aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* SSL: error messages style.Maxim Dounin2016-05-19
|
* SSL: support for multiple certificates (ticket #814).Maxim Dounin2016-05-19
|
* SSL: support for per-certificate chains.Maxim Dounin2016-05-19
| | | | | | | | | | | | | The SSL_CTX_add0_chain_cert() function as introduced in OpenSSL 1.0.2 now used instead of SSL_CTX_add_extra_chain_cert(). SSL_CTX_add_extra_chain_cert() adds extra certs for all certificates in the context, while SSL_CTX_add0_chain_cert() only to a particular certificate. There is no difference unless multiple certificates are used, though it is important when using multiple certificates. Additionally, SSL_CTX_select_current_cert() is now called before using a chain to make sure correct chain will be returned.
* SSL: made it possible to iterate though all certificates.Maxim Dounin2016-05-19
| | | | | | | | | | | | | | | | A pointer to a previously configured certificate now stored in a certificate. This makes it possible to iterate though all certificates configured in the SSL context. This is now used to configure OCSP stapling for all certificates, and in ngx_ssl_session_id_context(). As SSL_CTX_use_certificate() frees previously loaded certificate of the same type, and we have no way to find out if it's the case, X509_free() calls are now posponed till ngx_ssl_cleanup_ctx(). Note that in OpenSSL 1.0.2+ this can be done without storing things in exdata using the SSL_CTX_set_current_cert() and SSL_CTX_get0_certificate() functions. These are not yet available in all supported versions though, so it's easier to continue to use exdata for now.
* OCSP stapling: additional function to configure stapling on a cert.Maxim Dounin2016-05-19
|
* OCSP stapling: staple now extracted via SSL_get_certificate().Maxim Dounin2016-05-19
| | | | | | | | | This makes it possible to properly return OCSP staple with multiple certificates configured. Note that it only works properly in OpenSSL 1.0.1d+, 1.0.0k, 0.9.8y+. In older versions SSL_get_certificate() fails to return correct certificate when the certificate status callback is called.
* OCSP stapling: staple now stored in certificate, not SSL context.Maxim Dounin2016-05-19
|
* OCSP stapling: staple provided in arguments.Maxim Dounin2016-05-19
|
* Added overflow checks for version numbers (ticket #762).Maxim Dounin2016-05-18
| | | | | | | | Both minor and major versions are now limited to 999 maximum. In case of r->http_minor, this limit is already implied by the code. Major version, r->http_major, in theory can be up to 65535 with current code, but such values are very unlikely to become real (and, additionally, such values are not allowed by RFC 7230), so the same test was used for r->http_major.
* Events: close descriptors on errors in ngx_epoll_test_rdhup().Maxim Dounin2016-05-18
|
* Events: changed ngx_epoll_test_rdhup() to use existing epollfd.Maxim Dounin2016-05-18
|
* Fixed work with --test-build-epoll after f7849bfb6d21.Maxim Dounin2016-05-18
|
* Cache: fixed updating bypassed cached errors (ticket #827).Maxim Dounin2016-05-16
|
* Dav: return 501 on PUT with ranges (ticket #948).Maxim Dounin2016-05-16
|
* Fixed an error log message about epoll_wait() timeout.Valentin Bartenev2016-05-16
| | | | The errno value is unset in case of epoll_wait() timeout.
* Improved EPOLLRDHUP handling.Valentin Bartenev2016-05-13
| | | | | | | | | | | | | | | | | When it's known that the kernel supports EPOLLRDHUP, there is no need in additional recv() call to get EOF or error when the flag is absent in the event generated by the kernel. A special runtime test is done at startup to detect if EPOLLRDHUP is actually supported by the kernel because epoll_ctl() silently ignores unknown flags. With this knowledge it's now possible to drop the "ready" flag for partial read. Previously, the "ready" flag was kept until the recv() returned EOF or error. In particular, this change allows the lingering close heuristics (which relies on the "ready" flag state) to actually work on Linux, and not wait for more data in most cases. The "available" flag is now used in the read event with the semantics similar to the corresponding counter in kqueue.
* Map: support of complex values in resulting strings.Dmitry Volyntsev2016-05-12
|
* Removed a surplus condition from ngx_parse_inet6_url().Ruslan Ermilov2016-05-11
| | | | No functional changes, since the condition was always true.
* Core: fixed port handling in ngx_parse_inet6_url().Valentin Bartenev2016-05-11
| | | | | This fixes buffer over-read when no port is specified in cases similar to 5df5d7d771f6, and catches missing port separator.
* Removed unused flag unexpected_eof from ngx_connection_t.Ruslan Ermilov2016-04-28
|
* Variable $request_id.Vladimir Homutov2016-04-26
| | | | | The variable contains text representation based on random data, usable as a unique request identifier.
* Upstream: the "transparent" parameter of proxy_bind and friends.Roman Arutyunyan2015-12-18
| | | | | | | | | | | This parameter lets binding the proxy connection to a non-local address. Upstream will see the connection as coming from that address. When used with $remote_addr, upstream will accept the connection from real client address. Example: proxy_bind $remote_addr transparent;
* Stream: prepared proxy_bind to accept parameters.Roman Arutyunyan2016-04-13
|
* Upstream: prepared proxy_bind to accept parameters.Roman Arutyunyan2016-04-13
| | | | In addition, errors occurred while setting bind address are no longer ignored.
* Removed some bitrot.Ruslan Ermilov2016-04-26
| | | | | Removed NGX_CONF_MULTI unused since 1.3.4. Removed ngx_url_t.one_addr unused since 1.3.10.
* Version bump.Ruslan Ermilov2016-04-26
|
* HTTP/2: send the output queue after emitting WINDOW_UPDATE.Valentin Bartenev2016-04-19
| | | | | | | | The WINDOW_UPDATE frame could be left in the output queue for an indefinite period of time resulting in the request timeout. This might happen if reading of the body was triggered by an event unrelated to client connection, e.g. by the limit_req timer.
* HTTP/2: skip data frames in case of internal errors.Valentin Bartenev2016-04-19
| | | | | | This prevents possible processing of such frames and triggering rb->post_handler if an error occurred during r->request_body initialization.
* HTTP/2: don't send WINDOW_UPDATE for an empty request body.Valentin Bartenev2016-04-19
| | | | | | | Particularly this prevents sending WINDOW_UPDATE with zero delta which can result in PROTOCOL_ERROR. Also removed surplus setting of no_flow_control to 0.
* Thread pools: memory barriers in task completion notifications.Maxim Dounin2016-04-19
| | | | | | | | | | The ngx_thread_pool_done object isn't volatile, and at least some compilers assume that it is permitted to reorder modifications of volatile and non-volatile objects. Added appropriate ngx_memory_barrier() calls to make sure all modifications will happen before the lock is released. Reported by Mindaugas Rasiukevicius, http://mailman.nginx.org/pipermail/nginx-devel/2016-April/008160.html.
* HTTP/2: write logs when refusing streams with data.Maxim Dounin2016-04-18
| | | | | | Refusing streams is known to be incorrectly handled at least by IE, Edge and Safari. Make sure to provide appropriate logging to simplify fixing this in the affected browsers.
* HTTP/2: send WINDOW_UPDATE instead of RST_STREAM with NO_ERROR.Valentin Bartenev2016-04-14
| | | | | | | | | | | | | | | | | After the 92464ebace8e change, it has been discovered that not all clients follow the RFC and handle RST_STREAM with NO_ERROR properly. Notably, Chrome currently interprets it as INTERNAL_ERROR and discards the response. As a workaround, instead of RST_STREAM the maximum stream window update will be sent, which will let client to send up to 2 GB of a request body data before getting stuck on flow control. All the received data will be silently discarded. See for details: http://mailman.nginx.org/pipermail/nginx-devel/2016-April/008143.html https://bugs.chromium.org/p/chromium/issues/detail?id=603182
* HTTP/2: refuse streams with data until SETTINGS is acknowledged.Valentin Bartenev2016-04-14
| | | | | | | | | A client is allowed to send requests before receiving and acknowledging the SETTINGS frame. Such a client having a wrong idea about the stream's could send the request body that nginx isn't ready to process. The previous behavior was to send RST_STREAM with FLOW_CONTROL_ERROR in such case, but it didn't allow retrying requests that have been rejected.
* HTTP/2: deduplicated some code in ngx_http_v2_state_headers().Valentin Bartenev2016-04-14
| | | | No functional changes.
* FastCGI: skip special bufs in buffered request body chain.Valentin Bartenev2016-04-11
| | | | | | | | | | | This prevents forming empty records out of such buffers. Particularly it fixes double end-of-stream records with chunked transfer encoding, or when HTTP/2 is used and the END_STREAM flag has been sent without data. In both cases there is an empty buffer at the end of the request body chain with the "last_buf" flag set. The canonical libfcgi, as well as php implementation, tolerates such records, while the HHVM parser is more strict and drops the connection (ticket #950).
* Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse (as in e444e8f6538b).Ruslan Ermilov2016-04-12
|
* Fixed typos.Alessandro Ghedini2016-04-11
|
* Removed redundant "u" format specifier.Ruslan Ermilov2016-04-08
| | | | It is implied for "x" and "X".
* Simplified ngx_unix_recv() and ngx_readv_chain().Ruslan Ermilov2016-04-08
| | | | This makes ngx_unix_recv() and ngx_udp_unix_recv() differ minimally.
* Merged implementations of ngx_unix_recv().Valentin Bartenev2016-04-08
| | | | | There's no real need in two separate implementations, with and without kqueue support.
* Fixed small inconsistency in handling EOF among receive functions.Valentin Bartenev2016-04-08
| | | | Now all functions always drop the ready flag in this case.
* Merged implementations of ngx_udp_unix_recv().Valentin Bartenev2016-04-08
| | | | | There's no real need in two separate implementations, with and without kqueue support.
* Fixed spelling.Josh Soref2016-04-07
|
* Version bump.Ruslan Ermilov2016-04-07
|
* HTTP/2: support for unbuffered upload of request body.Valentin Bartenev2016-04-01
|
* HTTP/2: rewritten handling of request body.Valentin Bartenev2016-04-01
| | | | | | | | | | | | | There are two improvements: 1. Support for request body filters; 2. Receiving of request body is started only after the ngx_http_read_client_request_body() call. The last one fixes the problem when the client_max_body_size value might not be respected from the right location if the location was changed either during the process of receiving body or after the whole body had been received.
* HTTP/2: sending RST_STREAM with NO_ERROR to discard request body.Valentin Bartenev2016-04-01
| | | | | | | | | | | | | | RFC 7540 states that "A server can send a complete response prior to the client sending an entire request if the response does not depend on any portion of the request that has not been sent and received. When this is true, a server MAY request that the client abort transmission of a request without error by sending a RST_STREAM with an error code of NO_ERROR after sending a complete response (i.e., a frame with the END_STREAM flag)." This should prevent a client from blocking on the stream window, since it isn't maintained for closed streams. Currently, quite big initial stream windows are used, so such blocking is very unlikly, but that will be changed in the further patches.
* Core: removed incorrect GCC 2.7 check.Maxim Dounin2016-04-01
| | | | | | | | It was broken since introduction (__GNU__ instead of __GNUC__) and did nothing. Moreover, GCC 2.7 is happy with the normal version of the code. Reported by Joel Cunningham, http://mailman.nginx.org/pipermail/nginx-devel/2016-March/007964.html.
* SSL: SSLeay_version() is deprecated in OpenSSL 1.1.0.Maxim Dounin2016-03-31
| | | | | | | | SSLeay_version() and SSLeay() are no longer available if OPENSSL_API_COMPAT is set to 0x10100000L. Switched to using OpenSSL_version() instead. Additionally, we now compare version strings instead of version numbers, and this correctly works for LibreSSL as well.
* SSL: X509 was made opaque in OpenSSL 1.1.0.Sergey Kandaurov2016-03-31
| | | | | To increment reference counters we now use newly introduced X509_up_ref() function.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-21 23:43:51 +0000