summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2022-05-30Auth request: multiple WWW-Authenticate headers (ticket #485).Maxim Dounin1-3/+8
When using auth_request with an upstream server which returns 401 (Unauthorized), multiple WWW-Authenticate headers from the upstream server response are now properly copied to the response.
2022-05-30Upstream: header handlers can now return parsing errors.Maxim Dounin5-10/+30
With this change, duplicate Content-Length and Transfer-Encoding headers are now rejected. Further, responses with invalid Content-Length or Transfer-Encoding headers are now rejected, as well as responses with both Content-Length and Transfer-Encoding.
2022-05-30Upstream: all known headers in u->headers_in are linked lists now.Maxim Dounin1-0/+2
2022-05-30All known output headers can be linked lists now.Maxim Dounin10-0/+13
The h->next pointer properly provided as NULL in all cases where known output headers are added. Note that there are 3rd party modules which might not do this, and it might be risky to rely on this for arbitrary headers.
2022-05-30Perl: combining unknown headers during $r->header_in() lookup.Maxim Dounin1-40/+44
2022-05-30Perl: all known input headers are handled identically.Maxim Dounin1-20/+2
As all known input headers are now linked lists, these are now handled identically. In particular, this makes it possible to access properly combined values of headers not specifically handled previously, such as "Via" or "Connection".
2022-05-30Reworked multi headers to use linked lists.Maxim Dounin7-82/+51
Multi headers are now using linked lists instead of arrays. Notably, the following fields were changed: r->headers_in.cookies (renamed to r->headers_in.cookie), r->headers_in.x_forwarded_for, r->headers_out.cache_control, r->headers_out.link, u->headers_in.cache_control u->headers_in.cookies (renamed to u->headers_in.set_cookie). The r->headers_in.cookies and u->headers_in.cookies fields were renamed to r->headers_in.cookie and u->headers_in.set_cookie to match header names. The ngx_http_parse_multi_header_lines() and ngx_http_parse_set_cookie_lines() functions were changed accordingly. With this change, multi headers are now essentially equivalent to normal headers, and following changes will further make them equivalent.
2022-05-30Uwsgi: combining headers with identical names (ticket #1724).Maxim Dounin1-6/+51
The uwsgi specification states that "The uwsgi block vars represent a dictionary/hash". This implies that no duplicate headers are expected. Further, provided headers are expected to follow CGI specification, which also requires to combine headers (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables"): "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-05-30SCGI: combining headers with identical names (ticket #1724).Maxim Dounin1-5/+45
SCGI specification explicitly forbids headers with duplicate names (section "3. Request Format"): "Duplicate names are not allowed in the headers". Further, provided headers are expected to follow CGI specification, which also requires to combine headers (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables"): "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-05-30FastCGI: combining headers with identical names (ticket #1724).Maxim Dounin1-11/+55
FastCGI responder is expected to receive CGI/1.1 environment variables in the parameters (see section "6.2 Responder" of the FastCGI specification). Obviously enough, there cannot be multiple environment variables with the same name. Further, CGI specification (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables") explicitly requires to combine headers: "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-01-26HTTP/3: removed draft versions support in ALPN.Sergey Kandaurov1-15/+0
2021-12-21Moved Huffman coding out of HTTP/2.Ruslan Ermilov1-8/+8
ngx_http_v2_huff_decode.c and ngx_http_v2_huff_encode.c are renamed to ngx_http_huff_decode.c and ngx_http_huff_encode.c.
2021-12-24Merged with the default branch.Ruslan Ermilov2-8/+11
2021-12-04HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro.Roman Arutyunyan1-18/+23
Listen quic parameter is no longer supported.
2021-12-06HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module.Roman Arutyunyan3-607/+6
2021-12-02HTTP/3: adjusted ALPN macro names to align with 61abb35bb8cf.Sergey Kandaurov2-5/+5
2021-11-17HTTP/3: fixed compilation with QUIC, but without HTTP/3.Roman Arutyunyan1-0/+2
2021-11-11QUIC: reject streams which we could not create.Roman Arutyunyan1-0/+3
The reasons why a stream may not be created by server currently include hitting worker_connections limit and memory allocation error. Previously in these cases the entire QUIC connection was closed and all its streams were shut down. Now the new stream is rejected and existing streams continue working. To reject an HTTP/3 request stream, RESET_STREAM and STOP_SENDING with H3_REQUEST_REJECTED error code are sent to client. HTTP/3 uni streams and Stream streams are not rejected.
2021-11-01SSL: $ssl_curve (ticket #2135).Sergey Kandaurov1-0/+3
The variable contains a negotiated curve used for the handshake key exchange process. Known curves are listed by their names, unknown ones are shown in hex. Note that for resumed sessions in TLSv1.2 and older protocols, $ssl_curve contains the curve used during the initial handshake, while in TLSv1.3 it contains the curve used during the session resumption (see the SSL_get_negotiated_group manual page for details). The variable is only meaningful when using OpenSSL 3.0 and above. With older versions the variable is empty.
2021-10-28Mp4: mp4_start_key_frame directive.Roman Arutyunyan1-27/+194
The directive enables including all frames from start time to the most recent key frame in the result. Those frames are removed from presentation timeline using mp4 edit lists. Edit lists are currently supported by popular players and browsers such as Chrome, Safari, QuickTime and ffmpeg. Among those not supporting them properly is Firefox[1]. Based on a patch by Tracey Jaquith, Internet Archive. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1735300
2021-10-28Mp4: added ngx_http_mp4_update_mdhd_atom() function.Roman Arutyunyan1-8/+32
The function updates the duration field of mdhd atom. Previously it was updated in ngx_http_mp4_read_mdhd_atom(). The change makes it possible to alter track duration as a result of processing track frames.
2021-11-03QUIC: connections with wrong ALPN protocols are now rejected.Vladimir Homutov1-1/+0
Previously, it was not enforced in the stream module. Now, since b9e02e9b2f1d it is possible to specify protocols. Since ALPN is always required, the 'require_alpn' setting is now obsolete.
2021-11-03Merged with the default branch.Sergey Kandaurov6-95/+240
2021-09-29HTTP/3: fixed segfault when using SSL certificates with variables.Sergey Kandaurov1-2/+0
A QUIC connection doesn't have c->log->data and friends initialized to sensible values. Yet, a request can be created in the certificate callback with such an assumption, which leads to a segmentation fault due to null pointer dereference in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of a connection such that it has all of that in place. Further, this appends logging error context for unsuccessful QUIC handshakes: - cannot load certificate .. while handling frames - SSL_do_handshake() failed .. while sending frames
2021-09-29Fixed mismerge of ssl_reject_handshake in 71b7453fb11f.Sergey Kandaurov1-10/+11
In particular, this fixes rejecting "listen .. quic|http3" configurations without TLSv1.3 configured.
2021-09-01Merged with the default branch.Sergey Kandaurov4-25/+25
2021-10-20HTTP: connections with wrong ALPN protocols are now rejected.Vladimir Homutov1-7/+6
This is a recommended behavior by RFC 7301 and is useful for mitigation of protocol confusion attacks [1]. To avoid possible negative effects, list of supported protocols was extended to include all possible HTTP protocol ALPN IDs registered by IANA [2], i.e. "http/1.0" and "http/0.9". [1] https://alpaca-attack.com/ [2] https://www.iana.org/assignments/tls-extensiontype-values/
2021-10-14SSL: added $ssl_alpn_protocol variable.Vladimir Homutov1-0/+3
The variable contains protocol selected by ALPN during handshake and is empty otherwise.
2021-10-15HTTP/2: removed support for NPN.Vladimir Homutov1-54/+5
NPN was replaced with ALPN, published as RFC 7301 in July 2014. It used to negotiate SPDY (and, in transition, HTTP/2). NPN supported appeared in OpenSSL 1.0.1. It does not work with TLSv1.3 [1]. ALPN is supported since OpenSSL 1.0.2. The NPN support was dropped in Firefox 53 [2] and Chrome 51 [3]. [1] https://github.com/openssl/openssl/issues/3665. [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1248198 [3] https://www.chromestatus.com/feature/5767920709795840
2021-10-18Upstream: fixed logging level of upstream invalid header errors.Maxim Dounin4-4/+4
In b87b7092cedb (nginx 1.21.1), logging level of "upstream sent invalid header" errors was accidentally changed to "info". This change restores the "error" level, which is a proper logging level for upstream-side errors.
2021-10-07Proxy: disabled keepalive on extra data in non-buffered mode.Awdhesh Mathpal1-0/+1
The u->keepalive flag is initialized early if the response has no body (or an empty body), and needs to be reset if there are any extra data, similarly to how it is done in ngx_http_proxy_copy_filter(). Missed in 83c4622053b0.
2021-08-16SSL: ciphers now set before loading certificates (ticket #2035).Maxim Dounin4-25/+25
To load old/weak server or client certificates it might be needed to adjust the security level, as introduced in OpenSSL 1.1.0. This change ensures that ciphers are set before loading the certificates, so security level changes via the cipher string apply to certificate loading.
2021-08-02QUIC: stream limits in "hq" mode.Roman Arutyunyan1-0/+35
The "hq" mode is HTTP/0.9-1.1 over QUIC. The following limits are introduced: - uni streams are not allowed - keepalive_requests is enforced - keepalive_time is enforced In case of error, QUIC connection is finalized with 0x101 code. This code corresponds to HTTP/3 General Protocol Error.
2021-07-20QUIC: the "quic_gso" directive.Vladimir Homutov1-0/+9
The directive enables usage of UDP segmentation offloading by quic. By default, gso is disabled since it is not always operational when detected (depends on interface configuration).
2021-07-15Merged with the default branch.Sergey Kandaurov5-15/+36
2021-06-30QUIC: consider max_ack_delay=16384 invalid.Roman Arutyunyan1-1/+1
As per RFC 9000: Values of 2^14 or greater are invalid.
2021-06-28Improved logging of invalid headers.Maxim Dounin4-12/+20
In 71edd9192f24 logging of invalid headers which were rejected with the NGX_HTTP_PARSE_INVALID_HEADER error was restricted to just the "client sent invalid header line" message, without any attempts to log the header itself. This patch returns logging of the header up to the invalid character and the character itself. The r->header_end pointer is now properly set in all cases to make logging possible. The same logging is also introduced when parsing headers from upstream servers.
2021-06-28Disabled control characters and space in header names.Maxim Dounin1-1/+1
Control characters (0x00-0x1f, 0x7f), space, and colon were never allowed in header names. The only somewhat valid use is header continuation which nginx never supported and which is explicitly obsolete by RFC 7230. Previously, such headers were considered invalid and were ignored by default (as per ignore_invalid_headers directive). With this change, such headers are unconditionally rejected. It is expected to make nginx more resilient to various attacks, in particular, with ignore_invalid_headers switched off (which is inherently unsecure, though nevertheless sometimes used in the wild).
2021-06-28Disabled spaces in URIs (ticket #196).Maxim Dounin1-2/+2
From now on, requests with spaces in URIs are immediately rejected rather than allowed. Spaces were allowed in 31e9677b15a1 (0.8.41) to handle bad clients. It is believed that now this behaviour causes more harm than good.
2021-06-17gRPC: RST_STREAM(NO_ERROR) handling micro-optimization.Sergey Kandaurov1-0/+4
After 2096b21fcd10, a single RST_STREAM(NO_ERROR) may not result in an error. This change removes several unnecessary ctx->type checks for such a case.
2021-06-17gRPC: handling GOAWAY with a higher last stream identifier.Sergey Kandaurov1-0/+9
Previously, once received from upstream, it couldn't limit opening additional streams in a cached keepalive connection.
2021-05-28Merged with the default branch.Sergey Kandaurov7-118/+187
2021-05-24Location header escaping in redirects (ticket #882).Ruslan Ermilov2-4/+38
The header is escaped in redirects based on request URI or location name (auto redirect).
2021-05-06Upstream: variables support in certificates.Maxim Dounin3-73/+111
2021-05-06Auth basic: changed alcf->user_file to be a pointer.Maxim Dounin1-9/+12
This saves some memory in typical case when auth_basic_user_file is not explicitly set, and unifies the code with alcf->realm.
2021-05-06Changed complex value slots to use NGX_CONF_UNSET_PTR.Maxim Dounin5-32/+26
With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge complex values. This change follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22), and the change in ngx_conf_set_keyval_slot() (7728:485dba3e2a01, 1.19.4). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.
2021-05-05HTTP/3: reference h3c directly from ngx_http_connection_t.Roman Arutyunyan2-1/+5
Previously, an ngx_http_v3_connection_t object was created for HTTP/3 and then assinged to c->data instead of the generic ngx_http_connection_t object. Now a direct reference is added to ngx_http_connection_t, which is less confusing and does not require a flag for http3.
2021-04-13QUIC: normalize header inclusion.Sergey Kandaurov1-2/+0
Stop including QUIC headers with no user-serviceable parts inside. This allows to provide a much cleaner QUIC interface. To cope with that, ngx_quic_derive_key() is now explicitly exported for v3 and quic modules. Additionally, this completely hides the ngx_quic_keys_t internal type.
2021-04-08Changed keepalive_requests default to 1000 (ticket #2155).Maxim Dounin1-1/+1
It turns out no browsers implement HTTP/2 GOAWAY handling properly, and large enough number of resources on a page results in failures to load some resources. In particular, Chrome seems to experience errors if loading of all resources requires more than 1 connection (while it is usually able to retry requests at least once, even with 2 connections there are occasional failures for some reason), Safari if loading requires more than 3 connections, and Firefox if loading requires more than 10 connections (can be configured with network.http.request.max-attempts, defaults to 10). It does not seem to be possible to resolve this on nginx side, even strict limiting of maximum concurrency does not help, and loading issues seems to be triggered by merely queueing of a request for a particular connection. The only available mitigation seems to use higher keepalive_requests value. The new default is 1000 and matches previously used default for http2_max_requests. It is expected to be enough for 99.98% of the pages (https://httparchive.org/reports/state-of-the-web?start=latest#reqTotal) even in Chrome.
2021-04-08Introduced the "keepalive_time" directive.Maxim Dounin1-0/+14
Similar to lingering_time, it limits total connection lifetime before keepalive is switched off. The default is 1 hour, which is close to the total maximum connection lifetime possible with default keepalive_requests and keepalive_timeout.
generated by cgit (git 2.34.1) at 2025-12-31 23:46:53 +0000