summaryrefslogtreecommitdiffhomepage
path: root/src (follow)
AgeCommit message (Collapse)AuthorFilesLines
2021-09-13HTTP/3: implemented QPACK Huffman encoding for response fields.Sergey Kandaurov1-5/+82
2021-09-09HTTP/3: reading body buffering in filters.Roman Arutyunyan1-3/+35
This change follows similar changes in HTTP/1 and HTTP/2 in 9cf043a5d9ca.
2021-09-09QUIC: removed Firefox workaround for trailing zeroes in datagrams.Sergey Kandaurov1-5/+0
This became unnecessary after discarding invalid packets since a6784cf32c13.
2021-09-09QUIC: macro style.Ruslan Ermilov1-1/+1
2021-09-08Merged with the default branch.Sergey Kandaurov2-56/+30
2021-09-06QUIC: store QUIC connection fd in stream fake connection.Roman Arutyunyan2-6/+8
Previously it had -1 as fd. This fixes proxying, which relies on downstream connection having a real fd. Also, this reduces diff to the default branch for ngx_close_connection().
2021-09-06HTTP/2: optimized processing of small DATA frames.Maxim Dounin1-54/+12
The request body filter chain is no longer called after processing a DATA frame. Instead, we now post a read event to do this. This ensures that multiple small DATA frames read during the same event loop iteration are coalesced together, resulting in much faster processing. Since rb->buf can now contain unprocessed data, window update is no longer sent in ngx_http_v2_state_read_data() in case of flow control being used due to filter buffering. Instead, window will be updated by ngx_http_v2_read_client_request_body_handler() in the posted read event.
2021-09-06HTTP/2: fixed timers left after request body reading.Maxim Dounin1-12/+12
Following rb->filter_need_buffering changes, request body reading is only finished after the filter chain is called and rb->last_saved is set. As such, with r->request_body_no_buffering, timer on fc->read is no longer removed when the last part of the body is received, potentially resulting in incorrect behaviour. The fix is to call ngx_http_v2_process_request_body() from the ngx_http_v2_read_unbuffered_request_body() function instead of directly calling ngx_http_v2_filter_request_body(), so the timer is properly removed.
2021-09-06HTTP/2: fixed window updates when buffering in filters.Maxim Dounin1-2/+18
In the body read handler, the window was incorrectly calculated based on the full buffer size instead of the amount of free space in the buffer. If the request body is buffered by a filter, and the buffer is not empty after the read event is generated by the filter to resume request body processing, this could result in "http2 negative window update" alerts. Further, in the body ready handler and in ngx_http_v2_state_read_data() the buffer wasn't cleared when the data were already written to disk, so the client might stuck without window updates.
2021-09-03QUIC: fixed null pointer dereference in MAX_DATA handler.Mariano Di Martino1-1/+3
If a MAX_DATA frame was received before any stream was created, then the worker process would crash in nginx_quic_handle_max_data_frame() while traversing the stream tree. The issue is solved by adding a check that makes sure the tree is not empty.
2021-09-02Fixed debug logging.Roman Arutyunyan1-2/+2
2021-09-03Version bump.Roman Arutyunyan1-2/+2
2021-09-01Merged with the default branch.Sergey Kandaurov17-215/+535
2021-08-31HTTP/2: avoid memcpy() with NULL source and zero length.Maxim Dounin1-1/+3
Prodded by Clang Static Analyzer.
2021-08-30Give GCC atomics precedence over deprecated Darwin atomic(3).Sergey Kandaurov1-33/+33
This allows to build nginx on macOS with -Wdeprecated-declarations.
2021-08-29Request body: reading body buffering in filters.Maxim Dounin3-26/+182
If a filter wants to buffer the request body during reading (for example, to check an external scanner), it can now do so. To make it possible, the code now checks rb->last_saved (introduced in the previous change) along with rb->rest == 0. Since in HTTP/2 this requires flow control to avoid overflowing the request body buffer, so filters which need buffering have to set the rb->filter_need_buffering flag on the first filter call. (Note that each filter is expected to call the next filter, so all filters will be able set the flag if needed.)
2021-08-29Request body: introduced rb->last_saved flag.Maxim Dounin2-15/+54
It indicates that the last buffer was received by the save filter, and can be used to check this at higher levels. To be used in the following changes.
2021-08-29Request body: added alert to catch duplicate body saving.Maxim Dounin1-0/+6
If due to an error ngx_http_request_body_save_filter() is called more than once with rb->rest == 0, this used to result in a segmentation fault. Added an alert to catch such errors, just in case.
2021-08-29Request body: missing comments about initialization.Maxim Dounin1-0/+2
2021-08-29HTTP/2: improved handling of preread unbuffered requests.Maxim Dounin1-1/+1
Previously, fully preread unbuffered requests larger than client body buffer size were saved to disk, despite the fact that "unbuffered" is expected to imply no disk buffering.
2021-08-29HTTP/2: improved handling of END_STREAM in a separate DATA frame.Maxim Dounin1-0/+3
The save body filter saves the request body to disk once the buffer is full. Yet in HTTP/2 this might happen even if there is no need to save anything to disk, notably when content length is known and the END_STREAM flag is sent in a separate empty DATA frame. Workaround is to provide additional byte in the buffer, so saving the request body won't be triggered. This fixes unexpected request body disk buffering in HTTP/2 observed after the previous change when content length is known and the END_STREAM flag is sent in a separate empty DATA frame.
2021-08-29HTTP/2: reworked body reading to better match HTTP/1.x code.Maxim Dounin1-62/+96
In particular, now the code always uses a buffer limited by client_body_buffer_size. At the cost of an additional copy it ensures that small DATA frames are not directly mapped to small write() syscalls, but rather buffered in memory before writing. Further, requests without Content-Length are no longer forced to use temporary files.
2021-08-29HTTP/2: improved body reading logging.Maxim Dounin1-0/+6
2021-08-20Upstream: fixed timeouts with gRPC, SSL and select (ticket #2229).Maxim Dounin1-0/+4
With SSL it is possible that an established connection is ready for reading after the handshake. Further, events might be already disabled in case of level-triggered event methods. If this happens and ngx_http_upstream_send_request() blocks waiting for some data from the upstream, such as flow control in case of gRPC, the connection will time out due to no read events on the upstream connection. Fix is to explicitly check the c->read->ready flag if sending request blocks and post a read event if it is set. Note that while it is possible to modify ngx_ssl_handshake() to keep read events active, this won't completely resolve the issue, since there can be data already received during the SSL handshake (see 573bd30e46b4).
2021-08-13Mail: Auth-SSL-Protocol and Auth-SSL-Cipher headers (ticket #2134).Rob Mueller1-2/+39
This adds new Auth-SSL-Protocol and Auth-SSL-Cipher headers to the mail proxy auth protocol when SSL is enabled. This can be useful for detecting users using older clients that negotiate old ciphers when you want to upgrade to newer TLS versions of remove suppport for old and insecure ciphers. You can use your auth backend to notify these users before the upgrade that they either need to upgrade their client software or contact your support team to work out an upgrade path.
2021-08-16SSL: ciphers now set before loading certificates (ticket #2035).Maxim Dounin7-43/+43
To load old/weak server or client certificates it might be needed to adjust the security level, as introduced in OpenSSL 1.1.0. This change ensures that ciphers are set before loading the certificates, so security level changes via the cipher string apply to certificate loading.
2021-08-10SSL: removed use of the SSL_OP_MSIE_SSLV2_RSA_PADDING option.Sergey Kandaurov1-5/+0
It has no effect since OpenSSL 0.9.7h and 0.9.8a.
2021-08-10SSL: removed export ciphers support.Sergey Kandaurov2-36/+0
Export ciphers are forbidden to negotiate in TLS 1.1 and later protocol modes. They are disabled since OpenSSL 1.0.2g by default unless explicitly configured with "enable-weak-ssl-ciphers", and completely removed in OpenSSL 1.1.0.
2021-08-10SSL: use of the SSL_OP_IGNORE_UNEXPECTED_EOF option.Sergey Kandaurov1-0/+4
A new behaviour was introduced in OpenSSL 1.1.1e, when a peer does not send close_notify before closing the connection. Previously, it was to return SSL_ERROR_SYSCALL with errno 0, known since at least OpenSSL 0.9.7, and is handled gracefully in nginx. Now it returns SSL_ERROR_SSL with a distinct reason SSL_R_UNEXPECTED_EOF_WHILE_READING ("unexpected eof while reading"). This leads to critical errors seen in nginx within various routines such as SSL_do_handshake(), SSL_read(), SSL_shutdown(). The behaviour was restored in OpenSSL 1.1.1f, but presents in OpenSSL 3.0 by default. Use of the SSL_OP_IGNORE_UNEXPECTED_EOF option added in OpenSSL 3.0 allows to set a compatible behaviour to return SSL_ERROR_ZERO_RETURN: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=09b90e0 See for additional details: https://github.com/openssl/openssl/issues/11381
2021-08-10SSL: silenced warnings when building with OpenSSL 3.0.Sergey Kandaurov1-0/+2
The OPENSSL_SUPPRESS_DEPRECATED macro is used to suppress deprecation warnings. This covers Session Tickets keys, SSL Engine, DH low level API for DHE ciphers. Unlike OPENSSL_API_COMPAT, it works well with OpenSSL built with no-deprecated. In particular, it doesn't unhide various macros in OpenSSL includes, which are meant to be hidden under OPENSSL_NO_DEPRECATED.
2021-08-10SSL: ERR_peek_error_line_data() compatibility with OpenSSL 3.0.Sergey Kandaurov2-1/+6
ERR_peek_error_line_data() was deprecated in favour of ERR_peek_error_all(). Here we use the ERR_peek_error_data() helper to pass only used arguments.
2021-08-10SSL: using SSL_CTX_set0_tmp_dh_pkey() with OpenSSL 3.0 in dhparam.Sergey Kandaurov1-1/+31
Using PEM_read_bio_DHparams() and SSL_CTX_set_tmp_dh() is deprecated as part of deprecating the low level DH functions in favor of EVP_PKEY: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=163f6dc
2021-08-10SSL: SSL_get_peer_certificate() is deprecated in OpenSSL 3.0.Sergey Kandaurov1-0/+5
Switch to SSL_get1_peer_certificate() when building with OpenSSL 3.0 and OPENSSL_NO_DEPRECATED defined.
2021-08-10SSL: RSA data type is deprecated in OpenSSL 3.0.Sergey Kandaurov2-1/+7
The only consumer is a callback function for SSL_CTX_set_tmp_rsa_callback() deprecated in OpenSSL 1.1.0. Now the function is conditionally compiled too.
2021-08-09Disabled HTTP/1.0 requests with Transfer-Encoding.Sergey Kandaurov1-0/+8
The latest HTTP/1.1 draft describes Transfer-Encoding in HTTP/1.0 as having potentially faulty message framing as that could have been forwarded without handling of the chunked encoding, and forbids processing subsequest requests over that connection: https://github.com/httpwg/http-core/issues/879. While handling of such requests is permitted, the most secure approach seems to reject them.
2021-08-04SSL: SSL_CTX_set_tmp_dh() error handling.Sergey Kandaurov1-1/+7
For example, it can fail due to weak DH parameters.
2021-08-03SSL: set events ready flags after handshake.Maxim Dounin1-0/+6
The c->read->ready and c->write->ready flags might be reset during the handshake, and not set again if the handshake was finished on the other event. At the same time, some data might be read from the socket during the handshake, so missing c->read->ready flag might result in a connection hang, for example, when waiting for an SMTP greeting (which was already received during the handshake). Found by Sergey Kandaurov.
2021-08-03Version bump.Maxim Dounin1-2/+2
2021-07-08HTTP/3: bulk parse functions.Roman Arutyunyan4-870/+1068
Previously HTTP/3 streams were parsed by one character. Now all parse functions receive buffers. This should optimize parsing time and CPU load.
2021-08-24QUIC: Stateless Reset Token debug logging cleanup.Sergey Kandaurov1-2/+0
2021-08-24QUIC: removed duplicate logging of Stateless Reset Token.Sergey Kandaurov1-4/+0
2021-08-24HTTP/3: fixed dead store assignment.Sergey Kandaurov1-1/+0
Found by Clang Static Analyzer.
2021-08-24QUIC: fixed dead store assignment.Sergey Kandaurov1-1/+0
Found by Clang Static Analyzer.
2021-08-17QUIC: fixed format specifiers in ngx_quic_bpf module.Sergey Kandaurov1-6/+6
2021-08-10HTTP/3: disabled control characters and space in header names.Sergey Kandaurov1-1/+1
This is a follow up to 41f4bd4c51f1.
2021-08-05HTTP/3: got rid of HTTP/2 module dependency.Vladimir Homutov2-6/+6
The Huffman encoder/decoder now can be built separately from HTTP/2 module.
2021-08-04HTTP/3: replaced macros with values.Roman Arutyunyan2-13/+4
2021-08-05QUIC: asynchronous shutdown.Roman Arutyunyan2-1/+5
Previously, when cleaning up a QUIC stream in shutdown mode, ngx_quic_shutdown_quic() was called, which could close the QUIC connection right away. This could be a problem if the connection was referenced up the stack. For example, this could happen in ngx_quic_init_streams(), ngx_quic_close_streams(), ngx_quic_create_client_stream() etc. With a typical HTTP/3 client the issue is unlikely because of HTTP/3 uni streams which need a posted event to close. In this case QUIC connection cannot be closed right away. Now QUIC connection read event is posted and it will shut down the connection asynchronously.
2021-08-04QUIC: client certificate validation with OCSP.Sergey Kandaurov6-14/+109
2021-07-29HTTP/3: close connection on keepalive_requests * 2.Roman Arutyunyan1-2/+9
After receiving GOAWAY, client is not supposed to create new streams. However, until client reads this frame, we allow it to create new streams, which are gracefully rejected. To prevent client from abusing this algorithm, a new limit is introduced. Upon reaching keepalive_requests * 2, server now closes the entire QUIC connection claiming excessive load.
generated by cgit (git 2.34.1) at 2025-12-15 20:15:45 +0000