summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2014-09-15SSL: session id context now includes certificate hash.Maxim Dounin1-2/+96
This prevents inappropriate session reuse in unrelated server{} blocks, while preserving ability to restore sessions on other servers when using TLS Session Tickets. Additionally, session context is now set even if there is no session cache configured. This is needed as it's also used for TLS Session Tickets. Thanks to Antoine Delignat-Lavaud and Piotr Sikora.
2014-09-12Upstream: limited next_upstream time and tries (ticket #544).Roman Arutyunyan1-0/+1
The new directives {proxy,fastcgi,scgi,uwsgi,memcached}_next_upstream_tries and {proxy,fastcgi,scgi,uwsgi,memcached}_next_upstream_timeout limit the number of upstreams tried and the maximum time spent for these tries when searching for a valid upstream.
2014-09-03SSL: guard use of all SSL options for bug workarounds.Piotr Sikora1-0/+17
Some of the OpenSSL forks (read: BoringSSL) started removing unused, no longer necessary and/or not really working bug workarounds along with the SSL options and defines for them. Instead of fixing nginx build after each removal, be proactive and guard use of all SSL options for bug workarounds. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-09-01Events: processing of posted events changed from LIFO to FIFO.Valentin Bartenev12-49/+44
In theory, this can provide a bit better distribution of latencies. Also it simplifies the code, since ngx_queue_t is now used instead of custom implementation.
2014-09-01Events: removed broken thread support from posted events.Valentin Bartenev16-411/+59
It's mostly dead code. And the idea of thread support for this task has been deprecated.
2014-08-10Events: removed unused variable in ngx_poll_process_events().Maxim Dounin1-4/+1
2014-08-07Events: format specifier fixes.Yves Crespin2-6/+6
2014-08-07Events: changed nevents type to unsigned in poll module.Yves Crespin1-6/+6
2014-07-30SSL: let it build against LibreSSL.Piotr Sikora1-3/+3
LibreSSL developers decided that LibreSSL is OpenSSL-2.0.0, so tests for OpenSSL-1.0.2+ are now passing, even though the library doesn't provide functions that are expected from that version of OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-30SSL: let it build against BoringSSL.Piotr Sikora1-0/+10
This change adds support for using BoringSSL as a drop-in replacement for OpenSSL without adding support for any of the BoringSSL-specific features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.Piotr Sikora3-1/+15
This is really just a prerequisite for building against BoringSSL, which doesn't provide either of those features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: misplaced space in debug message.Maxim Dounin1-1/+1
2014-07-09SSL: fix build with recent OpenSSL.Piotr Sikora1-4/+4
X509_check_host() prototype changed recently: - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ced3d91 - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=297c67f Bump version requirement, so that OpenSSL-1.0.2-beta1 uses fallback code. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-08Style: use ngx_memcpy() instead of memcpy().Piotr Sikora1-1/+1
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: stop accessing SSL_SESSION's fields directly.Piotr Sikora1-14/+42
SSL_SESSION struct is internal part of the OpenSSL library and it's fields should be accessed via API (when exposed), not directly. The unfortunate side-effect of this change is that we're losing reference count that used to be printed at the debug log level, but this seems to be an acceptable trade-off. Almost fixes build with -DOPENSSL_NO_SSL_INTERN. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-09SSL: fixed build with OPENSSL_NO_DEPRECATED defined.Maxim Dounin1-0/+4
The RSA_generate_key() is marked as deprecated and causes build to fail. On the other hand, replacement function, RSA_generate_key_ex(), requires much more code. Since RSA_generate_key() is only needed for barely usable EXP ciphers, the #ifdef was added instead. Prodded by Piotr Sikora.
2014-07-06SSL: return temporary RSA key only when the key length matches.Piotr Sikora1-4/+6
This change is mostly cosmetic, because in practice this callback is used only for 512-bit RSA keys. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: include correct OpenSSL headers.Piotr Sikora1-0/+7
Previously, <bn.h>, <dh.h>, <rand.h> and <rsa.h> were pulled in by <engine.h> using OpenSSL's deprecated interface, which meant that nginx couldn't have been built with -DOPENSSL_NO_DEPRECATED. Both <x509.h> and <x509v3.h> are pulled in by <ocsp.h>, but we're calling X509 functions directly, so let's include those as well. <crypto.h> is pulled in by virtually everything, but we're calling CRYPTO_add() directly, so let's include it as well. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-04SSL: logging level of "peer closed connection in SSL handshake".Maxim Dounin1-2/+2
Previously, the NGX_LOG_INFO level was used unconditionally. This is correct for client SSL connections, but too low for connections to upstream servers. To resolve this, ngx_connection_error() now used to log this error, it will select logging level appropriately. With this change, if an upstream connection is closed during SSL handshake, it is now properly logged at "error" level.
2014-07-04Upstream: p->downstream_error instead of closing connection.Maxim Dounin1-10/+5
Previously, nginx closed client connection in cases when a response body from upstream was needed to be cached or stored but shouldn't be sent to the client. While this is normal for HTTP, it is unacceptable for SPDY. Fix is to use instead the p->downstream_error flag to prevent nginx from sending anything downstream. To make this work, the event pipe code was modified to properly cache empty responses with the flag set.
2014-06-16SSL: the "ssl_password_file" directive.Valentin Bartenev2-9/+217
2014-05-23Events: use eventfd() instead of syscall(SYS_eventfd) if possible.Ruslan Ermilov1-4/+4
This fixes --with-file-aio support on systems that lack eventfd() syscall, notably aarch64 Linux. The syscall(SYS_eventfd) may still be necessary on systems that have eventfd() syscall in the kernel but lack it in glibc, e.g. as seen in the current CentOS 5 release.
2014-05-22Core: output client port number when logging accept event.Ruslan Ermilov1-3/+11
2014-05-20SSL: $ssl_client_fingerprint variable.Sergey Budnevitch2-0/+36
2014-04-29OCSP stapling: missing OCSP request free call.Filipe da Silva1-0/+2
2014-04-23SSL: explicit handling of empty names.Maxim Dounin1-0/+4
X509_check_host() can't handle non null-terminated names with zero length, so make sure to fail before calling it.
2014-04-22SSL: added explicit check for ngx_strlchr() result.Maxim Dounin1-0/+5
2014-04-18Upstream: proxy_ssl_verify and friends.Maxim Dounin2-0/+166
2014-04-18SSL: $ssl_server_name variable.Maxim Dounin2-0/+24
2014-04-18SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.Maxim Dounin1-3/+3
2014-04-07Win32: fixed shared ssl_session_cache (ticket #528).Maxim Dounin1-3/+3
In a worker process shm_zone->data was set to NULL instead of a proper value extracted from shared memory.
2014-03-31Core: slab log_nomem flag.Maxim Dounin1-1/+3
The flag allows to suppress "ngx_slab_alloc() failed: no memory" messages from a slab allocator, e.g., if an LRU expiration is used by a consumer and allocation failures aren't fatal. The flag is now used in the SSL session cache code, and in the limit_req module.
2014-03-06Fixed format specifier in logging of "c->number".Sergey Kandaurov2-2/+2
2014-02-11SSL: the $ssl_session_reused variable.Maxim Dounin2-0/+16
2014-01-23SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.Maxim Dounin1-0/+4
Even during execution of a request it is possible that there will be no session available, notably in case of renegotiation. As a result logging of $ssl_session_id in some cases caused NULL pointer dereference after revision 97e3769637a7 (1.5.9). The check added returns an empty string if there is no session available.
2014-01-22SSL: fixed $ssl_session_id variable.Maxim Dounin1-13/+3
Previously, it used to contain full session serialized instead of just a session id, making it almost impossible to use the variable in a safe way. Thanks to Ivan Ristić.
2013-12-20SSL: ssl_buffer_size directive.Maxim Dounin2-3/+8
2013-12-09Resolver: implemented IPv6 name to address resolving.Ruslan Ermilov1-1/+0
2013-12-06Changed resolver API to use ngx_addr_t.Ruslan Ermilov1-22/+34
2013-12-11Use ngx_chain_get_free_buf() in pipe input filters.Valentin Bartenev1-19/+5
No functional changes.
2013-12-09Core: keep the length of the local sockaddr.Ruslan Ermilov2-2/+2
2013-11-29SSL: fixed c->read->ready handling in ngx_ssl_recv().Maxim Dounin1-0/+5
If c->read->ready was reset, but later some data were read from a socket buffer due to a call to ngx_ssl_recv(), the c->read->ready flag should be restored if not all data were read from OpenSSL buffers (as kernel won't notify us about the data anymore). More details are available here: http://mailman.nginx.org/pipermail/nginx/2013-November/041178.html
2013-10-11SSL: added ability to set keys used for Session Tickets (RFC5077).Piotr Sikora2-0/+240
In order to support key rollover, ssl_session_ticket_key can be defined multiple times. The first key will be used to issue and resume Session Tickets, while the rest will be used only to resume them. ssl_session_ticket_key session_tickets/current.key; ssl_session_ticket_key session_tickets/prev-1h.key; ssl_session_ticket_key session_tickets/prev-2h.key; Please note that nginx supports Session Tickets even without explicit configuration of the keys and this feature should be only used in setups where SSL traffic is distributed across multiple nginx servers. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-10-14SSL: SSL_CTX_set_timeout() now always called.Maxim Dounin1-2/+2
The timeout set is used by OpenSSL as a hint for clients in TLS Session Tickets. Previous code resulted in a default timeout (5m) used for TLS Sessions Tickets if there was no session cache configured. Prodded by Piotr Sikora.
2013-10-14SSL: fixed build with OpenSSL 0.9.7.Maxim Dounin1-2/+2
SSL_get_rbio() and SSL_get_wbio() functions used to get non-const pointer in OpenSSL 0.9.7, hence an explicit cast added to drop const qualifier.
2013-10-02Unused macro and variable removed.Sergey Kandaurov1-1/+0
The macro NGX_HTTP_DAV_COPY_BLOCK is not used since 8101d9101ed8 (0.8.9). The variable ngx_accept_mutex_lock_file was never used.
2013-09-27SSL: adjust buffer used by OpenSSL during handshake (ticket #413).Maxim Dounin2-0/+27
2013-09-18SSL: fixed possible memory and file descriptor leak on HUP signal.Piotr Sikora1-0/+2
The problem appeared in 386a06a22c40 (1.3.7). Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-16SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.Piotr Sikora1-0/+2
This option had no effect since 0.9.7h / 0.9.8b and it was removed in recent OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-07-12Events: support for EPOLLRDHUP (ticket #320).Valentin Bartenev2-7/+20
Since Linux 2.6.17, epoll is able to report about peer half-closed connection using special EPOLLRDHUP flag on a read event.
generated by cgit (git 2.34.1) at 2026-01-05 22:13:02 +0000