summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2014-09-15SSL: session id context now includes certificate hash.Maxim Dounin1-2/+96
This prevents inappropriate session reuse in unrelated server{} blocks, while preserving ability to restore sessions on other servers when using TLS Session Tickets. Additionally, session context is now set even if there is no session cache configured. This is needed as it's also used for TLS Session Tickets. Thanks to Antoine Delignat-Lavaud and Piotr Sikora.
2014-04-07Win32: fixed shared ssl_session_cache (ticket #528).Maxim Dounin1-3/+3
In a worker process shm_zone->data was set to NULL instead of a proper value extracted from shared memory.
2014-03-31Core: slab log_nomem flag.Maxim Dounin1-1/+3
The flag allows to suppress "ngx_slab_alloc() failed: no memory" messages from a slab allocator, e.g., if an LRU expiration is used by a consumer and allocation failures aren't fatal. The flag is now used in the SSL session cache code, and in the limit_req module.
2014-03-06Fixed format specifier in logging of "c->number".Sergey Kandaurov2-2/+2
2014-02-11SSL: the $ssl_session_reused variable.Maxim Dounin2-0/+16
2014-01-23SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.Maxim Dounin1-0/+4
Even during execution of a request it is possible that there will be no session available, notably in case of renegotiation. As a result logging of $ssl_session_id in some cases caused NULL pointer dereference after revision 97e3769637a7 (1.5.9). The check added returns an empty string if there is no session available.
2014-01-22SSL: fixed $ssl_session_id variable.Maxim Dounin1-13/+3
Previously, it used to contain full session serialized instead of just a session id, making it almost impossible to use the variable in a safe way. Thanks to Ivan Ristić.
2013-12-20SSL: ssl_buffer_size directive.Maxim Dounin2-3/+8
2013-12-09Resolver: implemented IPv6 name to address resolving.Ruslan Ermilov1-1/+0
2013-12-06Changed resolver API to use ngx_addr_t.Ruslan Ermilov1-22/+34
2013-12-11Use ngx_chain_get_free_buf() in pipe input filters.Valentin Bartenev1-19/+5
No functional changes.
2013-12-09Core: keep the length of the local sockaddr.Ruslan Ermilov2-2/+2
2013-11-29SSL: fixed c->read->ready handling in ngx_ssl_recv().Maxim Dounin1-0/+5
If c->read->ready was reset, but later some data were read from a socket buffer due to a call to ngx_ssl_recv(), the c->read->ready flag should be restored if not all data were read from OpenSSL buffers (as kernel won't notify us about the data anymore). More details are available here: http://mailman.nginx.org/pipermail/nginx/2013-November/041178.html
2013-10-11SSL: added ability to set keys used for Session Tickets (RFC5077).Piotr Sikora2-0/+240
In order to support key rollover, ssl_session_ticket_key can be defined multiple times. The first key will be used to issue and resume Session Tickets, while the rest will be used only to resume them. ssl_session_ticket_key session_tickets/current.key; ssl_session_ticket_key session_tickets/prev-1h.key; ssl_session_ticket_key session_tickets/prev-2h.key; Please note that nginx supports Session Tickets even without explicit configuration of the keys and this feature should be only used in setups where SSL traffic is distributed across multiple nginx servers. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-10-14SSL: SSL_CTX_set_timeout() now always called.Maxim Dounin1-2/+2
The timeout set is used by OpenSSL as a hint for clients in TLS Session Tickets. Previous code resulted in a default timeout (5m) used for TLS Sessions Tickets if there was no session cache configured. Prodded by Piotr Sikora.
2013-10-14SSL: fixed build with OpenSSL 0.9.7.Maxim Dounin1-2/+2
SSL_get_rbio() and SSL_get_wbio() functions used to get non-const pointer in OpenSSL 0.9.7, hence an explicit cast added to drop const qualifier.
2013-10-02Unused macro and variable removed.Sergey Kandaurov1-1/+0
The macro NGX_HTTP_DAV_COPY_BLOCK is not used since 8101d9101ed8 (0.8.9). The variable ngx_accept_mutex_lock_file was never used.
2013-09-27SSL: adjust buffer used by OpenSSL during handshake (ticket #413).Maxim Dounin2-0/+27
2013-09-18SSL: fixed possible memory and file descriptor leak on HUP signal.Piotr Sikora1-0/+2
The problem appeared in 386a06a22c40 (1.3.7). Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-16SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.Piotr Sikora1-0/+2
This option had no effect since 0.9.7h / 0.9.8b and it was removed in recent OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-07-12Events: support for EPOLLRDHUP (ticket #320).Valentin Bartenev2-7/+20
Since Linux 2.6.17, epoll is able to report about peer half-closed connection using special EPOLLRDHUP flag on a read event.
2013-09-05Events: removed unused flags from the ngx_event_s structure.Valentin Bartenev1-4/+0
They are not used since 708f8bb772ec (pre 0.0.1).
2013-09-04SSL: clear error queue after SSL_CTX_load_verify_locations().Maxim Dounin1-0/+14
The SSL_CTX_load_verify_locations() may leave errors in the error queue while returning success (e.g. if there are duplicate certificates in the file specified), resulting in "ignoring stale global SSL error" alerts later at runtime.
2013-09-04Win32: MinGW GCC compatibility.Maxim Dounin6-8/+10
Several warnings silenced, notably (ngx_socket_t) -1 is now checked on socket operations instead of -1, as ngx_socket_t is unsigned on win32 and gcc complains on comparison. With this patch, it's now possible to compile nginx using mingw gcc, with options we normally compile on win32.
2013-09-04Win32: Borland C compatibility fixes.Maxim Dounin1-1/+1
Several false positive warnings silenced, notably W8012 "Comparing signed and unsigned" (due to u_short values promoted to int), and W8072 "Suspicious pointer arithmetic" (due to large type values added to pointers). With this patch, it's now again possible to compile nginx using bcc32, with options we normally compile on win32 minus ipv6 and ssl.
2013-09-02Added the NGX_EBADF define.Valentin Bartenev1-1/+1
2013-08-28Typo fixed.Maxim Dounin1-2/+2
2013-08-20Backed out f1a91825730a and 7094bd12c1ff.Maxim Dounin2-7/+7
While ngx_get_full_name() might have a bit more descriptive arguments, the ngx_conf_full_name() is generally easier to use when parsing configuration and limits exposure of cycle->prefix / cycle->conf_prefix details.
2013-08-20Format specifier fixes in error logging.Sergey Kandaurov1-2/+2
2013-08-06Replaced ngx_conf_full_name() with ngx_get_full_name().Valentin Bartenev2-7/+7
The ngx_get_full_name() function takes more readable arguments list.
2013-07-25Event pipe: fixed writing cache header to a temp file.Maxim Dounin1-7/+4
With previous code the p->temp_file->offset wasn't adjusted if a temp file was written by the code in ngx_event_pipe_write_to_downstream() after an EOF, resulting in cache not being used with empty scgi and uwsgi responses with Content-Length set to 0. Fix it to call ngx_event_pipe_write_chain_to_temp_file() there instead of calling ngx_write_chain_to_temp_file() directly.
2013-07-11Core: extended ngx_sock_ntop() with socklen parameter.Vladimir Homutov3-3/+6
On Linux, sockaddr length is required to process unix socket addresses properly due to unnamed sockets (which don't have sun_path set at all) and abstract namespace sockets.
2013-05-31Win32: accept_mutex now always disabled (ticket #362).Maxim Dounin1-0/+11
Use of accept mutex on win32 may result in a deadlock if there are multiple worker_processes configured and the mutex is grabbed by a process which can't accept connections.
2013-05-31OCSP stapling: fixed incorrect debug level.Ruslan Ermilov1-1/+1
2013-05-21Style: replace SSL *ssl with ngx_ssl_conn_t *ssl_conn.Piotr Sikora2-2/+4
No functional changes. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-21Style: remove unnecessary references to HTTP from non-HTTP modules.Piotr Sikora1-3/+3
No functional changes. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-16OCSP stapling: fix error logging of successful OCSP responses.Piotr Sikora1-3/+2
Due to a bad argument list, nginx worker would crash (SIGSEGV) while trying to log the fact that it received OCSP response with "revoked" or "unknown" certificate status. While there, fix similar (but non-crashing) error a few lines above. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-04-16Events: backout eventport changes (r5172) for now.Maxim Dounin1-8/+0
Evenport method needs more work. Changes in r5172, while being correct, introduce various new regressions with current code.
2013-04-12Events: fixed typos in two previous commits.Valentin Bartenev2-2/+2
2013-04-12Events: handle only active events in eventport.Valentin Bartenev1-0/+8
We generate both read and write events if an error event was returned by port_getn() without POLLIN/POLLOUT, but we should not try to handle inactive events, they may even have no handler.
2013-04-12Events: protection from stale events in eventport and devpoll.Valentin Bartenev2-2/+8
Stale write event may happen if read and write events was reported both, and processing of the read event closed descriptor. In practice this might result in "sendfilev() failed (134: ..." or "writev() failed (134: ..." errors when switching to next upstream server. See report here: http://mailman.nginx.org/pipermail/nginx/2013-April/038421.html
2013-03-27Event connect: don't penalize AF_INET6 connections.Maxim Dounin1-1/+1
Problems with setsockopt(TCP_NODELAY) and setsockopt(TCP_NOPUSH), as well as sendfile() syscall on Solaris, are specific to UNIX-domain sockets. Other address families, i.e. AF_INET and AF_INET6, are fine.
2013-03-15Status: introduced the "ngx_stat_waiting" counter.Valentin Bartenev2-1/+6
And corresponding variable $connections_waiting was added. Previously, waiting connections were counted as the difference between active connections and the sum of reading and writing connections. That made it impossible to count more than one request in one connection as reading or writing (as is the case for SPDY). Also, we no longer count connections in handshake state as waiting.
2013-02-23SSL: retry "sess_id" and "id" allocations.Maxim Dounin1-2/+22
In case of fully populated SSL session cache with no memory left for new allocations, ngx_ssl_new_session() will try to expire the oldest non-expired session and retry, but only in case when slab allocation fails for "cached_sess", not when slab allocation fails for either "sess_id" or "id", which can happen for number of reasons and results in new session not being cached. Patch fixes this by adding retry logic to "sess_id" & "id" allocations. Patch by Piotr Sikora.
2013-02-01SSL: fixed ngx_ssl_handshake() with level-triggered event methods.Maxim Dounin1-0/+8
Missing calls to ngx_handle_write_event() and ngx_handle_read_event() resulted in a CPU hog during SSL handshake if an level-triggered event method (e.g. select) was used.
2013-01-28SSL: take into account data in the buffer while limiting output.Valentin Bartenev1-1/+1
In some rare cases this can result in a more smooth sending rate.
2013-01-28SSL: avoid calling SSL_write() with zero data size.Valentin Bartenev1-0/+6
According to documentation, calling SSL_write() with num=0 bytes to be sent results in undefined behavior. We don't currently call ngx_ssl_send_chain() with empty chain and buffer. This check handles the case of a chain with total data size that is a multiple of NGX_SSL_BUFSIZE, and with the special buffer at the end. In practice such cases resulted in premature connection close and critical error "SSL_write() failed (SSL:)" in the error log.
2013-01-28SSL: calculation of buffer size moved closer to its usage.Valentin Bartenev1-2/+2
No functional changes.
2013-01-28SSL: preservation of flush flag for buffered data.Valentin Bartenev1-5/+5
Previously, if SSL buffer was not sent we lost information that the data must be flushed.
2013-01-28SSL: resetting of flush flag after the data was written.Valentin Bartenev1-0/+2
There is no need to flush next chunk of data if it does not contain a buffer with the flush or last_buf flags set.
generated by cgit (git 2.34.1) at 2026-01-07 14:46:15 +0000