summaryrefslogtreecommitdiffhomepage
path: root/src (follow)
AgeCommit message (Collapse)AuthorFilesLines
2016-07-26Version bump.Vladimir Homutov1-2/+2
2016-07-06Fixed regex captures handling without PCRE.Vladimir Homutov2-12/+16
If PCRE is disabled, captures were treated as normal variables in ngx_http_script_compile(), while code calculating flushes array length in ngx_http_compile_complex_value() did not account captures as variables. This could lead to write outside of the array boundary when setting last element to -1. Found with AddressSanitizer.
2016-06-14Stream: variables in proxy_pass and proxy_ssl_name.Vladimir Homutov4-53/+476
2016-07-19HTTP/2: flushing of the SSL buffer in transition to the idle state.Valentin Bartenev1-2/+18
It fixes potential connection leak if some unsent data was left in the SSL buffer. Particularly, that could happen when a client canceled the stream after the HEADERS frame has already been created. In this case no other frames might be produced and the HEADERS frame alone didn't flush the buffer.
2016-07-19HTTP/2: refactored ngx_http_v2_send_output_queue().Valentin Bartenev1-10/+10
Now it returns NGX_AGAIN if there's still data to be sent.
2016-07-19HTTP/2: fixed send timer handling.Valentin Bartenev1-1/+1
Checking for return value of c->send_chain() isn't sufficient since there are data can be left in the SSL buffer. Now the wew->ready flag is used instead. In particular, this fixed a connection leak in cases when all streams were closed, but there's still some data to be sent in the SSL buffer and the client forgot about the connection.
2016-07-19HTTP/2: avoid sending output queue if there's nothing to send.Valentin Bartenev1-0/+10
Particularly this fixes alerts on OS X and NetBSD systems when HTTP/2 is configured over plain TCP sockets. On these systems calling writev() with no data leads to EINVAL errors being logged as "writev() failed (22: Invalid argument) while processing HTTP/2 connection".
2016-07-19HTTP/2: always handle streams in error state.Valentin Bartenev1-6/+8
Previously, a stream could be closed by timeout if it was canceled while its send window was exhausted.
2016-07-19HTTP/2: prevented output of the HEADERS frame for canceled streams.Valentin Bartenev1-2/+6
It's useless to generate HEADERS if the stream has been canceled already.
2016-07-19HTTP/2: always send GOAWAY while worker is shutting down.Valentin Bartenev1-1/+1
Previously, if the worker process exited, GOAWAY was sent to connections in idle state, but connections with active streams were closed without GOAWAY.
2016-07-15Events: support for EPOLLEXCLUSIVE.Valentin Bartenev3-3/+41
This flag appeared in Linux 4.5 and is useful for avoiding thundering herd problem. The current Linux kernel implementation walks the list of exclusive waiters, and queues an event to each epfd, until it finds the first waiter that has threads blocked on it via epoll_wait().
2016-07-15Style: sorted epoll flags.Valentin Bartenev1-3/+3
2016-07-15Events: the "accept_mutex" directive is turned off by default.Valentin Bartenev1-1/+1
Now it is believed that the accept mutex brings more harm than benefits. Especially in various benchmarks it often results in situation where only one worker grabs all connections.
2016-07-12Stream: split_clients module.Vladimir Homutov1-0/+244
2016-06-30Stream: geo module.Vladimir Homutov1-0/+1572
2016-07-12Stream: geoip module.Vladimir Homutov1-0/+814
2016-07-12Stream: style.Vladimir Homutov7-7/+7
2016-07-07HTTP/2: avoid left-shifting signed integer into the sign bit.Sergey Kandaurov1-1/+1
On non-aligned platforms, properly cast argument before left-shifting it in ngx_http_v2_parse_uint32 that is used with u_char. Otherwise it propagates to int to hold the value and can step over the sign bit. Usually, on known compilers, this results in negation. Furthermore, a subsequent store into a wider type, that is ngx_uint_t on 64-bit platforms, results in sign-extension. In practice, this can be observed in debug log as a very large exclusive bit value, when client sent PRIORITY frame with exclusive bit set: : *14 http2 PRIORITY frame sid:5 on 1 excl:8589934591 weight:17 Found with UndefinedBehaviorSanitizer.
2016-07-07Avoid left-shifting integers into the sign bit, which is undefined.Sergey Kandaurov4-16/+16
Found with UndefinedBehaviorSanitizer.
2016-07-07Stream: resolver.Vladimir Homutov2-0/+63
2016-07-06Use NGX_MAX_PATH_LEVEL where appropriate.Ruslan Ermilov3-17/+16
The macro was unused since 0.7.44.
2016-07-06Version bump.Ruslan Ermilov1-2/+2
2016-05-18Stream: return module.Roman Arutyunyan1-0/+207
2016-06-29Stream: SSL-related variables.Vladimir Homutov1-1/+114
2016-06-29Stream: got rid of pseudo variables.Vladimir Homutov3-92/+124
Stream limit_conn, upstream_hash and proxy modules now use complex values.
2016-06-29Stream: map module.Vladimir Homutov1-0/+574
2016-06-14Stream: core module variables.Vladimir Homutov1-0/+350
2016-07-04Stream: variables and script.Vladimir Homutov8-57/+1845
This is a port of corresponding http code with unrelated features excluded.
2016-06-15Stream: added preconfiguration step.Vladimir Homutov11-2/+27
2016-07-02Sub filter: eliminate unnecessary buffering.Roman Arutyunyan1-4/+37
Previously, when a buffer was processed by the sub filter, its final bytes could be buffered by the filter even if they don't match any pattern. This happened because the Boyer-Moore algorithm, employed by the sub filter since b9447fc457b4 (1.9.4), matches the last characters of patterns prior to checking other characters. If the last character is out of scope, initial bytes of a potential match are buffered until the last character is available. Now, after receiving a flush or recycled buffer, the filter performs additional checks to reduce the number of buffered bytes. The potential match is checked against the initial parts of all patterns. Non-matching bytes are not buffered. This improves processing of a chunked response from upstream by sending the entire chunks without buffering unless a partial match is found at the end of a chunk.
2016-07-02Sub filter: introduced the ngx_http_sub_match() function.Roman Arutyunyan1-31/+52
No functional changes.
2016-06-30Internal md5 and sha1 implementations are now always used.Maxim Dounin5-75/+0
This reduces the number of moving parts in ABI compatibility checks. Additionally, it also allows to use OpenSSL in FIPS mode while still using md5 for non-security tasks.
2016-06-29Removed unused flag accept_context_updated from ngx_event_t.Ruslan Ermilov3-11/+2
Also, removed practically unused flag accept_context_updated from ngx_connection_t.
2016-06-27Style.Roman Arutyunyan1-10/+10
2016-06-22HTTP/2: style.Piotr Sikora1-6/+4
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
2016-06-22Style.Roman Arutyunyan1-1/+0
2016-06-22Stream: use ngx_pcalloc() in ngx_stream_proxy_bind().Roman Arutyunyan1-1/+1
2016-06-20Fixed build on MSVC.Roman Arutyunyan2-2/+2
2016-06-20Stream: set SO_REUSEADDR for UDP upstream sockets.Roman Arutyunyan1-1/+25
The option is only set if the socket is bound to a specific port to allow several such sockets coexist at the same time. This is required, for example, when nginx acts as a transparent proxy and receives two datagrams from the same client in a short time. The feature is only implemented for Linux.
2016-06-20Stream: support for $remote_port in proxy_bind.Roman Arutyunyan1-9/+20
The following two types of bind addresses are supported in addition to $remote_addr and address literals: - $remote_addr:$remote_port - [$remote_addr]:$remote_port In both cases client remote address with port is used in upstream socket bind.
2016-06-20Upstream: support for port in proxy_bind and friends.Roman Arutyunyan2-3/+5
2016-06-20Introduced ngx_inet_get_port() and ngx_inet_set_port() functions.Roman Arutyunyan15-317/+90
2016-06-20Set IP_BIND_ADDRESS_NO_PORT socket option for upstream sockets.Andrei Belov1-0/+26
2016-06-15SSL: ngx_ssl_ciphers() to set list of ciphers.Tim Taubert8-62/+40
This patch moves various OpenSSL-specific function calls into the OpenSSL module and introduces ngx_ssl_ciphers() to make nginx more crypto-library-agnostic.
2016-06-16HTTP/2: fixed the "http request count is zero" alert.Valentin Bartenev1-0/+1
When the stream is terminated the HEADERS frame can still wait in the output queue. This frame can't be removed and must be sent to the client anyway, since HTTP/2 uses stateful compression for headers. So in order to postpone closing and freeing memory of such stream the special close stream handler is set to the write event. After the HEADERS frame is sent the write event is called and the stream will be finally closed. Some events like receiving a RST_STREAM can trigger the read handler of such stream in closing state and cause unexpected processing that can result in another attempt to finalize the request. To prevent it the read handler is now set to ngx_http_empty_handler. Thanks to Amazon.
2016-06-16HTTP/2: avoid adding Content-Length for requests without body.Valentin Bartenev1-2/+4
There is no reason to add the "Content-Length: 0" header to a proxied request without body if the header isn't presented in the original request. Thanks to Amazon.
2016-06-16HTTP/2: prevented double termination of a stream.Valentin Bartenev1-0/+5
According to RFC 7540, an endpoint should not send more than one RST_STREAM frame for any stream. Also, now all the data frames will be skipped while termination.
2016-06-16HTTP/2: fixed a segfault while processing unbuffered upload.Valentin Bartenev1-4/+0
The ngx_http_v2_finalize_connection() closes current stream, but that is an invalid operation while processing unbuffered upload. This results in access to already freed memory, since the upstream module sets a cleanup handler that also finalizes the request.
2016-06-09An internal SHA1 implementation.Maxim Dounin3-13/+319
2016-06-08Fixed spelling.Otto Kekäläinen1-1/+1
generated by cgit (git 2.34.1) at 2025-12-08 12:58:57 +0000