-16
| | | | | | | | | | | | | | | | When the stream is terminated the HEADERS frame can still wait in the output queue. This frame can't be removed and must be sent to the client anyway, since HTTP/2 uses stateful compression for headers. So in order to postpone closing and freeing memory of such stream the special close stream handler is set to the write event. After the HEADERS frame is sent the write event is called and the stream will be finally closed. Some events like receiving a RST_STREAM can trigger the read handler of such stream in closing state and cause unexpected processing that can result in another attempt to finalize the request. To prevent it the read handler is now set to ngx_http_empty_handler. Thanks to Amazon.
* HTTP/2: avoid adding Content-Length for requests without body.Valentin Bartenev2016-06-16
| | | | | | | There is no reason to add the "Content-Length: 0" header to a proxied request without body if the header isn't presented in the original request. Thanks to Amazon.
* HTTP/2: prevented double termination of a stream.Valentin Bartenev2016-06-16
| | | | | | | According to RFC 7540, an endpoint should not send more than one RST_STREAM frame for any stream. Also, now all the data frames will be skipped while termination.
* HTTP/2: fixed a segfault while processing unbuffered upload.Valentin Bartenev2016-06-16
| | | | | | | The ngx_http_v2_finalize_connection() closes current stream, but that is an invalid operation while processing unbuffered upload. This results in access to already freed memory, since the upstream module sets a cleanup handler that also finalizes the request.
* An internal SHA1 implementation.Maxim Dounin2016-06-09
|
* Fixed spelling.Otto Kekäläinen2016-06-08
|
* Fixed an error log message.Valentin Bartenev2016-06-07
|
* Version bump.Sergey Kandaurov2016-06-07
|
* Core: skip special buffers on writing (ticket #981).Maxim Dounin2016-05-31
| | | | | | | | | | | | | | | A special last buffer with cl->buf->pos set to NULL can be present in a chain when writing request body if chunked encoding was used. This resulted in a NULL pointer dereference if it happened to be the only buffer left after a do...while loop iteration in ngx_write_chain_to_file(). The problem originally appeared in nginx 1.3.9 with chunked encoding support. Additionally, rev. 3832b608dc8d (nginx 1.9.13) changed the minimum number of buffers to trigger this from IOV_MAX (typically 1024) to NGX_IOVS_PREALLOCATE (typically 64). Fix is to skip such buffers in ngx_chain_to_iovec(), much like it is done in other places.
* HTTP/2: unbreak build on MSVC.Valentin Bartenev2016-05-24
|
* Version bump.Valentin Bartenev2016-05-24
|
* Fixed build on MSVC.Maxim Dounin2016-05-24
|
* HTTP/2: implemented preread buffer for request body (closes #959).Valentin Bartenev2016-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the stream's window was kept zero in order to prevent a client from sending the request body before it was requested (see 887cca40ba6a for details). Until such initial window was acknowledged all requests with data were rejected (see 0aa07850922f for details). That approach revealed a number of problems: 1. Some clients (notably MS IE/Edge, Safari, iOS applications) show an error or even crash if a stream is rejected; 2. This requires at least one RTT for every request with body before the client receives window update and able to send data. To overcome these problems the new directive "http2_body_preread_size" is introduced. It sets the initial window and configures a special per stream preread buffer that is used to save all incoming data before the body is requested and processed. If the directive's value is lower than the default initial window (65535), as previously, all streams with data will be rejected until the new window is acknowledged. Otherwise, no special processing is used and all requests with data are welcome right from the connection start. The default value is chosen to be 64k, which is bigger than the default initial window. Setting it to zero is fully complaint to the previous behavior.
* Realip: detect duplicate real_ip_header directive.Ruslan Ermilov2016-05-23
|
* Realip: port support in X-Real-IP and X-Forwarded-For.Dmitry Volyntsev2016-05-23
| | | | | | | | | | Now, the module extracts optional port which may accompany an IP address. This custom extension is introduced, among other things, in order to facilitate logging of original client ports. Addresses with ports are expected to be in the RFC 3986 format, that is, with IPv6 addresses in square brackets. E.g., "X-Real-IP: [2001:0db8::1]:12345" sets client port ($remote_port) to 12345.
* Realip: take client port from PROXY protocol header.Dmitry Volyntsev2016-05-23
| | | | | | | Previously, when the client address was changed to the one from the PROXY protocol header, the client port ($remote_port) was reset to zero. Now the client port is also changed to the one from the PROXY protocol header.
* Added the $realip_remote_port variable.Dmitry Volyntsev2016-05-23
|
* Added the $proxy_protocol_port variable.Dmitry Volyntsev2016-05-23
|
* Renamed "u" to "sockaddr" in listen options types.Maxim Dounin2016-05-23
|
* Introduced the ngx_sockaddr_t type.Ruslan Ermilov2016-05-23
| | | | It's properly aligned and can hold any supported sockaddr.
* Stream: fixed duplicate listen address detection.Ruslan Ermilov2016-05-23
| | | | | | | The 6f8254ae61b8 change inadvertently fixed the duplicate port detection similar to how it was fixed for mail in b2920b517490. It also revealed another issue: the socket type (tcp vs. udp) wasn't taken into account.
* Use ngx_cmp_sockaddr() where appropriate.Ruslan Ermilov2016-05-20
|
* HTTP/2: the "421 Misdirected Request" response (closes #848).Valentin Bartenev2016-05-20
| | | | | | | | | | | | | | | | | | | | | | | | Since 4fbef397c753 nginx rejects with the 400 error any attempts of requesting different host over the same connection, if the relevant virtual server requires verification of a client certificate. While requesting hosts other than negotiated isn't something legal in HTTP/1.x, the HTTP/2 specification explicitly permits such requests for connection reuse and has introduced a special response code 421. According to RFC 7540 Section 9.1.2 this code can be sent by a server that is not configured to produce responses for the combination of scheme and authority that are included in the request URI. And the client may retry the request over a different connection. Now this code is used for requests that aren't authorized in current connection. After receiving the 421 response a client will be able to open a new connection, provide the required certificate and retry the request. Unfortunately, not all clients currently are able to handle it well. Notably Chrome just shows an error, while at least the latest version of Firefox retries the request over a new connection.
* Belatedly changed the ngx_create_listening() prototype.Ruslan Ermilov2016-05-20
| | | | The function is called only with "struct sockaddr *" since 0.7.58.
* SSL: removed default DH parameters.Maxim Dounin2016-05-19
| | | | | | | | | | | | | | | Using the same DH parameters on multiple servers is believed to be subject to precomputation attacks, see http://weakdh.org/. Additionally, 1024 bits are not enough in the modern world as well. Let users provide their own DH parameters with the ssl_dhparam directive if they want to use EDH ciphers. Note that SSL_CTX_set_dh_auto() as provided by OpenSSL 1.1.0 uses fixed DH parameters from RFC 5114 and RFC 3526, and therefore subject to the same precomputation attacks. We avoid using it as well. This change also fixes compilation with OpenSSL 1.1.0-pre5 (aka Beta 2), as OpenSSL developers changed their policy after releasing Beta 1 and broke API once again by making the DH struct opaque (see ticket #860).
* SSL: support for multiple curves (ticket #885).Maxim Dounin2016-05-19
| | | | | | | | | | | | | | | | | | OpenSSL 1.0.2+ allows configuring a curve list instead of a single curve previously supported. This allows use of different curves depending on what client supports (as available via the elliptic_curves extension), and also allows use of different curves in an ECDHE key exchange and in the ECDSA certificate. The special value "auto" was introduced (now the default for ssl_ecdh_curve), which means "use an internal list of curves as available in the OpenSSL library used". For versions prior to OpenSSL 1.0.2 it maps to "prime256v1" as previously used. The default in 1.0.2b+ prefers prime256v1 as well (and X25519 in OpenSSL 1.1.0+). As client vs. server preference of curves is controlled by the same option as used for ciphers (SSL_OP_CIPHER_SERVER_PREFERENCE), the ssl_prefer_server_ciphers directive now controls both.
* SSL: style.Maxim Dounin2016-05-19
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-20 13:45:33 +0000