summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2012-10-30nginx-1.3.8-RELEASErelease-1.3.8Maxim Dounin1-0/+65
2012-10-30Event pipe: fixed handling of buf_to_file data.Maxim Dounin2-2/+10
Input filter might free a buffer if there is no data in it, and in case of first buffer (used for cache header and request header, aka p->buf_to_file) this resulted in cache corruption. Buffer memory was reused to read upstream response before headers were written to disk. Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer start if we were asked to free a buffer used by p->buf_to_file. This fixes occasional cache file corruption, usually resulted in "cache file ... has md5 collision" alerts. Reported by Anatoli Marinov.
2012-10-30Style, parentheses instead of braces in misc/GNUMakefile.Maxim Dounin1-4/+4
2012-10-29Variables $connection and $connection_requests.Maxim Dounin2-23/+53
Log module counterparts are removed as they aren't used often and there is no need to preserve them for efficiency.
2012-10-24Resolver: added missing memory allocation error handling.Maxim Dounin1-0/+4
2012-10-23ngx_http_keepalive_handler() is now trying to not keep c->buffer's memory forValentin Bartenev1-0/+14
idle connections. This behaviour is consistent with the ngx_http_set_keepalive() function and it should decrease memory usage in some cases (especially if epoll/rtsig is used).
2012-10-23Core: the "auto" parameter of the "worker_processes" directive.Andrey Belov1-2/+33
The parameter will set the number of worker processes to the autodetected number of available CPU cores.
2012-10-18Removed conditional compilation from waitpid() error test.Maxim Dounin1-4/+0
There are reports that call to a signal handler for an exited process despite waitpid() already called for the process may happen on Linux as well.
2012-10-18Gunzip: fixed r->gzip_ok check.Maxim Dounin1-1/+1
2012-10-05OCSP stapling: properly check if there is ssl.ctx.Maxim Dounin1-1/+1
This fixes segfault if stapling was enabled in a server without a certificate configured (and hence no ssl.ctx).
2012-10-03Variable $bytes_sent.Maxim Dounin1-0/+26
It replicates variable $bytes_sent as previously available in log module only. Patch by Benjamin Grössing (with minor changes).
2012-10-03Log: $apache_bytes_sent removed.Maxim Dounin1-8/+0
It was renamed to $body_bytes_sent in nginx 0.3.10 and the old name is deprecated since then.
2012-10-03SSL: the "ssl_verify_client" directive parameter "optional_no_ca".Maxim Dounin3-2/+12
This parameter allows to don't require certificate to be signed by a trusted CA, e.g. if CA certificate isn't known in advance, like in WebID protocol. Note that it doesn't add any security unless the certificate is actually checked to be trusted by some external means (e.g. by a backend). Patch by Mike Kazantsev, Eric O'Connor.
2012-10-03Version bump.Maxim Dounin2-3/+3
2012-10-02release-1.3.7 tagMaxim Dounin1-0/+1
2012-10-02nginx-1.3.7-RELEASErelease-1.3.7Maxim Dounin1-0/+47
2012-10-01OCSP stapling: build fixes.Maxim Dounin1-5/+5
With the "ssl_stapling_verify" commit build with old OpenSSL libraries was broken due to incorrect prototype of the ngx_ssl_stapling() function. One incorrect use of ngx_log_debug() instead of ngx_log_debug2() slipped in and broke win32 build.
2012-10-01OCSP stapling: ssl_stapling_verify directive.Maxim Dounin4-7/+22
OCSP response verification is now switched off by default to simplify configuration, and the ssl_stapling_verify allows to switch it on. Note that for stapling OCSP response verification isn't something required as it will be done by a client anyway. But doing verification on a server allows to mitigate some attack vectors, most notably stop an attacker from presenting some specially crafted data to all site clients.
2012-10-01OCSP stapling: OCSP_basic_verify() OCSP_TRUSTOTHER flag now used.Maxim Dounin1-1/+1
This is expected to simplify configuration in a common case when OCSP response is signed by a certificate already present in ssl_certificate chain. This case won't need any extra trusted certificates.
2012-10-01OCSP stapling: log error data in ngx_ssl_error().Maxim Dounin1-6/+17
It's hard to debug OCSP_basic_verify() failures without the actual error string it records in the error data field.
2012-10-01OCSP stapling: check Content-Type.Maxim Dounin1-0/+28
This will result in better error message in case of incorrect response from OCSP responder: ... OCSP responder sent invalid "Content-Type" header: "text/plain" while requesting certificate status, responder: ... vs. ... d2i_OCSP_RESPONSE() failed (SSL: error:0D07209B:asn1 encoding routines:ASN1_get_object:too long error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error) while requesting certificate status, responder: ...
2012-10-01OCSP stapling: loading OCSP responses.Maxim Dounin6-40/+1761
This includes the ssl_stapling_responder directive (defaults to OCSP responder set in certificate's AIA extension). OCSP response for a given certificate is requested once we get at least one connection with certificate_status extension in ClientHello, and certificate status won't be sent in the connection in question. This due to limitations in the OpenSSL API (certificate status callback is blocking). Note: SSL_CTX_use_certificate_chain_file() was reimplemented as it doesn't allow to access the certificate loaded via SSL_CTX.
2012-10-01OCSP stapling: the ngx_event_openssl_stapling.c file.Maxim Dounin1-0/+140
Missed in previous commit.
2012-10-01OCSP stapling: ssl_stapling_file support.Maxim Dounin4-1/+31
Very basic version without any OCSP responder query code, assuming valid DER-encoded OCSP response is present in a ssl_stapling_file configured. Such file might be produced with openssl like this: openssl ocsp -issuer root.crt -cert domain.crt -respout domain.staple \ -url http://ocsp.example.com
2012-10-01OCSP stapling: ssl_trusted_certificate directive.Maxim Dounin4-3/+51
The directive allows to specify additional trusted Certificate Authority certificates to be used during certificate verification. In contrast to ssl_client_certificate DNs of these cerificates aren't sent to a client during handshake. Trusted certificates are loaded regardless of the fact whether client certificates verification is enabled as the same certificates will be used for OCSP stapling, during construction of an OCSP request and for verification of an OCSP response. The same applies to a CRL (which is now always loaded).
2012-09-28Resolver: cached addresses are returned with random rotation now.Maxim Dounin1-2/+25
This ensures balancing when working with dynamically resolved upstream servers with multiple addresses. Based on patch by Anton Jouline.
2012-09-28Correct plural form for "path" in the whole source base.Andrey Belov7-29/+29
2012-09-28Made sure to initialize the entire ngx_file_t structure.Andrey Belov1-0/+2
Found by Coverity.
2012-09-27SSL: added version checks for ssl compression workaround.Maxim Dounin1-0/+2
The SSL_COMP_get_compression_methods() is only available as an API function in OpenSSL 0.9.8+, require it explicitly to unbreak build with OpenSSL 0.9.7.
2012-09-27SSL: fixed compression workaround to remove all methods.Maxim Dounin1-3/+3
Previous code used sk_SSL_COMP_delete(ssl_comp_methods, i) while iterating stack from 0 to n, resulting in removal of only even compression methods. In real life this change is a nop, as there is only one compression method which is enabled by default in OpenSSL.
2012-09-27Configure: additional test for ExtUtils::Embed perl module presence.Andrey Belov1-1/+9
Now perl configure will correctly fail if ExtUtils::Embed perl module is not present in the system (found on Amazon Linux AMI, as of release 2012.03).
2012-09-26Configure: help updated to list upstream keepalive and least_conn.Maxim Dounin1-0/+4
Patch by Joshua Zhu.
2012-09-26Added clearing of cpu_affinity after process spawn.Maxim Dounin1-0/+2
This fixes unwanted/incorrect cpu_affinity use on dead worker processes respawn. While this is not ideal, it's expected to be better when previous situation where multiple processes were spawn with identical CPU affinity set. Reported by Charles Chen.
2012-09-26Version bump.Maxim Dounin2-3/+3
2012-09-12release-1.3.6 tagMaxim Dounin1-0/+1
2012-09-12nginx-1.3.6-RELEASErelease-1.3.6Maxim Dounin1-0/+56
2012-09-11Updated zlib used for win32 builds.Maxim Dounin1-1/+1
2012-09-11Helper target "win32" to run configure for win32 builds.Maxim Dounin1-0/+37
2012-09-11Configure: fixed make macros to use parentheses instead of braces.Maxim Dounin3-3/+3
Parentheses are more portable, in particular they are understood by nmake while braces aren't.
2012-09-11Improved 50x error page.Valentin Bartenev1-11/+14
The feature set of the new page: - HTML5 compliant; - Looks similar to the new "Welcome page" (r4835); - Sysadmin hint with a link to the documentation of the "error_log" directive.
2012-09-11Configure: provide inflate() when building zlib on win32.Maxim Dounin3-7/+12
It is now needed for gunzip filter.
2012-09-11Gunzip: removed nginx.h leftover include.Maxim Dounin1-1/+0
2012-09-10Gunzip filter import.Maxim Dounin4-0/+692
2012-09-10Gzip static: "always" parameter in "gzip_static" directive.Maxim Dounin1-10/+32
With "always" gzip static returns gzipped content in all cases, without checking if client supports it. It is useful if there are no uncompressed files on disk anyway.
2012-09-10Memcached: memcached_gzip_flag directive.Maxim Dounin1-8/+56
This directive allows to test desired flag as returned by memcached and sets Content-Encoding to gzip if one found. This is reimplementation of patch by Tomash Brechko as available on http://openhack.ru/. It should be a bit more correct though (at least I think so). In particular, it doesn't try to detect if we are able to gunzip data, but instead just sets correct Content-Encoding.
2012-09-07Improved welcome page.Valentin Bartenev1-2/+19
The feature set of the new page: - HTML5 compliant; - Description of why the user is seeing the page and what his next step should be; - Links to official community and commercial support websites.
2012-09-05Write filter: replaced unneeded loop with one to free chains.Maxim Dounin1-11/+7
Noted by Gabor Lekeny.
2012-09-03Limit req: fix of rbtree node insertion on hash collisions.Valentin Bartenev1-4/+4
The rbtree used in ngx_http_limit_req_module has two level of keys, the top is hash, and the next is the value string itself. However, when inserting a new node, only hash has been set, while the value string has been left empty. The bug was introduced in r4419 (1.1.14). Found by Charles Chen.
2012-08-30Pass changes.xml thru xmllint when generating CHANGES and CHANGES.ru.Ruslan Ermilov3-9/+9
2012-08-30Converted DOS-style newlines.Ruslan Ermilov1-29/+29
generated by cgit (git 2.34.1) at 2025-12-06 10:13:26 +0000