Commit Graph

7794 Commits

Author SHA1 Message Date
Maxim Dounin
923c9d5f3b Version bump. 2018-04-05 16:53:27 +03:00
Maxim Dounin
d627eeefe5 release-1.13.11 tag 2018-04-03 17:38:10 +03:00
Maxim Dounin
ff70c2f1cd nginx-1.13.11-RELEASE 2018-04-03 17:38:09 +03:00
Maxim Dounin
703ca2b397 Updated OpenSSL and PCRE used for win32 builds. 2018-04-03 03:54:09 +03:00
Maxim Dounin
d90a75b7cd Upstream: fixed ngx_http_upstream_test_next() conditions.
Previously, ngx_http_upstream_test_next() used an outdated condition on
whether it will be possible to switch to a different server or not.  It
did not take into account restrictions on non-idempotent requests, requests
with non-buffered request body, and the next upstream timeout.

For such requests, switching to the next upstream server was rejected
later in ngx_http_upstream_next(), resulting in nginx own error page
being returned instead of the original upstream response.
2018-04-03 02:43:18 +03:00
Vladimir Homutov
cadc8ca306 Core: fixed build, broken by 63e91f263a49.
Both Solaris and Windows define "s_addr" as a macro.
2018-04-02 20:38:43 +03:00
Ruslan Ermilov
55f08fc9f7 Core: revised the PROXY protocol v2 code.
- use normal prefixes for types and macros
- removed some macros and types
- revised debug messages
- removed useless check of ngx_sock_ntop() returning 0
- removed special processing of AF_UNSPEC
2018-04-02 18:40:04 +03:00
Vladimir Homutov
ecd6e243b6 Core: style. 2018-03-27 18:39:38 +03:00
Vladimir Homutov
9207cc84b2 Core: added processing of version 2 of the PROXY protocol.
The protocol used on inbound connection is auto-detected and corresponding
parser is used to extract passed addresses.  TLV parameters are ignored.

The maximum supported size of PROXY protocol header is 107 bytes
(similar to version 1).
2018-03-22 15:55:28 +03:00
Roman Arutyunyan
f39d5e8b33 Stream: set action before each recv/send while proxying.
Now it's clear from log error message if the error occurred on client or
upstream side.
2018-03-22 18:43:49 +03:00
Maxim Dounin
0ac57648eb gRPC: fixed possible sign extension of error and setting_value.
All cases are harmless and should not happen on valid values, though can
result in bad values being shown incorrectly in logs.

Found by Coverity (CID 1430311, 1430312, 1430313).
2018-03-22 19:26:25 +03:00
Ruslan Ermilov
8e8734ec82 Improved code readability (closes #1512). 2018-03-22 18:13:33 +03:00
Maxim Dounin
78386faf7e Configure: restored "no-threads" in OpenSSL builds.
This was previously used, but was incorrectly removed in 83d54192e97b
while removing old threads remnants.  Instead of using it conditionally
when threads are not used, we now set in unconditionally, as even with
thread pools enabled we never call OpenSSL functions in threads.

This fixes resulting binary when using --with-openssl with OpenSSL 1.1.0+
and without -lpthread linked (notably on FreeBSD without PCRE).
2018-03-22 15:56:07 +03:00
Maxim Dounin
90ca1071b7 Configure: fixed static compilation with OpenSSL 1.1.1.
OpenSSL now uses pthread_atfork(), and this requires -lpthread on Linux
to compile.  Introduced NGX_LIBPTHREAD to add it as appropriate, similar
to existing NGX_LIBDL.
2018-03-22 15:55:57 +03:00
Maxim Dounin
25a26bbce4 Version bump. 2018-03-22 15:55:52 +03:00
Maxim Dounin
dfd9e43294 release-1.13.10 tag 2018-03-20 18:58:30 +03:00
Maxim Dounin
383c328cea nginx-1.13.10-RELEASE 2018-03-20 18:58:30 +03:00
Sergey Kandaurov
e232421266 gRPC: fixed missing state save in frame header parsing.
Previously, frame state wasn't saved if HEADERS frame payload
that begins with header fragment was not received at once.
2018-03-20 15:58:11 +03:00
Ruslan Ermilov
74ea120f7d HTTP/2: improved frame info debugging. 2018-03-19 21:32:15 +03:00
Sergey Kandaurov
f3ad346952 gRPC: fixed parsing response headers split on CONTINUATION frames. 2018-03-19 16:42:56 +03:00
Ruslan Ermilov
c09aa142d6 Fixed checking ngx_tcp_push() and ngx_tcp_nopush() return values.
No functional changes.
2018-03-19 16:28:23 +03:00
Ruslan Ermilov
510986b806 Upstream: fixed comments after 13f8dec720b5.
The fields "uri", "location", and "url" from ngx_http_upstream_conf_t
moved to ngx_http_proxy_loc_conf_t and ngx_http_proxy_vars_t, reflect
this change in create_loc_conf comments.
2018-03-19 16:22:09 +03:00
Sergey Kandaurov
8dfb87d6bb Configure: added gRPC module help message. 2018-03-19 12:41:36 +03:00
Gena Makhomed
14c46da20e Contrib: vim syntax, update core and 3rd party module directives. 2018-03-18 11:11:14 +02:00
Maxim Dounin
6559a42013 gRPC: special handling of "trailer only" responses.
The gRPC protocol makes a distinction between HEADERS frame with
the END_STREAM flag set, and a HEADERS frame followed by an empty
DATA frame with the END_STREAM flag.  The latter is not permitted,
and results in errors not being propagated through nginx.  Instead,
gRPC clients complain that "server closed the stream without sending
trailers" (seen in grpc-go) or "13: Received RST_STREAM with error
code 2" (seen in grpc-c).

To fix this, nginx now returns HEADERS with the END_STREAM flag if
the response length is known to be 0, and we are not expecting
any trailer headers to be added.  And the response length is
explicitly set to 0 in the gRPC proxy if we see initial HEADERS frame
with the END_STREAM flag set.
2018-03-17 23:04:26 +03:00
Maxim Dounin
6a0d9e5b2d gRPC: special handling of the TE request header.
According to the gRPC protocol specification, the "TE" header is used
to detect incompatible proxies, and at least grpc-c server rejects
requests without "TE: trailers".

To preserve the logic, we have to pass "TE: trailers" to the backend if
and only if the original request contains "trailers" in the "TE" header.
Note that no other TE values are allowed in HTTP/2, so we have to remove
anything else.
2018-03-17 23:04:25 +03:00
Maxim Dounin
56ad960e7a The gRPC proxy module.
The module allows passing requests to upstream gRPC servers.
The module is built by default as long as HTTP/2 support is compiled in.
Example configuration:

    grpc_pass 127.0.0.1:9000;

Alternatively, the "grpc://" scheme can be used:

    grpc_pass grpc://127.0.0.1:9000;

Keepalive support is available via the upstream keepalive module.  Note
that keepalive connections won't currently work with grpc-go as it fails
to handle SETTINGS_HEADER_TABLE_SIZE.

To use with SSL:

    grpc_pass grpcs://127.0.0.1:9000;

SSL connections use ALPN "h2" when available.  At least grpc-go works fine
without ALPN, so if ALPN is not available we just establish a connection
without it.

Tested with grpc-c++ and grpc-go.
2018-03-17 23:04:24 +03:00
Maxim Dounin
c67124190c Upstream: u->conf->preserve_output flag.
The flag can be used to continue sending request body even after we've
got a response from the backend.  In particular, this is needed for gRPC
proxying of bidirectional streaming RPCs, and also to send control frames
in other forms of RPCs.
2018-03-17 23:04:23 +03:00
Maxim Dounin
7be60194c1 Upstream: u->request_body_blocked flag.
The flag indicates whether last ngx_output_chain() returned NGX_AGAIN
or not.  If the flag is set, we arm the u->conf->send_timeout timer.
The flag complements c->write->ready test, and allows to stop sending
the request body in an output filter due to protocol-specific flow
control.
2018-03-17 23:04:22 +03:00
Maxim Dounin
7ef115a7e8 Upstream: trailers support, u->conf->pass_trailers flag.
Basic trailer headers support allows one to access response trailers
via the $upstream_trailer_* variables.

Additionally, the u->conf->pass_trailers flag was introduced.  When the
flag is set, trailer headers from the upstream response are passed to
the client.  Like normal headers, trailer headers will be hidden
if present in u->conf->hide_headers_hash.
2018-03-17 23:04:21 +03:00
Maxim Dounin
c554dd1434 HTTP/2: externalized various constants and interfaces. 2018-03-17 23:04:20 +03:00
Roman Arutyunyan
b84b67bc0f Style. 2018-03-12 18:38:53 +03:00
Roman Arutyunyan
1a5604bedd Stream ssl_preread: $ssl_preread_alpn_protocols variable.
The variable keeps a comma-separated list of protocol names from ALPN TLS
extension defined by RFC 7301.
2018-03-12 16:03:08 +03:00
Ruslan Ermilov
84d1e7de0c Improved code readablity.
No functional changes.
2018-03-07 18:28:12 +03:00
Maxim Dounin
83dceda868 HTTP/2: unknown frames now logged at info level. 2018-03-05 21:35:13 +03:00
Maxim Dounin
89ad448f57 Style. 2018-03-05 21:35:08 +03:00
Vladimir Homutov
7647372565 Access log: support for disabling escaping (ticket #1450).
Based on patches by Johannes Baiter <johannes.baiter@bsb-muenchen.de>
and Calin Don.
2018-03-01 11:42:55 +03:00
Maxim Dounin
c7e8a6f212 Core: ngx_current_msec now uses monotonic time if available.
When clock_gettime(CLOCK_MONOTONIC) (or faster variants, _FAST on FreeBSD,
and _COARSE on Linux) is available, we now use it for ngx_current_msec.
This should improve handling of timers if system time changes (ticket #189).
2018-03-01 20:25:50 +03:00
Roman Arutyunyan
6e30556127 Postpone filter: prevented uninitialized r->out.
The r->out chain link could be left uninitialized in case of error.
A segfault could happen if the subrequest handler accessed it.
The issue was introduced in commit 20f139e9ffa8.
2018-03-01 18:38:39 +03:00
Roman Arutyunyan
7c5c15a25d Generic subrequests in memory.
Previously, only the upstream response body could be accessed with the
NGX_HTTP_SUBREQUEST_IN_MEMORY feature.  Now any response body from a subrequest
can be saved in a memory buffer.  It is available as a single buffer in r->out
and the buffer size is configured by the subrequest_output_buffer_size
directive.

Upstream, proxy and fastcgi code used to handle the old-style feature is
removed.
2018-02-28 16:56:58 +03:00
Vladimir Homutov
2d9db482aa Modules compatibility: additional upstream metrics. 2018-02-22 17:25:43 +03:00
Vadim Filimonov
f607032e0c Auth basic: prevent null character in error log (ticket #1494). 2018-02-26 16:52:20 +02:00
Roman Arutyunyan
dd7dba520c Generate error for unsupported IPv6 transparent proxy.
On some platforms (for example, Linux with glibc 2.12-2.25) IPv4 transparent
proxying is available, but IPv6 transparent proxying is not.  The entire feature
is enabled in this case and NGX_HAVE_TRANSPARENT_PROXY macro is set to 1.
Previously, an attempt to enable transparency for an IPv6 socket was silently
ignored in this case and was usually followed by a bind(2) EADDRNOTAVAIL error
(ticket #1487).  Now the error is generated for unavailable IPv6 transparent
proxy.
2018-02-22 13:16:21 +03:00
Ruslan Ermilov
bcda92e843 HTTP/2: style.
Unified the style of validity checks in ngx_http_v2_validate_header().
2018-02-22 12:42:29 +03:00
Sergey Kandaurov
b3b4a98a5c Geo: fixed indentation. 2018-02-21 17:26:00 +03:00
Ruslan Ermilov
7a45918e0b Geo: optimized configuration parser.
If the geo block parser has failed, doing more things is pointless.
2018-02-21 15:50:43 +03:00
Ruslan Ermilov
f98a8c4db6 Geo: fixed memory allocation error handling (closes #1482).
If during configuration parsing of the geo directive the memory
allocation has failed, pool used to parse configuration inside
the block, and sometimes the temporary pool were not destroyed.
2018-02-21 15:50:42 +03:00
Ruslan Ermilov
864d93965b Version bump. 2018-02-21 15:50:35 +03:00
Maxim Dounin
89f4129f56 release-1.13.9 tag 2018-02-20 17:08:49 +03:00
Maxim Dounin
22adf80c4a nginx-1.13.9-RELEASE 2018-02-20 17:08:48 +03:00