summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2014-11-17SSL: logging level of "inappropriate fallback" (ticket #662).Maxim Dounin1-0/+3
Patch by Erik Dubbelboer.
2014-08-13Events: introduced cancelable timers.Valentin Bartenev3-0/+45
2014-08-25Events: simplified cycle in ngx_event_expire_timers().Valentin Bartenev1-18/+16
2014-08-25Events: removed broken thread support from event timers.Valentin Bartenev2-46/+3
It's mostly dead code. And the idea of thread support for this task has been deprecated.
2014-10-24SSL: simplified ssl_password_file error handling.Sergey Kandaurov1-14/+3
Instead of collecting a number of the possible SSL_CTX_use_PrivateKey_file() error codes that becomes more and more difficult with the rising variety of OpenSSL versions and its derivatives, just continue with the next password. Multiple passwords in a single ssl_password_file feature was broken after recent OpenSSL changes (commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e). Affected OpenSSL releases: 0.9.8zc, 1.0.0o, 1.0.1j and 1.0.2-beta3. Reported by Piotr Sikora.
2014-10-28Upstream: proxy_limit_rate and friends.Roman Arutyunyan2-5/+39
The directives limit the upstream read rate. For example, "proxy_limit_rate 42" limits proxy upstream read rate to 42 bytes per second.
2014-10-28Core: added limit to recv_chain().Roman Arutyunyan3-5/+16
2014-10-11Win32: fixed wrong type cast.Kouhei Sutou1-1/+1
GetQueuedCompletionStatus() document on MSDN says the following signature: http://msdn.microsoft.com/en-us/library/windows/desktop/aa364986.aspx BOOL WINAPI GetQueuedCompletionStatus( _In_ HANDLE CompletionPort, _Out_ LPDWORD lpNumberOfBytes, _Out_ PULONG_PTR lpCompletionKey, _Out_ LPOVERLAPPED *lpOverlapped, _In_ DWORD dwMilliseconds ); In the latest specification, the type of the third argument (lpCompletionKey) is PULONG_PTR not LPDWORD.
2014-09-15SSL: session id context now includes certificate hash.Maxim Dounin1-2/+96
This prevents inappropriate session reuse in unrelated server{} blocks, while preserving ability to restore sessions on other servers when using TLS Session Tickets. Additionally, session context is now set even if there is no session cache configured. This is needed as it's also used for TLS Session Tickets. Thanks to Antoine Delignat-Lavaud and Piotr Sikora.
2014-09-12Upstream: limited next_upstream time and tries (ticket #544).Roman Arutyunyan1-0/+1
The new directives {proxy,fastcgi,scgi,uwsgi,memcached}_next_upstream_tries and {proxy,fastcgi,scgi,uwsgi,memcached}_next_upstream_timeout limit the number of upstreams tried and the maximum time spent for these tries when searching for a valid upstream.
2014-09-03SSL: guard use of all SSL options for bug workarounds.Piotr Sikora1-0/+17
Some of the OpenSSL forks (read: BoringSSL) started removing unused, no longer necessary and/or not really working bug workarounds along with the SSL options and defines for them. Instead of fixing nginx build after each removal, be proactive and guard use of all SSL options for bug workarounds. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-09-01Events: processing of posted events changed from LIFO to FIFO.Valentin Bartenev12-49/+44
In theory, this can provide a bit better distribution of latencies. Also it simplifies the code, since ngx_queue_t is now used instead of custom implementation.
2014-09-01Events: removed broken thread support from posted events.Valentin Bartenev16-411/+59
It's mostly dead code. And the idea of thread support for this task has been deprecated.
2014-08-10Events: removed unused variable in ngx_poll_process_events().Maxim Dounin1-4/+1
2014-08-07Events: format specifier fixes.Yves Crespin2-6/+6
2014-08-07Events: changed nevents type to unsigned in poll module.Yves Crespin1-6/+6
2014-07-30SSL: let it build against LibreSSL.Piotr Sikora1-3/+3
LibreSSL developers decided that LibreSSL is OpenSSL-2.0.0, so tests for OpenSSL-1.0.2+ are now passing, even though the library doesn't provide functions that are expected from that version of OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-30SSL: let it build against BoringSSL.Piotr Sikora1-0/+10
This change adds support for using BoringSSL as a drop-in replacement for OpenSSL without adding support for any of the BoringSSL-specific features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: fix build with OPENSSL_NO_ENGINE and/or OPENSSL_NO_OCSP.Piotr Sikora3-1/+15
This is really just a prerequisite for building against BoringSSL, which doesn't provide either of those features. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-28SSL: misplaced space in debug message.Maxim Dounin1-1/+1
2014-07-09SSL: fix build with recent OpenSSL.Piotr Sikora1-4/+4
X509_check_host() prototype changed recently: - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ced3d91 - http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=297c67f Bump version requirement, so that OpenSSL-1.0.2-beta1 uses fallback code. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-08Style: use ngx_memcpy() instead of memcpy().Piotr Sikora1-1/+1
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: stop accessing SSL_SESSION's fields directly.Piotr Sikora1-14/+42
SSL_SESSION struct is internal part of the OpenSSL library and it's fields should be accessed via API (when exposed), not directly. The unfortunate side-effect of this change is that we're losing reference count that used to be printed at the debug log level, but this seems to be an acceptable trade-off. Almost fixes build with -DOPENSSL_NO_SSL_INTERN. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-09SSL: fixed build with OPENSSL_NO_DEPRECATED defined.Maxim Dounin1-0/+4
The RSA_generate_key() is marked as deprecated and causes build to fail. On the other hand, replacement function, RSA_generate_key_ex(), requires much more code. Since RSA_generate_key() is only needed for barely usable EXP ciphers, the #ifdef was added instead. Prodded by Piotr Sikora.
2014-07-06SSL: return temporary RSA key only when the key length matches.Piotr Sikora1-4/+6
This change is mostly cosmetic, because in practice this callback is used only for 512-bit RSA keys. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-06SSL: include correct OpenSSL headers.Piotr Sikora1-0/+7
Previously, <bn.h>, <dh.h>, <rand.h> and <rsa.h> were pulled in by <engine.h> using OpenSSL's deprecated interface, which meant that nginx couldn't have been built with -DOPENSSL_NO_DEPRECATED. Both <x509.h> and <x509v3.h> are pulled in by <ocsp.h>, but we're calling X509 functions directly, so let's include those as well. <crypto.h> is pulled in by virtually everything, but we're calling CRYPTO_add() directly, so let's include it as well. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2014-07-04SSL: logging level of "peer closed connection in SSL handshake".Maxim Dounin1-2/+2
Previously, the NGX_LOG_INFO level was used unconditionally. This is correct for client SSL connections, but too low for connections to upstream servers. To resolve this, ngx_connection_error() now used to log this error, it will select logging level appropriately. With this change, if an upstream connection is closed during SSL handshake, it is now properly logged at "error" level.
2014-07-04Upstream: p->downstream_error instead of closing connection.Maxim Dounin1-10/+5
Previously, nginx closed client connection in cases when a response body from upstream was needed to be cached or stored but shouldn't be sent to the client. While this is normal for HTTP, it is unacceptable for SPDY. Fix is to use instead the p->downstream_error flag to prevent nginx from sending anything downstream. To make this work, the event pipe code was modified to properly cache empty responses with the flag set.
2014-06-16SSL: the "ssl_password_file" directive.Valentin Bartenev2-9/+217
2014-05-23Events: use eventfd() instead of syscall(SYS_eventfd) if possible.Ruslan Ermilov1-4/+4
This fixes --with-file-aio support on systems that lack eventfd() syscall, notably aarch64 Linux. The syscall(SYS_eventfd) may still be necessary on systems that have eventfd() syscall in the kernel but lack it in glibc, e.g. as seen in the current CentOS 5 release.
2014-05-22Core: output client port number when logging accept event.Ruslan Ermilov1-3/+11
2014-05-20SSL: $ssl_client_fingerprint variable.Sergey Budnevitch2-0/+36
2014-04-29OCSP stapling: missing OCSP request free call.Filipe da Silva1-0/+2
2014-04-23SSL: explicit handling of empty names.Maxim Dounin1-0/+4
X509_check_host() can't handle non null-terminated names with zero length, so make sure to fail before calling it.
2014-04-22SSL: added explicit check for ngx_strlchr() result.Maxim Dounin1-0/+5
2014-04-18Upstream: proxy_ssl_verify and friends.Maxim Dounin2-0/+166
2014-04-18SSL: $ssl_server_name variable.Maxim Dounin2-0/+24
2014-04-18SSL: fixed misuse of NGX_LOG_DEBUG_HTTP.Maxim Dounin1-3/+3
2014-04-07Win32: fixed shared ssl_session_cache (ticket #528).Maxim Dounin1-3/+3
In a worker process shm_zone->data was set to NULL instead of a proper value extracted from shared memory.
2014-03-31Core: slab log_nomem flag.Maxim Dounin1-1/+3
The flag allows to suppress "ngx_slab_alloc() failed: no memory" messages from a slab allocator, e.g., if an LRU expiration is used by a consumer and allocation failures aren't fatal. The flag is now used in the SSL session cache code, and in the limit_req module.
2014-03-06Fixed format specifier in logging of "c->number".Sergey Kandaurov2-2/+2
2014-02-11SSL: the $ssl_session_reused variable.Maxim Dounin2-0/+16
2014-01-23SSL: fixed $ssl_session_id possible segfault after 97e3769637a7.Maxim Dounin1-0/+4
Even during execution of a request it is possible that there will be no session available, notably in case of renegotiation. As a result logging of $ssl_session_id in some cases caused NULL pointer dereference after revision 97e3769637a7 (1.5.9). The check added returns an empty string if there is no session available.
2014-01-22SSL: fixed $ssl_session_id variable.Maxim Dounin1-13/+3
Previously, it used to contain full session serialized instead of just a session id, making it almost impossible to use the variable in a safe way. Thanks to Ivan Ristić.
2013-12-20SSL: ssl_buffer_size directive.Maxim Dounin2-3/+8
2013-12-09Resolver: implemented IPv6 name to address resolving.Ruslan Ermilov1-1/+0
2013-12-06Changed resolver API to use ngx_addr_t.Ruslan Ermilov1-22/+34
2013-12-11Use ngx_chain_get_free_buf() in pipe input filters.Valentin Bartenev1-19/+5
No functional changes.
2013-12-09Core: keep the length of the local sockaddr.Ruslan Ermilov2-2/+2
2013-11-29SSL: fixed c->read->ready handling in ngx_ssl_recv().Maxim Dounin1-0/+5
If c->read->ready was reset, but later some data were read from a socket buffer due to a call to ngx_ssl_recv(), the c->read->ready flag should be restored if not all data were read from OpenSSL buffers (as kernel won't notify us about the data anymore). More details are available here: http://mailman.nginx.org/pipermail/nginx/2013-November/041178.html
generated by cgit (git 2.34.1) at 2026-01-08 16:36:14 +0000