summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-07-27FastCGI: fixed zero size buf alerts on extra data (ticket #2018).Maxim Dounin1-6/+22
After 05e42236e95b (1.19.1) responses with extra data might result in zero size buffers being generated and "zero size buf" alerts in writer (if f->rest happened to be 0 when processing additional stdout data).
2020-07-22Xslt: disabled ranges.Roman Arutyunyan1-0/+1
Previously, the document generated by the xslt filter was always fully sent to client even if a range was requested and response status was 206 with appropriate Content-Range. The xslt module is unable to serve a range because of suspending the header filter chain. By the moment full response xml is buffered by the xslt filter, range header filter is not called yet, but the range body filter has already been called and did nothing. The fix is to disable ranges by resetting the r->allow_ranges flag much like the image filter that employs a similar technique.
2020-07-09Slice filter: clear original Accept-Ranges.Roman Arutyunyan1-0/+5
The slice filter allows ranges for the response by setting the r->allow_ranges flag, which enables the range filter. If the range was not requested, the range filter adds an Accept-Ranges header to the response to signal the support for ranges. Previously, if an Accept-Ranges header was already present in the first slice response, client received two copies of this header. Now, the slice filter removes the Accept-Ranges header from the response prior to setting the r->allow_ranges flag.
2020-07-06gRPC: generate error when response size is wrong.Maxim Dounin1-1/+38
As long as the "Content-Length" header is given, we now make sure it exactly matches the size of the response. If it doesn't, the response is considered malformed and must not be forwarded (https://tools.ietf.org/html/rfc7540#section-8.1.2.6). While it is not really possible to "not forward" the response which is already being forwarded, we generate an error instead, which is the closest equivalent. Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Also this directly contradicts HTTP/2 specification requirements. Note that the new behaviour for the gRPC proxy is more strict than that applied in other variants of proxying. This is intentional, as HTTP/2 specification requires us to do so, while in other types of proxying malformed responses from backends are well known and historically tolerated.
2020-07-06FastCGI: protection from responses with wrong length.Maxim Dounin1-14/+106
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients. Additionally, we now also issue a warning if the response is too short, and make sure the fact it is truncated is propagated to the client. The u->error flag is introduced to make it possible to propagate the error to the client in case of unbuffered proxying. For responses to HEAD requests there is an exception: we do allow both responses without body and responses with body matching the Content-Length header.
2020-07-06Upstream: drop extra data sent by upstream.Maxim Dounin2-0/+72
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients. This change covers generic buffered and unbuffered filters as used in the scgi and uwsgi modules. Appropriate input filter init handlers are provided by the scgi and uwsgi modules to set corresponding lengths. Note that for responses to HEAD requests there is an exception: we do allow any response length. This is because responses to HEAD requests might be actual full responses, and it is up to nginx to remove the response body. If caching is enabled, only full responses matching the Content-Length header will be cached (see b779728b180c).
2020-07-06Proxy: style.Maxim Dounin1-2/+2
2020-07-06Proxy: detection of data after final chunk.Maxim Dounin1-1/+30
Previously, additional data after final chunk was either ignored (in the same buffer, or during unbuffered proxying) or sent to the client (in the next buffer already if it was already read from the socket). Now additional data are properly detected and ignored in all cases. Additionally, a warning is now logged and keepalive is disabled in the connection.
2020-07-06Proxy: drop extra data sent by upstream.Maxim Dounin1-9/+43
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients.
2020-07-06Memcached: protect from too long responses.Maxim Dounin1-3/+6
If a memcached response was followed by a correct trailer, and then the NUL character followed by some extra data - this was accepted by the trailer checking code. This in turn resulted in ctx->rest underflow and caused negative size buffer on the next reading from the upstream, followed by the "negative size buf in writer" alert. Fix is to always check for too long responses, so a correct trailer cannot be followed by extra data.
2020-06-15Correctly flush request body to uwsgi with SSL.Quantum1-0/+1
The flush flag was not set when forwarding the request body to the uwsgi server. When using uwsgi_pass suwsgi://..., this causes the uwsgi server to wait indefinitely for the request body and eventually time out due to SSL buffering. This is essentially the same change as 4009:3183165283cc, which was made to ngx_http_proxy_module.c. This will fix the uwsgi bug https://github.com/unbit/uwsgi/issues/1490.
2020-05-22OCSP: certificate status cache.Roman Arutyunyan2-1/+94
When enabled, certificate status is stored in cache and is used to validate the certificate in future requests. New directive ssl_ocsp_cache is added to configure the cache.
2020-05-22SSL: client certificate validation with OCSP (ticket #1534).Roman Arutyunyan2-5/+62
OCSP validation for client certificates is enabled by the "ssl_ocsp" directive. OCSP responder can be optionally specified by "ssl_ocsp_responder". When session is reused, peer chain is not available for validation. If the verified chain contains certificates from the peer chain not available at the server, validation will fail.
2020-04-23gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov1-1/+2
As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
2020-04-23gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov1-5/+19
As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
2020-03-13Auth basic: explicitly zero out password buffer.Ruslan Ermilov1-19/+18
2020-02-26Mp4: fixed possible chunk offset overflow.Roman Arutyunyan1-11/+64
In "co64" atom chunk start offset is a 64-bit unsigned integer. When trimming the "mdat" atom, chunk offsets are casted to off_t values which are typically 64-bit signed integers. A specially crafted mp4 file with huge chunk offsets may lead to off_t overflow and result in negative trim boundaries. The consequences of the overflow are: - Incorrect Content-Length header value in the response. - Negative left boundary of the response file buffer holding the trimmed "mdat". This leads to pread()/sendfile() errors followed by closing the client connection. On rare systems where off_t is a 32-bit integer, this scenario is also feasible with the "stco" atom. The fix is to add checks which make sure data chunks referenced by each track are within the mp4 file boundaries. Additionally a few more checks are added to ensure mp4 file consistency and log errors.
2020-01-17gRPC: variables support in the "grpc_pass" directive.Vladimir Homutov1-38/+190
2019-12-23Dav: added checks for chunked to body presence conditions.Maxim Dounin1-3/+5
These checks were missed when chunked support was introduced. And also added an explicit error message to ngx_http_dav_copy_move_handler() (it was missed for some reason, in contrast to DELETE and MKCOL handlers).
2019-12-16Rewrite: disallow empty replacements.Ruslan Ermilov1-0/+5
While empty replacements were caught at run-time, parsing code of the "rewrite" directive expects that a minimum length of the "replacement" argument is 1.
2019-12-16Fixed request finalization in ngx_http_index_handler().Ruslan Ermilov1-1/+1
Returning 500 instead of NGX_ERROR is preferable here because header has not yet been sent to the client.
2019-12-16Saved some memory allocations.Ruslan Ermilov2-28/+7
In configurations when "root" has variables, some modules unnecessarily allocated memory for the "Location" header value.
2019-12-16Dav: fixed Location in successful MKCOL response.Ruslan Ermilov1-1/+2
Instead of reducing URI length to not include the terminating '\0' character in 6ddaac3e0bf7, restore the terminating '/' character.
2019-12-05Upstream keepalive: clearing of c->data in cached connections.Maxim Dounin1-0/+1
Previously, connections returned from keepalive cache had c->data pointing to the keepalive cache item. While this shouldn't be a problem for correct code, as c->data is not expected to be used before it is set, explicitly clearing it might help to avoid confusion.
2019-11-18Limit conn: added shared context.Roman Arutyunyan1-47/+43
Previously only an rbtree was associated with a limit_conn. To make it possible to associate more data with a limit_conn, shared context is introduced similar to limit_req. Also, shared pool pointer is kept in a way similar to limit_req.
2019-11-18Limit conn: $limit_conn_status variable.Roman Arutyunyan1-3/+73
The variable takes one of the values: PASSED, REJECTED or REJECTED_DRY_RUN.
2019-11-19Limit conn: limit_conn_dry_run directive.Roman Arutyunyan1-1/+23
A new directive limit_conn_dry_run allows enabling the dry run mode. In this mode connections are not rejected, but reject status is logged as usual.
2019-11-06Limit req: $limit_req_status variable.Roman Arutyunyan1-4/+75
The variable takes one of the values: PASSED, DELAYED, REJECTED, DELAYED_DRY_RUN or REJECTED_DRY_RUN.
2019-10-21Core: moved PROXY protocol fields out of ngx_connection_t.Roman Arutyunyan1-4/+3
Now a new structure ngx_proxy_protocol_t holds these fields. This allows to add more PROXY protocol fields in the future without modifying the connection structure.
2019-09-16SSL: fixed ssl_verify_client error message.Sergey Kandaurov1-1/+1
2019-07-31Gzip: fixed "zero size buf" alerts after ac5a741d39cf.Maxim Dounin1-4/+11
After ac5a741d39cf it is now possible that after zstream.avail_out reaches 0 and we allocate additional buffer, there will be no more data to put into this buffer, triggering "zero size buf" alert. Fix is to reset b->temporary flag in this case. Additionally, an optimization added to avoid allocating additional buffer in this case, by checking if last deflate() call returned Z_STREAM_END. Note that checking for Z_STREAM_END by itself is not enough to fix alerts, as deflate() can return Z_STREAM_END without producing any output if the buffer is smaller than gzip trailer. Reported by Witold Filipczyk, http://mailman.nginx.org/pipermail/nginx-devel/2019-July/012469.html.
2019-07-18Xslt: fixed potential buffer overflow with null character.Maxim Dounin1-4/+2
Due to shortcomings of the ccv->zero flag implementation in complex value interface, length of the resulting string from ngx_http_complex_value() might either not include terminating null character or include it, so the only safe way to work with the result is to use it as a null-terminated string. Reported by Patrick Wollgast.
2019-07-18SSI: avoid potential buffer overflow.Maxim Dounin1-2/+2
When "-" follows a parameter of maximum length, a single byte buffer overflow happens, since the error branch does not check parameter length. Fix is to avoid saving "-" to the parameter key, and instead use an error message with "-" explicitly written. The message is mostly identical to one used in similar cases in the preequal state. Reported by Patrick Wollgast.
2019-07-17Perl: removed unused variable, forgotten in 975d7ab37b39.Maxim Dounin1-1/+0
2019-07-12Gzip: use zlib to write header and trailer.Ilya Leoshkevich1-117/+7
When nginx is used with zlib patched with [1], which provides integration with the future IBM Z hardware deflate acceleration, it ends up computing CRC32 twice: one time in hardware, which always does this, and one time in software by explicitly calling crc32(). crc32() calls were added in changesets 133:b27548f540ad ("nginx-0.0.1- 2003-09-24-23:51:12 import") and 134:d57c6835225c ("nginx-0.0.1- 2003-09-26-09:45:21 import") as part of gzip wrapping feature - back then zlib did not support it. However, since then gzip wrapping was implemented in zlib v1.2.0.4, and it's already being used by nginx for log compression. This patch replaces hand-written gzip wrapping with the one provided by zlib. It simplifies the code, and makes it avoid computing CRC32 twice when using hardware acceleration. [1] https://github.com/madler/zlib/pull/410
2019-07-12Perl: named locations in $r->internal_redirect().Maxim Dounin1-6/+12
2019-07-12Perl: expect escaped URIs in $r->internal_redirect().Maxim Dounin3-13/+9
Similarly to the change in 5491:74bfa803a5aa (1.5.9), we should accept properly escaped URIs and unescape them as needed, else it is not possible to handle URIs with question marks.
2019-07-12Perl: additional ctx->header_sent checks.Maxim Dounin2-0/+25
As we now have ctx->header_sent flag, it is further used to prevent duplicate $r->send_http_header() calls, prevent output before sending header, and $r->internal_redirect() after sending header. Further, $r->send_http_header() protected from calls after $r->internal_redirect().
2019-07-12Perl: avoid returning 500 if header was already sent.Maxim Dounin3-0/+7
Returning NGX_HTTP_INTERNAL_SERVER_ERROR if a perl code died after sending header will lead to a "header already sent" alert. To avoid it, we now check if header was already sent, and return NGX_ERROR instead if it was.
2019-07-12Perl: avoid redirects on errors.Maxim Dounin1-0/+2
Previously, redirects scheduled with $r->internal_redirect() were followed even if the code then died. Now these are ignored and nginx will return an error instead.
2019-07-12Perl: disabled unrelated calls from variable handlers.Maxim Dounin3-0/+50
Variable handlers are not expected to send anything to the client, cannot sleep or read body, and are not expected to modify the request. Added appropriate protection to prevent accidental foot shooting.
2019-07-12Perl: protection against duplicate $r->sleep() calls.Maxim Dounin1-0/+8
Duplicate $r->sleep() and/or $r->has_request_body() calls result in undefined behaviour (in practice, connection leaks were observed). To prevent this, croak() added in appropriate places.
2019-07-12Perl: handling of allocation errors.Maxim Dounin1-25/+51
Previously, allocation errors in nginx.xs were more or less ignored, potentially resulting in incorrect code execution in specific low-memory conditions. This is changed to use ctx->error bit and croak(), similarly to how output errors are now handled. Note that this is mostly a cosmetic change, as Perl itself exits on memory allocation errors, and hence nginx with Perl is hardly usable in low-memory conditions.
2019-07-12Perl: propagate errors.Maxim Dounin3-7/+90
When an error happens, the ctx->error bit is now set, and croak() is called to terminate further processing. The ctx->error bit is checked in ngx_http_perl_call_handler() to cancel further processing, and is also checked in various output functions - to make sure these won't be called if croak() was handled by an eval{} in perl code. In particular, this ensures that output chain won't be called after errors, as filters might not expect this to happen. This fixes some segmentation faults under low memory conditions. Also this stops request processing after filter finalization or request body reading errors. For cases where an HTTP error status can be additionally returned (for example, 416 (Requested Range Not Satisfiable) from the range filter), the ctx->status field is also added.
2019-07-12Perl: reworked perl module to pass ctx instead of request.Maxim Dounin3-94/+114
This ensures that correct ctx is always available, including after filter finalization. In particular, this fixes a segmentation fault with the following configuration: location / { image_filter test; perl 'sub { my $r = shift; $r->send_http_header(); $r->print("foo\n"); $r->print("bar\n"); }'; } This also seems to be the only way to correctly handle filter finalization in various complex cases, for example, when embedded perl is used both in the original handler and in an error page called after filter finalization.
2019-07-11Perl: removed unneeded NGX_DONE test.Maxim Dounin1-5/+0
The NGX_DONE test in ngx_http_perl_handle_request() was introduced in 1702:86bb52e28ce0, which also modified ngx_http_perl_call_handler() to return NGX_DONE with c->destroyed. The latter part was then removed in 3050:f54b02dbb12b, so NGX_DONE test is no longer needed.
2019-06-17Perl: disabled not_modified filter (ticket #1786).Maxim Dounin1-0/+2
Embedded perl does not set any request fields needed for conditional requests processing. Further, filter finalization in the not_modified filter can cause segmentation faults due to cleared ctx as in ticket #1786. Before 5fb1e57c758a (1.7.3) the not_modified filter was implicitly disabled for perl responses, as r->headers_out.last_modified_time was -1. This change restores this behaviour by using the explicit r->disable_not_modified flag. Note that this patch doesn't try to address perl module robustness against filter finalization and other errors returned from filter chains. It should be eventually reworked to handle errors instead of ignoring them.
2019-06-05Limit req: limit_req_dry_run directive.Roman Arutyunyan1-4/+25
A new directive limit_req_dry_run allows enabling the dry run mode. In this mode requests are neither rejected nor delayed, but reject/delay status is logged as usual.
2019-05-23Upstream hash: fall back to round-robin if hash key is empty.Niklas Keller1-2/+2
2019-05-13Range filter: fixed duplicate last buffers.Maxim Dounin1-4/+4
In ngx_http_range_singlepart_body() special buffers where passed unmodified, including ones after the end of the range. As such, if the last buffer of a response was sent separately as a special buffer, two buffers with b->last_buf set were present in the response. In particular, this might result in a duplicate final chunk when using chunked transfer encoding (normally range filter and chunked transfer encoding are not used together, but this may happen if there are trailers in the response). This also likely to cause problems in HTTP/2. Fix is to skip all special buffers after we've sent the last part of the range requested. These special buffers are not meaningful anyway, since we set b->last_buf in the buffer with the last part of the range, and everything is expected to be flushed due to it. Additionally, ngx_http_next_body_filter() is now called even if no buffers are to be passed to it. This ensures that various write events are properly propagated through the filter chain. In particular, this fixes test failures observed with the above change and aio enabled.
generated by cgit (git 2.34.1) at 2025-12-06 17:39:37 +0000