summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2018-02-20nginx-1.13.9-RELEASErelease-1.13.9Maxim Dounin1-0/+60
2018-02-15HTTP/2: precalculate hash for "Cookie".Maxim Dounin1-1/+2
There is no need to calculate hashes of static strings at runtime. The ngx_hash() macro can be used to do it during compilation instead, similarly to how it is done in ngx_http_proxy_module.c for "Server" and "Date" headers.
2018-02-15HTTP/2: fixed ngx_http_v2_push_stream() allocation error handling.Ruslan Ermilov1-15/+47
In particular, if a stream object allocation failed, and a client sent the PRIORITY frame for this stream, ngx_http_v2_set_dependency() could dereference a null pointer while trying to re-parent a dependency node.
2018-02-15HTTP/2: push additional request headers (closes #1478).Ruslan Ermilov4-94/+215
The Accept-Encoding, Accept-Language, and User-Agent header fields are now copied from the original request to pushed requests.
2018-02-15Expose more headers with NGX_HTTP_HEADERS.Ruslan Ermilov2-2/+2
2018-02-15Core: added a stub for additional zone configuration.Vladimir Homutov1-0/+1
2018-02-15HTTP/2: style.Sergey Kandaurov2-4/+4
2018-02-09HTTP/2: fixed null pointer dereference with server push.Ruslan Ermilov1-1/+5
r->headers_in.host can be NULL in ngx_http_v2_push_resource(). This happens when a request is terminated with 400 before the :authority or Host header is parsed, and either pushing is enabled on the server{} level or error_page 400 redirects to a location with pushes configured. Found by Coverity (CID 1429156).
2018-02-08HTTP/2: fixed build with -Werror=unused-but-set-variable.Ruslan Ermilov1-10/+3
2018-02-08HTTP/2: server push.Ruslan Ermilov5-18/+873
Resources to be pushed are configured with the "http2_push" directive. Also, preload links from the Link response headers, as described in https://www.w3.org/TR/preload/#server-push-http-2, can be pushed, if enabled with the "http2_push_preload" directive. Only relative URIs with absolute paths can be pushed. The number of concurrent pushes is normally limited by a client, but cannot exceed a hard limit set by the "http2_max_concurrent_pushes" directive.
2018-02-08HTTP/2: changed prototypes of request pseudo-headers parsers.Ruslan Ermilov1-25/+24
No functional changes.
2018-02-08Basic support of the Link response header.Ruslan Ermilov4-19/+32
2018-02-07Dav: added error logging.Roman Arutyunyan1-1/+10
Previously, when request body was not available or was previously read in memory rather than a file, client received HTTP 500 error, but no explanation was logged in error log. This could happen, for example, if request body was read or discarded prior to error_page redirect, or if mirroring was enabled along with dav.
2018-02-06HTTP/2: removed unused field from ngx_http_v2_stream_t.Sergey Kandaurov1-2/+0
2018-02-01Contrib: vim syntax, update 3rd party module directives.Gena Makhomed1-0/+5
Add new directives for 3rd party modules.
2018-02-01Contrib: vim syntax, update core module directives.Gena Makhomed1-2/+2
"match" is block directive, "upstream_conf" is deprecated by patch http://hg.nginx.org/nginx.org/rev/27c53e1cb4b6
2018-01-30Upstream: removed X-Powered-By from the list of special headers.Ruslan Ermilov1-4/+0
After 1e720b0be7ec, it's neither specially processed nor copied when redirecting with X-Accel-Redirect.
2018-01-30SSL: using default server context in session remove (closes #1464).Sergey Kandaurov3-6/+6
This fixes segfault in configurations with multiple virtual servers sharing the same port, where a non-default virtual server block misses certificate.
2018-01-30HTTP/2: finalize request as bad if parsing of pseudo-headers fails.Ruslan Ermilov1-8/+1
This is in line when the required pseudo-headers are missing, and avoids spurious zero statuses in access.log.
2018-01-29HTTP/2: more style, comments, and debugging.Ruslan Ermilov3-158/+168
2018-01-29HTTP/2: handle duplicate INITIAL_WINDOW_SIZE settings.Ruslan Ermilov1-2/+2
2018-01-16Fixed --test-build-eventport on macOS 10.12 and later.Ruslan Ermilov1-0/+2
In macOS 10.12, CLOCK_REALTIME and clockid_t were added, but not timer_t.
2018-01-11Upstream: fixed "header already sent" alerts on backend errors.Maxim Dounin1-3/+4
Following ad3f342f14ba046c (1.9.13), it is possible that a request where header was already sent will be finalized with NGX_HTTP_BAD_GATEWAY, triggering an attempt to return additional error response and the "header already sent" alert as a result. In particular, it is trivial to reproduce the problem with a HEAD request and caching enabled. With caching enabled nginx will change HEAD to GET and will set u->pipe->downstream_error to suppress sending the response body to the client. When a backend-related error occurs (for example, proxy_read_timeout expires), ngx_http_finalize_upstream_request() will be called with NGX_HTTP_BAD_GATEWAY. After ad3f342f14ba046c this will result in ngx_http_finalize_request(NGX_HTTP_BAD_GATEWAY). Fix is to move u->pipe->downstream_error handling to a later point, where all special response codes are changed to NGX_ERROR. Reported by Jan Prachar, http://mailman.nginx.org/pipermail/nginx-devel/2018-January/010737.html.
2018-01-11Year 2018.Maxim Dounin1-2/+2
2017-12-28Contrib: vim syntax, update core module directives.Gena Makhomed1-11/+0
Removed non-existent directives and directive redefinitions.
2017-12-28Contrib: vim syntax, update 3rd party module directives.Gena Makhomed1-1213/+1272
3rd party modules list synchronized with FreeBSD nginx-devel port.
2017-12-30Version bump.Maxim Dounin1-2/+2
2017-12-26release-1.13.8 tagMaxim Dounin1-0/+1
2017-12-26nginx-1.13.8-RELEASErelease-1.13.8Maxim Dounin1-0/+106
2017-12-26Updated OpenSSL used for win32 builds.Maxim Dounin1-1/+1
2017-12-25Contrib: vim syntax, listen options.Gena Makhomed1-3/+7
2017-12-25Contrib: vim syntax, update core module directives.Gena Makhomed1-17/+24
2017-12-25Contrib: updated vim syntax rules for variables.Maxim Dounin1-3/+3
Non-quoted parameters are allowed to contain variables in curly brackets (see d91a8c4ac6bb), so vim syntax rules were adjusted accordingly.
2017-12-21Allowed configuration token to start with a variable.Roman Arutyunyan1-0/+5
Specifically, it is now allowed to start with a variable expression with braces: ${name}. The opening curly bracket in such a token was previously considered the start of a new block. Variables located anywhere else in a token worked fine: foo${name}.
2017-12-19Fixed capabilities version.Roman Arutyunyan2-2/+2
Previously, capset(2) was called with the 64-bit capabilities version _LINUX_CAPABILITY_VERSION_3. With this version Linux kernel expected two copies of struct __user_cap_data_struct, while only one was submitted. As a result, random stack memory was accessed and random capabilities were requested by the worker. This sometimes caused capset() errors. Now the 32-bit version _LINUX_CAPABILITY_VERSION_1 is used instead. This is OK since CAP_NET_RAW is a 32-bit capability (CAP_NET_RAW = 13).
2017-12-18Improved the capabilities feature detection.Roman Arutyunyan3-4/+5
Previously included file sys/capability.h mentioned in capset(2) man page, belongs to the libcap-dev package, which may not be installed on some Linux systems when compiling nginx. This prevented the capabilities feature from being detected and compiled on that systems. Now linux/capability.h system header is included instead. Since capset() declaration is located in sys/capability.h, now capset() syscall is defined explicitly in code using the SYS_capset constant, similarly to other Linux-specific features in nginx.
2017-12-13Retain CAP_NET_RAW capability for transparent proxying.Roman Arutyunyan6-0/+82
The capability is retained automatically in unprivileged worker processes after changing UID if transparent proxying is enabled at least once in nginx configuration. The feature is only available in Linux.
2017-12-11Use sysconf to determine cacheline size at runtime.Debayan Ghosh2-0/+20
Determine cacheline size at runtime if supported using sysconf(_SC_LEVEL1_DCACHE_LINESIZE). In case not supported, fallback to compile time defaults.
2017-12-11Configure: set default cacheline size to 64 for aarch64 platforms.Debayan Ghosh1-0/+5
2017-12-07Configure: fixed SO_BINDANY comment.Maxim Dounin1-1/+1
2017-12-07Configure: moved IP_BIND_ADDRESS_NO_PORT test.Maxim Dounin1-11/+11
In 2c7b488a61fb, IP_BIND_ADDRESS_NO_PORT test was accidentally placed between SO_BINDANY, IP_TRANSPARENT, and IP_BINDANY tests. Moved it after these tests.
2017-11-20Proxy: escape explicit space in URI in default cache key.Roman Arutyunyan1-1/+1
If the flag space_in_uri is set, the URI in HTTP upstream request is escaped to convert space to %20. However this flag is not checked while creating the default cache key. This leads to different cache keys for requests '/foo bar' and '/foo%20bar', while the upstream requests are identical. Additionally, the change fixes background cache updates when the client URI contains unescaped space. Default cache key in a subrequest is always based on escaped URI, while the main request may not escape it. As a result, background cache update subrequest may update a different cache entry.
2017-11-20Inherit valid_unparsed_uri in cloned subrequests (ticket #1430).Roman Arutyunyan1-0/+1
Inheriting this flag will make the cloned subrequest behave consistently with the parent. Specifically, the upstream HTTP request and cache key created by the proxy module may depend directly on unparsed_uri if valid_unparsed_uri flag is set. Previously, the flag was zero for cloned requests, which could make background update proxy a request different than its parent and cache the result with a different key. For example, if client URI contained the escaped slash character %2F, it was used as is by the proxy module in the main request, but was unescaped in the subrequests. Similar problems exist in the slice module.
2017-11-20Proxy: simplified conditions of using unparsed uri.Roman Arutyunyan1-4/+2
Previously, the unparsed uri was explicitly allowed to be used only by the main request. However the valid_unparsed_uri flag is nonzero only in the main request, which makes the main request check pointless.
2017-12-01Upstream: flush low-level buffers on write retry.Patryk Lesiewicz1-1/+1
If the data to write is bigger than what the socket can send, and the reminder is smaller than NGX_SSL_BUFSIZE, then SSL_write() fails with SSL_ERROR_WANT_WRITE. The reminder of payload however is successfully copied to the low-level buffer and all the output chain buffers are flushed. This means that retry logic doesn't work because ngx_http_upstream_process_non_buffered_request() checks only if there's anything in the output chain buffers and ignores the fact that something may be buffered in low-level parts of the stack. Signed-off-by: Patryk Lesiewicz <patryk@google.com>
2017-11-28Upstream keepalive: clean read delayed flag in stored connections.Roman Arutyunyan1-0/+1
If a connection with the read delayed flag set was stored in the keepalive cache, and after picking it from the cache a read timer was set on that connection, this timer was considered a delay timer rather than a socket read event timer as expected. The latter timeout is usually much longer than the former, which caused a significant delay in request processing. The issue manifested itself with proxy_limit_rate and upstream keepalive enabled and exists since 973ee2276300 (1.7.7) when proxy_limit_rate was introduced.
2017-12-04Autoindex: discard request body (ticket #1439).Maxim Dounin1-0/+6
2017-11-28Removed unused FreeBSD-specific definitions in ngx_posix_config.h.Sergey Kandaurov1-20/+0
2017-11-28Fixed "changing binary" when reaper is not init.Ruslan Ermilov7-3/+12
On some systems, it's possible that reaper of orphaned processes is set to something other than "init" process. On such systems, the changing binary procedure did not work. The fix is to check if PPID has changed, instead of assuming it's always 1 for orphaned processes.
2017-11-23Configure: fixed clang detection on MINIX.Maxim Dounin2-2/+6
As per POSIX, basic regular expressions have no alternations, and the interpretation of the "\|" construct is undefined. At least on MINIX and Solaris grep interprets "\|" as literal "|", and not as an alternation as GNU grep does. Removed such constructs introduced in f1daa0356a1d. This fixes clang detection on MINIX.
generated by cgit (git 2.34.1) at 2025-12-07 10:02:56 +0000