summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2014-07-30SSL: let it build against LibreSSL.Piotr Sikora1-3/+3
LibreSSL developers decided that LibreSSL is OpenSSL-2.0.0, so tests for OpenSSL-1.0.2+ are now passing, even though the library doesn't provide functions that are expected from that version of OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-30SSL: let it build against BoringSSL.Piotr Sikora1-0/+10
This change adds support for using BoringSSL as a drop-in replacement for OpenSSL without adding support for any of the BoringSSL-specific features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.Piotr Sikora3-1/+15
This is really just a prerequisite for building against BoringSSL, which doesn't provide either of those features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: misplaced space in debug message.Maxim Dounin1-1/+1
2014-07-09SSL: fix build with recent OpenSSL.Piotr Sikora1-4/+4
X509_check_host() prototype changed recently: - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ced3d91 - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=297c67f Bump version requirement, so that OpenSSL-1.0.2-beta1 uses fallback code. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-08Style: use ngx_memcpy() instead of memcpy().Piotr Sikora1-1/+1
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: stop accessing SSL_SESSION's fields directly.Piotr Sikora1-14/+42
SSL_SESSION struct is internal part of the OpenSSL library and it's fields should be accessed via API (when exposed), not directly. The unfortunate side-effect of this change is that we're losing reference count that used to be printed at the debug log level, but this seems to be an acceptable trade-off. Almost fixes build with -DOPENSSL_NO_SSL_INTERN. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-09SSL: fixed build with OPENSSL_NO_DEPRECATED defined.Maxim Dounin1-0/+4
The RSA_generate_key() is marked as deprecated and causes build to fail. On the other hand, replacement function, RSA_generate_key_ex(), requires much more code. Since RSA_generate_key() is only needed for barely usable EXP ciphers, the #ifdef was added instead. Prodded by Piotr Sikora.
2014-07-06SSL: return temporary RSA key only when the key length matches.Piotr Sikora1-4/+6
This change is mostly cosmetic, because in practice this callback is used only for 512-bit RSA keys. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: include correct OpenSSL headers.Piotr Sikora1-0/+7
Previously, <bn.h>, <dh.h>, <rand.h> and <rsa.h> were pulled in by <engine.h> using OpenSSL's deprecated interface, which meant that nginx couldn't have been built with -DOPENSSL_NO_DEPRECATED. Both <x509.h> and <x509v3.h> are pulled in by <ocsp.h>, but we're calling X509 functions directly, so let's include those as well. <crypto.h> is pulled in by virtually everything, but we're calling CRYPTO_add() directly, so let's include it as well. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-04SSL: logging level of "peer closed connection in SSL handshake".Maxim Dounin1-2/+2
Previously, the NGX_LOG_INFO level was used unconditionally. This is correct for client SSL connections, but too low for connections to upstream servers. To resolve this, ngx_connection_error() now used to log this error, it will select logging level appropriately. With this change, if an upstream connection is closed during SSL handshake, it is now properly logged at "error" level.
2014-07-04Upstream: p->downstream_error instead of closing connection.Maxim Dounin1-10/+5
Previously, nginx closed client connection in cases when a response body from upstream was needed to be cached or stored but shouldn't be sent to the client. While this is normal for HTTP, it is unacceptable for SPDY. Fix is to use instead the p->downstream_error flag to prevent nginx from sending anything downstream. To make this work, the event pipe code was modified to properly cache empty responses with the flag set.
2014-06-16SSL: the "ssl_password_file" directive.Valentin Bartenev2-9/+217
2014-05-23Events: use eventfd() instead of syscall(SYS_eventfd) if possible.Ruslan Ermilov1-4/+4
This fixes --with-file-aio support on systems that lack eventfd() syscall, notably aarch64 Linux. The syscall(SYS_eventfd) may still be necessary on systems that have eventfd() syscall in the kernel but lack it in glibc, e.g. as seen in the current CentOS 5 release.
2014-05-22Core: output client port number when logging accept event.Ruslan Ermilov1-3/+11
2014-05-20SSL: $ssl_client_fingerprint variable.Sergey Budnevitch2-0/+36
2014-04-29OCSP stapling: missing OCSP request free call.Filipe da Silva1-0/+2
2014-04-23SSL: explicit handling of empty names.Maxim Dounin1-0/+4
X509_check_host() can't handle non null-terminated names with zero length, so make sure to fail before calling it.
2014-04-22SSL: added explicit check for ngx_strlchr() result.Maxim Dounin1-0/+5
2014-04-18Upstream: proxy_ssl_verify and friends.Maxim Dounin2-0/+166
2014-04-18SSL: $ssl_server_name variable.Maxim Dounin2-0/+24
2014-04-18SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.Maxim Dounin1-3/+3
2014-04-07Win32: fixed shared ssl_session_cache (ticket #528).Maxim Dounin1-3/+3
In a worker process shm_zone->data was set to NULL instead of a proper value extracted from shared memory.
2014-03-31Core: slab log_nomem flag.Maxim Dounin1-1/+3
The flag allows to suppress "ngx_slab_alloc() failed: no memory" messages from a slab allocator, e.g., if an LRU expiration is used by a consumer and allocation failures aren't fatal. The flag is now used in the SSL session cache code, and in the limit_req module.
2014-03-06Fixed format specifier in logging of "c->number".Sergey Kandaurov2-2/+2
2014-02-11SSL: the $ssl_session_reused variable.Maxim Dounin2-0/+16
2014-01-23SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.Maxim Dounin1-0/+4
Even during execution of a request it is possible that there will be no session available, notably in case of renegotiation. As a result logging of $ssl_session_id in some cases caused NULL pointer dereference after revision 97e3769637a7 (1.5.9). The check added returns an empty string if there is no session available.
2014-01-22SSL: fixed $ssl_session_id variable.Maxim Dounin1-13/+3
Previously, it used to contain full session serialized instead of just a session id, making it almost impossible to use the variable in a safe way. Thanks to Ivan Ristić.
2013-12-20SSL: ssl_buffer_size directive.Maxim Dounin2-3/+8
2013-12-09Resolver: implemented IPv6 name to address resolving.Ruslan Ermilov1-1/+0
2013-12-06Changed resolver API to use ngx_addr_t.Ruslan Ermilov1-22/+34
2013-12-11Use ngx_chain_get_free_buf() in pipe input filters.Valentin Bartenev1-19/+5
No functional changes.
2013-12-09Core: keep the length of the local sockaddr.Ruslan Ermilov2-2/+2
2013-11-29SSL: fixed c->read->ready handling in ngx_ssl_recv().Maxim Dounin1-0/+5
If c->read->ready was reset, but later some data were read from a socket buffer due to a call to ngx_ssl_recv(), the c->read->ready flag should be restored if not all data were read from OpenSSL buffers (as kernel won't notify us about the data anymore). More details are available here: http://mailman.nginx.org/pipermail/nginx/2013-November/041178.html
2013-10-11SSL: added ability to set keys used for Session Tickets (RFC5077).Piotr Sikora2-0/+240
In order to support key rollover, ssl_session_ticket_key can be defined multiple times. The first key will be used to issue and resume Session Tickets, while the rest will be used only to resume them. ssl_session_ticket_key session_tickets/current.key; ssl_session_ticket_key session_tickets/prev-1h.key; ssl_session_ticket_key session_tickets/prev-2h.key; Please note that nginx supports Session Tickets even without explicit configuration of the keys and this feature should be only used in setups where SSL traffic is distributed across multiple nginx servers. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-10-14SSL: SSL_CTX_set_timeout() now always called.Maxim Dounin1-2/+2
The timeout set is used by OpenSSL as a hint for clients in TLS Session Tickets. Previous code resulted in a default timeout (5m) used for TLS Sessions Tickets if there was no session cache configured. Prodded by Piotr Sikora.
2013-10-14SSL: fixed build with OpenSSL 0.9.7.Maxim Dounin1-2/+2
SSL_get_rbio() and SSL_get_wbio() functions used to get non-const pointer in OpenSSL 0.9.7, hence an explicit cast added to drop const qualifier.
2013-10-02Unused macro and variable removed.Sergey Kandaurov1-1/+0
The macro NGX_HTTP_DAV_COPY_BLOCK is not used since 8101d9101ed8 (0.8.9). The variable ngx_accept_mutex_lock_file was never used.
2013-09-27SSL: adjust buffer used by OpenSSL during handshake (ticket #413).Maxim Dounin2-0/+27
2013-09-18SSL: fixed possible memory and file descriptor leak on HUP signal.Piotr Sikora1-0/+2
The problem appeared in 386a06a22c40 (1.3.7). Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-16SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.Piotr Sikora1-0/+2
This option had no effect since 0.9.7h / 0.9.8b and it was removed in recent OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-07-12Events: support for EPOLLRDHUP (ticket #320).Valentin Bartenev2-7/+20
Since Linux 2.6.17, epoll is able to report about peer half-closed connection using special EPOLLRDHUP flag on a read event.
2013-09-05Events: removed unused flags from the ngx_event_s structure.Valentin Bartenev1-4/+0
They are not used since 708f8bb772ec (pre 0.0.1).
2013-09-04SSL: clear error queue after SSL_CTX_load_verify_locations().Maxim Dounin1-0/+14
The SSL_CTX_load_verify_locations() may leave errors in the error queue while returning success (e.g. if there are duplicate certificates in the file specified), resulting in "ignoring stale global SSL error" alerts later at runtime.
2013-09-04Win32: MinGW GCC compatibility.Maxim Dounin6-8/+10
Several warnings silenced, notably (ngx_socket_t) -1 is now checked on socket operations instead of -1, as ngx_socket_t is unsigned on win32 and gcc complains on comparison. With this patch, it's now possible to compile nginx using mingw gcc, with options we normally compile on win32.
2013-09-04Win32: Borland C compatibility fixes.Maxim Dounin1-1/+1
Several false positive warnings silenced, notably W8012 "Comparing signed and unsigned" (due to u_short values promoted to int), and W8072 "Suspicious pointer arithmetic" (due to large type values added to pointers). With this patch, it's now again possible to compile nginx using bcc32, with options we normally compile on win32 minus ipv6 and ssl.
2013-09-02Added the NGX_EBADF define.Valentin Bartenev1-1/+1
2013-08-28Typo fixed.Maxim Dounin1-2/+2
2013-08-20Backed out f1a91825730a and 7094bd12c1ff.Maxim Dounin2-7/+7
While ngx_get_full_name() might have a bit more descriptive arguments, the ngx_conf_full_name() is generally easier to use when parsing configuration and limits exposure of cycle->prefix / cycle->conf_prefix details.
2013-08-20Format specifier fixes in error logging.Sergey Kandaurov1-2/+2
generated by cgit (git 2.34.1) at 2026-01-29 11:21:42 +0000