Commit Graph

188 Commits

Author SHA1 Message Date
Maxim Dounin
52c5ba0f37 Mail: fixed buffer allocation for CRLF after Auth-SMTP-* headers.
There were no buffer overruns in real life as there is extra space
allocated for the Auth-Login-Attempt counter.
2015-02-25 17:47:43 +03:00
Ruslan Ermilov
2b7e167dbb Mail: fixed the duplicate listen address detection. 2015-01-23 15:23:29 +03:00
Ruslan Ermilov
0b30dec0d3 Mail: fixed a comment. 2015-01-23 15:23:27 +03:00
Valentin Bartenev
3ca3f609cb Mail: initialize the "signature" field of ngx_mail_session_t.
Currently it isn't used, but it can be suitable to distinguish
objects stored in c->data.
2014-09-01 17:50:59 +04:00
Valentin Bartenev
c7efcf6ba6 Mail: fixed number of arguments allowed in the listen directive. 2014-08-20 13:13:27 +04:00
Valentin Bartenev
8575dc3516 Mail: fixed a comment.
There's no loc_conf in the mail module.
2014-08-20 13:13:27 +04:00
Maxim Dounin
44f45a5466 Mail: discard pipelined commands after SMTP STARTTLS.
The bug had appeared in nginx 1.5.6 (04e43d03e153).

Reported by Chris Boulton.
2014-08-05 12:22:07 +04:00
Valentin Bartenev
9f8785ae5e SSL: the "ssl_password_file" directive. 2014-06-16 19:43:25 +04:00
Ruslan Ermilov
7808ac0d42 Mail: output client port number on client connects (ticket #531). 2014-05-22 00:16:17 +04:00
Maxim Dounin
ca02a1020c Mail: added a check for the number of arguments in MAIL/RCPT.
Missed during introduction of the SMTP pipelining support (04e43d03e153,
1.5.6).  Previously, the check wasn't needed as s->buffer was used directly
and the number of arguments didn't matter.

Reported by Svyatoslav Nikolsky.
2014-05-21 21:56:20 +04:00
Ruslan Ermilov
5a3d4410cc Style: use %N instead of '\n' where appropriate. 2014-05-14 22:26:30 +04:00
Maxim Dounin
e042fc9038 Mail: fixed ngx_mail_send() (ticket #519). 2014-03-31 21:38:27 +04:00
Sergey Kandaurov
bd3516e8d9 Fixed format specifier in logging of "c->number". 2014-03-06 18:25:59 +04:00
Ruslan Ermilov
8b7fe56e95 Mail: fixed passing of IPv6 client address in XCLIENT. 2014-01-17 22:06:04 +04:00
Dirkjan Bussink
58a240d773 SSL: ssl_session_tickets directive.
This adds support so it's possible to explicitly disable SSL Session
Tickets. In order to have good Forward Secrecy support either the
session ticket key has to be reloaded by using nginx' binary upgrade
process or using an external key file and reloading the configuration.
This directive adds another possibility to have good support by
disabling session tickets altogether.

If session tickets are enabled and the process lives for a long a time,
an attacker can grab the session ticket from the process and use that to
decrypt any traffic that occured during the entire lifetime of the
process.
2014-01-10 16:12:40 +01:00
Ruslan Ermilov
769eded732 Resolver: implemented IPv6 name to address resolving. 2013-12-09 10:53:28 +04:00
Ruslan Ermilov
3aeefbcaea Changed resolver API to use ngx_addr_t. 2013-12-06 14:30:27 +04:00
Piotr Sikora
79be6a5462 SSL: added ability to set keys used for Session Tickets (RFC5077).
In order to support key rollover, ssl_session_ticket_key can be defined
multiple times. The first key will be used to issue and resume Session
Tickets, while the rest will be used only to resume them.

    ssl_session_ticket_key  session_tickets/current.key;
    ssl_session_ticket_key  session_tickets/prev-1h.key;
    ssl_session_ticket_key  session_tickets/prev-2h.key;

Please note that nginx supports Session Tickets even without explicit
configuration of the keys and this feature should be only used in setups
where SSL traffic is distributed across multiple nginx servers.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-10-11 16:05:24 -07:00
Maxim Dounin
ef8c64acbe Mail: fixed segfault with ssl/starttls at mail{} level and no cert.
A configuration like "mail { starttls on; server {}}" triggered NULL
pointer dereference in ngx_mail_ssl_merge_conf() as conf->file was not set.
2013-09-30 22:10:13 +04:00
Maxim Dounin
aa36cc39a4 Mail: fixed overrun of allocated memory (ticket #411).
Reported by Markus Linnala.
2013-09-30 22:10:08 +04:00
Maxim Dounin
f2b5192c30 Mail: handle smtp multiline replies.
See here for details:

http://nginx.org/pipermail/nginx/2010-August/021713.html
http://nginx.org/pipermail/nginx/2010-August/021784.html
http://nginx.org/pipermail/nginx/2010-August/021785.html
2013-09-30 22:10:03 +04:00
Maxim Dounin
4f6f653f48 Mail: smtp pipelining support.
Basically, this does the following two changes (and corresponding
modifications of related code):

1. Does not reset session buffer unless it's reached it's end, and always
wait for LF to terminate command (even if we detected invalid command).

2. Record command name to make it available for handlers (since now we
can't assume that command starts from s->buffer->start).
2013-09-30 22:09:57 +04:00
Maxim Dounin
32d6035303 Mail: added session close on smtp_greeting_delay violation.
A server MUST send greeting before other replies, while before this
change in case of smtp_greeting_delay violation the 220 greeting was
sent after several 503 replies to commands received before greeting,
resulting in protocol synchronization loss.  Moreover, further commands
were accepted after the greeting.

While closing a connection isn't strictly RFC compliant (RFC 5321
requires servers to wait for a QUIT before closing a connection), it's
probably good enough for practial uses.
2013-09-30 22:09:50 +04:00
Piotr Sikora
f52a2c7585 SSL: stop loading configs with invalid "ssl_ciphers" values.
While there, remove unnecessary check in ngx_mail_ssl_module.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-22 22:36:11 -07:00
Maxim Dounin
d10251030a Style. 2013-07-11 20:38:27 +04:00
Vladimir Homutov
af18946d76 Core: extended ngx_sock_ntop() with socklen parameter.
On Linux, sockaddr length is required to process unix socket addresses properly
due to unnamed sockets (which don't have sun_path set at all) and abstract
namespace sockets.
2013-07-11 16:07:25 +04:00
Maxim Dounin
2b356db155 Mail: fixed possible uninitialized memory access.
Found by Valgrind.
2013-06-05 19:44:23 +04:00
Piotr Sikora
c3d20f52d0 Style: remove unnecessary references to HTTP from non-HTTP modules.
No functional changes.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-21 18:43:43 -07:00
F. da Silva
2b1779b916 Mail: missing ngx_ssl_ecdh_curve() call. 2013-05-10 16:53:45 +02:00
Filipe Da Silva
8597218f38 Mail: removed surplus ngx_close_connection() call.
It is already called for a peer connection a few lines above.
2013-05-09 10:54:28 +02:00
Ruslan Ermilov
4f2d6513dc Mail: IPv6 backends (ticket #323). 2013-03-25 13:38:59 +00:00
Ruslan Ermilov
b8a90c6903 Implemented IPv6 support for URLs specified using domain names.
This includes "debug_connection", upstreams, "proxy_pass", etc.
(ticket #92)

To preserve compatibility, "listen" specified with a domain name
selects the first IPv4 address, if available.  If not available,
the first IPv6 address will be used (ticket #186).
2012-12-17 12:08:53 +00:00
Maxim Dounin
83e35f6f22 Whitespace fix. 2012-08-18 23:04:39 +00:00
Ruslan Ermilov
53b8514f2d Mail: fixed handling of AF_UNIX addresses in "listen".
This makes AF_UNIX addresses in mail officially supported.
2012-08-17 05:21:28 +00:00
Ruslan Ermilov
ff3236e7a7 Removed a stale "AF_INET only" comment.
IPv6 client connections in mail modules have been supported since r2856.
2012-08-17 05:14:19 +00:00
Ruslan Ermilov
f12c7563e2 Mail: fixed sorting of listen addresses (ticket #187).
For http module this problem was already fixed in r4756.
2012-08-17 05:08:42 +00:00
Ruslan Ermilov
9aac01a76e mail_core: don't let the well-known port in the "listen" directive to
override the already set "protocol".
2012-08-15 11:30:24 +00:00
Ruslan Ermilov
89ad2e91e5 Corrected the directive name in the ngx_mail_auth_http_module error message. 2012-08-15 11:17:55 +00:00
Ruslan Ermilov
deaf22d220 Core: ipv6only is now on by default.
There is a general consensus that this change results in better
consistency between different operating systems and differently
tuned operating systems.

Note: this changes the width and meaning of the ipv6only field
of the ngx_listening_t structure.  3rd party modules that create
their own listening sockets might need fixing.
2012-07-30 12:27:06 +00:00
Ruslan Ermilov
1efcca36cc Fixed compilation with -Wmissing-prototypes. 2012-07-24 15:09:54 +00:00
Maxim Dounin
ee187436af Whitespace fixes. 2012-03-05 18:09:06 +00:00
Ruslan Ermilov
b74f8ffce4 Fixed spelling in single-line comments. 2012-02-28 11:31:05 +00:00
Maxim Dounin
9f38b20db5 Time parsing cleanup.
Nuke NGX_PARSE_LARGE_TIME, it's not used since 0.6.30.  The only error
ngx_parse_time() can currently return is NGX_ERROR, check it explicitly
and make sure to cast it to appropriate type (either time_t or ngx_msec_t)
to avoid signedness warnings on platforms with unsigned time_t (notably QNX).
2012-02-13 15:41:11 +00:00
Maxim Konovalov
f8d59e33f3 Copyright updated. 2012-01-18 15:07:43 +00:00
Maxim Dounin
4efcbce328 Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.
Support for TLSv1.1 and TLSv1.2 protocols was introduced in OpenSSL 1.0.1
(-beta1 was recently released).  This change makes it possible to disable
these protocols and/or enable them without other protocols.
2012-01-11 11:15:00 +00:00
Valentin Bartenev
92edf47ff9 Added the "so_keepalive=" parameter to the "listen" directive.
The "so_keepalive" directive in mail module was deprecated.

Thanks to Vsevolod Stakhov for initial work.
2011-12-05 08:06:15 +00:00
Sergey Budnevitch
66a60a62cc Fixed NGX_CONF_TAKE1/NGX_CONF_FLAG misuse. 2011-11-14 09:12:15 +00:00
Ruslan Ermilov
f12d6ceb65 Fixed port range checking. 2011-10-25 13:48:43 +00:00
Igor Sysoev
620718102b Support of several servers in the "resolver" directive.
Patch by Kirill A. Korinskiy.
2011-10-24 16:09:05 +00:00
Maxim Dounin
554768dabb Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993). 2011-09-27 12:06:07 +00:00
Igor Sysoev
dfd81a23b2 A new fix for the case when ssl_session_cache defined, but ssl is not
enabled in any server. The previous r1033 does not help when unused zone
becomes used after reconfiguration, so it is backed out.

The initial thought was to make SSL modules independed from SSL implementation
and to keep OpenSSL code dependance as much as in separate files.
2011-08-04 11:12:30 +00:00
Igor Sysoev
f39642a907 ECDHE support
patch by Adrian Kotelba
2011-07-20 15:42:40 +00:00
Igor Sysoev
e61ba26744 MSIE export versions are rare now, so RSA 512 key is generated on demand
and is shared among all hosts instead of pregenerating for every HTTPS host
on configuraiton phase. This decreases start time for configuration with
large number of HTTPS hosts.
2011-07-20 12:59:24 +00:00
Igor Sysoev
8d7b1d222e use !aNULL to disable all anonymous cipher suites
patch by Rob Stradling
2011-06-27 15:47:51 +00:00
Igor Sysoev
aa6936e61a style fix 2010-06-23 16:34:54 +00:00
Igor Sysoev
05b1a8f1e3 ngx_str_set() and ngx_str_null() 2010-05-14 09:56:37 +00:00
Igor Sysoev
ab4c0d3628 Zimbra IMAP server may return only 4 bytes: "+ \r\n" 2010-04-23 09:53:52 +00:00
Igor Sysoev
070f0a865b delete surplus code 2010-02-12 09:48:04 +00:00
Igor Sysoev
280e5e7072 use "localhost" in "Host" header line, if unix socket is used in "auth_http" 2009-12-25 15:43:40 +00:00
Igor Sysoev
a59ba33060 *) fix resolving an empty name ("."),
*) add quotes in an error message,
*) backout r3299 in ngx_mail_smtp_handler.c
2009-11-09 19:15:11 +00:00
Igor Sysoev
70966c154f fix "PTR ." case in address resolver 2009-11-09 18:04:05 +00:00
Igor Sysoev
0c189c5159 rename ngx_peer_addr_t to ngx_addr_t 2009-11-02 15:14:17 +00:00
Igor Sysoev
0f25ed3d77 replace inet_addr() with ngx_inet_addr() 2009-11-02 13:51:10 +00:00
Igor Sysoev
3bed0daced use only strong ciphers by default 2009-10-07 14:46:13 +00:00
Igor Sysoev
cf9dd76b43 disable SSLv2 and low ciphers by default 2009-10-06 14:24:53 +00:00
Igor Sysoev
80c3e8e03b delete OpenSSL pre-0.9.7 compatibility: the sources were not actually
compatible with OpenSSL 0.9.6 since ssl_session_cache introduction
2009-07-23 12:54:20 +00:00
Igor Sysoev
a5fe5881c6 ignore ngx_atomic_fetch_add() result
this fixes building at least by gcc 4.2.1 on Mac OS X 10.6
2009-06-18 13:14:51 +00:00
Igor Sysoev
260c4321d7 return NULL instead of NGX_CONF_ERROR on a create conf failure 2009-06-02 16:09:44 +00:00
Igor Sysoev
610cbd4223 mail proxy listen IPv6 support 2009-05-18 12:20:22 +00:00
Igor Sysoev
ee4be0345f ngx_create_listening() 2009-05-05 17:33:26 +00:00
Igor Sysoev
6efa56fe7f delete ngx_listening_inet_stream_socket() 2009-05-04 19:51:09 +00:00
Igor Sysoev
4c9d36765c axe imap module artifacts 2009-05-04 19:34:59 +00:00
Igor Sysoev
0cd76ea290 *) refactor error_log processing: listen socket log might inherit built-in
error_log with zero level, and r2447, r2466, r2467 were not enough
*) remove bogus "stderr" level
*) some functions and fields renames
2009-04-30 13:53:42 +00:00
Igor Sysoev
2ac565faf0 fix building by MSVC8 2009-04-27 11:33:34 +00:00
Igor Sysoev
7b9feda70b fix Auth-Method, the bug has been introduced in r2496 2009-04-24 09:54:40 +00:00
Igor Sysoev
a35eaccdec a prelimiary IPv6 support, HTTP listen 2009-02-21 07:02:02 +00:00
Igor Sysoev
c43beec76f send HELO/EHLO after XCLIENT
patch by Maxim Dounin
2009-02-10 15:19:45 +00:00
Igor Sysoev
09f6cd5fa9 compatibility with Microsoft's
AUTH LOGIN [base64 encoded user name ]
patch by Maxim Dounin
2009-02-09 12:03:55 +00:00
Igor Sysoev
bd5c23ee0a avoid deep nested calls, flatten call tree 2009-01-31 20:34:26 +00:00
Igor Sysoev
77a797436d update r2439: make clear name 2009-01-13 06:47:29 +00:00
Igor Sysoev
103fe34052 fix r2312 2009-01-12 15:40:26 +00:00
Igor Sysoev
c9aae14a7e use "!= NGX_OK" instead of "== NGX_ERROR" 2008-12-09 17:27:48 +00:00
Igor Sysoev
2ab644895e do not close session if SMTP backend returned an error on RCPT TO
patch by Maxim Dounin
2008-11-13 14:20:54 +00:00
Igor Sysoev
d67d8478a6 remove unused field 2008-11-13 13:30:34 +00:00
Igor Sysoev
d0e8e5456c smtp_auth none
patch by Maxim Dounin
2008-11-13 13:25:34 +00:00
Igor Sysoev
f100c7816d *) listen ssl
*) no default ssl_cetificate and ssl_cetificate_key
2008-09-01 14:19:01 +00:00
Igor Sysoev
c9491d113c *) refactor ngx_parse_inet_url()
*) refactor ngx_parse_unix_domain_url()
*) delete unused ngx_url_t fields
2008-08-26 14:24:14 +00:00
Igor Sysoev
6a75019ad6 *) remove zero termination in ngx_inet_ntop() and ngx_sock_ntop()
*) use ngx_snprintf() in ngx_inet_ntop() and ngx_sock_ntop()
   as they are called just once per connection
*) NGX_INET_ADDRSTRLEN
2008-08-21 18:47:23 +00:00
Igor Sysoev
a408b2ba2d backout both r2162 and r2128 and implement a new fix 2008-08-12 12:04:49 +00:00
Igor Sysoev
4c756c46cd fix typo 2008-07-29 14:31:03 +00:00
Igor Sysoev
f2a1484347 change useless ngx_pcalloc() to ngx_pnalloc() 2008-06-23 12:27:03 +00:00
Igor Sysoev
7f6b2ffc60 *) back out r2040
*) refactor ngx_palloc()
*) introduce ngx_pnalloc()
*) additional pool blocks have smaller header
2008-06-17 15:00:30 +00:00
Igor Sysoev
df83e6f81a DH parameters, ssl_dhparam 2008-06-16 05:51:32 +00:00
Igor Sysoev
d6548faf64 ssl_session_cache none 2008-05-26 07:14:13 +00:00
Igor Sysoev
3be5257a4f $hostname variable 2008-05-16 14:39:06 +00:00
Igor Sysoev
49db9d4602 reset message 2008-04-29 09:35:06 +00:00
Igor Sysoev
de8ec1efc8 use ngx_int_t in ngx_sort() callback 2008-03-24 13:04:02 +00:00
Igor Sysoev
73eb97f500 check duplicate resolver 2008-03-06 08:48:25 +00:00
Igor Sysoev
dfd5511f7a use cf->cycle->new_log because at merge stage cf->pool->log is old log 2008-03-04 10:42:05 +00:00
Igor Sysoev
4491daef30 cleanup resolver 2008-02-28 20:38:34 +00:00