<feed xmlns='http://www.w3.org/2005/Atom'>
<title>nginx.git/src, branch release-1.9.10</title>
<subtitle>nginx</subtitle>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/'/>
<entry>
<title>Resolver: limited CNAME recursion.</title>
<updated>2016-01-26T13:47:14+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2016-01-26T13:47:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=fe89d99796d42b86816e17d9c87ab16964768024'/>
<id>fe89d99796d42b86816e17d9c87ab16964768024</id>
<content type='text'>
Previously, the recursion was only limited for cached responses.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, the recursion was only limited for cached responses.
</pre>
</div>
</content>
</entry>
<entry>
<title>Resolver: fixed use-after-free memory accesses with CNAME.</title>
<updated>2016-01-26T13:46:59+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2016-01-26T13:46:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=a3d42258d97ebd0b638c20976654d3edfbaf943f'/>
<id>a3d42258d97ebd0b638c20976654d3edfbaf943f</id>
<content type='text'>
When several requests were waiting for a response, then after getting
a CNAME response only the last request's context had the name updated.
Contexts of other requests had the wrong name.  This name was used by
ngx_resolve_name_done() to find the node to remove the request context
from.  When the name was wrong, the request could not be properly
cancelled, its context was freed but stayed linked to the node's waiting
list.  This happened e.g. when the first request was aborted or timed
out before the resolving completed.  When it completed, this triggered
a use-after-free memory access by calling ctx-&gt;handler of already freed
request context.  The bug manifests itself by
"could not cancel &lt;name&gt; resolving" alerts in error_log.

When a request was responded with a CNAME, the request context kept
the pointer to the original node's rn-&gt;u.cname.  If the original node
expired before the resolving timed out or completed with an error,
this would trigger a use-after-free memory access via ctx-&gt;name in
ctx-&gt;handler().

The fix is to keep ctx-&gt;name unmodified.  The name from context
is no longer used by ngx_resolve_name_done().  Instead, we now keep
the pointer to resolver node to which this request is linked.
Keeping the original name intact also improves logging.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When several requests were waiting for a response, then after getting
a CNAME response only the last request's context had the name updated.
Contexts of other requests had the wrong name.  This name was used by
ngx_resolve_name_done() to find the node to remove the request context
from.  When the name was wrong, the request could not be properly
cancelled, its context was freed but stayed linked to the node's waiting
list.  This happened e.g. when the first request was aborted or timed
out before the resolving completed.  When it completed, this triggered
a use-after-free memory access by calling ctx-&gt;handler of already freed
request context.  The bug manifests itself by
"could not cancel &lt;name&gt; resolving" alerts in error_log.

When a request was responded with a CNAME, the request context kept
the pointer to the original node's rn-&gt;u.cname.  If the original node
expired before the resolving timed out or completed with an error,
this would trigger a use-after-free memory access via ctx-&gt;name in
ctx-&gt;handler().

The fix is to keep ctx-&gt;name unmodified.  The name from context
is no longer used by ngx_resolve_name_done().  Instead, we now keep
the pointer to resolver node to which this request is linked.
Keeping the original name intact also improves logging.
</pre>
</div>
</content>
</entry>
<entry>
<title>Resolver: changed the ngx_resolver_create_*_query() arguments.</title>
<updated>2016-01-26T13:46:48+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2016-01-26T13:46:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=b1a110e3a457d98f0eaffb0cb0e646df9178024f'/>
<id>b1a110e3a457d98f0eaffb0cb0e646df9178024f</id>
<content type='text'>
No functional changes.

This is needed by the following change.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
No functional changes.

This is needed by the following change.
</pre>
</div>
</content>
</entry>
<entry>
<title>Resolver: fixed CNAME processing for several requests.</title>
<updated>2016-01-26T13:46:38+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2016-01-26T13:46:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=4016e6b1da4fbf9c45963211791be124cd7ffb8f'/>
<id>4016e6b1da4fbf9c45963211791be124cd7ffb8f</id>
<content type='text'>
When several requests were waiting for a response, then after getting
a CNAME response only the last request was properly processed, while
others were left waiting.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When several requests were waiting for a response, then after getting
a CNAME response only the last request was properly processed, while
others were left waiting.
</pre>
</div>
</content>
</entry>
<entry>
<title>Resolver: fixed crashes in timeout handler.</title>
<updated>2016-01-26T13:46:31+00:00</updated>
<author>
<name>Ruslan Ermilov</name>
<email>ru@nginx.com</email>
</author>
<published>2016-01-26T13:46:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=4b581a7c21e4328d059bf400a059c0458fc9f806'/>
<id>4b581a7c21e4328d059bf400a059c0458fc9f806</id>
<content type='text'>
If one or more requests were waiting for a response, then after
getting a CNAME response, the timeout event on the first request
remained active, pointing to the wrong node with an empty
rn-&gt;waiting list, and that could cause either null pointer
dereference or use-after-free memory access if this timeout
expired.

If several requests were waiting for a response, and the first
request terminated (e.g., due to client closing a connection),
other requests were left without a timeout and could potentially
wait indefinitely.

This is fixed by introducing per-request independent timeouts.
This change also reverts 954867a2f0a6 and 5004210e8c78.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If one or more requests were waiting for a response, then after
getting a CNAME response, the timeout event on the first request
remained active, pointing to the wrong node with an empty
rn-&gt;waiting list, and that could cause either null pointer
dereference or use-after-free memory access if this timeout
expired.

If several requests were waiting for a response, and the first
request terminated (e.g., due to client closing a connection),
other requests were left without a timeout and could potentially
wait indefinitely.

This is fixed by introducing per-request independent timeouts.
This change also reverts 954867a2f0a6 and 5004210e8c78.
</pre>
</div>
</content>
</entry>
<entry>
<title>Resolver: fixed possible segmentation fault on DNS format error.</title>
<updated>2016-01-26T13:46:18+00:00</updated>
<author>
<name>Roman Arutyunyan</name>
<email>arut@nginx.com</email>
</author>
<published>2016-01-26T13:46:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=c44fd4e837f979912749a5a19490ccb9b46398d3'/>
<id>c44fd4e837f979912749a5a19490ccb9b46398d3</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Request body: removed surplus assigment, no functional changes.</title>
<updated>2016-01-12T16:19:07+00:00</updated>
<author>
<name>Valentin Bartenev</name>
<email>vbart@nginx.com</email>
</author>
<published>2016-01-12T16:19:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=8a5df8c720a0b5e773bc852779f542ffa66e7061'/>
<id>8a5df8c720a0b5e773bc852779f542ffa66e7061</id>
<content type='text'>
Setting rb-&gt;bufs to NULL is surplus after ngx_http_write_request_body()
has returned NGX_OK.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Setting rb-&gt;bufs to NULL is surplus after ngx_http_write_request_body()
has returned NGX_OK.
</pre>
</div>
</content>
</entry>
<entry>
<title>Core: worker_cpu_affinity auto.</title>
<updated>2016-01-11T16:23:17+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2016-01-11T16:23:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=d0bf684ab6643edc18ab65e2c40bf88862ead8e5'/>
<id>d0bf684ab6643edc18ab65e2c40bf88862ead8e5</id>
<content type='text'>
If enabled, workers are bound to available CPUs, each worker to once CPU
in order.  If there are more workers than available CPUs, remaining are
bound in a loop, starting again from the first available CPU.

The optional mask parameter defines which CPUs are available for automatic
binding.

In collaboration with Vladimir Homutov.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If enabled, workers are bound to available CPUs, each worker to once CPU
in order.  If there are more workers than available CPUs, remaining are
bound in a loop, starting again from the first available CPU.

The optional mask parameter defines which CPUs are available for automatic
binding.

In collaboration with Vladimir Homutov.
</pre>
</div>
</content>
</entry>
<entry>
<title>Upstream: fixed changing method on X-Accel-Redirect.</title>
<updated>2016-01-11T16:08:12+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2016-01-11T16:08:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=af647a3da2eb9ff558655424868f82f259de94f1'/>
<id>af647a3da2eb9ff558655424868f82f259de94f1</id>
<content type='text'>
Previously, only r-&gt;method was changed, resulting in handling of a request
as GET within nginx itself, but not in requests to proxied servers.

See http://mailman.nginx.org/pipermail/nginx/2015-December/049518.html.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, only r-&gt;method was changed, resulting in handling of a request
as GET within nginx itself, but not in requests to proxied servers.

See http://mailman.nginx.org/pipermail/nginx/2015-December/049518.html.
</pre>
</div>
</content>
</entry>
<entry>
<title>Upstream: don't keep connections on early responses (ticket #669).</title>
<updated>2015-12-17T13:39:15+00:00</updated>
<author>
<name>Maxim Dounin</name>
<email>mdounin@mdounin.ru</email>
</author>
<published>2015-12-17T13:39:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.sigsegv.uk/nginx.git/commit/?id=fda7d021ca23d43cb7a17ff92cd4ad5c805a156c'/>
<id>fda7d021ca23d43cb7a17ff92cd4ad5c805a156c</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
