~titusx/nginx/mainline : changes

~titusx/nginx/mainline » Changes from revision 7236

From Revision 6785 to 6766

Rev	Summary	Authors	Tags	Date
6785	Use .Mt to mark up email addresses. Use .Mt to mark up email addresses.	Sergey Kandaurov		3 years ago
6784	Core: "-e" command line option. Core: "-e" command line option. When installing or running from a non-root user it is sometimes required to override default, compiled in error log path. There was no way to do this without rebuilding the binary (ticket #147). This patch introduced "-e" command line option which allows one to override compiled in error log path.	Igor Ippolitov		3 years ago
6783	Configure: shared sources for addon modules. Configure: shared sources for addon modules. Addon modules, both dynamic and static, can now use shared source files. Shared sources result in only one make rule even if specified several times in different modules.	Maxim Dounin		3 years ago
6782	Configure: initialization of NGX_ADDON_SRCS. Configure: initialization of NGX_ADDON_SRCS.	Maxim Dounin		3 years ago
6781	Configure: style. Configure: style.	Maxim Dounin		3 years ago
6780	Request body: removed error assumption (ticket #2058). Request body: removed error assumption (ticket #2058). Before introduction of request body filter in 42d9beeb22db, the only possible return code from the ngx_http_request_body_filter() call without actual buffers was NGX_HTTP_INTERNAL_SERVER_ERROR, and the code in ngx_http_read_client_request_body() hardcoded the only possible error to simplify the code of initial call to set rb->rest. This is no longer true after introduction of request body filters though, as a request body filter might need to return other errors, such as 403. Fix is to preserve the error code actually returned by the call instead of assuming 500.	Maxim Dounin		3 years ago
6779	Request body: improved logging. Request body: improved logging. Added logging before returning NGX_HTTP_INTERNAL_SERVER_ERROR if there are busy buffers after a request body flush. This should never happen with current code, though bugs can be introduced by 3rd party modules. Make sure debugging will be easy enough.	Maxim Dounin		3 years ago
6778	SSL: fixed non-working SSL shutdown on lingering close. SSL: fixed non-working SSL shutdown on lingering close. When doing lingering close, the socket was first shut down for writing, so SSL shutdown initiated after lingering close was not able to send the close_notify alerts (ticket #2056). The fix is to call ngx_ssl_shutdown() before shutting down the socket.	Ruslan Ermilov		3 years ago
6777	Removed dead code from ngx_http_set_keepalive(). Removed dead code from ngx_http_set_keepalive(). The code removed became dead after 98f03cd8d6cc (0.8.14), circa when the request reference counting was introduced.	Ruslan Ermilov		3 years ago
6776	Core: added format specifiers to output binary data as hex. Core: added format specifiers to output binary data as hex. Now "s", "V", and "v" format specifiers may be prefixed with "x" (lowercase) or "X" (uppercase) to output corresponding data in hexadecimal format. In collaboration with Maxim Dounin.	Vladimir Homutov		3 years ago
6775	Version bump. Version bump.	Vladimir Homutov		3 years ago
6774	release-1.19.4 tag release-1.19.4 tag	Maxim Dounin		3 years ago
6773	nginx-1.19.4-RELEASE nginx-1.19.4-RELEASE	Maxim Dounin	release-1.19.4	3 years ago
6772	SSL: ssl_reject_handshake directive (ticket #195). SSL: ssl_reject_handshake directive (ticket #195). In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.	Maxim Dounin		3 years ago
6771	Stream: proxy_ssl_conf_command directive. Stream: proxy_ssl_conf_command directive. Similarly to ssl_conf_command, proxy_ssl_conf_command can be used to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later, when connecting to upstream servers with SSL. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).	Maxim Dounin		3 years ago
6770	Upstream: proxy_ssl_conf_command and friends. Upstream: proxy_ssl_conf_command and friends. Similarly to ssl_conf_command, proxy_ssl_conf_command (grpc_ssl_conf_command, uwsgi_ssl_conf_command) can be used to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later, when connecting to upstream servers with SSL. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).	Maxim Dounin		3 years ago
6769	SSL: ssl_conf_command directive. SSL: ssl_conf_command directive. With the ssl_conf_command directive it is now possible to set arbitrary OpenSSL configuration parameters as long as nginx is compiled with OpenSSL 1.0.2 or later. Full list of available configuration commands can be found in the SSL_CONF_cmd manual page (https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html). In particular, this allows configuring PrioritizeChaCha option (ticket #1445): ssl_conf_command Options PrioritizeChaCha; It can be also used to configure TLSv1.3 ciphers in OpenSSL, which fails to configure them via the SSL_CTX_set_cipher_list() interface (ticket #1529): ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; Configuration commands are applied after nginx own configuration for SSL, so they can be used to override anything set by nginx. Note though that configuring OpenSSL directly with ssl_conf_command might result in a behaviour nginx does not expect, and should be done with care.	Maxim Dounin		3 years ago
6768	Core: ngx_conf_set_keyval_slot() now accepts NGX_CONF_UNSET_... Core: ngx_conf_set_keyval_slot() now accepts NGX_CONF_UNSET_PTR. With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge keyval arrays. This change actually follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.	Maxim Dounin		3 years ago
6767	Cpp test: added stream. Cpp test: added stream.	Ruslan Ermilov		3 years ago
6766	Limit req: unlocking of nodes on complex value errors. Limit req: unlocking of nodes on complex value errors. Previously, if there were multiple limits configured, errors in ngx_http_complex_value() during processing of a non-first limit resulted in reference count leak in shared memory nodes of already processed limits. Fix is to explicity unlock relevant nodes, much like we do when rejecting requests.	Maxim Dounin		3 years ago