Commit Graph

6905 Commits

Author SHA1 Message Date
Maxim Dounin
5f85bb3714 Added CONNECT method rejection.
No valid CONNECT requests are expected to appear within nginx, since it
is not a forward proxy.  Further, request line parsing will reject
proper CONNECT requests anyway, since we don't allow authority-form of
request-target.  On the other hand, RFC 7230 specifies separate message
length rules for CONNECT which we don't support, so make sure to always
reject CONNECTs to avoid potential abuse.
2021-06-28 18:01:04 +03:00
Maxim Dounin
d9c1d1bae7 Moved TRACE method rejection to a better place.
Previously, TRACE requests were rejected before parsing Transfer-Encoding.
This is not important since keepalive is not enabled at this point anyway,
though rejecting such requests after properly parsing other headers is
less likely to cause issues in case of further code changes.
2021-06-28 18:01:00 +03:00
Vladimir Homutov
8b92710728 Core: added the ngx_rbtree_data() macro. 2021-06-21 09:42:43 +03:00
Maxim Dounin
a407583ef1 Fixed format strings for ngx_win32_version. 2021-06-18 04:00:21 +03:00
Sergey Kandaurov
693e4134a5 gRPC: RST_STREAM(NO_ERROR) handling micro-optimization.
After 2096b21fcd10, a single RST_STREAM(NO_ERROR) may not result in an error.
This change removes several unnecessary ctx->type checks for such a case.
2021-06-17 11:44:06 +03:00
Sergey Kandaurov
dcdf7ec096 gRPC: handling GOAWAY with a higher last stream identifier.
Previously, once received from upstream, it couldn't limit
opening additional streams in a cached keepalive connection.
2021-06-17 11:43:55 +03:00
Maxim Dounin
5eadaf69e3 Fixed SSL logging with lingering close.
Recent fixes to SSL shutdown with lingering close (554c6ae25ffc, 1.19.5)
broke logging of SSL variables.  To make sure logging of SSL variables
works properly, avoid freeing c->ssl when doing an SSL shutdown before
lingering close.

Reported by Reinis Rozitis
(http://mailman.nginx.org/pipermail/nginx/2021-May/060670.html).
2021-06-01 17:37:51 +03:00
Maxim Dounin
235d2df1de SSL: ngx_ssl_shutdown() rework.
Instead of calling SSL_free() with each return point, introduced a single
place where cleanup happens.  As a positive side effect, this fixes two
potential memory leaks on ngx_handle_read_event() and ngx_handle_write_event()
errors where there were no SSL_free() calls (though unlikely practical,
as errors there are only expected to happen due to bugs or kernel issues).
2021-06-01 17:37:49 +03:00
Gena Makhomed
df1da673f7 Contrib: vim syntax, update core and 3rd party module directives. 2021-05-30 12:26:00 +03:00
Maxim Dounin
52cde89586 Core: disabled SO_REUSEADDR on UDP sockets while testing config.
On Linux, SO_REUSEADDR allows completely duplicate UDP sockets, so using
SO_REUSEADDR when testing configuration results in packets being dropped
if there is an existing traffic on the sockets being tested (ticket #2187).
While dropped packets are expected with UDP, it is better to avoid this
when possible.

With this change, SO_REUSEADDR is no longer set on datagram sockets when
testing configuration.
2021-05-31 16:36:51 +03:00
Maxim Dounin
85a104aa4e Core: disabled cloning sockets when testing config (ticket #2188).
Since we anyway do not set SO_REUSEPORT when testing configuration
(see ecb5cd305b06), trying to open additional sockets does not make much
sense, as all these additional sockets are expected to result in EADDRINUSE
errors from bind().  On the other hand, there are reports that trying
to open these sockets takes significant time under load: total configuration
testing time greater than 15s was observed in ticket #2188, compared to less
than 1s without load.

With this change, no additional sockets are opened during testing
configuration.
2021-05-31 16:36:37 +03:00
Maxim Dounin
427cfff79b Version bump. 2021-05-31 16:36:12 +03:00
Maxim Dounin
798813e96b release-1.21.0 tag 2021-05-25 15:28:56 +03:00
Maxim Dounin
ffcf93a6bf nginx-1.21.0-RELEASE 2021-05-25 15:28:55 +03:00
Maxim Dounin
e860ecce82 Resolver: explicit check for compression pointers in question.
Since nginx always uses exactly one entry in the question section of
a DNS query, and never uses compression pointers in this entry, parsing
of a DNS response in ngx_resolver_process_response() does not expect
compression pointers to appear in the question section of the DNS
response.  Indeed, compression pointers in the first name of a DNS response
hardly make sense, do not seem to be allowed by RFC 1035 (which says
"a pointer to a prior occurance of the same name", note "prior"), and
were never observed in practice.

Added an explicit check to ngx_resolver_process_response()'s parsing
of the question section to properly report an error if compression pointers
nevertheless appear in the question section.
2021-05-25 15:17:50 +03:00
Maxim Dounin
f85d701694 Resolver: simplified ngx_resolver_copy().
Instead of checking on each label if we need to place a dot or not,
now it always adds a dot after a label, and reduces the resulting
length afterwards.
2021-05-25 15:17:45 +03:00
Maxim Dounin
f1dd1d50e0 Resolver: reworked ngx_resolver_copy() copy loop.
To make the code easier to read, reworked the ngx_resolver_copy()
copy loop to match the one used to calculate length.  No functional
changes.
2021-05-25 15:17:43 +03:00
Maxim Dounin
bbd403a7ab Resolver: fixed label types handling in ngx_resolver_copy().
Previously, anything with any of the two high bits set were interpreted
as compression pointers.  This is incorrect, as RFC 1035 clearly states
that "The 10 and 01 combinations are reserved for future use".  Further,
the 01 combination is actually allocated for EDNS extended label type
(see RFC 2671 and RFC 6891), not really used though.

Fix is to reject unrecognized label types rather than misinterpreting
them as compression pointers.
2021-05-25 15:17:41 +03:00
Maxim Dounin
077a890a76 Resolver: fixed off-by-one read in ngx_resolver_copy().
It is believed to be harmless, and in the worst case it uses some
uninitialized memory as a part of the compression pointer length,
eventually leading to the "name is out of DNS response" error.
2021-05-25 15:17:38 +03:00
Maxim Dounin
9f1dcb0c04 Resolver: fixed off-by-one write in ngx_resolver_copy().
Reported by Luis Merino, Markus Vervier, Eric Sesterhenn, X41 D-Sec GmbH.
2021-05-25 15:17:36 +03:00
Ruslan Ermilov
41a241b3ef Location header escaping in redirects (ticket #882).
The header is escaped in redirects based on request URI or
location name (auto redirect).
2021-05-24 21:55:20 +03:00
Maxim Dounin
52d0ec7d17 Fixed log action when using SSL certificates with variables.
When variables are used in ssl_certificate or ssl_certificate_key, a request
is created in the certificate callback to evaluate the variables, and then
freed.  Freeing it, however, updates c->log->action to "closing request",
resulting in confusing error messages like "client timed out ... while
closing request" when a client times out during the SSL handshake.

Fix is to restore c->log->action after calling ngx_http_free_request().
2021-05-24 18:23:42 +03:00
Ruslan Ermilov
ecbe06b9fe Stream: the "fastopen" parameter of the "listen" directive.
Based on a patch by Anbang Wen.
2021-05-20 19:59:16 +03:00
Ruslan Ermilov
6029e211c6 Core: fixed comment about msie_refresh escaping.
After 12a656452ad1, the "%" character is no longer escaped by
ngx_escape_uri(NGX_ESCAPE_REFRESH).
2021-05-19 16:24:13 +03:00
Maxim Dounin
173f16f736 Mail: max_errors directive.
Similarly to smtpd_hard_error_limit in Postfix and smtp_max_unknown_commands
in Exim, specifies the number of errors after which the connection is closed.
2021-05-19 03:13:31 +03:00
Maxim Dounin
5015209054 Mail: IMAP pipelining support.
The change is mostly the same as the SMTP one (04e43d03e153 and 3f5d0af4e40a),
and ensures that nginx is able to properly handle or reject multiple IMAP
commands.  The s->cmd field is not really used and set for consistency.

Non-synchronizing literals handling in invalid/unknown commands is limited,
so when a non-synchronizing literal is detected at the end of a discarded
line, the connection is closed.
2021-05-19 03:13:28 +03:00
Maxim Dounin
4617dd64b8 Mail: stricter checking of IMAP tags.
Only "A-Za-z0-9-._" characters now allowed (which is stricter than what
RFC 3501 requires, but expected to be enough for all known clients),
and tags shouldn't be longer than 32 characters.
2021-05-19 03:13:26 +03:00
Maxim Dounin
82840d1651 Mail: fixed backslash handling in IMAP literals.
Previously, s->backslash was set if any of the arguments was a quoted
string with a backslash character.  After successful command parsing
this resulted in all arguments being filtered to remove backslashes.
This is, however, incorrect, as backslashes should not be removed from
IMAP literals.  For example:

   S: * OK IMAP4 ready
   C: a01 login {9}
   S: + OK
   C: user\name "pass\"word"
   S: * BAD internal server error

resulted in "Auth-User: username" instead of "Auth-User: user\name"
as it should.

Fix is to apply backslash filtering on per-argument basis during parsing.
2021-05-19 03:13:23 +03:00
Maxim Dounin
fabe28259f Mail: removed dead s->arg_start handling.
As discussed in the previous change, s->arg_start handling in the "done"
labels of ngx_mail_pop3_parse_command(), ngx_mail_imap_parse_command(),
and ngx_mail_smtp_parse_command() is wrong: s->arg_start cannot be
set there, as it is handled and cleared on all code paths where the
"done" labels are reached.  The relevant code is dead and now removed.
2021-05-19 03:13:22 +03:00
Maxim Dounin
3c660ef59b Mail: fixed s->arg_start clearing on invalid IMAP commands.
Previously, s->arg_start was left intact after invalid IMAP commands,
and this might result in an argument incorrectly added to the following
command.  Similarly, s->backslash was left intact as well, leading
to unneeded backslash removal.

For example (LFs from the client are explicitly shown as "<LF>"):

  S: * OK IMAP4 ready
  C: a01 login "\<LF>
  S: a01 BAD invalid command
  C: a0000000000\2 authenticate <LF>
  S: a00000000002 aBAD invalid command

The backslash followed by LF generates invalid command with s->arg_start
and s->backslash set, the following command incorrectly treats anything
from the old s->arg_start to the space after the command as an argument,
and removes the backslash from the tag.  If there is no space, s->arg_end
will be NULL.

Both things seem to be harmless though.  In particular:

- This can be used to provide an incorrect argument to a command without
  arguments.  The only command which seems to look at the single argument
  is AUTHENTICATE, and it checks the argument length before trying to
  access it.

- Backslash removal uses the "end" pointer, and stops due to "src < end"
  condition instead of scanning all the process memory if s->arg_end is
  NULL (and arg[0].len is huge).

- There should be no backslashes in unquoted strings.

An obvious fix is to clear s->arg_start and s->backslash on invalid commands,
similarly to how it is done in POP3 parsing (added in 810:e3aa8f305d21) and
SMTP parsing.

This, however, makes it clear that s->arg_start handling in the "done"
label is wrong: s->arg_start cannot be legitimately set there, as it
is expected to be cleared in all possible cases when the "done" label is
reached.  The relevant code is dead and will be removed by the following
change.
2021-05-19 03:13:20 +03:00
Maxim Dounin
d96d60d2e0 Mail: POP3 pipelining support.
The change is mostly the same as the SMTP one (04e43d03e153 and 3f5d0af4e40a),
and ensures that nginx is able to properly handle or reject multiple POP3
commands, as required by the PIPELINING capability (RFC 2449).  The s->cmd
field is not really used and set for consistency.
2021-05-19 03:13:18 +03:00
Maxim Dounin
317223cb56 Mail: optimized discarding invalid SMTP commands.
There is no need to scan buffer from s->buffer->pos, as we already scanned
the buffer till "p" and wasn't able to find an LF.

There is no real need for this change in SMTP, since it is at most a
microoptimization of a non-common code path.  Similar code in IMAP, however,
will have to start scanning from "p" to be correct, since there can be
newlines in IMAP literals.
2021-05-19 03:13:17 +03:00
Maxim Dounin
204f944add Mail: fixed handling of invalid SMTP commands split between reads.
Previously, if an invalid SMTP command was split between reads, nginx failed
to wait for LF before returning an error, and interpreted the rest of the
command received later as a separate command.

The sw_invalid state in ngx_mail_smtp_parse_command(), introduced in
04e43d03e153, did not work, since ngx_mail_smtp_auth_state() clears
s->state when returning an error due to NGX_MAIL_PARSE_INVALID_COMMAND.
And not clearing s->state will introduce another problem: the rest
of the command would trigger duplicate error when rest of the command is
received.

Fix is to return NGX_AGAIN from ngx_mail_smtp_parse_command() until full
command is received.
2021-05-19 03:13:15 +03:00
Maxim Dounin
60a5a6f0d3 Mail: fixed SMTP pipelining to send the response immediately.
Previously, if there were some pipelined SMTP data in the buffer when
a proxied connection with the backend was established, nginx called
ngx_mail_proxy_handler() to send these data, and not tried to send the
response to the last command.  In most cases, this response was later sent
along with the response to the pipelined command, but if for some reason
client decides to wait for the response before finishing the next command
this might result in a connection hang.

Fix is to always call ngx_mail_proxy_handler() to send the response, and
additionally post an event to send the pipelined data if needed.
2021-05-19 03:13:12 +03:00
Maxim Dounin
130a3ec501 MIME: added application/wasm type (ticket #1606). 2021-05-08 20:31:03 +03:00
Maxim Dounin
c7de65228f Upstream: variables support in certificates. 2021-05-06 02:22:09 +03:00
Maxim Dounin
a6bce8c227 Auth basic: changed alcf->user_file to be a pointer.
This saves some memory in typical case when auth_basic_user_file is not
explicitly set, and unifies the code with alcf->realm.
2021-05-06 02:22:07 +03:00
Maxim Dounin
4faa840853 Changed complex value slots to use NGX_CONF_UNSET_PTR.
With this change, it is now possible to use ngx_conf_merge_ptr_value()
to merge complex values.  This change follows much earlier changes in
ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot()
in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22), and the
change in ngx_conf_set_keyval_slot() (7728:485dba3e2a01, 1.19.4).

To preserve compatibility with existing 3rd party modules, both NULL
and NGX_CONF_UNSET_PTR are accepted for now.
2021-05-06 02:22:03 +03:00
Ruslan Ermilov
f02e2a734e Restored zeroing of ngx_channel_t in ngx_pass_open_channel().
Due to structure's alignment, some uninitialized memory contents may have
been passed between processes.

Zeroing was removed in 0215ec9aaa8a.

Reported by Johnny Wang.
2021-04-22 16:12:52 +03:00
Maxim Dounin
7b9920aad8 Mail: fixed reading with fully filled buffer (ticket #2159).
With SMTP pipelining, ngx_mail_read_command() can be called with s->buffer
without any space available, to parse additional commands received to the
buffer on previous calls.  Previously, this resulted in recv() being called
with zero length, resulting in zero being returned, which was interpreted
as a connection close by the client, so nginx silently closed connection.

Fix is to avoid calling c->recv() if there is no free space in the buffer,
but continue parsing of the already received commands.
2021-04-21 23:24:59 +03:00
Maxim Dounin
ead9ab0925 Version bump. 2021-04-21 23:24:48 +03:00
Maxim Dounin
a64190933e release-1.19.10 tag 2021-04-13 18:13:59 +03:00
Maxim Dounin
95d97aedb9 nginx-1.19.10-RELEASE 2021-04-13 18:13:58 +03:00
Maxim Dounin
eb52de8311 Changed keepalive_requests default to 1000 (ticket #2155).
It turns out no browsers implement HTTP/2 GOAWAY handling properly, and
large enough number of resources on a page results in failures to load
some resources.  In particular, Chrome seems to experience errors if
loading of all resources requires more than 1 connection (while it
is usually able to retry requests at least once, even with 2 connections
there are occasional failures for some reason), Safari if loading requires
more than 3 connections, and Firefox if loading requires more than 10
connections (can be configured with network.http.request.max-attempts,
defaults to 10).

It does not seem to be possible to resolve this on nginx side, even strict
limiting of maximum concurrency does not help, and loading issues seems to
be triggered by merely queueing of a request for a particular connection.
The only available mitigation seems to use higher keepalive_requests value.

The new default is 1000 and matches previously used default for
http2_max_requests.  It is expected to be enough for 99.98% of the pages
(https://httparchive.org/reports/state-of-the-web?start=latest#reqTotal)
even in Chrome.
2021-04-08 00:16:30 +03:00
Maxim Dounin
497acbd0ed Added $connection_time variable. 2021-04-08 00:16:17 +03:00
Maxim Dounin
d9996d6f27 Introduced the "keepalive_time" directive.
Similar to lingering_time, it limits total connection lifetime before
keepalive is switched off.  The default is 1 hour, which is close to
the total maximum connection lifetime possible with default
keepalive_requests and keepalive_timeout.
2021-04-08 00:15:48 +03:00
Maxim Dounin
5599731c00 HTTP/2: relaxed PRIORITY frames limit.
Firefox uses several idle streams for PRIORITY frames[1], and
"http2_max_concurrent_streams 1;" results in "client sent too many
PRIORITY frames" errors when a connection is established by Firefox.

Fix is to relax the PRIORITY frames limit to use at least 100 as
the initial value (which is the recommended by the HTTP/2 protocol
minimum limit on the number of concurrent streams, so it is not
unreasonable for clients to assume that similar number of idle streams
can be used for prioritization).

[1] https://hg.mozilla.org/mozilla-central/file/32a9e6e145d6e3071c3993a20bb603a2f388722b/netwerk/protocol/http/Http2Stream.cpp#l1270
2021-04-07 02:03:29 +03:00
Maxim Dounin
ca9bf16f09 Configure: fixed --test-build-epoll on FreeBSD 13.
In FreeBSD 13, eventfd(2) was added, and this breaks build
with --test-build-epoll and without --with-file-aio.  Fix is
to move eventfd(2) detection to auto/os/linux, as it is used
only on Linux as a notification mechanism for epoll().
2021-04-05 20:14:16 +03:00
Maxim Dounin
4af67214ad Gzip: updated handling of zlib variant from Intel.
In current versions (all versions based on zlib 1.2.11, at least
since 2018) it no longer uses 64K hash and does not force window
bits to 13 if it is less than 13.  That is, it needs just 16 bytes
more memory than normal zlib, so these bytes are simply added to
the normal size calculation.
2021-04-05 04:07:17 +03:00
Maxim Dounin
e3797a66a3 Gzip: support for zlib-ng. 2021-04-05 04:06:58 +03:00