summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2012-10-29Variables $connection and $connection_requests.Maxim Dounin1-23/+0
Log module counterparts are removed as they aren't used often and there is no need to preserve them for efficiency.
2012-10-18Gunzip: fixed r->gzip_ok check.Maxim Dounin1-1/+1
2012-10-05OCSP stapling: properly check if there is ssl.ctx.Maxim Dounin1-1/+1
This fixes segfault if stapling was enabled in a server without a certificate configured (and hence no ssl.ctx).
2012-10-03Log: $apache_bytes_sent removed.Maxim Dounin1-8/+0
It was renamed to $body_bytes_sent in nginx 0.3.10 and the old name is deprecated since then.
2012-10-03SSL: the "ssl_verify_client" directive parameter "optional_no_ca".Maxim Dounin1-1/+2
This parameter allows to don't require certificate to be signed by a trusted CA, e.g. if CA certificate isn't known in advance, like in WebID protocol. Note that it doesn't add any security unless the certificate is actually checked to be trusted by some external means (e.g. by a backend). Patch by Mike Kazantsev, Eric O'Connor.
2012-10-03Version bump.Maxim Dounin1-1/+1
2012-10-01OCSP stapling: ssl_stapling_verify directive.Maxim Dounin2-2/+12
OCSP response verification is now switched off by default to simplify configuration, and the ssl_stapling_verify allows to switch it on. Note that for stapling OCSP response verification isn't something required as it will be done by a client anyway. But doing verification on a server allows to mitigate some attack vectors, most notably stop an attacker from presenting some specially crafted data to all site clients.
2012-10-01OCSP stapling: loading OCSP responses.Maxim Dounin2-5/+57
This includes the ssl_stapling_responder directive (defaults to OCSP responder set in certificate's AIA extension). OCSP response for a given certificate is requested once we get at least one connection with certificate_status extension in ClientHello, and certificate status won't be sent in the connection in question. This due to limitations in the OpenSSL API (certificate status callback is blocking). Note: SSL_CTX_use_certificate_chain_file() was reimplemented as it doesn't allow to access the certificate loaded via SSL_CTX.
2012-10-01OCSP stapling: ssl_stapling_file support.Maxim Dounin2-0/+27
Very basic version without any OCSP responder query code, assuming valid DER-encoded OCSP response is present in a ssl_stapling_file configured. Such file might be produced with openssl like this: openssl ocsp -issuer root.crt -cert domain.crt -respout domain.staple \ -url http://ocsp.example.com
2012-10-01OCSP stapling: ssl_trusted_certificate directive.Maxim Dounin2-3/+22
The directive allows to specify additional trusted Certificate Authority certificates to be used during certificate verification. In contrast to ssl_client_certificate DNs of these cerificates aren't sent to a client during handshake. Trusted certificates are loaded regardless of the fact whether client certificates verification is enabled as the same certificates will be used for OCSP stapling, during construction of an OCSP request and for verification of an OCSP response. The same applies to a CRL (which is now always loaded).
2012-09-26Version bump.Maxim Dounin1-1/+1
2012-09-11Gunzip: removed nginx.h leftover include.Maxim Dounin1-1/+0
2012-09-10Gunzip filter import.Maxim Dounin1-0/+677
2012-09-10Gzip static: "always" parameter in "gzip_static" directive.Maxim Dounin1-10/+32
With "always" gzip static returns gzipped content in all cases, without checking if client supports it. It is useful if there are no uncompressed files on disk anyway.
2012-09-10Memcached: memcached_gzip_flag directive.Maxim Dounin1-8/+56
This directive allows to test desired flag as returned by memcached and sets Content-Encoding to gzip if one found. This is reimplementation of patch by Tomash Brechko as available on http://openhack.ru/. It should be a bit more correct though (at least I think so). In particular, it doesn't try to detect if we are able to gunzip data, but instead just sets correct Content-Encoding.
2012-09-03Limit req: fix of rbtree node insertion on hash collisions.Valentin Bartenev1-4/+4
The rbtree used in ngx_http_limit_req_module has two level of keys, the top is hash, and the next is the value string itself. However, when inserting a new node, only hash has been set, while the value string has been left empty. The bug was introduced in r4419 (1.1.14). Found by Charles Chen.
2012-08-30Fixed strict aliasing bugs when dealing with IPv4-mapped IPv6 addressesRuslan Ermilov2-2/+20
(closes #201).
2012-08-28Fixed the "include" directive.Ruslan Ermilov1-10/+2
The "include" directive should be able to include multiple files if given a filename mask. Fixed this to work for "include" directives inside the "map" or "types" blocks. The "include" directive inside the "geo" block is still not fixed.
2012-08-27Version bump.Ruslan Ermilov1-1/+1
2012-08-17Mark logically dead code with corresponding comment.Andrey Belov1-0/+1
Found by Coverity.
2012-08-17Mp4: removed restriction to avc1/mp4a formats (ticket #194).Maxim Dounin1-8/+0
2012-08-16Geo: fixed handling of ranges without default set.Maxim Dounin1-4/+4
The bug had appeared in 0.8.43 (r3653). Patch by Weibin Yao.
2012-08-16Map: fixed optimization of variables as values.Maxim Dounin1-8/+2
Previous code incorrectly used ctx->var_values as an array of pointers to ngx_http_variable_value_t, but the array contains structures, not pointers. Additionally, ctx->var_values inspection failed to properly set var on match.
2012-08-08Added three missing checks for NULL after ngx_array_push() calls.Valentin Bartenev3-0/+10
Found by Coverity.
2012-07-31Version bump.Ruslan Ermilov1-1/+1
2012-07-24Fixed compilation with -Wmissing-prototypes.Ruslan Ermilov2-2/+2
2012-07-20Fixed debugging messages to account that limit_zone was renamed to limit_conn.Ruslan Ermilov1-2/+2
2012-07-17Version bump.Ruslan Ermilov1-1/+1
2012-07-09Entity tags: empty etags handling in If-Range.Maxim Dounin1-1/+1
Entity tag may be of length 2 as per RFC 2616, i.e. double quotes only. Pointed out by Ruslan Ermilov.
2012-07-09Entity tags: set for static respones.Maxim Dounin4-0/+16
2012-07-07Entity tags: handling in add_header.Maxim Dounin1-0/+38
Notably this allows to clear ETag if one want to for some reason.
2012-07-07Entity tags: clear on entity changes.Maxim Dounin5-0/+5
2012-07-07Entity tags: support in If-Range header.Maxim Dounin1-5/+29
2012-07-07Entity tags: basic support in not modified filter.Maxim Dounin1-2/+92
This includes handling of ETag headers (if present in a response) with basic support for If-Match, If-None-Match conditionals in not modified filter. Note that the "r->headers_out.last_modified_time == -1" check in the not modified filter is left as is intentionally. It's to prevent handling of If-* headers in case of proxy without cache (much like currently done with If-Modified-Since).
2012-07-07Not modified filter: tests separated from actions.Maxim Dounin1-31/+38
This makes code more extendable. The only functional change is when If-Modified-Since and If-Unmodified-Since are specified together, the case which is explicitly left undefined by RFC 2616. The new behaviour is to respect them both, which seems better.
2012-07-07Added Last-Modified parsing in add_header.Maxim Dounin1-25/+13
This allows to use last modified time set in If-Range checks. Code simplified to improve readability.
2012-07-07Fixed If-Range with unknown last modified time.Maxim Dounin1-1/+5
If modification time isn't known, skip range processing and return full entity body instead of just ignoring If-Range. Ignoring If-Range isn't safe as client will assume entity wasn't changed since time specified.
2012-06-29map: strip final dot before looking up in a map of hostnames.Ruslan Ermilov1-5/+4
(closes #182)
2012-06-29Version bump.Ruslan Ermilov1-1/+1
2012-06-26Mp4: fixed build on win32 after r4689.Maxim Dounin1-1/+1
2012-06-19Added IPv6 support to ip_hash.Ruslan Ermilov1-16/+27
2012-06-18Upstream keepalive: "single" parameter deprecated.Maxim Dounin1-29/+4
The original idea was to optimize edge cases in case of interchangeable backends, i.e. don't establish a new connection if we have any one cached. This causes more harm than good though, as it screws up underlying balancer's idea about backends used and may result in various unexpected problems.
2012-06-18Mp4: fixed streaming if moov atom is at buffer edge.Maxim Dounin1-0/+10
2012-06-18Mp4: fixed non-keyframe seeks in some cases (ticket #175).Maxim Dounin1-1/+8
Number of entries in stsc atom was wrong if we've added an entry to split a chunk. Additionally, there is no need to add an entry if we are going to split last chunk in an entry, it's enough to update the entry we already have. Previously new entry was added and old one was left as is, resulting in incorrect entry with zero chunks which might confuse some software.
2012-06-18New core variable: $status.Andrey Belov1-4/+1
Contains response status code as a 3-digit integer (with leading zeroes if necessary), or one of the following values: 000 - response status code has not yet been assigned 009 - HTTP/0.9 request is being processed
2012-06-18Version bump.Ruslan Ermilov1-1/+1
2012-06-08Fixed spelling of "endianness", and called it "byte ordering" in theRuslan Ermilov1-1/+1
user visible part.
2012-06-04Upstream: least_conn compilation fixes.Maxim Dounin1-5/+3
Removed duplicate call of ngx_http_upstream_init_round_robin_peer() overlooked during code changes. Rewritten "return lcp->free_rr_peer(...)" as MSVC doesn't like it.
2012-06-03Upstream: weights support in ip_hash balancer.Maxim Dounin1-1/+17
2012-06-03Upstream: least_conn balancer module.Maxim Dounin1-0/+404
generated by cgit (git 2.34.1) at 2025-12-07 22:43:32 +0000