summaryrefslogtreecommitdiffhomepage
path: root/src (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2013-10-01SPDY: ignore priority when queuing blocked frames.Valentin Bartenev1-2/+2
With this change all such frames will be added in front of the output queue, and will be sent first. It prevents HOL blocking when response with higher priority is blocked by response with lower priority in the middle of the queue because the order of their SYN_REPLY frames cannot be changed. Proposed by Yury Kirpichev.
2013-10-01SPDY: set empty write handler during connection finalization.Valentin Bartenev1-0/+1
While ngx_http_spdy_write_handler() should not make any harm with current code, calling it during finalization of SPDY connection was not intended.
2013-10-01SPDY: fixed connection leak while waiting for request headers.Valentin Bartenev1-1/+19
If an error occurs in a SPDY connection, the c->error flag is set on every fake request connection, and its read or write event handler is called, in order to finalize it. But while waiting for request headers, it was a no-op since the read event handler had been set to ngx_http_empty_handler().
2013-10-01SPDY: fixed connection leak while waiting for request body.Valentin Bartenev1-0/+4
If an error occurs in a SPDY connection, the c->error flag is set on every fake request connection, and its read or write event handler is called, in order to finalize it. But while waiting for a request body, it was a no-op since the read event handler ngx_http_request_handler() calls r->read_event_handler that had been set to ngx_http_block_reading().
2013-09-30Mail: fixed segfault with ssl/starttls at mail{} level and no cert.Maxim Dounin1-0/+5
A configuration like "mail { starttls on; server {}}" triggered NULL pointer dereference in ngx_mail_ssl_merge_conf() as conf->file was not set.
2013-09-30Mail: fixed overrun of allocated memory (ticket #411).Maxim Dounin1-1/+0
Reported by Markus Linnala.
2013-09-30Mail: handle smtp multiline replies.Maxim Dounin1-1/+20
See here for details: http://nginx.org/pipermail/nginx/2010-August/021713.html http://nginx.org/pipermail/nginx/2010-August/021784.html http://nginx.org/pipermail/nginx/2010-August/021785.html
2013-09-30Mail: smtp pipelining support.Maxim Dounin5-63/+71
Basically, this does the following two changes (and corresponding modifications of related code): 1. Does not reset session buffer unless it's reached it's end, and always wait for LF to terminate command (even if we detected invalid command). 2. Record command name to make it available for handlers (since now we can't assume that command starts from s->buffer->start).
2013-09-30Mail: added session close on smtp_greeting_delay violation.Maxim Dounin1-0/+1
A server MUST send greeting before other replies, while before this change in case of smtp_greeting_delay violation the 220 greeting was sent after several 503 replies to commands received before greeting, resulting in protocol synchronization loss. Moreover, further commands were accepted after the greeting. While closing a connection isn't strictly RFC compliant (RFC 5321 requires servers to wait for a QUIT before closing a connection), it's probably good enough for practial uses.
2013-09-27SSL: adjust buffer used by OpenSSL during handshake (ticket #413).Maxim Dounin2-0/+27
2013-09-27FastCGI: non-buffered mode support.Maxim Dounin1-8/+230
2013-09-27Upstream: subrequest_in_memory support for SCGI and uwsgi enabled.Maxim Dounin2-14/+0
This was missed in 9d59a8eda373 when non-buffered support was added to SCGI and uwsgi.
2013-09-27Upstream: subrequest_in_memory fix.Maxim Dounin1-4/+6
With previous code only part of u->buffer might be emptied in case of special responses, resulting in partial responses seen by SSI set in case of simple protocols, or spurious errors like "upstream sent invalid chunked response" in case of complex ones.
2013-09-27Upstream: proxy_no_cache, fastcgi_no_cache warnings removed.Maxim Dounin2-12/+0
2013-09-23Proxy: added the "proxy_ssl_ciphers" directive.Piotr Sikora1-0/+22
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-23Added ngx_filename_cmp() with "/" sorted to the left.Maxim Dounin10-17/+51
This patch fixes incorrect handling of auto redirect in configurations like: location /0 { } location /a- { } location /a/ { proxy_pass ... } With previously used sorting, this resulted in the following locations tree (as "-" is less than "/"): "/a-" "/0" "/a/" and a request to "/a" didn't match "/a/" with auto_redirect, as it didn't traverse relevant tree node during lookup (it tested "/a-", then "/0", and then falled back to null location). To preserve locale use for non-ASCII characters on case-insensetive systems, libc's tolower() used.
2013-09-23Caseless location tree construction (ticket #90).Maxim Dounin2-6/+9
Location tree was always constructed using case-sensitive comparison, even on case-insensitive systems. This resulted in incorrect operation if uppercase letters were used in location directives. Notably, the following config: location /a { ... } location /B { ... } failed to properly map requests to "/B" into "location /B".
2013-09-22SSL: stop loading configs with invalid "ssl_ciphers" values.Piotr Sikora2-9/+9
While there, remove unnecessary check in ngx_mail_ssl_module. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-20Core: fix misallocation at ngx_crypt_apr1 (ticket #412).Markus Linnala1-1/+1
Found by using auth_basic.t from mdounin nginx-tests under valgrind. ==10470== Invalid write of size 1 ==10470== at 0x43603D: ngx_crypt_to64 (ngx_crypt.c:168) ==10470== by 0x43648E: ngx_crypt (ngx_crypt.c:153) ==10470== by 0x489D8B: ngx_http_auth_basic_crypt_handler (ngx_http_auth_basic_module.c:297) ==10470== by 0x48A24A: ngx_http_auth_basic_handler (ngx_http_auth_basic_module.c:240) ==10470== by 0x44EAB9: ngx_http_core_access_phase (ngx_http_core_module.c:1121) ==10470== by 0x44A822: ngx_http_core_run_phases (ngx_http_core_module.c:895) ==10470== by 0x44A932: ngx_http_handler (ngx_http_core_module.c:878) ==10470== by 0x455EEF: ngx_http_process_request (ngx_http_request.c:1852) ==10470== by 0x456527: ngx_http_process_request_headers (ngx_http_request.c:1283) ==10470== by 0x456A91: ngx_http_process_request_line (ngx_http_request.c:964) ==10470== by 0x457097: ngx_http_wait_request_handler (ngx_http_request.c:486) ==10470== by 0x4411EE: ngx_epoll_process_events (ngx_epoll_module.c:691) ==10470== Address 0x5866fab is 0 bytes after a block of size 27 alloc'd ==10470== at 0x4A074CD: malloc (vg_replace_malloc.c:236) ==10470== by 0x43B251: ngx_alloc (ngx_alloc.c:22) ==10470== by 0x421B0D: ngx_malloc (ngx_palloc.c:119) ==10470== by 0x421B65: ngx_pnalloc (ngx_palloc.c:147) ==10470== by 0x436368: ngx_crypt (ngx_crypt.c:140) ==10470== by 0x489D8B: ngx_http_auth_basic_crypt_handler (ngx_http_auth_basic_module.c:297) ==10470== by 0x48A24A: ngx_http_auth_basic_handler (ngx_http_auth_basic_module.c:240) ==10470== by 0x44EAB9: ngx_http_core_access_phase (ngx_http_core_module.c:1121) ==10470== by 0x44A822: ngx_http_core_run_phases (ngx_http_core_module.c:895) ==10470== by 0x44A932: ngx_http_handler (ngx_http_core_module.c:878) ==10470== by 0x455EEF: ngx_http_process_request (ngx_http_request.c:1852) ==10470== by 0x456527: ngx_http_process_request_headers (ngx_http_request.c:1283) ==10470==
2013-09-19Proxy: added the "proxy_ssl_protocols" directive.Andrei Belov1-10/+40
2013-09-18SSL: fixed possible memory and file descriptor leak on HUP signal.Piotr Sikora1-0/+2
The problem appeared in 386a06a22c40 (1.3.7). Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-18Fixed response line formatting with empty reason phrase.Sergey Kandaurov1-3/+3
As per RFC 2616 sec 6.1 the response status code is always followed by SP.
2013-09-18Version bump.Sergey Kandaurov1-2/+2
2013-09-16SSL: guard use of SSL_OP_MSIE_SSLV2_RSA_PADDING.Piotr Sikora1-0/+2
This option had no effect since 0.9.7h / 0.9.8b and it was removed in recent OpenSSL. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-16Improved check for duplicate path names in ngx_add_path().Valentin Bartenev1-0/+8
The same path names with different "data" context should not be allowed. In particular it rejects configurations like this: proxy_cache_path /var/cache/ keys_zone=one:10m max_size=1g inactive=5m; proxy_cache_path /var/cache/ keys_zone=two:20m max_size=4m inactive=30s;
2013-09-16Removed surplus initializations from ngx_conf_set_path_slot().Valentin Bartenev1-3/+0
An instance of ngx_path_t is already zeroed by ngx_pcalloc().
2013-09-16Use ngx_pcalloc() in ngx_conf_merge_path_value().Valentin Bartenev1-5/+1
It initializes the "data" pointer of ngx_path_t that will be checked after subsequent changes.
2013-09-16Use EPOLLRDHUP in ngx_http_test_reading() (ticket #320).Valentin Bartenev1-0/+27
This allows to detect client connection close with pending data when the ngx_http_test_reading() request event handler is set.
2013-09-16Upstream: use EPOLLRDHUP to check broken connections (ticket #320).Valentin Bartenev1-0/+49
This allows to detect client connection close with pending data on Linux while processing upstream.
2013-07-12Events: support for EPOLLRDHUP (ticket #320).Valentin Bartenev2-7/+20
Since Linux 2.6.17, epoll is able to report about peer half-closed connection using special EPOLLRDHUP flag on a read event.
2013-09-05Events: removed unused flags from the ngx_event_s structure.Valentin Bartenev1-4/+0
They are not used since 708f8bb772ec (pre 0.0.1).
2013-09-05Fixed handling of the ready flag with kqueue.Valentin Bartenev2-0/+2
There is nothing to do more when recv() has returned 0, so we should drop the flag.
2013-09-03Return reason phrase for 414.Valentin Bartenev1-4/+1
After 62be77b0608f nginx can return this code.
2013-09-04Upstream: fixed $upstream_response_time format specifiers.Maxim Dounin1-1/+1
2013-09-04SSL: clear error queue after SSL_CTX_load_verify_locations().Maxim Dounin1-0/+14
The SSL_CTX_load_verify_locations() may leave errors in the error queue while returning success (e.g. if there are duplicate certificates in the file specified), resulting in "ignoring stale global SSL error" alerts later at runtime.
2013-09-04Fixed incorrect response line on "return 203".Maxim Dounin1-0/+6
Reported by Weibin Yao, http://mailman.nginx.org/pipermail/nginx-devel/2013-April/003607.html.
2013-09-04Request cleanup code unified, no functional changes.Maxim Dounin1-1/+6
Additionally, detaching a cleanup chain from a request is a bit more resilent to various bugs if any.
2013-09-04Handling of ngx_int_t != intptr_t case.Maxim Dounin3-6/+7
Casts between pointers and integers produce warnings on size mismatch. To silence them, cast to (u)intptr_t should be used. Prevoiusly, casts to ngx_(u)int_t were used in some cases, and several ngx_int_t expressions had no casts. As of now it's mostly style as ngx_int_t is defined as intptr_t.
2013-09-04Win32: $request_time fixed.Maxim Dounin2-2/+2
On win32, time_t is 64 bits wide by default, and passing an ngx_msec_int_t argument for %T format specifier doesn't work. This doesn't manifest itself on other platforms as time_t and ngx_msec_int_t are usually of the same size.
2013-09-04Win32: MinGW GCC compatibility.Maxim Dounin14-21/+31
Several warnings silenced, notably (ngx_socket_t) -1 is now checked on socket operations instead of -1, as ngx_socket_t is unsigned on win32 and gcc complains on comparison. With this patch, it's now possible to compile nginx using mingw gcc, with options we normally compile on win32.
2013-09-04Win32: Borland C compatibility fixes.Maxim Dounin8-13/+25
Several false positive warnings silenced, notably W8012 "Comparing signed and unsigned" (due to u_short values promoted to int), and W8072 "Suspicious pointer arithmetic" (due to large type values added to pointers). With this patch, it's now again possible to compile nginx using bcc32, with options we normally compile on win32 minus ipv6 and ssl.
2013-09-04Win32: Open Watcom C compatibility fixes.Maxim Dounin3-2/+16
Precompiled headers are disabled as they lead to internal compiler errors with long configure lines. Couple of false positive warnings silenced. Various win32 typedefs are adjusted to work with Open Watcom C 1.9 headers. With this patch, it's now again possible to compile nginx using owc386, with options we normally compile on win32 minus ipv6 and ssl.
2013-09-02Disable symlinks: removed recursive call of ngx_file_o_path_info().Valentin Bartenev1-1/+0
It is surplus.
2013-09-02Disable symlinks: use O_PATH to open path components.Valentin Bartenev2-0/+70
It was introduced in Linux 2.6.39, glibc 2.14 and allows to obtain file descriptors without actually opening files. Thus made it possible to traverse path with openat() syscalls without the need to have read permissions for path components. It is effectively emulates O_SEARCH which is missing on Linux. O_PATH is used in combination with O_RDONLY. The last one is ignored if O_PATH is used, but it allows nginx to not fail when it was built on modern system (i.e. glibc 2.14+) and run with a kernel older than 2.6.39. Then O_PATH is unknown to the kernel and ignored, while O_RDONLY is used. Sadly, fstat() is not working with O_PATH descriptors till Linux 3.6. As a workaround we fallback to fstatat() with the AT_EMPTY_PATH flag that was introduced at the same time as O_PATH.
2013-09-02Added the NGX_EBADF define.Valentin Bartenev3-1/+3
2013-09-02Assume the HTTP/1.0 version by default.Valentin Bartenev1-0/+1
It is believed to be better than fallback to HTTP/0.9, because most of the clients at present time support HTTP/1.0. It allows nginx to return error response code for them in cases when it fail to parse request line, and therefore fail to detect client protocol version. Even if the client does not support HTTP/1.0, this assumption should not cause any harm, since from the HTTP/0.9 point of view it still a valid response.
2013-08-30Upstream: setting u->header_sent before ngx_http_upstream_upgrade().Maxim Dounin1-2/+2
Without u->header_sent set a special response might be generated following an upgraded connection. The problem appeared in 1ccdda1f37f3 (1.5.3). Catched by "header already sent" alerts in 1.5.4 after upstream timeouts.
2013-08-29Referer: fixed hostname buffer overflow check.Valentin Bartenev1-3/+3
Because of premature check the effective buffer size was 255 symbols while the buffer is able to handle 256.
2013-08-29Referer: "server_names" parsing deferred to merge phase.Sergey Kandaurov1-33/+45
This allows to approach "server_name" values specified below the "valid_referers" directive when used within the "server_names" parameter, e.g.: server_name example.org; valid_referers server_names; server_name example.com; As a bonus, this fixes bogus error with "server_names" specified several times.
2013-08-29Referer: fixed server_name regex matching.Sergey Kandaurov1-22/+67
The server_name regexes are normally compiled for case-sensitive matching. This violates case-insensitive obligations in the referer module. To fix this, the host string is converted to lower case before matching. Previously server_name regex was executed against the whole referer string after dropping the scheme part. This could led to an improper matching, e.g.: server_name ~^localhost$; valid_referers server_names; Referer: http://localhost/index.html It was changed to look only at the hostname part. The server_name regexes are separated into another array to not clash with regular regexes.
generated by cgit (git 2.34.1) at 2025-12-08 08:05:20 +0000