Commit Graph

6931 Commits

Author SHA1 Message Date
Maxim Dounin
7d4cd6cff4 Mail: postponed session initialization under accept mutex.
Similarly to 40e8ce405859 in the stream module, this reduces the time
accept mutex is held.  This also simplifies following changes to
introduce PROXY protocol support.
2021-03-05 17:16:19 +03:00
Maxim Dounin
065a1641b2 Mail: added missing event handling after reading data.
If we need to be notified about further events, ngx_handle_read_event()
needs to be called after a read event is processed.  Without this,
an event can be removed from the kernel and won't be reported again,
notably when using oneshot event methods, such as eventport on Solaris.

For consistency, existing ngx_handle_read_event() call removed from
ngx_mail_read_command(), as this call only covers one of the code paths
where ngx_mail_read_command() returns NGX_AGAIN.  Instead, appropriate
processing added to the callers, covering all code paths where NGX_AGAIN
is returned.
2021-03-05 17:16:17 +03:00
Maxim Dounin
8ed63c936c Mail: added missing event handling after blocking events.
As long as a read event is blocked (ignored), ngx_handle_read_event()
needs to be called to make sure no further notifications will be
triggered when using level-triggered event methods, such as select() or
poll().
2021-03-05 17:16:16 +03:00
Maxim Dounin
d5a31fdad5 Events: fixed eventport handling in ngx_handle_read_event().
The "!rev->ready" test seems to be a typo, introduced in the original
commit (719:f30b1a75fd3b).  The ngx_handle_write_event() code properly
tests for "rev->ready" instead.

Due to this typo, read events might be unexpectedly removed during
proxying after an event on the other part of the proxied connection.
Catched by mail proxying tests.
2021-03-05 17:16:15 +03:00
Maxim Dounin
797ac536fe SSL: fixed build by Sun C with old OpenSSL versions.
Sun C complains about "statement not reached" if a "return" is followed
by additional statements.
2021-03-05 17:16:13 +03:00
Ruslan Ermilov
a38a8438b8 Proxy: variables support in "proxy_cookie_flags" flags. 2021-03-02 00:58:24 +03:00
Maxim Dounin
4c5a49ce4c Introduced strerrordesc_np() support.
The strerrordesc_np() function, introduced in glibc 2.32, provides an
async-signal-safe way to obtain error messages.  This makes it possible
to avoid copying error messages.
2021-03-01 20:00:45 +03:00
Maxim Dounin
71eb19da43 Improved maximum errno detection.
Previously, systems without sys_nerr (or _sys_nerr) were handled with an
assumption that errors start at 0 and continuous.  This is, however, not
something POSIX requires, and not true on some platforms.

Notably, on Linux, where sys_nerr is no longer available for newly linked
binaries starting with glibc 2.32, there are gaps in error list, which
used to stop us from properly detecting maximum errno.  Further, on
GNU/Hurd errors start at 0x40000001.

With this change, maximum errno detection is moved to the runtime code,
now able to ignore gaps, and also detects the first error if needed.
This fixes observed "Unknown error" messages as seen on Linux with
glibc 2.32 and on GNU/Hurd.
2021-03-01 20:00:43 +03:00
Maxim Dounin
0f5d0c5798 HTTP/2: client_header_timeout before first request (ticket #2142).
With this change, behaviour of HTTP/2 becomes even closer to HTTP/1.x,
and client_header_timeout instead of keepalive_timeout is used before
the first request is received.

This fixes HTTP/2 connections being closed even before the first request
if "keepalive_timeout 0;" was used in the configuration; the problem
appeared in f790816a0e87 (1.19.7).
2021-03-01 17:31:28 +03:00
Maxim Dounin
a74961f552 Contrib: vim syntax, default highlighting (ticket #2141).
Using default highlighting makes it possible to easily overrule
highlighting specified in the syntax file, see ":highlight-default"
in vim help for details.
2021-02-25 23:42:25 +03:00
Maxim Dounin
ef44627852 SSL: added check for debugging.
If debugging is not enabled, there is no need to do extra work in
ngx_ssl_verify_callback() and ngx_ssl_handshake_log().
2021-02-20 18:03:04 +03:00
Maxim Dounin
7ae100407c SSL: added missed error reporting during variables evaluation. 2021-02-20 18:02:54 +03:00
Maxim Dounin
60a8ed26f3 SSL: X509_NAME_oneline() error handling. 2021-02-20 18:02:49 +03:00
Ruslan Ermilov
1bb89914d7 Configure: marked top-level make targets as phony.
Reported by Thibault Nélis.
2021-02-20 12:44:26 +03:00
Ruslan Ermilov
fbcc09e17f Version bump. 2021-02-20 12:44:07 +03:00
Maxim Dounin
949c97007b release-1.19.7 tag 2021-02-16 18:57:18 +03:00
Maxim Dounin
e539d472e7 nginx-1.19.7-RELEASE 2021-02-16 18:57:18 +03:00
Maxim Dounin
51fea093e4 HTTP/2: removed http2_max_field_size and http2_max_header_size.
Instead, size of one large_client_header_buffers buffer and all large
client header buffers are used.
2021-02-11 21:52:26 +03:00
Maxim Dounin
94567a8f84 HTTP/2: keepalive_timeout now armed once between requests.
Previously, PINGs and other frames extended possible keepalive time,
making it possible to keep an open HTTP/2 connection for a long time.
Now the connection is always closed as long as keepalive_timeout expires,
similarly to how it happens in HTTP/1.x.

Note that as a part of this change, incomplete frames are no longer
trigger a separate timeout, so http2_recv_timeout (replaced by
client_header_timeout in previous patches) is essentially cancelled.
The client_header_timeout is, however, used for SSL handshake and
while reading HEADERS frames.
2021-02-11 21:52:24 +03:00
Maxim Dounin
49ab331244 HTTP/2: removed http2_idle_timeout and http2_max_requests.
Instead, keepalive_timeout and keepalive_requests are now used.  This
is expected to simplify HTTP/2 code and usage.  This also matches
directives used by upstream module for all protocols.

In case of default settings, this effectively changes maximum number
of requests per connection from 1000 to 100.  This looks acceptable,
especially given that HTTP/2 code now properly supports lingering close.

Further, this changes default keepalive timeout in HTTP/2 from 300 seconds
to 75 seconds.  This also looks acceptable, and larger than PING interval
used by Firefox (network.http.spdy.ping-threshold defaults to 58s),
the only browser to use PINGs.
2021-02-11 21:52:23 +03:00
Maxim Dounin
d18e066d65 HTTP/2: removed http2_recv_timeout.
Instead, the client_header_timeout is now used for HTTP/2 reading.
Further, the timeout is changed to be set once till no further data
left to read, similarly to how client_header_timeout is used in other
places.
2021-02-11 21:52:20 +03:00
Maxim Dounin
e82939206d HTTP/2: removed SPDY directives handling.
The spdy_* directives are not available since introduction of HTTP/2 module
in nginx 1.9.5 more than five years ago.
2021-02-11 21:52:19 +03:00
Maxim Dounin
797a2dc7cf HTTP/2: fixed reusing connections with active requests.
New connections are marked reusable by ngx_http_init_connection() if there
are no data available for reading.  As a result, if SSL is not used,
ngx_http_v2_init() might be called when the connection is marked reusable.
If a HEADERS frame is immediately available for reading, this resulted
in connection being preserved in reusable state with an active request,
and possibly closed later as if during worker shutdown (that is, after
all active requests were finalized).

Fix is to explicitly mark connections non-reusable in ngx_http_v2_init()
instead of (incorrectly) assuming they are already non-reusable.

Found by Sergey Kandaurov.
2021-02-11 21:52:17 +03:00
Maxim Dounin
76672e6500 HTTP/2: reuse of connections with incomplete frames.
Prodded by Taewoo Kim.
2021-02-11 21:52:12 +03:00
Maxim Dounin
9a3ec20232 Additional connections reuse.
If ngx_drain_connections() fails to immediately reuse any connections
and there are no free connections, it now additionally tries to reuse
a connection again.  This helps to provide at least one free connection
in case of HTTP/2 with lingering close, where merely trying to reuse
a connection once does not free it, but makes it reusable again,
waiting for lingering close.
2021-02-11 21:52:11 +03:00
Maxim Dounin
fb2a2152d7 Reuse of connections in lingering close.
This is particularly important in HTTP/2, where keepalive connections
are closed with lingering.  Before the patch, reusing a keepalive HTTP/2
connection resulted in the connection waiting for lingering close to
remain in the reusable connections queue, preventing ngx_drain_connections()
from closing additional connections.

The patch fixes it by marking the connection reusable again, and so
moving it in the reusable connections queue.  Further, it makes actually
possible to reuse such connections if needed.
2021-02-11 21:52:09 +03:00
Ruslan Ermilov
327e21c432 HTTP/2: lingering close changed to handle NGX_AGAIN.
This part somehow slipped away from c5840ca2063d.

While it is not expected to be needed in case of lingering close,
it is good to keep it for correctness (see 2b5528023f6b).
2021-02-01 16:42:50 +03:00
Sergey Kandaurov
56f5331683 Clean up trailers in ngx_http_clean_header() as well.
The function has not been updated with introduction of trailers support
in 7034:1b068a4e82d8 (1.13.2).
2021-01-26 12:39:28 +03:00
Maxim Dounin
2f008a76f8 Year 2021. 2021-01-19 20:35:17 +03:00
Maxim Dounin
2ec8fac2d6 Core: removed post_accept_timeout.
Keeping post_accept_timeout in ngx_listening_t is no longer needed since
we've switched to 1 second timeout for deferred accept in 5541:fdb67cfc957d.

Further, using it in HTTP code can result in client_header_timeout being
used from an incorrect server block, notably if address-specific virtual
servers are used along with a wildcard listening socket, or if we've switched
to a different server block based on SNI in SSL handshake.
2021-01-19 20:32:00 +03:00
Maxim Dounin
d2c0b9a6c7 Removed incorrect optimization of HEAD requests.
The stub status module and ngx_http_send_response() (used by the empty gif
module and the "return" directive) incorrectly assumed that responding
to HEAD requests always results in r->header_only being set.  This is not
true, and results in incorrect behaviour, for example, in the following
configuration:

   location / {
       image_filter size;
       return 200 test;
   }

Fix is to remove this incorrect micro-optimization from both stub status
module and ngx_http_send_response().

Reported by Chris Newton.
2021-01-19 20:21:12 +03:00
Maxim Dounin
e1ca985122 Upstream: fixed zero size buf alerts on extra data (ticket #2117).
After 7675:9afa45068b8f and 7678:bffcc5af1d72 (1.19.1), during non-buffered
simple proxying, responses with extra data might result in zero size buffers
being generated and "zero size buf" alerts in writer.  This bug is similar
to the one with FastCGI proxying fixed in 7689:da8d758aabeb.

In non-buffered mode, normally the filter function is not called if
u->length is already 0, since u->length is checked after each call of
the filter function.  There is a case when this can happen though: if
the response length is 0, and there are pre-read response body data left
after reading response headers.  As such, a check for u->length is needed
at the start of non-buffered filter functions, similar to the one
for p->length present in buffered filter functions.

Appropriate checks added to the existing non-buffered copy filters
in the upstream (used by scgi and uwsgi proxying) and proxy modules.
2021-01-12 16:59:31 +03:00
Gena Makhomed
7b6b8b62dd Contrib: vim syntax, update core and 3rd party module directives. 2020-12-29 13:13:57 +02:00
Maxim Dounin
09b41d5eab Version bump. 2021-01-11 22:06:27 +03:00
Maxim Dounin
402f4cda0c release-1.19.6 tag 2020-12-15 17:41:39 +03:00
Maxim Dounin
65ddeebf33 nginx-1.19.6-RELEASE 2020-12-15 17:41:39 +03:00
Maxim Dounin
b3341c06cb Updated OpenSSL used for win32 builds. 2020-12-15 16:49:24 +03:00
Maxim Dounin
b138e26395 Fixed double close of non-regular files in flv and mp4.
With introduction of open_file_cache in 1454:f497ed7682a7, opening a file
with ngx_open_cached_file() automatically adds a cleanup handler to close
the file.  As such, calling ngx_close_file() directly for non-regular files
is no longer needed and will result in duplicate close() call.

In 1454:f497ed7682a7 ngx_close_file() call for non-regular files was removed
in the static module, but wasn't in the flv module.  And the resulting
incorrect code was later copied to the mp4 module.  Fix is to remove the
ngx_close_file() call from both modules.

Reported by Chris Newton.
2020-12-11 13:42:07 +03:00
Maxim Dounin
2e94c81b0b Removed extra allocation for r->uri.
The ngx_http_parse_complex_uri() function cannot make URI longer and does
not null-terminate URI, so there is no need to allocate an extra byte.  This
allocation appears to be a leftover from changes in 461:a88a3e4e158f (0.1.5),
where null-termination of r->uri and many other strings was removed.
2020-12-10 20:09:39 +03:00
Maxim Dounin
ce9971b2b5 Fixed parsing of absolute URIs with empty path (ticket #2079).
When the request line contains request-target in the absolute-URI form,
it can contain path-empty instead of a single slash (see RFC 7230, RFC 3986).
Previously, the ngx_http_parse_request_line() function only accepted empty
path when there was no query string.

With this change, non-empty query is also correctly handled.  That is,
request line "GET http://example.com?foo HTTP/1.1" is accepted and results
in $uri "/" and $args "foo".

Note that $request_uri remains "?foo", similarly to how spaces in URIs
are handled.  Providing "/?foo", similarly to how "/" is provided for
"GET http://example.com HTTP/1.1", requires allocation.
2020-12-10 20:09:30 +03:00
Ruslan Ermilov
e62a5132ca SSL: fixed SSL shutdown on lingering close.
Ensure c->recv is properly reset to ngx_recv if SSL_shutdown()
blocks on writing.

The bug had appeared in 554c6ae25ffc.
2020-12-08 01:43:36 +03:00
Ruslan Ermilov
cfa669151e Upstream: excluded down servers from the next_upstream tries.
Previously, the number of next_upstream tries included servers marked
as "down", resulting in "no live upstreams" with the code 502 instead
of the code derived from an attempt to connect to the last tried "up"
server (ticket #2096).
2020-11-27 00:01:20 +03:00
Ruslan Ermilov
4f7a9ec7a9 Version bump. 2020-11-26 23:46:59 +03:00
Maxim Dounin
84a2201964 release-1.19.5 tag 2020-11-24 18:06:34 +03:00
Maxim Dounin
caa1e4ffa6 nginx-1.19.5-RELEASE 2020-11-24 18:06:34 +03:00
Pavel Pautov
671cbc1840 gRPC: RST_STREAM(NO_ERROR) handling after "trailer only" responses.
Similarly to the problem fixed in 2096b21fcd10 (ticket #1792),
when a "trailer only" gRPC response (that is, a response with the
END_STREAM flag in the HEADERS frame) was immediately followed by
RST_STREAM(NO_ERROR) in the data preread along with the response
header, RST_STREAM wasn't properly skipped and caused "upstream
rejected request with error 0" errors.
Observed with "unknown service" gRPC errors returned by grpc-go.

Fix is to set ctx->done if we are going to parse additional data,
so the RST_STREAM(NO_ERROR) is properly skipped.  Additionally, now
ngx_http_grpc_filter() will complain about frames sent for closed
stream if there are any.
2020-11-18 18:41:16 -08:00
Sergey Kandaurov
01ed3c3591 Use .Mt to mark up email addresses. 2020-11-19 17:15:22 +00:00
Igor Ippolitov
7e1637a316 Core: "-e" command line option.
When installing or running from a non-root user it is sometimes required to
override default, compiled in error log path. There was no way to do this
without rebuilding the binary (ticket #147).

This patch introduced "-e" command line option which allows one to override
compiled in error log path.
2020-11-19 16:59:00 +00:00
Maxim Dounin
23597e97f5 Configure: shared sources for addon modules.
Addon modules, both dynamic and static, can now use shared source files.
Shared sources result in only one make rule even if specified several
times in different modules.
2020-11-10 17:13:20 +03:00
Maxim Dounin
3030907f5f Configure: initialization of NGX_ADDON_SRCS. 2020-11-10 17:13:17 +03:00