summaryrefslogtreecommitdiffhomepage
path: root/src/mail (follow)
AgeCommit message (Collapse)AuthorFilesLines
2016-03-31SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0.Maxim Dounin1-1/+1
OpenSSL removed support for all 40 and 56 bit ciphers.
2016-03-31Fixed logging.Sergey Kandaurov2-2/+2
2016-03-30Style.Ruslan Ermilov3-5/+5
2016-02-04Dynamic modules: changed ngx_modules to cycle->modules.Maxim Dounin2-18/+18
2016-02-04Dynamic modules: moved module-related stuff to separate files.Maxim Dounin1-8/+1
2015-08-17Win32: MSVC 2015 compatibility.Maxim Dounin1-2/+1
Resolved warnings about declarations that hide previous local declarations. Warnings about WSASocketA() being deprecated resolved by explicit use of WSASocketW() instead of WSASocket(). When compiling without IPv6 support, WinSock deprecated warnings are disabled to allow use of gethostbyname().
2015-06-16Disabled duplicate http, mail, and stream blocks.Vladimir Homutov1-0/+4
Such configurations have very limited use, introduce various problems and are not officially supported.
2015-06-08Mail: listen backlog=.Ruslan Ermilov3-0/+17
2015-06-08Mail: embed ngx_mail_listen_t into ngx_mail_conf_addr_t.Ruslan Ermilov3-68/+48
2015-05-25Disabled SSLv3 by default (ticket #653).Maxim Dounin1-1/+1
2015-05-20Simplified ngx_http_init_listening().Maxim Dounin1-7/+1
There is no need to set "i" to 0, as it's expected to be 0 assuming the bindings are properly sorted, and we already rely on this when explicitly set hport->naddrs to 1. Remaining conditional code is replaced with identical "hport->naddrs = i + 1". Identical modifications are done in the mail and stream modules, in the ngx_mail_optimize_servers() and ngx_stream_optimize_servers() functions, respectively. No functional changes.
2015-04-29Removed the deprecated "imap" directive.Ruslan Ermilov1-13/+0
2015-04-29Removed the deprecated "so_keepalive" directive.Ruslan Ermilov3-31/+0
2015-02-20Mail: error_log support.Vladimir Homutov4-19/+54
2015-03-23SSL: avoid SSL_CTX_set_tmp_rsa_callback() call with LibreSSL.Maxim Dounin1-0/+2
LibreSSL removed support for export ciphers and a call to SSL_CTX_set_tmp_rsa_callback() results in an error left in the error queue. This caused alerts "ignoring stale global SSL error (...called a function you should not call) while SSL handshaking" on a first connection in each worker process.
2015-03-04Style: use %*s format, as in 68d21fd1dc64.Ruslan Ermilov1-8/+3
2015-02-27Mail: don't emit Auth-SSL-Verify with disabled ssl_verify_client.Sergey Kandaurov1-5/+9
Previously, the Auth-SSL-Verify header with the "NONE" value was always passed to the auth_http script if verification of client certificates is disabled.
2015-02-25Mail: client SSL certificates support.Maxim Dounin8-4/+294
The "ssl_verify_client", "ssl_verify_depth", "ssl_client_certificate", "ssl_trusted_certificate", and "ssl_crl" directives introduced to control SSL client certificate verification in mail proxy module. If there is a certificate, detail of the certificate are passed to the auth_http script configured via Auth-SSL-Verify, Auth-SSL-Subject, Auth-SSL-Issuer, Auth-SSL-Serial, Auth-SSL-Fingerprint headers. If the auth_http_pass_client_cert directive is set, client certificate in PEM format will be passed in the Auth-SSL-Cert header (urlencoded). If there is no required certificate provided during an SSL handshake or certificate verification fails then a protocol-specific error is returned after the SSL handshake and the connection is closed. Based on previous work by Sven Peter, Franck Levionnois and Filipe Da Silva.
2015-02-25Mail: added Auth-SSL header to indicate SSL.Maxim Dounin1-0/+12
Based on a patch by Filipe da Silva.
2015-02-25Mail: fixed buffer allocation for CRLF after Auth-SMTP-* headers.Maxim Dounin1-3/+3
There were no buffer overruns in real life as there is extra space allocated for the Auth-Login-Attempt counter.
2015-01-23Mail: fixed the duplicate listen address detection.Ruslan Ermilov1-2/+2
2015-01-23Mail: fixed a comment.Ruslan Ermilov1-1/+1
2014-09-01Mail: initialize the "signature" field of ngx_mail_session_t.Valentin Bartenev1-0/+2
Currently it isn't used, but it can be suitable to distinguish objects stored in c->data.
2014-08-20Mail: fixed number of arguments allowed in the listen directive.Valentin Bartenev1-1/+1
2014-08-20Mail: fixed a comment.Valentin Bartenev1-2/+1
There's no loc_conf in the mail module.
2014-08-05Mail: discard pipelined commands after SMTP STARTTLS.Maxim Dounin1-0/+3
The bug had appeared in nginx 1.5.6 (04e43d03e153). Reported by Chris Boulton.
2014-06-16SSL: the "ssl_password_file" directive.Valentin Bartenev2-1/+38
2014-05-22Mail: output client port number on client connects (ticket #531).Ruslan Ermilov1-2/+6
2014-05-21Mail: added a check for the number of arguments in MAIL/RCPT.Maxim Dounin1-0/+10
Missed during introduction of the SMTP pipelining support (04e43d03e153, 1.5.6). Previously, the check wasn't needed as s->buffer was used directly and the number of arguments didn't matter. Reported by Svyatoslav Nikolsky.
2014-05-14Style: use %N instead of '\n' where appropriate.Ruslan Ermilov1-1/+1
2014-03-31Mail: fixed ngx_mail_send() (ticket #519).Maxim Dounin1-0/+7
2014-03-06Fixed format specifier in logging of "c->number".Sergey Kandaurov1-1/+1
2014-01-17Mail: fixed passing of IPv6 client address in XCLIENT.Ruslan Ermilov1-5/+28
2014-01-10SSL: ssl_session_tickets directive.Dirkjan Bussink2-0/+18
This adds support so it's possible to explicitly disable SSL Session Tickets. In order to have good Forward Secrecy support either the session ticket key has to be reloaded by using nginx' binary upgrade process or using an external key file and reloading the configuration. This directive adds another possibility to have good support by disabling session tickets altogether. If session tickets are enabled and the process lives for a long a time, an attacker can grab the session ticket from the process and use that to decrypt any traffic that occured during the entire lifetime of the process.
2013-12-09Resolver: implemented IPv6 name to address resolving.Ruslan Ermilov1-1/+0
2013-12-06Changed resolver API to use ngx_addr_t.Ruslan Ermilov1-20/+23
2013-10-11SSL: added ability to set keys used for Session Tickets (RFC5077).Piotr Sikora2-0/+19
In order to support key rollover, ssl_session_ticket_key can be defined multiple times. The first key will be used to issue and resume Session Tickets, while the rest will be used only to resume them. ssl_session_ticket_key session_tickets/current.key; ssl_session_ticket_key session_tickets/prev-1h.key; ssl_session_ticket_key session_tickets/prev-2h.key; Please note that nginx supports Session Tickets even without explicit configuration of the keys and this feature should be only used in setups where SSL traffic is distributed across multiple nginx servers. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-30Mail: fixed segfault with ssl/starttls at mail{} level and no cert.Maxim Dounin1-0/+5
A configuration like "mail { starttls on; server {}}" triggered NULL pointer dereference in ngx_mail_ssl_merge_conf() as conf->file was not set.
2013-09-30Mail: fixed overrun of allocated memory (ticket #411).Maxim Dounin1-1/+0
Reported by Markus Linnala.
2013-09-30Mail: handle smtp multiline replies.Maxim Dounin1-1/+20
See here for details: http://nginx.org/pipermail/nginx/2010-August/021713.html http://nginx.org/pipermail/nginx/2010-August/021784.html http://nginx.org/pipermail/nginx/2010-August/021785.html
2013-09-30Mail: smtp pipelining support.Maxim Dounin5-63/+71
Basically, this does the following two changes (and corresponding modifications of related code): 1. Does not reset session buffer unless it's reached it's end, and always wait for LF to terminate command (even if we detected invalid command). 2. Record command name to make it available for handlers (since now we can't assume that command starts from s->buffer->start).
2013-09-30Mail: added session close on smtp_greeting_delay violation.Maxim Dounin1-0/+1
A server MUST send greeting before other replies, while before this change in case of smtp_greeting_delay violation the 220 greeting was sent after several 503 replies to commands received before greeting, resulting in protocol synchronization loss. Moreover, further commands were accepted after the greeting. While closing a connection isn't strictly RFC compliant (RFC 5321 requires servers to wait for a QUIT before closing a connection), it's probably good enough for practial uses.
2013-09-22SSL: stop loading configs with invalid "ssl_ciphers" values.Piotr Sikora1-9/+8
While there, remove unnecessary check in ngx_mail_ssl_module. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-07-11Style.Maxim Dounin1-1/+1
2013-07-11Core: extended ngx_sock_ntop() with socklen parameter.Vladimir Homutov2-3/+6
On Linux, sockaddr length is required to process unix socket addresses properly due to unnamed sockets (which don't have sun_path set at all) and abstract namespace sockets.
2013-06-05Mail: fixed possible uninitialized memory access.Maxim Dounin1-0/+4
Found by Valgrind.
2013-05-21Style: remove unnecessary references to HTTP from non-HTTP modules.Piotr Sikora1-2/+2
No functional changes. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-10Mail: missing ngx_ssl_ecdh_curve() call.F. da Silva1-0/+4
2013-05-09Mail: removed surplus ngx_close_connection() call.Filipe Da Silva1-1/+0
It is already called for a peer connection a few lines above.
2013-03-25Mail: IPv6 backends (ticket #323).Ruslan Ermilov1-24/+35
generated by cgit (git 2.34.1) at 2025-12-13 11:32:42 +0000