summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Version bump.Roman Arutyunyan2022-11-031-2/+2
|
* Mp4: disabled duplicate atoms.Roman Arutyunyan2022-10-191-0/+147
| | | | | | Most atoms should not appear more than once in a container. Previously, this was not enforced by the module, which could result in worker process crash, memory corruption and disclosure.
* SSL: improved validation of ssl_session_cache and ssl_ocsp_cache.Sergey Kandaurov2022-10-173-4/+4
| | | | | | | Now it properly detects invalid shared zone configuration with omitted size. Previously it used to read outside of the buffer boundary. Found with AddressSanitizer.
* SSL: removed cast not needed after 5ffd76a9ccf3.Sergey Kandaurov2022-10-131-1/+1
|
* SSL: workaround for session timeout handling with TLSv1.3.Maxim Dounin2022-10-122-0/+48
| | | | | | | | | | | | | OpenSSL with TLSv1.3 updates the session creation time on session resumption and keeps the session timeout unmodified, making it possible to maintain the session forever, bypassing client certificate expiration and revocation. To make sure session timeouts are actually used, we now update the session creation time and reduce the session timeout accordingly. BoringSSL with TLSv1.3 ignores configured session timeouts and uses a hardcoded timeout instead, 7 days. So we update session timeout to the configured value as soon as a session is created.
* SSL: optimized rotation of session ticket keys.Maxim Dounin2022-10-122-19/+47
| | | | | | | | | | | | Instead of syncing keys with shared memory on each ticket operation, the code now does this only when the worker is going to change expiration of the current key, or going to switch to a new key: that is, usually at most once per second. To do so without races, the code maintains 3 keys: current, previous, and next. If a worker will switch to the next key earlier, other workers will still be able to decrypt new tickets, since they will be encrypted with the next key.
* SSL: automatic rotation of session ticket keys.Maxim Dounin2022-10-122-30/+160
| | | | | | | | | | | | | As long as ssl_session_cache in shared memory is configured, session ticket keys are now automatically generated in shared memory, and rotated periodically. This can be beneficial from forward secrecy point of view, and also avoids increased CPU usage after configuration reloads. This also helps BoringSSL to properly resume sessions in configurations with multiple worker processes and no ssl_session_ticket_key directives, as BoringSSL tries to automatically rotate session ticket keys and does this independently in different worker processes, thus breaking session resumption between worker processes.
* SSL: shorter debug messages about session tickets.Maxim Dounin2022-10-121-3/+3
|
* SSL: renamed session ticket key functions and data index.Maxim Dounin2022-10-122-16/+13
| | | | Previously used names are way too long, renamed to simplify writing code.
* SSL: renamed session ticket key type.Maxim Dounin2022-10-122-21/+21
| | | | | The ngx_ssl_session_ticket_key_t is way too long, renamed to ngx_ssl_ticket_key_t to simplify writing code.
* SSL: style.Maxim Dounin2022-10-121-0/+2
| | | | Runtime OCSP functions separated from configuration ones.
* SSL: explicit clearing of expired sessions.Maxim Dounin2022-10-121-0/+6
| | | | | This reduces lifetime of session keying material in server's memory, and therefore can be beneficial from forward secrecy point of view.
* SSL: single allocation in session cache on 32-bit platforms.Maxim Dounin2022-10-122-48/+25
| | | | | | | | | | | | Given the present typical SSL session sizes, on 32-bit platforms it is now beneficial to store all data in a single allocation, since rbtree node + session id + ASN1 representation of a session takes 256 bytes of shared memory (36 + 32 + 150 = about 218 bytes plus SNI server name). Storing all data in a single allocation is beneficial for SNI names up to about 40 characters long and makes it possible to store about 4000 sessions in one megabyte (instead of about 3000 sessions now). This also slightly simplifies the code.
* SSL: explicit session id length checking.Maxim Dounin2022-10-121-2/+8
| | | | | | | | Session ids are not expected to be longer than 32 bytes, but this is theoretically possible with TLSv1.3, where session ids are essentially arbitrary and sent as session tickets. Since on 64-bit platforms we use fixed 32-byte buffer for session ids, added an explicit length check to make sure the buffer is large enough.
* SSL: updated comment about session sizes.Maxim Dounin2022-10-121-6/+6
| | | | | Previous numbers are somewhat outdated, typical ASN1 representations of sessions are slightly bigger now.
* SSL: reduced logging of session cache failures (ticket #621).Maxim Dounin2022-10-122-2/+8
| | | | | | | | | | | Session cache allocations might fail as long as the new session is different in size from the one least recently used (and freed when the first allocation fails). In particular, it might not be possible to allocate space for sessions with client certificates, since they are noticeably bigger than normal sessions. To ensure such allocation failures won't clutter logs, logging level changed to "warn", and logging is now limited to at most one warning per second.
* SSL: disabled saving tickets to session cache.Maxim Dounin2022-10-121-0/+17
| | | | | | | OpenSSL tries to save TLSv1.3 sessions into session cache even when using tickets for stateless session resumption, "because some applications just want to know about the creation of a session". To avoid trashing session cache with useless data, we do not save such sessions now.
* Added type cast to ngx_proxy_protocol_parse_uint16().Roman Arutyunyan2022-09-271-1/+3
| | | | | The cast is added to make ngx_proxy_protocol_parse_uint16() similar to ngx_proxy_protocol_parse_uint32().
* PROXY protocol v2 TLV variables.Roman Arutyunyan2022-10-124-2/+265
| | | | | The variables have prefix $proxy_protocol_tlv_ and are accessible by name and by type. Examples are: $proxy_protocol_tlv_0x01, $proxy_protocol_tlv_alpn.
* Log only the first line of user input on PROXY protocol v1 error.Roman Arutyunyan2022-10-101-1/+7
| | | | | | | | Previously, all received user input was logged. If a multi-line text was received from client and logged, it could reduce log readability and also make it harder to parse nginx log by scripts. The change brings to PROXY protocol the same behavior that exists for HTTP request line in ngx_http_log_error_handler().
* SSL: silenced GCC warnings when building with BoringSSL.Sergey Kandaurov2022-09-081-1/+1
| | | | | BoringSSL uses macro stub for SSL_CTX_set_ecdh_auto that expands to 1, which triggers -Wunused-value "statement with no effect" warnings.
* Win32: fixed build on Windows with OpenSSL 3.0.x (ticket #2379).Maxim Dounin2022-09-071-3/+3
| | | | | | | | SSL_sendfile() expects integer file descriptor as an argument, but nginx uses OS file handles (HANDLE) to work with files on Windows, and passing HANDLE instead of an integer correctly results in build failure. Since SSL_sendfile() is not expected to work on Windows anyway, the code is now disabled on Windows with appropriate compile-time checks.
* Win32: disabled C4306 warnings with MSVC.Maxim Dounin2022-09-071-0/+3
| | | | | | | | | Multiple C4306 warnings (conversion from 'type1' to 'type2' of greater size) appear during 64-bit compilation with MSVC 2010 (and older) due to extensively used constructs like "(void *) -1", so they were disabled. In newer MSVC versions C4306 warnings were replaced with C4312 ones, and these are not generated for such trivial type casts.
* Win32: removed misleading comment about warnings being disabled.Maxim Dounin2022-09-071-2/+0
| | | | Warnings being disabled are not only from the "-W4" level since e4590dfd97ff.
* SSL: fixed incorrect usage of #if instead of #ifdef.Maxim Dounin2022-09-071-1/+1
| | | | | | | | In 2014ed60f17f, "#if SSL_CTRL_SET_ECDH_AUTO" test was incorrectly used instead of "#ifdef SSL_CTRL_SET_ECDH_AUTO". There is no practical difference, since SSL_CTRL_SET_ECDH_AUTO evaluates to a non-zero numeric value when defined, but anyway it's better to correctly test if the value is defined.
* Events: fixed style and wrong error handling in the iocp module.Maxim Dounin2022-09-071-4/+3
|
* SSL: logging level of "bad record type" errors.Murilo Andrade2022-08-091-0/+3
| | | | | | | The SSL_R_BAD_RECORD_TYPE ("bad record type") errors are reported by OpenSSL 1.1.1 or newer when using TLSv1.3 if the client sends a record with unknown or unexpected type. These errors are now logged at the "info" level.
* Version bump.Maxim Dounin2022-08-301-2/+2
|
* Events: fixed EPOLLRDHUP with FIONREAD (ticket #2367).Maxim Dounin2022-07-151-0/+2
| | | | | | | | | | | | | | | | | | | When reading exactly rev->available bytes, rev->available might become 0 after FIONREAD usage introduction in efd71d49bde0. On the next call of ngx_readv_chain() on systems with EPOLLRDHUP this resulted in return without any actions, that is, with rev->ready set, and this in turn resulted in no timers set in event pipe, leading to socket leaks. Fix is to reset rev->ready in ngx_readv_chain() when returning due to rev->available being 0 with EPOLLRDHUP, much like it is already done in ngx_unix_recv(). This ensures that if rev->available will become 0, on systems with EPOLLRDHUP support appropriate EPOLLRDHUP-specific handling will happen on the next ngx_readv_chain() call. While here, also synced ngx_readv_chain() to match ngx_unix_recv() and reset rev->ready when returning due to rev->available being 0 with kqueue. This is mostly cosmetic change, as rev->ready is anyway reset when rev->available is set to 0.
* Range filter: clearing of pre-existing Content-Range headers.Maxim Dounin2022-07-151-0/+13
| | | | | | | | Some servers might emit Content-Range header on 200 responses, and this does not seem to contradict RFC 9110: as per RFC 9110, the Content-Range header has no meaning for status codes other than 206 and 416. Previously this resulted in duplicate Content-Range headers in nginx responses handled by the range filter. Fix is to clear pre-existing headers.
* Resolver: fixed memory leak for the "ipv4=off" case.Sergey Kandaurov2022-07-141-4/+1
| | | | | | This change partially reverts 2a77754cd9fe to properly free rn->query. Found by Coverity (CID 1507244).
* The "ipv4=" parameter of the "resolver" directive.Ruslan Ermilov2022-07-122-15/+54
| | | | | When set to "off", only IPv6 addresses will be resolved, and no A queries are ever sent (ticket #2196).
* SSL: logging levels of various errors added in OpenSSL 1.1.1.Maxim Dounin2022-07-121-0/+12
| | | | | | | | | Starting with OpenSSL 1.1.1, various additional errors can be reported by OpenSSL in case of client-related issues, most notably during TLSv1.3 handshakes. In particular, SSL_R_BAD_KEY_SHARE ("bad key share"), SSL_R_BAD_EXTENSION ("bad extension"), SSL_R_BAD_CIPHER ("bad cipher"), SSL_R_BAD_ECPOINT ("bad ecpoint"). These are now logged at the "info" level.
* Upstream: optimized use of SSL contexts (ticket #1234).Maxim Dounin2022-06-294-27/+235
| | | | | | | | | | | | To ensure optimal use of memory, SSL contexts for proxying are now inherited from previous levels as long as relevant proxy_ssl_* directives are not redefined. Further, when no proxy_ssl_* directives are redefined in a server block, we now preserve plcf->upstream.ssl in the "http" section configuration to inherit it to all servers. Similar changes made in uwsgi, grpc, and stream proxy.
* Version bump.Maxim Dounin2022-06-291-2/+2
|
* Perl: removed unused variables, forgotten in ef6a3a99a81a.Sergey Kandaurov2022-06-141-2/+1
|
* Resolver: make TCP write timer event cancelable.Aleksei Bavshin2022-06-011-0/+1
| | | | | | | | | | | | | | | | | | | Similar to 70e65bf8dfd7, the change is made to ensure that the ability to cancel resolver tasks is fully controlled by the caller. As mentioned in the referenced commit, it is safe to make this timer cancelable because resolve tasks can have their own timeouts that are not cancelable. The scenario where this may become a problem is a periodic background resolve task (not tied to a specific request or a client connection), which receives a response with short TTL, large enough to warrant fallback to a TCP query. With each event loop wakeup, we either have a previously set write timer instance or schedule a new one. The non-cancelable write timer can delay or block graceful shutdown of a worker even if the ngx_resolver_ctx_t->cancelable flag is set by the API user, and there are no other tasks or connections. We use the resolver API in this way to maintain the list of upstream server addresses specified with the 'resolve' parameter, and there could be third-party modules implementing similar logic.
* Stream: don't flush empty buffers created for read errors.Aleksei Bavshin2022-05-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we generate the last_buf buffer for an UDP upstream recv error, it does not contain any data from the wire. ngx_stream_write_filter attempts to forward it anyways, which is incorrect (e.g., UDP upstream ECONNREFUSED will be translated to an empty packet). This happens because we mark the buffer as both 'flush' and 'last_buf', and ngx_stream_write_filter has special handling for flush with certain types of connections (see d127837c714f, 32b0ba4855a6). The flags are meant to be mutually exclusive, so the fix is to ensure that flush and last_buf are not set at the same time. Reproduction: stream { upstream unreachable { server 127.0.0.1:8880; } server { listen 127.0.0.1:8998 udp; proxy_pass unreachable; } } 1 0.000000000 127.0.0.1 → 127.0.0.1 UDP 47 45588 → 8998 Len=5 2 0.000166300 127.0.0.1 → 127.0.0.1 UDP 47 51149 → 8880 Len=5 3 0.000172600 127.0.0.1 → 127.0.0.1 ICMP 75 Destination unreachable (Port unreachable) 4 0.000202400 127.0.0.1 → 127.0.0.1 UDP 42 8998 → 45588 Len=0 Fixes d127837c714f.
* Mp4: fixed potential overflow in ngx_http_mp4_crop_stts_data().Maxim Dounin2022-06-071-1/+1
| | | | | | | | Both "count" and "duration" variables are 32-bit, so their product might potentially overflow. It is used to reduce 64-bit start_time variable, and with very large start_time this can result in incorrect seeking. Found by Coverity (CID 1499904).
* Upstream: handling of certificates specified as an empty string.Sergey Kandaurov2022-06-075-12/+20
| | | | | | | Now, if the directive is given an empty string, such configuration cancels loading of certificates, in particular, if they would be otherwise inherited from the previous level. This restores previous behaviour, before variables support in certificates was introduced (3ab8e1e2f0f7).
* Upstream: fixed X-Accel-Expires/Cache-Control/Expires handling.Maxim Dounin2022-06-072-7/+24
| | | | | | | | | | | | | | | | | | | | | | Previously, if caching was disabled due to Expires in the past, nginx failed to cache the response even if it was cacheable as per subsequently parsed Cache-Control header (ticket #964). Similarly, if caching was disabled due to Expires in the past, "Cache-Control: no-cache" or "Cache-Control: max-age=0", caching was not used if it was cacheable as per subsequently parsed X-Accel-Expires header. Fix is to avoid disabling caching immediately after parsing Expires in the past or Cache-Control, but rather set flags which are later checked by ngx_http_upstream_process_headers() (and cleared by "Cache-Control: max-age" and X-Accel-Expires). Additionally, now X-Accel-Expires does not prevent parsing of cache control extensions, notably stale-while-revalidate and stale-if-error. This ensures that order of the X-Accel-Expires and Cache-Control headers is not important. Prodded by Vadim Fedorenko and Yugo Horie.
* Upstream: fixed build without http cache (broken by cd73509f21e2).Maxim Dounin2022-05-311-4/+5
|
* Headers filter: improved memory allocation error handling.Maxim Dounin2022-05-301-0/+4
|
* Multiple WWW-Authenticate headers with "satisfy any;".Maxim Dounin2022-05-301-2/+3
| | | | | | | | | | | | | | | If a module adds multiple WWW-Authenticate headers (ticket #485) to the response, linked in r->headers_out.www_authenticate, all headers are now cleared if another module later allows access. This change is a nop for standard modules, since the only access module which can add multiple WWW-Authenticate headers is the auth request module, and it is checked after other standard access modules. Though this might affect some third party access modules. Note that if a 3rd party module adds a single WWW-Authenticate header and not yet modified to set the header's next pointer to NULL, attempt to clear such a header with this change will result in a segmentation fault.
* Auth request: multiple WWW-Authenticate headers (ticket #485).Maxim Dounin2022-05-301-3/+8
| | | | | | When using auth_request with an upstream server which returns 401 (Unauthorized), multiple WWW-Authenticate headers from the upstream server response are now properly copied to the response.
* Upstream: multiple WWW-Authenticate headers (ticket #485).Maxim Dounin2022-05-301-9/+17
| | | | | | When using proxy_intercept_errors and an error page for error 401 (Unauthorized), multiple WWW-Authenticate headers from the upstream server response are now properly copied to the response.
* Upstream: handling of multiple Vary headers (ticket #1423).Maxim Dounin2022-05-301-5/+43
| | | | Previously, only the last header value was used when caching.
* Upstream: duplicate headers ignored or properly linked.Maxim Dounin2022-05-302-9/+104
| | | | | | | | | Most of the known duplicate upstream response headers are now ignored with a warning. If syntax permits multiple headers, these are now properly linked to the lists, notably Vary and WWW-Authenticate. This makes it possible to further handle such lists where it makes sense.
* Upstream: header handlers can now return parsing errors.Maxim Dounin2022-05-306-13/+80
| | | | | | | With this change, duplicate Content-Length and Transfer-Encoding headers are now rejected. Further, responses with invalid Content-Length or Transfer-Encoding headers are now rejected, as well as responses with both Content-Length and Transfer-Encoding.
* Upstream: all known headers in u->headers_in are linked lists now.Maxim Dounin2022-05-302-0/+11
|
View Lorry Controller Status