summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeLines
* release-1.16.1 tagbranches/stable-1.16Maxim Dounin2019-08-13-0/+1
|
* nginx-1.16.1-RELEASErelease-1.16.1Maxim Dounin2019-08-13-0/+18
|
* HTTP/2: limited number of PRIORITY frames.Ruslan Ermilov2019-08-13-0/+11
| | | | | Fixed excessive CPU usage caused by a peer that continuously shuffles priority of streams. Fix is to limit the number of PRIORITY frames.
* HTTP/2: limited number of DATA frames.Ruslan Ermilov2019-08-13-5/+21
| | | | | | Fixed excessive memory growth and CPU usage if stream windows are manipulated in a way that results in generating many small DATA frames. Fix is to limit the number of simultaneously allocated DATA frames.
* HTTP/2: reject zero length headers with PROTOCOL_ERROR.Sergey Kandaurov2019-08-13-4/+8
| | | | | | Fixed uncontrolled memory growth if peer sends a stream of headers with a 0-length header name and 0-length header value. Fix is to reject headers with zero name length.
* Updated OpenSSL used for win32 builds.Maxim Dounin2019-06-25-1/+1
|
* Version bump.Maxim Dounin2019-08-13-2/+2
|
* release-1.16.0 tagMaxim Dounin2019-04-23-0/+1
|
* nginx-1.16.0-RELEASErelease-1.16.0Maxim Dounin2019-04-23-0/+14
|
* Stable branch.Maxim Dounin2019-04-23-2/+2
|
* release-1.15.12 tagMaxim Dounin2019-04-16-0/+1
|
* nginx-1.15.12-RELEASErelease-1.15.12Maxim Dounin2019-04-16-0/+20
|
* Updated PCRE used for win32 builds.Maxim Dounin2019-04-16-1/+1
|
* Fixed incorrect length handling in ngx_utf8_length().Maxim Dounin2019-04-15-1/+1
| | | | | | | | | | | | | Previously, ngx_utf8_decode() was called from ngx_utf8_length() with incorrect length, potentially resulting in out-of-bounds read when handling invalid UTF-8 strings. In practice out-of-bounds reads are not possible though, as autoindex, the only user of ngx_utf8_length(), provides null-terminated strings, and ngx_utf8_decode() anyway returns an errors when it sees a null in the middle of an UTF-8 sequence. Reported by Yunbin Liu.
* OCSP stapling: fixed segfault with dynamic certificate loading.Maxim Dounin2019-04-15-0/+5
| | | | | | | | | | | | | If OCSP stapling was enabled with dynamic certificate loading, with some OpenSSL versions (1.0.2o and older, 1.1.0h and older; fixed in 1.0.2p, 1.1.0i, 1.1.1) a segmentation fault might happen. The reason is that during an abbreviated handshake the certificate callback is not called, but the certificate status callback was called (https://github.com/openssl/openssl/issues/1662), leading to NULL being returned from SSL_get_certificate(). Fix is to explicitly check SSL_get_certificate() result.
* Version bump.Maxim Dounin2019-04-15-2/+2
|
* release-1.15.11 tagMaxim Dounin2019-04-09-0/+1
|
* nginx-1.15.11-RELEASErelease-1.15.11Maxim Dounin2019-04-09-0/+14
|
* Win32: avoid using CFLAGS, just add define instead.Maxim Dounin2019-04-04-2/+1
| | | | | | | With CFLAGS set as in 7da71a7b141a, OpenSSL compilation drops various non-important compiler options. To avoid this, a define is added instead - OpenSSL is smart enough to recognize -D... in Configure arguments.
* Win32: defined pdb path.Maxim Dounin2019-04-04-1/+1
| | | | | By default, MSVC uses vc<version>.pdb in the current directory. With the "-Fd" switch it is directed to be in the objs directory instead.
* Win32: preserving binary compatibility with Windows XP - Vista.Sergey Kandaurov2019-04-04-1/+2
| | | | | | | | | OpenSSL 1.1.0 and above uses BCrypt if available (Windows 7 or higher). This results in an unusable binary on older Windows versions, when building with newer Windows SDK (such as 7.0A). Using CFLAGS to define _WIN32_WINNT allows to set a desired ABI and make sure the binary works with Windows XP. To not mix with other potential CFLAGS uses, it is set in GNUmakefile.
* Win32: skip building OpenSSL tests to conserve time and space.Sergey Kandaurov2019-04-04-1/+1
| | | | | | | | When building OpenSSL 1.1.1b, as used for win32 builds, with tests it takes about twice as long and near ~1GB of additional disk space. Using "no-tests" OpenSSL configuration option allows to skip them. Since such an option is supported since OpenSSL 1.1.1 only, it is residing here and not in configure.
* OCSP stapling: open ssl_stapling_file in binary-mode.Sergey Kandaurov2019-04-03-1/+1
| | | | | OCSP response uses the DER format and as such needs to be opened in binary-mode. This only has any effect under Win32.
* SSL: missing free calls in $ssl_client_s_dn and $ssl_client_i_dn.Nikolay Morozov2019-03-26-0/+2
| | | | | | | | If X509_get_issuer_name() or X509_get_subject_name() returned NULL, this could lead to a certificate reference leak. It cannot happen in practice though, since each function returns an internal pointer to a mandatory subfield of the certificate successfully decoded by d2i_X509() during certificate message processing (closes #1751).
* Version bump.Sergey Kandaurov2019-03-26-2/+2
|
* release-1.15.10 tagMaxim Dounin2019-03-26-0/+1
|
* nginx-1.15.10-RELEASErelease-1.15.10Maxim Dounin2019-03-26-0/+60
|
* Listen port ranges.Roman Arutyunyan2019-03-06-29/+119
| | | | | | | | | | A range is specified with a dash. For each port in a range a separate listen socket is created. Examples: listen 8080-9000; listen example.com:80-88;
* Removed sorting of getaddrinfo() results.Roman Arutyunyan2019-03-20-14/+5
| | | | | | | | | | Previously the ngx_inet_resolve_host() function sorted addresses in a way that IPv4 addresses came before IPv6 addresses. This was implemented in eaf95350d75c (1.3.10) along with the introduction of getaddrinfo() which could resolve host names to IPv6 addresses. Since the "listen" directive only used the first address, sorting allowed to preserve "listen" compatibility with the previous behavior and with the behavior of nginx built without IPv6 support. Now "listen" uses all resolved addresses which makes sorting pointless.
* Multiple addresses in "listen".Roman Arutyunyan2019-03-15-427/+276
| | | | | | Previously only one address was used by the listen directive handler even if host name resolved to multiple addresses. Now a separate listening socket is created for each address.
* SSL: support for parsing PEM certificates from memory.Maxim Dounin2019-03-09-25/+43
| | | | | | This makes it possible to provide certificates directly via variables in ssl_certificate / ssl_certificate_key directives, without using intermediate files.
* SSL: removed redundant "pkey" variable.Maxim Dounin2019-03-09-3/+2
| | | | | | | | | It was accidentally introduced in 77436d9951a1 (1.15.9). In MSVC 2015 and more recent MSVC versions it triggers warning C4456 (declaration of 'pkey' hides previous local declaration). Previously, all such warnings were resolved in 2a621245f4cf. Reported by Steve Stevenson.
* SSL: moved c->ssl->handshaked check in server name callback.Maxim Dounin2019-03-05-6/+6
| | | | | | | | | Server name callback is always called by OpenSSL, even if server_name extension is not present in ClientHello. As such, checking c->ssl->handshaked before the SSL_get_servername() result should help to more effectively prevent renegotiation in OpenSSL 1.1.0 - 1.1.0g, where neither SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS nor SSL_OP_NO_RENEGOTIATION is available.
* SSL: use of the SSL_OP_NO_CLIENT_RENEGOTIATION option.Maxim Dounin2019-03-03-0/+4
| | | | | | The SSL_OP_NO_CLIENT_RENEGOTIATION option was introduced in LibreSSL 2.5.1. Unlike OpenSSL's SSL_OP_NO_RENEGOTIATION, it only disables client-initiated renegotiation, and hence can be safely used on all SSL contexts.
* SSL: fixed potential leak on memory allocation errors.Maxim Dounin2019-03-03-8/+15
| | | | | | | | | If ngx_pool_cleanup_add() fails, we have to clean just created SSL context manually, thus appropriate call added. Additionally, ngx_pool_cleanup_add() moved closer to ngx_ssl_create() in the ngx_http_ssl_module, to make sure there are no leaks due to intermediate code.
* SSL: server name callback changed to return fatal errors.Maxim Dounin2019-03-03-7/+28
| | | | | | | | | Notably this affects various allocation errors, and should generally improve things if an allocation error actually happens during a callback. Depending on the OpenSSL version, returning an error can result in either SSL_R_CALLBACK_FAILED or SSL_R_CLIENTHELLO_TLSEXT error from SSL_do_handshake(), so both errors were switched to the "info" level.
* SSL: server name callback changed to return SSL_TLSEXT_ERR_OK.Maxim Dounin2019-03-03-6/+25
| | | | | | | | | | | | | | OpenSSL 1.1.1 does not save server name to the session if server name callback returns anything but SSL_TLSEXT_ERR_OK, thus breaking the $ssl_server_name variable in resumed sessions. Since $ssl_server_name can be used even if we've selected the default server and there are no other servers, it looks like the only viable solution is to always return SSL_TLSEXT_ERR_OK regardless of the actual result. To fix things in the stream module as well, added a dummy server name callback which always returns SSL_TLSEXT_ERR_OK.
* Version bump.Maxim Dounin2019-03-03-2/+2
|
* release-1.15.9 tagMaxim Dounin2019-02-26-0/+1
|
* nginx-1.15.9-RELEASErelease-1.15.9Maxim Dounin2019-02-26-0/+53
|
* Updated OpenSSL used for win32 builds.Maxim Dounin2019-02-26-1/+1
|
* SSL: fixed possible segfault with dynamic certificates.Maxim Dounin2019-02-25-4/+4
| | | | | | | | | | A virtual server may have no SSL context if it does not have certificates defined, so we have to use config of the ngx_http_ssl_module from the SSL context in the certificate callback. To do so, it is now passed as the argument of the callback. The stream module doesn't really need any changes, but was modified as well to match http code.
* SSL: adjusted session id context with dynamic certificates.Maxim Dounin2019-02-25-8/+31
| | | | | | | | | | | | Dynamic certificates re-introduce problem with incorrect session reuse (AKA "virtual host confusion", CVE-2014-3616), since there are no server certificates to generate session id context from. To prevent this, session id context is now generated from ssl_certificate directives as specified in the configuration. This approach prevents incorrect session reuse in most cases, while still allowing sharing sessions across multiple machines with ssl_session_ticket_key set as long as configurations are identical.
* SSL: dynamic certificate loading in the stream module.Maxim Dounin2019-02-25-4/+179
|
* SSL: passwords support for dynamic certificate loading.Maxim Dounin2019-02-25-2/+77
| | | | | | | | | | Passwords have to be copied to the configuration pool to be used at runtime. Also, to prevent blocking on stdin (with "daemon off;") an empty password list is provided. To make things simpler, password handling was modified to allow an empty array (with 0 elements and elts set to NULL) as an equivalent of an array with 1 empty password.
* SSL: variables support in ssl_certificate and ssl_certificate_key.Maxim Dounin2019-02-25-23/+224
| | | | | | | | | | To evaluate variables, a request is created in the certificate callback, and then freed. To do this without side effects on the stub_status counters and connection state, an additional function was introduced, ngx_http_alloc_request(). Only works with OpenSSL 1.0.2+, since there is no SSL_CTX_set_cert_cb() in older versions.
* SSL: loading of connection-specific certificates.Maxim Dounin2019-02-25-0/+78
|
* SSL: reworked ngx_ssl_certificate().Maxim Dounin2019-02-25-103/+186
| | | | | | | | | This makes it possible to reuse certificate loading at runtime, as introduced in the following patches. Additionally, this improves error logging, so nginx will now log human-friendly messages "cannot load certificate" instead of only referring to sometimes cryptic names of OpenSSL functions.
* SSL: removed logging of empty "(SSL:)" in ngx_ssl_error().Maxim Dounin2019-02-25-22/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "(SSL:)" snippet currently appears in logs when nginx code uses ngx_ssl_error() to log an error, but OpenSSL's error queue is empty. This can happen either because the error wasn't in fact from OpenSSL, or because OpenSSL did not indicate the error in the error queue for some reason. In particular, currently "(SSL:)" can be seen in errors at least in the following cases: - When SSL_write() fails due to a syscall error, "[info] ... SSL_write() failed (SSL:) (32: Broken pipe)...". - When loading a certificate with no data in it, "[emerg] PEM_read_bio_X509_AUX(...) failed (SSL:)". This can easily happen due to an additional empty line before the end line, so all lines of the certificate are interpreted as header lines. - When trying to configure an unknown curve, "[emerg] SSL_CTX_set1_curves_list("foo") failed (SSL:)". Likely there are other cases as well. With this change, "(SSL:...)" will be only added to the error message if there is something in the error queue. This is expected to make logs more readable in the above cases. Additionally, with this change it is now possible to use ngx_ssl_error() to log errors when some of the possible errors are not from OpenSSL and not expected to have anything in the error queue.
* Style.Maxim Dounin2019-02-25-0/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-18 17:15:03 +0000