summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-09-27Proxy: added the "proxy_cookie_flags" directive.Ruslan Ermilov1-30/+552
2020-09-27Proxy: changed interface of some internal functions.Ruslan Ermilov1-32/+30
This is in preparation for the next change. Also, moved optimization from ngx_http_proxy_rewrite_regex_handler() to ngx_http_proxy_rewrite().
2020-09-27Proxy: strengthen syntax checking for some directives.Ruslan Ermilov1-12/+20
The "false" parameter of the proxy_redirect directive is deprecated. Warning has been emitted since c2230102df6f (0.7.54). The "off" parameter of the proxy_redirect, proxy_cookie_domain, and proxy_cookie_path directives tells nginx not to inherit the configuration from the previous configuration level. Previously, after specifying the directive with the "off" parameter, any other directives were ignored, and syntax checking was disabled. The syntax was enforced to allow either one directive with the "off" parameter, or several directives with other parameters. Also, specifying "proxy_redirect default foo" no longer works like "proxy_redirect default".
2020-09-15SSL: added the "ssl_keys_file" directive.Vladimir Homutov2-0/+23
2020-10-01Merged with the default branch.Sergey Kandaurov2-73/+677
2020-10-01QUIC: moved ssl configuration pointer to quic configuration.Vladimir Homutov1-0/+5
The ssl configuration is obtained at config time and saved for future use.
2020-09-30QUIC: added stateless reset support.Vladimir Homutov1-1/+12
The new "quic_stateless_reset_token_key" directive is added. It sets the endpoint key used to generate stateless reset tokens and enables feature. If the endpoint receives short-header packet that can't be matched to existing connection, a stateless reset packet is generated with a proper token. If a valid stateless reset token is found in the incoming packet, the connection is closed. Example configuration: http { quic_stateless_reset_token_key "foo"; ... }
2020-08-18Merged with the default branch.Roman Arutyunyan3-6/+28
2020-07-27FastCGI: fixed zero size buf alerts on extra data (ticket #2018).Maxim Dounin1-6/+22
After 05e42236e95b (1.19.1) responses with extra data might result in zero size buffers being generated and "zero size buf" alerts in writer (if f->rest happened to be 0 when processing additional stdout data).
2020-07-22Xslt: disabled ranges.Roman Arutyunyan1-0/+1
Previously, the document generated by the xslt filter was always fully sent to client even if a range was requested and response status was 206 with appropriate Content-Range. The xslt module is unable to serve a range because of suspending the header filter chain. By the moment full response xml is buffered by the xslt filter, range header filter is not called yet, but the range body filter has already been called and did nothing. The fix is to disable ranges by resetting the r->allow_ranges flag much like the image filter that employs a similar technique.
2020-07-21QUIC: added "quic" listen parameter in Stream.Roman Arutyunyan1-0/+1
Also, introduced ngx_stream_quic_module.
2020-07-21QUIC: added "quic" listen parameter.Roman Arutyunyan3-8/+394
The parameter allows processing HTTP/0.9-2 over QUIC. Also, introduced ngx_http_quic_module and moved QUIC settings there
2020-07-13Merged with the default branch.Sergey Kandaurov6-30/+298
2020-07-09Slice filter: clear original Accept-Ranges.Roman Arutyunyan1-0/+5
The slice filter allows ranges for the response by setting the r->allow_ranges flag, which enables the range filter. If the range was not requested, the range filter adds an Accept-Ranges header to the response to signal the support for ranges. Previously, if an Accept-Ranges header was already present in the first slice response, client received two copies of this header. Now, the slice filter removes the Accept-Ranges header from the response prior to setting the r->allow_ranges flag.
2020-07-06gRPC: generate error when response size is wrong.Maxim Dounin1-1/+38
As long as the "Content-Length" header is given, we now make sure it exactly matches the size of the response. If it doesn't, the response is considered malformed and must not be forwarded (https://tools.ietf.org/html/rfc7540#section-8.1.2.6). While it is not really possible to "not forward" the response which is already being forwarded, we generate an error instead, which is the closest equivalent. Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Also this directly contradicts HTTP/2 specification requirements. Note that the new behaviour for the gRPC proxy is more strict than that applied in other variants of proxying. This is intentional, as HTTP/2 specification requires us to do so, while in other types of proxying malformed responses from backends are well known and historically tolerated.
2020-07-06FastCGI: protection from responses with wrong length.Maxim Dounin1-14/+106
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients. Additionally, we now also issue a warning if the response is too short, and make sure the fact it is truncated is propagated to the client. The u->error flag is introduced to make it possible to propagate the error to the client in case of unbuffered proxying. For responses to HEAD requests there is an exception: we do allow both responses without body and responses with body matching the Content-Length header.
2020-07-06Upstream: drop extra data sent by upstream.Maxim Dounin2-0/+72
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients. This change covers generic buffered and unbuffered filters as used in the scgi and uwsgi modules. Appropriate input filter init handlers are provided by the scgi and uwsgi modules to set corresponding lengths. Note that for responses to HEAD requests there is an exception: we do allow any response length. This is because responses to HEAD requests might be actual full responses, and it is up to nginx to remove the response body. If caching is enabled, only full responses matching the Content-Length header will be cached (see b779728b180c).
2020-07-06Proxy: style.Maxim Dounin1-2/+2
2020-07-06Proxy: detection of data after final chunk.Maxim Dounin1-1/+30
Previously, additional data after final chunk was either ignored (in the same buffer, or during unbuffered proxying) or sent to the client (in the next buffer already if it was already read from the socket). Now additional data are properly detected and ignored in all cases. Additionally, a warning is now logged and keepalive is disabled in the connection.
2020-07-06Proxy: drop extra data sent by upstream.Maxim Dounin1-9/+43
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients.
2020-07-06Memcached: protect from too long responses.Maxim Dounin1-3/+6
If a memcached response was followed by a correct trailer, and then the NUL character followed by some extra data - this was accepted by the trailer checking code. This in turn resulted in ctx->rest underflow and caused negative size buffer on the next reading from the upstream, followed by the "negative size buf in writer" alert. Fix is to always check for too long responses, so a correct trailer cannot be followed by extra data.
2020-06-15Correctly flush request body to uwsgi with SSL.Quantum1-0/+1
The flush flag was not set when forwarding the request body to the uwsgi server. When using uwsgi_pass suwsgi://..., this causes the uwsgi server to wait indefinitely for the request body and eventually time out due to SSL buffering. This is essentially the same change as 4009:3183165283cc, which was made to ngx_http_proxy_module.c. This will fix the uwsgi bug https://github.com/unbit/uwsgi/issues/1490.
2020-05-26Merged with the default branch.Sergey Kandaurov3-10/+175
2020-05-22OCSP: certificate status cache.Roman Arutyunyan2-1/+94
When enabled, certificate status is stored in cache and is used to validate the certificate in future requests. New directive ssl_ocsp_cache is added to configure the cache.
2020-05-22SSL: client certificate validation with OCSP (ticket #1534).Roman Arutyunyan2-5/+62
OCSP validation for client certificates is enabled by the "ssl_ocsp" directive. OCSP responder can be optionally specified by "ssl_ocsp_responder". When session is reused, peer chain is not available for validation. If the verified chain contains certificates from the peer chain not available at the server, validation will fail.
2020-04-23gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov1-1/+2
As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
2020-04-23gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov1-5/+19
As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
2020-04-14Merged with the default branch.Sergey Kandaurov1-19/+18
2020-03-27Chunked response body in HTTP/3.Roman Arutyunyan1-13/+45
2020-03-23Support for HTTP/3 ALPN.Roman Arutyunyan1-2/+10
This is required by Chrome.
2020-03-18Moved setting QUIC methods to runtime.Roman Arutyunyan2-15/+0
This allows listening to both https and http3 in the same server. Also, the change eliminates the ssl_quic directive.
2020-03-13Auth basic: explicitly zero out password buffer.Ruslan Ermilov1-19/+18
2020-02-28Cleanup.Sergey Kandaurov1-3/+0
2020-02-28Initial QUIC support in http.Sergey Kandaurov2-1/+27
2020-02-26Mp4: fixed possible chunk offset overflow.Roman Arutyunyan1-11/+64
In "co64" atom chunk start offset is a 64-bit unsigned integer. When trimming the "mdat" atom, chunk offsets are casted to off_t values which are typically 64-bit signed integers. A specially crafted mp4 file with huge chunk offsets may lead to off_t overflow and result in negative trim boundaries. The consequences of the overflow are: - Incorrect Content-Length header value in the response. - Negative left boundary of the response file buffer holding the trimmed "mdat". This leads to pread()/sendfile() errors followed by closing the client connection. On rare systems where off_t is a 32-bit integer, this scenario is also feasible with the "stco" atom. The fix is to add checks which make sure data chunks referenced by each track are within the mp4 file boundaries. Additionally a few more checks are added to ensure mp4 file consistency and log errors.
2020-01-17gRPC: variables support in the "grpc_pass" directive.Vladimir Homutov1-38/+190
2019-12-23Dav: added checks for chunked to body presence conditions.Maxim Dounin1-3/+5
These checks were missed when chunked support was introduced. And also added an explicit error message to ngx_http_dav_copy_move_handler() (it was missed for some reason, in contrast to DELETE and MKCOL handlers).
2019-12-16Rewrite: disallow empty replacements.Ruslan Ermilov1-0/+5
While empty replacements were caught at run-time, parsing code of the "rewrite" directive expects that a minimum length of the "replacement" argument is 1.
2019-12-16Fixed request finalization in ngx_http_index_handler().Ruslan Ermilov1-1/+1
Returning 500 instead of NGX_ERROR is preferable here because header has not yet been sent to the client.
2019-12-16Saved some memory allocations.Ruslan Ermilov2-28/+7
In configurations when "root" has variables, some modules unnecessarily allocated memory for the "Location" header value.
2019-12-16Dav: fixed Location in successful MKCOL response.Ruslan Ermilov1-1/+2
Instead of reducing URI length to not include the terminating '\0' character in 6ddaac3e0bf7, restore the terminating '/' character.
2019-12-05Upstream keepalive: clearing of c->data in cached connections.Maxim Dounin1-0/+1
Previously, connections returned from keepalive cache had c->data pointing to the keepalive cache item. While this shouldn't be a problem for correct code, as c->data is not expected to be used before it is set, explicitly clearing it might help to avoid confusion.
2019-11-18Limit conn: added shared context.Roman Arutyunyan1-47/+43
Previously only an rbtree was associated with a limit_conn. To make it possible to associate more data with a limit_conn, shared context is introduced similar to limit_req. Also, shared pool pointer is kept in a way similar to limit_req.
2019-11-18Limit conn: $limit_conn_status variable.Roman Arutyunyan1-3/+73
The variable takes one of the values: PASSED, REJECTED or REJECTED_DRY_RUN.
2019-11-19Limit conn: limit_conn_dry_run directive.Roman Arutyunyan1-1/+23
A new directive limit_conn_dry_run allows enabling the dry run mode. In this mode connections are not rejected, but reject status is logged as usual.
2019-11-06Limit req: $limit_req_status variable.Roman Arutyunyan1-4/+75
The variable takes one of the values: PASSED, DELAYED, REJECTED, DELAYED_DRY_RUN or REJECTED_DRY_RUN.
2019-10-21Core: moved PROXY protocol fields out of ngx_connection_t.Roman Arutyunyan1-4/+3
Now a new structure ngx_proxy_protocol_t holds these fields. This allows to add more PROXY protocol fields in the future without modifying the connection structure.
2019-09-16SSL: fixed ssl_verify_client error message.Sergey Kandaurov1-1/+1
2019-07-31Gzip: fixed "zero size buf" alerts after ac5a741d39cf.Maxim Dounin1-4/+11
After ac5a741d39cf it is now possible that after zstream.avail_out reaches 0 and we allocate additional buffer, there will be no more data to put into this buffer, triggering "zero size buf" alert. Fix is to reset b->temporary flag in this case. Additionally, an optimization added to avoid allocating additional buffer in this case, by checking if last deflate() call returned Z_STREAM_END. Note that checking for Z_STREAM_END by itself is not enough to fix alerts, as deflate() can return Z_STREAM_END without producing any output if the buffer is smaller than gzip trailer. Reported by Witold Filipczyk, http://mailman.nginx.org/pipermail/nginx-devel/2019-July/012469.html.
2019-07-18Xslt: fixed potential buffer overflow with null character.Maxim Dounin1-4/+2
Due to shortcomings of the ccv->zero flag implementation in complex value interface, length of the resulting string from ngx_http_complex_value() might either not include terminating null character or include it, so the only safe way to work with the result is to use it as a null-terminated string. Reported by Patrick Wollgast.
generated by cgit (git 2.34.1) at 2025-12-07 12:11:14 +0000