summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2022-06-22Merged with the default branch.Sergey Kandaurov20-178/+308
2022-06-07Mp4: fixed potential overflow in ngx_http_mp4_crop_stts_data().Maxim Dounin1-1/+1
Both "count" and "duration" variables are 32-bit, so their product might potentially overflow. It is used to reduce 64-bit start_time variable, and with very large start_time this can result in incorrect seeking. Found by Coverity (CID 1499904).
2022-06-07Upstream: handling of certificates specified as an empty string.Sergey Kandaurov3-6/+9
Now, if the directive is given an empty string, such configuration cancels loading of certificates, in particular, if they would be otherwise inherited from the previous level. This restores previous behaviour, before variables support in certificates was introduced (3ab8e1e2f0f7).
2022-05-30Headers filter: improved memory allocation error handling.Maxim Dounin1-0/+4
2022-05-30Auth request: multiple WWW-Authenticate headers (ticket #485).Maxim Dounin1-3/+8
When using auth_request with an upstream server which returns 401 (Unauthorized), multiple WWW-Authenticate headers from the upstream server response are now properly copied to the response.
2022-05-30Upstream: header handlers can now return parsing errors.Maxim Dounin5-10/+30
With this change, duplicate Content-Length and Transfer-Encoding headers are now rejected. Further, responses with invalid Content-Length or Transfer-Encoding headers are now rejected, as well as responses with both Content-Length and Transfer-Encoding.
2022-05-30Upstream: all known headers in u->headers_in are linked lists now.Maxim Dounin1-0/+2
2022-05-30All known output headers can be linked lists now.Maxim Dounin10-0/+13
The h->next pointer properly provided as NULL in all cases where known output headers are added. Note that there are 3rd party modules which might not do this, and it might be risky to rely on this for arbitrary headers.
2022-05-30Perl: combining unknown headers during $r->header_in() lookup.Maxim Dounin1-40/+44
2022-05-30Perl: all known input headers are handled identically.Maxim Dounin1-20/+2
As all known input headers are now linked lists, these are now handled identically. In particular, this makes it possible to access properly combined values of headers not specifically handled previously, such as "Via" or "Connection".
2022-05-30Reworked multi headers to use linked lists.Maxim Dounin7-82/+51
Multi headers are now using linked lists instead of arrays. Notably, the following fields were changed: r->headers_in.cookies (renamed to r->headers_in.cookie), r->headers_in.x_forwarded_for, r->headers_out.cache_control, r->headers_out.link, u->headers_in.cache_control u->headers_in.cookies (renamed to u->headers_in.set_cookie). The r->headers_in.cookies and u->headers_in.cookies fields were renamed to r->headers_in.cookie and u->headers_in.set_cookie to match header names. The ngx_http_parse_multi_header_lines() and ngx_http_parse_set_cookie_lines() functions were changed accordingly. With this change, multi headers are now essentially equivalent to normal headers, and following changes will further make them equivalent.
2022-05-30Uwsgi: combining headers with identical names (ticket #1724).Maxim Dounin1-6/+51
The uwsgi specification states that "The uwsgi block vars represent a dictionary/hash". This implies that no duplicate headers are expected. Further, provided headers are expected to follow CGI specification, which also requires to combine headers (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables"): "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-05-30SCGI: combining headers with identical names (ticket #1724).Maxim Dounin1-5/+45
SCGI specification explicitly forbids headers with duplicate names (section "3. Request Format"): "Duplicate names are not allowed in the headers". Further, provided headers are expected to follow CGI specification, which also requires to combine headers (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables"): "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-05-30FastCGI: combining headers with identical names (ticket #1724).Maxim Dounin1-11/+55
FastCGI responder is expected to receive CGI/1.1 environment variables in the parameters (see section "6.2 Responder" of the FastCGI specification). Obviously enough, there cannot be multiple environment variables with the same name. Further, CGI specification (RFC 3875, section "4.1.18. Protocol-Specific Meta-Variables") explicitly requires to combine headers: "If multiple header fields with the same field-name are received then the server MUST rewrite them as a single value having the same semantics".
2022-01-26HTTP/3: removed draft versions support in ALPN.Sergey Kandaurov1-15/+0
2021-12-21Moved Huffman coding out of HTTP/2.Ruslan Ermilov1-8/+8
ngx_http_v2_huff_decode.c and ngx_http_v2_huff_encode.c are renamed to ngx_http_huff_decode.c and ngx_http_huff_encode.c.
2021-12-24Merged with the default branch.Ruslan Ermilov2-8/+11
2021-12-04HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro.Roman Arutyunyan1-18/+23
Listen quic parameter is no longer supported.
2021-12-06HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module.Roman Arutyunyan3-607/+6
2021-12-02HTTP/3: adjusted ALPN macro names to align with 61abb35bb8cf.Sergey Kandaurov2-5/+5
2021-11-17HTTP/3: fixed compilation with QUIC, but without HTTP/3.Roman Arutyunyan1-0/+2
2021-11-11QUIC: reject streams which we could not create.Roman Arutyunyan1-0/+3
The reasons why a stream may not be created by server currently include hitting worker_connections limit and memory allocation error. Previously in these cases the entire QUIC connection was closed and all its streams were shut down. Now the new stream is rejected and existing streams continue working. To reject an HTTP/3 request stream, RESET_STREAM and STOP_SENDING with H3_REQUEST_REJECTED error code are sent to client. HTTP/3 uni streams and Stream streams are not rejected.
2021-11-01SSL: $ssl_curve (ticket #2135).Sergey Kandaurov1-0/+3
The variable contains a negotiated curve used for the handshake key exchange process. Known curves are listed by their names, unknown ones are shown in hex. Note that for resumed sessions in TLSv1.2 and older protocols, $ssl_curve contains the curve used during the initial handshake, while in TLSv1.3 it contains the curve used during the session resumption (see the SSL_get_negotiated_group manual page for details). The variable is only meaningful when using OpenSSL 3.0 and above. With older versions the variable is empty.
2021-10-28Mp4: mp4_start_key_frame directive.Roman Arutyunyan1-27/+194
The directive enables including all frames from start time to the most recent key frame in the result. Those frames are removed from presentation timeline using mp4 edit lists. Edit lists are currently supported by popular players and browsers such as Chrome, Safari, QuickTime and ffmpeg. Among those not supporting them properly is Firefox[1]. Based on a patch by Tracey Jaquith, Internet Archive. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1735300
2021-10-28Mp4: added ngx_http_mp4_update_mdhd_atom() function.Roman Arutyunyan1-8/+32
The function updates the duration field of mdhd atom. Previously it was updated in ngx_http_mp4_read_mdhd_atom(). The change makes it possible to alter track duration as a result of processing track frames.
2021-11-03QUIC: connections with wrong ALPN protocols are now rejected.Vladimir Homutov1-1/+0
Previously, it was not enforced in the stream module. Now, since b9e02e9b2f1d it is possible to specify protocols. Since ALPN is always required, the 'require_alpn' setting is now obsolete.
2021-11-03Merged with the default branch.Sergey Kandaurov6-95/+240
2021-09-29HTTP/3: fixed segfault when using SSL certificates with variables.Sergey Kandaurov1-2/+0
A QUIC connection doesn't have c->log->data and friends initialized to sensible values. Yet, a request can be created in the certificate callback with such an assumption, which leads to a segmentation fault due to null pointer dereference in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of a connection such that it has all of that in place. Further, this appends logging error context for unsuccessful QUIC handshakes: - cannot load certificate .. while handling frames - SSL_do_handshake() failed .. while sending frames
2021-09-29Fixed mismerge of ssl_reject_handshake in 71b7453fb11f.Sergey Kandaurov1-10/+11
In particular, this fixes rejecting "listen .. quic|http3" configurations without TLSv1.3 configured.
2021-09-01Merged with the default branch.Sergey Kandaurov4-25/+25
2021-10-20HTTP: connections with wrong ALPN protocols are now rejected.Vladimir Homutov1-7/+6
This is a recommended behavior by RFC 7301 and is useful for mitigation of protocol confusion attacks [1]. To avoid possible negative effects, list of supported protocols was extended to include all possible HTTP protocol ALPN IDs registered by IANA [2], i.e. "http/1.0" and "http/0.9". [1] https://alpaca-attack.com/ [2] https://www.iana.org/assignments/tls-extensiontype-values/
2021-10-14SSL: added $ssl_alpn_protocol variable.Vladimir Homutov1-0/+3
The variable contains protocol selected by ALPN during handshake and is empty otherwise.
2021-10-15HTTP/2: removed support for NPN.Vladimir Homutov1-54/+5
NPN was replaced with ALPN, published as RFC 7301 in July 2014. It used to negotiate SPDY (and, in transition, HTTP/2). NPN supported appeared in OpenSSL 1.0.1. It does not work with TLSv1.3 [1]. ALPN is supported since OpenSSL 1.0.2. The NPN support was dropped in Firefox 53 [2] and Chrome 51 [3]. [1] https://github.com/openssl/openssl/issues/3665. [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1248198 [3] https://www.chromestatus.com/feature/5767920709795840
2021-10-18Upstream: fixed logging level of upstream invalid header errors.Maxim Dounin4-4/+4
In b87b7092cedb (nginx 1.21.1), logging level of "upstream sent invalid header" errors was accidentally changed to "info". This change restores the "error" level, which is a proper logging level for upstream-side errors.
2021-10-07Proxy: disabled keepalive on extra data in non-buffered mode.Awdhesh Mathpal1-0/+1
The u->keepalive flag is initialized early if the response has no body (or an empty body), and needs to be reset if there are any extra data, similarly to how it is done in ngx_http_proxy_copy_filter(). Missed in 83c4622053b0.
2021-08-16SSL: ciphers now set before loading certificates (ticket #2035).Maxim Dounin4-25/+25
To load old/weak server or client certificates it might be needed to adjust the security level, as introduced in OpenSSL 1.1.0. This change ensures that ciphers are set before loading the certificates, so security level changes via the cipher string apply to certificate loading.
2021-08-02QUIC: stream limits in "hq" mode.Roman Arutyunyan1-0/+35
The "hq" mode is HTTP/0.9-1.1 over QUIC. The following limits are introduced: - uni streams are not allowed - keepalive_requests is enforced - keepalive_time is enforced In case of error, QUIC connection is finalized with 0x101 code. This code corresponds to HTTP/3 General Protocol Error.
2021-07-20QUIC: the "quic_gso" directive.Vladimir Homutov1-0/+9
The directive enables usage of UDP segmentation offloading by quic. By default, gso is disabled since it is not always operational when detected (depends on interface configuration).
2021-07-15Merged with the default branch.Sergey Kandaurov5-15/+36
2021-06-30QUIC: consider max_ack_delay=16384 invalid.Roman Arutyunyan1-1/+1
As per RFC 9000: Values of 2^14 or greater are invalid.
2021-06-28Improved logging of invalid headers.Maxim Dounin4-12/+20
In 71edd9192f24 logging of invalid headers which were rejected with the NGX_HTTP_PARSE_INVALID_HEADER error was restricted to just the "client sent invalid header line" message, without any attempts to log the header itself. This patch returns logging of the header up to the invalid character and the character itself. The r->header_end pointer is now properly set in all cases to make logging possible. The same logging is also introduced when parsing headers from upstream servers.
2021-06-28Disabled control characters and space in header names.Maxim Dounin1-1/+1
Control characters (0x00-0x1f, 0x7f), space, and colon were never allowed in header names. The only somewhat valid use is header continuation which nginx never supported and which is explicitly obsolete by RFC 7230. Previously, such headers were considered invalid and were ignored by default (as per ignore_invalid_headers directive). With this change, such headers are unconditionally rejected. It is expected to make nginx more resilient to various attacks, in particular, with ignore_invalid_headers switched off (which is inherently unsecure, though nevertheless sometimes used in the wild).
2021-06-28Disabled spaces in URIs (ticket #196).Maxim Dounin1-2/+2
From now on, requests with spaces in URIs are immediately rejected rather than allowed. Spaces were allowed in 31e9677b15a1 (0.8.41) to handle bad clients. It is believed that now this behaviour causes more harm than good.
2021-06-17gRPC: RST_STREAM(NO_ERROR) handling micro-optimization.Sergey Kandaurov1-0/+4
After 2096b21fcd10, a single RST_STREAM(NO_ERROR) may not result in an error. This change removes several unnecessary ctx->type checks for such a case.
2021-06-17gRPC: handling GOAWAY with a higher last stream identifier.Sergey Kandaurov1-0/+9
Previously, once received from upstream, it couldn't limit opening additional streams in a cached keepalive connection.
2021-05-28Merged with the default branch.Sergey Kandaurov7-118/+187
2021-05-24Location header escaping in redirects (ticket #882).Ruslan Ermilov2-4/+38
The header is escaped in redirects based on request URI or location name (auto redirect).
2021-05-06Upstream: variables support in certificates.Maxim Dounin3-73/+111
2021-05-06Auth basic: changed alcf->user_file to be a pointer.Maxim Dounin1-9/+12
This saves some memory in typical case when auth_basic_user_file is not explicitly set, and unifies the code with alcf->realm.
2021-05-06Changed complex value slots to use NGX_CONF_UNSET_PTR.Maxim Dounin5-32/+26
With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge complex values. This change follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22), and the change in ngx_conf_set_keyval_slot() (7728:485dba3e2a01, 1.19.4). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.
generated by cgit (git 2.34.1) at 2025-12-28 22:29:36 +0000