From sirtcp at gmail.com  Wed Jun  1 13:26:55 2016
From: sirtcp at gmail.com (Muhammad Yousuf Khan)
Date: Wed, 1 Jun 2016 18:26:55 +0500
Subject: Buitwith.com showing apache and nginx both.
In-Reply-To: <20160531202421.GE2852@daoine.org>
References: <CAGWVfMk6EsV0Ei_8ROa0Sa45usonwZEReyHbxzM4cxsLDLDxhg@mail.gmail.com>
 <20160531202421.GE2852@daoine.org>
Message-ID: <CAGWVfMmULWzGs9GTnceG4p53fTNpaeS7nVwEbW9o=TzvADZfGw@mail.gmail.com>

Thanks for the tip Francis, really appreciate.

Thanks,
MYK

On Wed, Jun 1, 2016 at 1:24 AM, Francis Daly <francis at daoine.org> wrote:

> On Tue, May 31, 2016 at 07:04:30PM +0500, Muhammad Yousuf Khan wrote:
>
> Hi there,
>
> > When i scan my site with builtwith.com it is showing that i am using
> both
> > nginx and apache.
>
> When you scan your site with builtwith.com, what do your nginx logs say
> the requests were?
>
> When you make those same requests yourself, what responses do you get?
>
> Pay particular attention to the http headers.
>
> > Any idea why?
>
> Perhaps builtwith.com makes a request that your nginx is configured to
> reverse-proxy to an apache server, without hiding the Server header.
>
> Perhaps builtwith.com scanned your site previously, and show all
> historical answers.
>
> Perhaps builtwith.com uses heuristics which are wrong for your site.
>
>         f
> --
> Francis Daly        francis at daoine.org
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160601/da9d89d0/attachment.html>

From larry.martell at gmail.com  Wed Jun  1 20:45:29 2016
From: larry.martell at gmail.com (Larry Martell)
Date: Wed, 1 Jun 2016 16:45:29 -0400
Subject: checking headers
In-Reply-To: <20160531230619.GF2852@daoine.org>
References: <CAEuShZdeBL6fcZ57jHwV1qxqJxDSFsAh21xFsBnoHj-RYvZ_oQ@mail.gmail.com>
 <CACwCsY4tm9i7cM8o18xER3azhmtWnSN8juopHa9yrnkWVQzmsA@mail.gmail.com>
 <CACwCsY47YPLUZGjbOr_2aP1Ue1o9TPL5p5UvTzm8R2F+F80qag@mail.gmail.com>
 <CACwCsY6D6-6=bbnHv2q=sWtJGQTOAOCrHpOuE9P80oR6tQHdng@mail.gmail.com>
 <20160531134557.GB2852@daoine.org>
 <CACwCsY4hhixqqeexukKF73aH2sEN7NKQK-QMQ2ZNL1uG5pCpYg@mail.gmail.com>
 <20160531153828.GC2852@daoine.org>
 <CACwCsY6-Qw2bWSue_g4NneC9D_-vqOhJ-30HXxHUCm3BknSrwA@mail.gmail.com>
 <20160531201948.GD2852@daoine.org>
 <CACwCsY6CxFO1X=FBBJFmesCDJURUrdH8ndUAqanBBn-gUMYziQ@mail.gmail.com>
 <20160531230619.GF2852@daoine.org>
Message-ID: <CACwCsY4+oMxgkT1rVt3omxs4XOQ5zS2s_gX2dpoKfD0U1_5o8Q@mail.gmail.com>

On Tue, May 31, 2016 at 7:06 PM, Francis Daly <francis at daoine.org> wrote:
> On Tue, May 31, 2016 at 04:48:19PM -0400, Larry Martell wrote:
>> On Tue, May 31, 2016 at 4:19 PM, Francis Daly <francis at daoine.org> wrote:
>> > On Tue, May 31, 2016 at 12:33:56PM -0400, Larry Martell wrote:
>
> Hi there,
>
>> > It sounds like your design is that your client sends a http request to
>> > port 8004; the http service there returns a 301 redirect to a url on port
>> > 8000 and includes a particular response header; and you want your client
>> > to follow the redirect by making a new request to port 8000 and include a
>> > request header that mirrors the particular response header that you sent.
>>
>> With the django app, what you are saying is correct.
>>
>> > If you are using the client that you wrote, then you can make sure that
>> > it does that.
>> >
>> > If you are using a general http client, it is unlikely to do that.
>>
>> I am knida new to all this. The apps were written by someone who quit
>> and then this was all dropped in my lap.

Francis, I really appreciate the time you took to send such a complete
and thoughtful reply.

> It might be instructive for you to find out *why* they quit.

I'll never know for sure, as he was gone before I got there. But I
have some pretty good guesses.

> If it was related to them being required to implement a design which they
> knew can't possibly work, it would be good for you to learn that early.

He was the one who designed and built it, and it seems overly
complicated to me. But I like to give people the benefit of the doubt
and think he had his reasons.

> But that's beside the point, here.
>
>> I thought I was clear on what
>> a client and server were in life, in this app it's somewhat screwy.
>
> Probably a good thing you can do for you, is take a pencil and paper
> and write down the intended data flow of this application.

Yes, that was one of the first things I did when I took the job. I
understand the flow, but I don't understand why it was done in the way
it was.

> Until you are happy that the design is right, you probably can't accept
> responsibility for implementing it.

It's implemented already and it functionally works, but it has no
security or authentication at all. That is what I was asked to add.
And they wanted it done ASAP since they were hanging out naked.

> In general, the app is a chain of events. At each point, one client is
> making one request of one server.
>
> When you can see the data flow design, it will be clearer to you.
>
>> What is behind port 8000 is nginx routing to some Angular code that
>> sends a request out. So the Angular code, although client side, is
>> acting like a server in that it is invoked in response to a request.
>
> I don't follow all of those words, but that's ok: I don't have to.

Initially I didn't find it confusing, but perhaps that is from my
ignorance. But when I talked to people about it they were always
confused. I didn't see why there were so confused, but then it struck
me - the Angular code acts like a server and in everyone's mind, that
is not what client side code does. I was trying in the Angular code to
get info on the request it was serving. But from Angular's point of
view, it wasn't serving a request - it was just being invoked and it
sends out a request. The fact that it was invoked because nginx got a
request on port 8000 was not known to Angular. So me trying to do
server type things (like look a the request headers) made no sense in
client side code.

>> Then it turns about and acts like a client and sends a request out.
>> So, who's the server here? nginx?
>
> Whatever is making the request is the client at this instant; whatever
> is receiving the request is the server at this instant.
>
>> There are 2 approved ways to send a request to port 8000. One is from
>> an app we wrote that is in C++ and it directly sends the request to
>> port 8000. These requests are always previously authenticated and are
>> good to go. The second is from a django endpoint listening on 8004. It
>> does some authentication and if all is good, redirects to 8000. So
>> with both of these cases I want to request to port 8000 to go through.
>>
>> Then, of course, there are myriad other ways for a request to get port
>> 8000 - from a browser, curl, wget, etc. In all of these cases I want
>> the request to be blocked and return a 401.
>
> nginx on port 8000 does not care whether the request came from your C++
> app or from my curl command.
>
> All it cares about is what it is configured to do: which is to accept a
> http request that includes the "I promise I am authorised" token.
>
> browser, curl, wget, etc, can all include that token, without touching
> your django app or your C++ program.

Yes, I realize all that. I was going for some short term security by
obscurity. Anything is better then the nothing they had.

> If that is your design, and the authorisation actually matters for
> anything, then your design is broken and you need to re-design.

What I ended up doing was to embed the auth info in the URL parameters
and then encrypt that. Got me by for the moment. Down the road I'll do
something better.

>> I was hoping to do this with a custom header, but that appears not to
>> work. Can anyone recommend another way to achieve this?
>
> One possibility might be to use auth_request
> (http://nginx.org/r/auth_request) within nginx to authorise-and-return
> the content in one step (as far as the client is concerned) in nginx.
>
> Another possibility might be to use "X-Accel-Redirect" from the
> reverse-proxied authorisation-checker. Again, from the client perspective,
> the request with credentials results in the desired response directly.

Thanks I will look into those solutions.

> The current two-step process of one request with credentials which are
> checked, returning a "I am authorised" token; followed by another request
> with that token which the second server does not authenticate at all;
> leads to you being able to use "curl" to pretend to be authorised.

Yes, if someone knew what header field and value to use.

>> > Perhaps an alternate design involving reverse-proxying would be valid?
>>
>> How would that help me?
>
> As above, nginx could reverse-proxy to the authorisation checker; or
> alternatively the django app could reverse-proxy to nginx; and then you
> could put in external (firewall?) rules which mean that only your C++
> app and your django app can get to nginx on port 8000.
>
> Good luck with it,

Thanks again!

-Larry


From lists at ruby-forum.com  Thu Jun  2 17:51:06 2016
From: lists at ruby-forum.com (Gabriel Arrais)
Date: Thu, 02 Jun 2016 19:51:06 +0200
Subject: Map is not matching correctly against upstream custom header
Message-ID: <f99d63bd1e66661d80b53db72d7623e5@ruby-forum.com>

Hi, I'm trying to configure my proxy cache settings based in a response
custom
header, using proxy_no_cache and proxy_cache_bypass directives.

First question: is it possible at all?
Second question: If it is, why this map is always hitting the default
value?

   map $sent_http_x_my_custom_header $no_cache {
        default    0;
        1          0;
        true     0;
        false      1;
        "~*false"  1;
    }

    ....

   location ~ ^/ {
       ...
       proxy_no_cache  $no_cache;^M
       proxy_cache_bypass  $no_cache;^M
   }

I've already tried the map with $sent_http_x_my_custom_header,
$upstream_http_x_my_custom_header and $http_x_my_custom_header. It's
always the same result.

obs: I've already tried with if but if is resolved in request time so it
didn't work.

Thank you in advance.

-- 
Posted via http://www.ruby-forum.com/.


From mdounin at mdounin.ru  Thu Jun  2 18:26:21 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Thu, 2 Jun 2016 21:26:21 +0300
Subject: Map is not matching correctly against upstream custom header
In-Reply-To: <f99d63bd1e66661d80b53db72d7623e5@ruby-forum.com>
References: <f99d63bd1e66661d80b53db72d7623e5@ruby-forum.com>
Message-ID: <20160602182621.GM36620@mdounin.ru>

Hello!

On Thu, Jun 02, 2016 at 07:51:06PM +0200, Gabriel Arrais wrote:

> Hi, I'm trying to configure my proxy cache settings based in a response
> custom
> header, using proxy_no_cache and proxy_cache_bypass directives.
> 
> First question: is it possible at all?
> Second question: If it is, why this map is always hitting the default
> value?
> 
>    map $sent_http_x_my_custom_header $no_cache {
>         default    0;
>         1          0;
>         true     0;
>         false      1;
>         "~*false"  1;
>     }
> 
>     ....
> 
>    location ~ ^/ {
>        ...
>        proxy_no_cache  $no_cache;^M
>        proxy_cache_bypass  $no_cache;^M
>    }
> 
> I've already tried the map with $sent_http_x_my_custom_header,
> $upstream_http_x_my_custom_header and $http_x_my_custom_header. It's
> always the same result.
> 
> obs: I've already tried with if but if is resolved in request time so it
> didn't work.

The problem is that you are trying to lookup response headers when 
there is no response yet.  Both "if" and "proxy_cache_bypass" are 
checked before the request is sent to a backend, and hence they 
can't do anything good.

Additionally, map{} results are always cached, and when you try to 
lookup it again via "proxy_no_cache" it just return a previously 
cached value (the one computed when there were no response yet).

Consider removing "proxy_cache_bypass" from your cofiguration.  
Just

    map $upstream_http_x_my_custom_header $no_cache {
        ...
    }

    proxy_no_cache $no_cache;

is expected to work fine.

-- 
Maxim Dounin
http://nginx.org/


From lists at ruby-forum.com  Thu Jun  2 19:12:58 2016
From: lists at ruby-forum.com (Gabriel Arrais)
Date: Thu, 02 Jun 2016 21:12:58 +0200
Subject: Map is not matching correctly against upstream custom header
In-Reply-To: <20160602182621.GM36620@mdounin.ru>
References: <f99d63bd1e66661d80b53db72d7623e5@ruby-forum.com>
 <20160602182621.GM36620@mdounin.ru>
Message-ID: <8624346c0f1cbae78b7ad2133625a30c@ruby-forum.com>

Maxim Dounin wrote in post #1183769:
> Hello!
>
> On Thu, Jun 02, 2016 at 07:51:06PM +0200, Gabriel Arrais wrote:
>
>>         1          0;
>>        proxy_cache_bypass  $no_cache;^M
>>    }
>>
>> I've already tried the map with $sent_http_x_my_custom_header,
>> $upstream_http_x_my_custom_header and $http_x_my_custom_header. It's
>> always the same result.
>>
>> obs: I've already tried with if but if is resolved in request time so it
>> didn't work.
>
> The problem is that you are trying to lookup response headers when
> there is no response yet.  Both "if" and "proxy_cache_bypass" are
> checked before the request is sent to a backend, and hence they
> can't do anything good.
>
> Additionally, map{} results are always cached, and when you try to
> lookup it again via "proxy_no_cache" it just return a previously
> cached value (the one computed when there were no response yet).
>
> Consider removing "proxy_cache_bypass" from your cofiguration.
> Just
>
>     map $upstream_http_x_my_custom_header $no_cache {
>         ...
>     }
>
>     proxy_no_cache $no_cache;
>
> is expected to work fine.
>
> --
> Maxim Dounin
> http://nginx.org/


Hello Maxim!

Thank you very much for the response, I think that I can't remove the 
"proxy_cache_bypass" from my configuration because other mecanisms are 
using this directive, in other situations..

I will try to use two different variables for proxy_no_cache and 
proxy_cache_bypass.

Again, thank you!

-- 
Posted via http://www.ruby-forum.com/.


From thaisdauto at hotmail.com  Fri Jun  3 03:04:45 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 03:04:45 +0000
Subject: Problem
Message-ID: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>

I know that you are the hosting company 's website: www.empresascnpj.com because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!

Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/034ad2e3/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 03:07:04 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 03:07:04 +0000
Subject: Problem
In-Reply-To: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
Message-ID: <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>

Immediately!!!!


________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
Enviado: sexta-feira, 3 de junho de 2016 00:04
Para: nginx at nginx.org
Assunto: Problem


I know that you are the hosting company 's website: www.empresascnpj.com because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!

Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/c7fd127a/attachment.html>

From rpaprocki at fearnothingproductions.net  Fri Jun  3 03:21:27 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Thu, 2 Jun 2016 20:21:27 -0700
Subject: Problem
In-Reply-To: <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
Message-ID: <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>

Oh man you guys. Immediately. Next to his lawyer. 

> On Jun 2, 2016, at 20:07, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
> Immediately!!!!
> 
> 
> 
>  
> De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
> Enviado: sexta-feira, 3 de junho de 2016 00:04
> Para: nginx at nginx.org
> Assunto: Problem
>  
> I know that you are the hosting company 's website: www.empresascnpj.com because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!
> 
> Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103
> 
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160602/86e53904/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 03:25:35 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 03:25:35 +0000
Subject: Problem
In-Reply-To: <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>,
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
Message-ID: <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>


I just want to remove the website link I sent.




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
Enviado: sexta-feira, 3 de junho de 2016 00:21
Para: nginx at nginx.org
Assunto: Re: Problem

Oh man you guys. Immediately. Next to his lawyer.

On Jun 2, 2016, at 20:07, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


Immediately!!!!


________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>>
Enviado: sexta-feira, 3 de junho de 2016 00:04
Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Problem


I know that you are the hosting company 's website: www.empresascnpj.com<http://www.empresascnpj.com> because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!

Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103



_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/d3018abc/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 03:29:38 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 03:29:38 +0000
Subject: No subject
Message-ID: <GRUPR80MB07952D7ADB5C58FAD71FE0CCC3590@GRUPR80MB0795.lamprd80.prod.outlook.com>


You are the webmaster. Host that site . So can remove.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/737eb010/attachment.html>

From rpaprocki at fearnothingproductions.net  Fri Jun  3 03:40:40 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Thu, 2 Jun 2016 20:40:40 -0700
Subject: Problem
In-Reply-To: <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
Message-ID: <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>

This is NOT the appropriate address to send these requests. This is a public mailing list for Nginx users. Nginx is an open source web server, not a web master or web hosting company. 

> On Jun 2, 2016, at 20:25, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
> 
> I just want to remove the website link I sent.
> 
> 
> 
> 
>  
> De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
> Enviado: sexta-feira, 3 de junho de 2016 00:21
> Para: nginx at nginx.org
> Assunto: Re: Problem
>  
> Oh man you guys. Immediately. Next to his lawyer. 
> 
> On Jun 2, 2016, at 20:07, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
>> Immediately!!!!
>> 
>> 
>> 
>>  
>> De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
>> Enviado: sexta-feira, 3 de junho de 2016 00:04
>> Para: nginx at nginx.org
>> Assunto: Problem
>>  
>> I know that you are the hosting company 's website: www.empresascnpj.com because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!
>> 
>> Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160602/7c6d92ee/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 03:50:35 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 03:50:35 +0000
Subject: Problem
In-Reply-To: <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>,
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
Message-ID: <GRUPR80MB07955163032ABE3D05D76EC6C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>


I would like then to know what is the appropriate address !? And I would like further to know why nginx is on the homepage of the website " empresacnpj " main to support and problems , and as webmaster. Site moreover, that contains my data without my permission .




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
Enviado: sexta-feira, 3 de junho de 2016 00:40
Para: nginx at nginx.org
Assunto: Re: Problem

This is NOT the appropriate address to send these requests. This is a public mailing list for Nginx users. Nginx is an open source web server, not a web master or web hosting company.

On Jun 2, 2016, at 20:25, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


I just want to remove the website link I sent.




________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net<mailto:rpaprocki at fearnothingproductions.net>>
Enviado: sexta-feira, 3 de junho de 2016 00:21
Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Re: Problem

Oh man you guys. Immediately. Next to his lawyer.

On Jun 2, 2016, at 20:07, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


Immediately!!!!


________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>>
Enviado: sexta-feira, 3 de junho de 2016 00:04
Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Problem


I know that you are the hosting company 's website: www.empresascnpj.com<http://www.empresascnpj.com> because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!

Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103



_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/15903dec/attachment.html>

From jim at ohlste.in  Fri Jun  3 04:25:42 2016
From: jim at ohlste.in (Jim Ohlstein)
Date: Fri, 3 Jun 2016 00:25:42 -0400
Subject: Problem
In-Reply-To: <GRUPR80MB07955163032ABE3D05D76EC6C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <GRUPR80MB07955163032ABE3D05D76EC6C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
Message-ID: <7D008911-0E84-4FA7-B395-AAD6559B771D@ohlste.in>

You're really pretty dense but I'll try.

You're in the wrong place. There. That's it. We don't know why someone put information on THEIR website. 

Try figuring out who actually hosts it, and complain to them. 

We can't help you so please stop bothering us. 

Jim Ohlstein

> On Jun 2, 2016, at 11:50 PM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
> 
> I would like then to know what is the appropriate address !? And I would like further to know why nginx is on the homepage
>  of the website " empresacnpj " main to support and problems , and as webmaster. Site moreover, that contains my data without my permission .
> 
> 
> 
> 
> De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
> Enviado: sexta-feira, 3 de junho de 2016 00:40
> Para: nginx at nginx.org
> Assunto: Re: Problem
>  
> This is NOT the appropriate address to send these requests. This is a public mailing list for Nginx users. Nginx is an open source web server, not a web master or web hosting company. 
> 
> On Jun 2, 2016, at 20:25, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
>> 
>> I just want to remove the website link I sent.
>> 
>> 
>> 
>> 
>> De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
>> Enviado: sexta-feira, 3 de junho de 2016 00:21
>> Para: nginx at nginx.org
>> Assunto: Re: Problem
>>  
>> Oh man you guys. Immediately. Next to his lawyer. 
>> 
>> On Jun 2, 2016, at 20:07, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>> 
>>> Immediately!!!!
>>> 
>>> 
>>> 
>>> De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
>>> Enviado: sexta-feira, 3 de junho de 2016 00:04
>>> Para: nginx at nginx.org
>>> Assunto: Problem
>>>  
>>> I know that you are the hosting company 's website: www.empresascnpj.com because there on page one even has the link to get in touch with you . As there is no way to contact them and there responsaliza you as their support , I want you to remove IMMEDIATELY a link that contains my ex cnpj . I 've given this low cnpj ! And I never allowed that this site and show exisse my personal data , as it has done . Exposing myself to anyone who look for my name on the internet ! I want to remove my data from this site ! I did not authorize !!!!!!! I was clear? Or I'll look for my rights , next to my lawyer!
>>> 
>>> Page! http://www.empresascnpj.com/s/empresa/sam-estetica-me/22509539000103
>>> _______________________________________________
>>> nginx mailing list
>>> nginx at nginx.org
>>> http://mailman.nginx.org/mailman/listinfo/nginx
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/38b06d20/attachment.html>

From lists at lazygranch.com  Fri Jun  3 04:33:14 2016
From: lists at lazygranch.com (lists at lazygranch.com)
Date: Fri, 03 Jun 2016 00:33:14 -0400
Subject: Problem
In-Reply-To: <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
Message-ID: <20160603043314.5451859.33870.4071@lazygranch.com>

An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/11b2116a/attachment.html>

From shilei at qiyi.com  Fri Jun  3 06:55:15 2016
From: shilei at qiyi.com (=?gb2312?B?yq/A2g==?=)
Date: Fri, 3 Jun 2016 06:55:15 +0000
Subject: How to reproduce issue CVE-2016-4450?
Message-ID: <bcb3133ce0984fc2b75489b1efc3b6c6@EXCH04.iqiyi.pps>

Hi,

I am working on the fixing of issue CVE-2016-4450, it seems that if the request body is neither saved in the memory nor in file, it might crash when save the request body to the temp file.
Could you instruct me what kind of request body can trigger this issue? I want to reproduce it, and evaluate the whether upgrade our nginx server.

Refer to CVE-2016-4450:
A problem was identified in nginx code responsible for saving
client request body to a temporary file.  A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).

Thanks!


?  ?
?????????????

[????logo]

?????
??????????????2???????17?
???100080
????86 138 1180 3496
???
????86 10 6267 7000
???shilei at qiyi.com<mailto:shilei at qiyi.com>
???www.iQIYI.com  www.ppstream.com<http://www.ppstream.com/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/97ab6e03/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 25521 bytes
Desc: image001.jpg
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/97ab6e03/attachment.jpg>

From wangsamp at gmail.com  Fri Jun  3 07:32:15 2016
From: wangsamp at gmail.com (Oleksandr V. Typlyns'kyi)
Date: Fri, 3 Jun 2016 10:32:15 +0300 (EEST)
Subject: How to reproduce issue CVE-2016-4450?
In-Reply-To: <bcb3133ce0984fc2b75489b1efc3b6c6@EXCH04.iqiyi.pps>
References: <bcb3133ce0984fc2b75489b1efc3b6c6@EXCH04.iqiyi.pps>
Message-ID: <alpine.BSF.2.00.1606031029170.32902@u.fchgavxzrqvn.arg>

Today Jun 3, 2016 at 06:55 ?? wrote:

> Hi,
> 
> I am working on the fixing of issue CVE-2016-4450, it seems that if the request body is neither saved in the memory nor in file, it might crash when save the request body to the temp file.
> Could you instruct me what kind of request body can trigger this issue? I want to reproduce it, and evaluate the whether upgrade our nginx server.

  Chunked WebDAV PUT: https://trac.nginx.org/nginx/ticket/981

-- 
WNGS-RIPE


From maxim at nginx.com  Fri Jun  3 07:39:47 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Fri, 3 Jun 2016 10:39:47 +0300
Subject: Problem
In-Reply-To: <20160603043314.5451859.33870.4071@lazygranch.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <20160603043314.5451859.33870.4071@lazygranch.com>
Message-ID: <43872302-db51-a576-0209-0142c709442c@nginx.com>

On 6/3/16 7:33 AM, lists at lazygranch.com wrote:
> Perhaps in a future release of Nginx, the error pages should not
> contain any reference to nginx. That is the only way I can figure
> out this person came up with the idea of complaining to the list.
> (Assuming this isn't spam to encourage use to click on that website
> link.)
> 
Actually, a number of such complains is still surprisingly low.

> I think another mistake is to have the error page indicate the rev
> of nginx. That is an easy way for someone to spot a vulnerable rev
> of the nginx on a server.
> 

-- 
Maxim Konovalov


From reallfqq-nginx at yahoo.fr  Fri Jun  3 10:42:52 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Fri, 3 Jun 2016 12:42:52 +0200
Subject: Problem
In-Reply-To: <43872302-db51-a576-0209-0142c709442c@nginx.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <20160603043314.5451859.33870.4071@lazygranch.com>
 <43872302-db51-a576-0209-0142c709442c@nginx.com>
Message-ID: <CALqce=1wdkyN9ZKSnk8ASsbn+fxpszjZeufD7+TaZVNydK3k5w@mail.gmail.com>

xD Maxim.

I would have put 'hopefully' along with 'surprisingly' though... just to
convince myself such dumbness is marginal.

To lists at lazygranch.com, nginx version can already be removed with the help
of the server_tokens
<http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens>
directive.
Why that is not the default brings back the eternal difficulties around
changing defaults, compatbility and stability, debate I (re)initiated
around some other 'odd' defaults.

Anyway, we are drifting away from the original subject, which is... Oh
yeah, stupidity. And next to his lawyer. (And huge font size.)
---
*B. R.*

On Fri, Jun 3, 2016 at 9:39 AM, Maxim Konovalov <maxim at nginx.com> wrote:

> On 6/3/16 7:33 AM, lists at lazygranch.com wrote:
> > Perhaps in a future release of Nginx, the error pages should not
> > contain any reference to nginx. That is the only way I can figure
> > out this person came up with the idea of complaining to the list.
> > (Assuming this isn't spam to encourage use to click on that website
> > link.)
> >
> Actually, a number of such complains is still surprisingly low.
>
> > I think another mistake is to have the error page indicate the rev
> > of nginx. That is an easy way for someone to spot a vulnerable rev
> > of the nginx on a server.
> >
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/8bdb8410/attachment.html>

From pb.rakesh90 at gmail.com  Fri Jun  3 11:57:07 2016
From: pb.rakesh90 at gmail.com (RAKESH P B)
Date: Fri, 3 Jun 2016 17:27:07 +0530
Subject: Enable the Etag for dynamic content
Message-ID: <CAB6Dfx4gX70v6r9dijGREE7ppHXprHaw6nPXyeU8zXNr6kR8vA@mail.gmail.com>

Hi All,

I'm using ngnx version nginx/1.10.1,  php application in back end connected
via unix socket. We are planning to enable the cache behavior for dynamic
contents using cache control headers and etag. We have tried below below
method to enable the etag, but none of the method working as expected.


1. Compiled the nginx source code (1.10.0) with dynamic etag module.
2. upstream configuration is used to to connect via unix socket instead of
location method.

Any suggestions will be helpful
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/738b05e3/attachment.html>

From mdounin at mdounin.ru  Fri Jun  3 14:08:02 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Fri, 3 Jun 2016 17:08:02 +0300
Subject: Enable the Etag for dynamic content
In-Reply-To: <CAB6Dfx4gX70v6r9dijGREE7ppHXprHaw6nPXyeU8zXNr6kR8vA@mail.gmail.com>
References: <CAB6Dfx4gX70v6r9dijGREE7ppHXprHaw6nPXyeU8zXNr6kR8vA@mail.gmail.com>
Message-ID: <20160603140802.GP36620@mdounin.ru>

Hello!

On Fri, Jun 03, 2016 at 05:27:07PM +0530, RAKESH P B wrote:

> Hi All,
> 
> I'm using ngnx version nginx/1.10.1,  php application in back end connected
> via unix socket. We are planning to enable the cache behavior for dynamic
> contents using cache control headers and etag. We have tried below below
> method to enable the etag, but none of the method working as expected.
> 
> 
> 1. Compiled the nginx source code (1.10.0) with dynamic etag module.
> 2. upstream configuration is used to to connect via unix socket instead of
> location method.
> 
> Any suggestions will be helpful

Try generating entity tags in your application instead.

-- 
Maxim Dounin
http://nginx.org/


From zxcvbn4038 at gmail.com  Fri Jun  3 17:05:18 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Fri, 3 Jun 2016 13:05:18 -0400
Subject: Problem
In-Reply-To: <43872302-db51-a576-0209-0142c709442c@nginx.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <20160603043314.5451859.33870.4071@lazygranch.com>
 <43872302-db51-a576-0209-0142c709442c@nginx.com>
Message-ID: <CA+p3EyxvsLv_NFnEtKHgsSZCf6ktfZJKMmiizq20+Z=6WtJuQQ@mail.gmail.com>

I once knew a guy who convinced someone they had hacked their site by
making a DNS entry to 127.0.0.1. So when the guy tried to access the
"other" site his passwords worked, all his files were there, it was even
running the same software! He made changes on his site and they instantly
appeared on the "other" site. He deleted files off the "other" site and
they were removed from his site - obviously in retaliation!. So after an
hour or so of trying to figure out how his server is being accessed the guy
just goes completely ballistic and starts calling the police and then the
FBI (this was in the US). The FBI did investigate and visited the prankster
in person. He explained what loopback was and how the prank worked, and the
FBI agents thought it was pretty funny - they do have a sense of humor
after all.


On Fri, Jun 3, 2016 at 3:39 AM, Maxim Konovalov <maxim at nginx.com> wrote:

> On 6/3/16 7:33 AM, lists at lazygranch.com wrote:
> > Perhaps in a future release of Nginx, the error pages should not
> > contain any reference to nginx. That is the only way I can figure
> > out this person came up with the idea of complaining to the list.
> > (Assuming this isn't spam to encourage use to click on that website
> > link.)
> >
> Actually, a number of such complains is still surprisingly low.
>
> > I think another mistake is to have the error page indicate the rev
> > of nginx. That is an easy way for someone to spot a vulnerable rev
> > of the nginx on a server.
> >
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/e5396db1/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:18:21 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:18:21 +0000
Subject: Problem
In-Reply-To: <CA+p3EyxvsLv_NFnEtKHgsSZCf6ktfZJKMmiizq20+Z=6WtJuQQ@mail.gmail.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <20160603043314.5451859.33870.4071@lazygranch.com>
 <43872302-db51-a576-0209-0142c709442c@nginx.com>,
 <CA+p3EyxvsLv_NFnEtKHgsSZCf6ktfZJKMmiizq20+Z=6WtJuQQ@mail.gmail.com>
Message-ID: <BLUPR80MB078721D8F6C43D682C8CDEC3C3590@BLUPR80MB0787.lamprd80.prod.outlook.com>

Hi

I do not want to receive these emails . I received a lot of emails and none were really to me or to help me in what I said. So now I want to stop receiving these emails . I sent an email to " nginx at nginx.org " I sent my personal email , I use to serious things , I would like to know why the email is that web page !? https://forum.nginx.org/read.php?2,267331,267333 exposing my email and the material contained therein , the google search ! And I just looked for a " nginx " to get an error page of google searches, page which contained and still contains some personal documents. Look I'm trying to do the easy method , but I think I'll have to get justice.




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de CJ Ess <zxcvbn4038 at gmail.com>
Enviado: sexta-feira, 3 de junho de 2016 14:05
Para: nginx at nginx.org
Assunto: Re: Problem

I once knew a guy who convinced someone they had hacked their site by making a DNS entry to 127.0.0.1. So when the guy tried to access the "other" site his passwords worked, all his files were there, it was even running the same software! He made changes on his site and they instantly appeared on the "other" site. He deleted files off the "other" site and they were removed from his site - obviously in retaliation!. So after an hour or so of trying to figure out how his server is being accessed the guy just goes completely ballistic and starts calling the police and then the FBI (this was in the US). The FBI did investigate and visited the prankster in person. He explained what loopback was and how the prank worked, and the FBI agents thought it was pretty funny - they do have a sense of humor after all.


On Fri, Jun 3, 2016 at 3:39 AM, Maxim Konovalov <maxim at nginx.com<mailto:maxim at nginx.com>> wrote:
On 6/3/16 7:33 AM, lists at lazygranch.com<mailto:lists at lazygranch.com> wrote:
> Perhaps in a future release of Nginx, the error pages should not
> contain any reference to nginx. That is the only way I can figure
> out this person came up with the idea of complaining to the list.
> (Assuming this isn't spam to encourage use to click on that website
> link.)
>
Actually, a number of such complains is still surprisingly low.

> I think another mistake is to have the error page indicate the rev
> of nginx. That is an easy way for someone to spot a vulnerable rev
> of the nginx on a server.
>

--
Maxim Konovalov

_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/7538dc4a/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:21:45 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:21:45 +0000
Subject: Okay?
Message-ID: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>

I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/9d9bfa28/attachment.html>

From rva at onvaoo.com  Fri Jun  3 18:23:59 2016
From: rva at onvaoo.com (Rva@onvaoo.com)
Date: Fri, 3 Jun 2016 20:23:59 +0200
Subject: Okay?
In-Reply-To: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
Message-ID: <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>

Can you give us your exact location (GPS ) this is for the drone action 


> On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
> I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 <https://forum.nginx.org/read.php?2,267331,267333> I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !
> 
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org <mailto:nginx at nginx.org>
> http://mailman.nginx.org/mailman/listinfo/nginx <http://mailman.nginx.org/mailman/listinfo/nginx>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/450b95c5/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:26:01 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:26:01 +0000
Subject: Okay?
In-Reply-To: <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>,
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
Message-ID: <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>

I will not give my location , for whom I do not even know !




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <rva at onvaoo.com>
Enviado: sexta-feira, 3 de junho de 2016 15:23
Para: nginx at nginx.org
Assunto: Re: Okay?

Can you give us your exact location (GPS ) this is for the drone action


On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/5c0ebcce/attachment.html>

From rpaprocki at fearnothingproductions.net  Fri Jun  3 18:27:15 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Fri, 3 Jun 2016 11:27:15 -0700
Subject: Okay?
In-Reply-To: <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
Message-ID: <CAEuShZeRD-SZ=gYvDUHFjxAhsbK_13Q36Lbp_7ZhdLMd=Pv8yQ@mail.gmail.com>

Dare I say, it's time for some moderation on this list?

On Fri, Jun 3, 2016 at 11:26 AM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:

> I will not give my location , for whom I do not even know !
>
>
>
>
>
> ------------------------------
> *De:* nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <
> rva at onvaoo.com>
> *Enviado:* sexta-feira, 3 de junho de 2016 15:23
> *Para:* nginx at nginx.org
> *Assunto:* Re: Okay?
>
> Can you give us your exact location (GPS ) this is for the drone action
>
>
> On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>
> I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/6cf69179/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:27:54 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:27:54 +0000
Subject: Okay?
In-Reply-To: <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>,
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>,
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
Message-ID: <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>


What I want is simple. I sent a private email from my personal hotmail. And everything is published in google searches. I want you to remove !




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
Enviado: sexta-feira, 3 de junho de 2016 15:26
Para: nginx at nginx.org
Assunto: Re: Okay?


I will not give my location , for whom I do not even know !




________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <rva at onvaoo.com>
Enviado: sexta-feira, 3 de junho de 2016 15:23
Para: nginx at nginx.org
Assunto: Re: Okay?

Can you give us your exact location (GPS ) this is for the drone action


On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/05f1bf4c/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:29:44 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:29:44 +0000
Subject: Okay?
In-Reply-To: <CAEuShZeRD-SZ=gYvDUHFjxAhsbK_13Q36Lbp_7ZhdLMd=Pv8yQ@mail.gmail.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>,
 <CAEuShZeRD-SZ=gYvDUHFjxAhsbK_13Q36Lbp_7ZhdLMd=Pv8yQ@mail.gmail.com>
Message-ID: <BLUPR80MB0787AD519A7BCD4680A56887C3590@BLUPR80MB0787.lamprd80.prod.outlook.com>

What?


________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
Enviado: sexta-feira, 3 de junho de 2016 15:27
Para: nginx at nginx.org
Assunto: Re: Okay?

Dare I say, it's time for some moderation on this list?

On Fri, Jun 3, 2016 at 11:26 AM, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:

I will not give my location , for whom I do not even know !




________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Rva at onvaoo.com<mailto:Rva at onvaoo.com> <rva at onvaoo.com<mailto:rva at onvaoo.com>>
Enviado: sexta-feira, 3 de junho de 2016 15:23
Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Re: Okay?

Can you give us your exact location (GPS ) this is for the drone action


On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/2fb0dee6/attachment.html>

From rpaprocki at fearnothingproductions.net  Fri Jun  3 18:30:06 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Fri, 3 Jun 2016 11:30:06 -0700
Subject: Okay?
In-Reply-To: <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
Message-ID: <CAEuShZedzOEV1OUXo7+kPUDM0kVN7PMus5wSLDGwSymBu9j2ng@mail.gmail.com>

You sent an email to a public mailing list. Public mailing lists are
archived for... public use. What did you expect was going to happen?
Continuing to berate this list will accomplish nothing. May I also point
you to: https://en.wikipedia.org/wiki/Streisand_effect

On Fri, Jun 3, 2016 at 11:27 AM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:

>
> What I want is simple. I sent a private email from my personal hotmail.
> And everything is published in google searches. I want you to remove !
>
>
>
>
> ------------------------------
> *De:* nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <
> thaisdauto at hotmail.com>
> *Enviado:* sexta-feira, 3 de junho de 2016 15:26
>
> *Para:* nginx at nginx.org
> *Assunto:* Re: Okay?
>
>
> I will not give my location , for whom I do not even know !
>
>
>
>
>
> ------------------------------
> *De:* nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <
> rva at onvaoo.com>
> *Enviado:* sexta-feira, 3 de junho de 2016 15:23
> *Para:* nginx at nginx.org
> *Assunto:* Re: Okay?
>
> Can you give us your exact location (GPS ) this is for the drone action
>
>
> On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>
> I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/a68d868e/attachment.html>

From thaisdauto at hotmail.com  Fri Jun  3 18:36:33 2016
From: thaisdauto at hotmail.com (=?iso-8859-1?Q?Tha=EDs_Dauto?=)
Date: Fri, 3 Jun 2016 18:36:33 +0000
Subject: Okay?
In-Reply-To: <CAEuShZedzOEV1OUXo7+kPUDM0kVN7PMus5wSLDGwSymBu9j2ng@mail.gmail.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>,
 <CAEuShZedzOEV1OUXo7+kPUDM0kVN7PMus5wSLDGwSymBu9j2ng@mail.gmail.com>
Message-ID: <GRUPR80MB079582AAC21F640F417F6C77C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>

I want to remove my emails the internet . I do not want anything in my google searches. Only I sent these emails to " nginx " because they are on a page that contains my data on Google as well. And I sent asking to remove . Now other emails are on display. I want to cut them this page. https://forum.nginx.org/read.php?2,267331,267333 can you help me ?



________________________________
De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
Enviado: sexta-feira, 3 de junho de 2016 15:30
Para: nginx at nginx.org
Assunto: Re: Okay?

You sent an email to a public mailing list. Public mailing lists are archived for... public use. What did you expect was going to happen? Continuing to berate this list will accomplish nothing. May I also point you to: https://en.wikipedia.org/wiki/Streisand_effect
[http://upload.wikimedia.org/wikipedia/commons/thumb/f/f6/Streisand_Estate.jpg/300px-Streisand_Estate.jpg]<https://en.wikipedia.org/wiki/Streisand_effect>

Streisand effect - Wikipedia, the free encyclopedia<https://en.wikipedia.org/wiki/Streisand_effect>
en.wikipedia.org
The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the ...



On Fri, Jun 3, 2016 at 11:27 AM, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:

What I want is simple. I sent a private email from my personal hotmail. And everything is published in google searches. I want you to remove !




________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>>
Enviado: sexta-feira, 3 de junho de 2016 15:26

Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Re: Okay?


I will not give my location , for whom I do not even know !




________________________________
De: nginx <nginx-bounces at nginx.org<mailto:nginx-bounces at nginx.org>> em nome de Rva at onvaoo.com<mailto:Rva at onvaoo.com> <rva at onvaoo.com<mailto:rva at onvaoo.com>>
Enviado: sexta-feira, 3 de junho de 2016 15:23
Para: nginx at nginx.org<mailto:nginx at nginx.org>
Assunto: Re: Okay?

Can you give us your exact location (GPS ) this is for the drone action


On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com<mailto:thaisdauto at hotmail.com>> wrote:


I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx


_______________________________________________
nginx mailing list
nginx at nginx.org<mailto:nginx at nginx.org>
http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/4443893b/attachment.html>

From nginx-forum at forum.nginx.org  Fri Jun  3 09:23:15 2016
From: nginx-forum at forum.nginx.org (Peter Fulier)
Date: Fri, 03 Jun 2016 05:23:15 -0400
Subject: FIPS native support
Message-ID: <021646498529cdde09eb3c3391635a61.NginxMailingListEnglish@forum.nginx.org>

Hello All,

could you please advise if/when the nginx will be officially/natively
supporting FIPS mode in the future (eg similar way as the Apache HTTP does
with directive SSLFIPS) ?


Many thanks for your help/answer

Kind regards,

Peter

Peter Fulier

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267347,267347#msg-267347


From nginx-forum at forum.nginx.org  Thu Jun  2 08:01:12 2016
From: nginx-forum at forum.nginx.org (Harkonnen)
Date: Thu, 02 Jun 2016 04:01:12 -0400
Subject: "pid" directive is duplicate in /etc/nginx/nginx.conf
Message-ID: <15bad2b9e6e3ea639f3d0fe3eec80549.NginxMailingListEnglish@forum.nginx.org>

Hi,

I'm trying to set up a very simple nginx web server on top of an archlinux
distribution. Here is my nginx.conf :

user                          http;
worker_processes    1;
error_log                   /var/log/nginx/error.log;
pid                            /var/run/nginx.pid;

events {
    worker_connections    1024;
}

http {
    include             mime.types;
    default_type     application/octet-stream;
}

it's a very simple one, no nested includes other than mime.types. But when I
try to start my server, I have the following error :

 "pid" directive is duplicate in /etc/nginx/nginx.conf

And I don't know why, as there are no other "pid" directive. If I comment
the "pid" line, it's ok.

Can you explain me what am I missing ?

Thanks in advance

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267309,267309#msg-267309


From nginx-forum at forum.nginx.org  Thu Jun  2 04:05:17 2016
From: nginx-forum at forum.nginx.org (davidjb)
Date: Thu, 02 Jun 2016 00:05:17 -0400
Subject: Module: Configuring upstream params (eg fastcgi_param) per request
In-Reply-To: <9a6fbba09081e44ecf72c31f21f9d9a4.NginxMailingListEnglish@forum.nginx.org>
References: <9a6fbba09081e44ecf72c31f21f9d9a4.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <41e5aa2ab2f8d4d35c4f4d6e2958114c.NginxMailingListEnglish@forum.nginx.org>

Anyone have any thoughts?  Even if it's just to say "this isn't possible".

Cheers,
David

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,266934,267307#msg-267307


From jim at ohlste.in  Fri Jun  3 18:59:59 2016
From: jim at ohlste.in (Jim Ohlstein)
Date: Fri, 3 Jun 2016 14:59:59 -0400
Subject: Okay?
In-Reply-To: <GRUPR80MB079582AAC21F640F417F6C77C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <CAEuShZedzOEV1OUXo7+kPUDM0kVN7PMus5wSLDGwSymBu9j2ng@mail.gmail.com>
 <GRUPR80MB079582AAC21F640F417F6C77C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
Message-ID: <6DBCC648-4A85-4DB4-919D-30B9C3BB10AC@ohlste.in>

I could. But I won't. 

These emails are posted to several websites. If you want them to stop appearing at those sites, stop sending them.  I'd also suggest that you consult a psychiatrist and get back on your medication. 

Jim Ohlstein

> On Jun 3, 2016, at 2:36 PM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
> 
> I want to remove my emails the internet . I do not want anything in my google searches. Only I sent these emails to " nginx " because they are on a page that contains my data on Google as well. And I sent asking to remove . Now other emails are on display. I want to cut them this page. https://forum.nginx.org/read.php?2,267331,267333 can you help me ?
> 
> 
> 
> De: nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <rpaprocki at fearnothingproductions.net>
> Enviado: sexta-feira, 3 de junho de 2016 15:30
> Para: nginx at nginx.org
> Assunto: Re: Okay?
>  
> You sent an email to a public mailing list. Public mailing lists are archived for... public use. What did you expect was going to happen? Continuing to berate this list will accomplish nothing. May I also point you to: https://en.wikipedia.org/wiki/Streisand_effect
> 
> Streisand effect - Wikipedia, the free encyclopedia
> en.wikipedia.org
> The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the ...
> 
> 
>> On Fri, Jun 3, 2016 at 11:27 AM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>> 
>> What I want is simple. I sent a private email from my personal hotmail. And everything is published in google searches. I want you to
>>  remove !
>> 
>> 
>> 
>> 
>> De: nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <thaisdauto at hotmail.com>
>> Enviado: sexta-feira, 3 de junho de 2016 15:26
>> 
>> Para: nginx at nginx.org
>> Assunto: Re: Okay?
>>  
>>  I will not give my location , for whom I do not even know !
>> 
>> 
>> 
>> 
>> De: nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <rva at onvaoo.com>
>> Enviado: sexta-feira, 3 de junho de 2016 15:23
>> Para: nginx at nginx.org
>> Assunto: Re: Okay?
>>  
>> Can you give us your exact location (GPS ) this is for the drone action 
>> 
>> 
>>> On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>>> 
>>> I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !
>>> 
>>> 
>>> _______________________________________________
>>> nginx mailing list
>>> nginx at nginx.org
>>> http://mailman.nginx.org/mailman/listinfo/nginx
>> 
>> 
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/fc623466/attachment.html>

From feldan1 at gmail.com  Fri Jun  3 19:05:57 2016
From: feldan1 at gmail.com (Lorne Wanamaker)
Date: Fri, 3 Jun 2016 15:05:57 -0400
Subject: Okay?
In-Reply-To: <6DBCC648-4A85-4DB4-919D-30B9C3BB10AC@ohlste.in>
References: <BLUPR80MB0787E825C6B7A7EE1885C5DAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <3AB7E82E-CB7A-401F-AC5F-DB188082C125@onvaoo.com>
 <BLUPR80MB0787EDCB6E591D921F79AFCAC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <BLUPR80MB0787D2527827402E82BBCC7CC3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
 <CAEuShZedzOEV1OUXo7+kPUDM0kVN7PMus5wSLDGwSymBu9j2ng@mail.gmail.com>
 <GRUPR80MB079582AAC21F640F417F6C77C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <6DBCC648-4A85-4DB4-919D-30B9C3BB10AC@ohlste.in>
Message-ID: <CAEBAV9r7TBu6+CDHMXvAPH2NoudHNPocL2299hkC+3-GoeVV9A@mail.gmail.com>

Well this is entertaining, lol.

On Fri, Jun 3, 2016 at 2:59 PM, Jim Ohlstein <jim at ohlste.in> wrote:

> I could. But I won't.
>
> These emails are posted to several websites. If you want them to stop
> appearing at those sites, stop sending them.  I'd also suggest that you
> consult a psychiatrist and get back on your medication.
>
> Jim Ohlstein
>
> On Jun 3, 2016, at 2:36 PM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>
> I want to remove my emails the internet . I do not want anything in my google searches. Only I sent these emails to " nginx " because they are on a page that contains my data on Google as well. And I sent asking to remove . Now other emails are on display. I want to cut them this page. https://forum.nginx.org/read.php?2,267331,267333 can you help me ?
>
>
>
>
> ------------------------------
> *De:* nginx <nginx-bounces at nginx.org> em nome de Robert Paprocki <
> rpaprocki at fearnothingproductions.net>
> *Enviado:* sexta-feira, 3 de junho de 2016 15:30
> *Para:* nginx at nginx.org
> *Assunto:* Re: Okay?
>
> You sent an email to a public mailing list. Public mailing lists are
> archived for... public use. What did you expect was going to happen?
> Continuing to berate this list will accomplish nothing. May I also point
> you to: https://en.wikipedia.org/wiki/Streisand_effect
> <https://en.wikipedia.org/wiki/Streisand_effect>
> Streisand effect - Wikipedia, the free encyclopedia
> <https://en.wikipedia.org/wiki/Streisand_effect>
> en.wikipedia.org
> The Streisand effect is the phenomenon whereby an attempt to hide, remove,
> or censor a piece of information has the unintended consequence of
> publicizing the ...
>
>
> On Fri, Jun 3, 2016 at 11:27 AM, Tha?s Dauto <thaisdauto at hotmail.com>
> wrote:
>
>>
>> What I want is simple. I sent a private email from my personal hotmail.
>> And everything is published in google searches. I want you to remove !
>>
>>
>>
>>
>> ------------------------------
>> *De:* nginx <nginx-bounces at nginx.org> em nome de Tha?s Dauto <
>> thaisdauto at hotmail.com>
>> *Enviado:* sexta-feira, 3 de junho de 2016 15:26
>>
>> *Para:* nginx at nginx.org
>> *Assunto:* Re: Okay?
>>
>>
>> I will not give my location , for whom I do not even know !
>>
>>
>>
>>
>>
>> ------------------------------
>> *De:* nginx <nginx-bounces at nginx.org> em nome de Rva at onvaoo.com <
>> rva at onvaoo.com>
>> *Enviado:* sexta-feira, 3 de junho de 2016 15:23
>> *Para:* nginx at nginx.org
>> *Assunto:* Re: Okay?
>>
>> Can you give us your exact location (GPS ) this is for the drone action
>>
>>
>> On 03 Jun 2016, at 20:21, Tha?s Dauto <thaisdauto at hotmail.com> wrote:
>>
>> I want my e- mails are deleted from this website. https://forum.nginx.org/read.php?2,267331,267333 I sent an e- mail . By hotmail. And I did not ask to publish the google search , exposing me !
>>
>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/650fc4e9/attachment.html>

From kurt at x64architecture.com  Fri Jun  3 19:36:18 2016
From: kurt at x64architecture.com (Kurt Cancemi)
Date: Fri, 3 Jun 2016 15:36:18 -0400
Subject: "pid" directive is duplicate in /etc/nginx/nginx.conf
In-Reply-To: <15bad2b9e6e3ea639f3d0fe3eec80549.NginxMailingListEnglish@forum.nginx.org>
References: <15bad2b9e6e3ea639f3d0fe3eec80549.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <A9E552AB-A5A2-4389-9453-95B710CD8695@x64architecture.com>

Hello,

See here https://bugs.archlinux.org/task/46500 <https://bugs.archlinux.org/task/46500>.

Kurt Cancemi
https://www.x64architecture <https://www.x64architecture/>.com

> On Jun 2, 2016, at 04:01, Harkonnen <nginx-forum at forum.nginx.org> wrote:
> 
> Hi,
> 
> I'm trying to set up a very simple nginx web server on top of an archlinux
> distribution. Here is my nginx.conf :
> 
> user                          http;
> worker_processes    1;
> error_log                   /var/log/nginx/error.log;
> pid                            /var/run/nginx.pid;
> 
> events {
>    worker_connections    1024;
> }
> 
> http {
>    include             mime.types;
>    default_type     application/octet-stream;
> }
> 
> it's a very simple one, no nested includes other than mime.types. But when I
> try to start my server, I have the following error :
> 
> "pid" directive is duplicate in /etc/nginx/nginx.conf
> 
> And I don't know why, as there are no other "pid" directive. If I comment
> the "pid" line, it's ok.
> 
> Can you explain me what am I missing ?
> 
> Thanks in advance
> 
> Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267309,267309#msg-267309
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160603/69fdfc30/attachment.html>

From kurt at x64architecture.com  Fri Jun  3 19:37:51 2016
From: kurt at x64architecture.com (Kurt Cancemi)
Date: Fri, 3 Jun 2016 15:37:51 -0400
Subject: "pid" directive is duplicate in /etc/nginx/nginx.conf
In-Reply-To: <15bad2b9e6e3ea639f3d0fe3eec80549.NginxMailingListEnglish@forum.nginx.org>
References: <15bad2b9e6e3ea639f3d0fe3eec80549.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <390C8CD7-240E-4A4A-A0F4-9AFBF84EFBF7@x64architecture.com>

Hello,

See here https://bugs.archlinux.org/task/46500.

Kurt Cancemi
https://www.x64architecture.com

> On Jun 2, 2016, at 04:01, Harkonnen <nginx-forum at forum.nginx.org> wrote:
> 
> Hi,
> 
> I'm trying to set up a very simple nginx web server on top of an archlinux
> distribution. Here is my nginx.conf :
> 
> user                          http;
> worker_processes    1;
> error_log                   /var/log/nginx/error.log;
> pid                            /var/run/nginx.pid;
> 
> events {
>    worker_connections    1024;
> }
> 
> http {
>    include             mime.types;
>    default_type     application/octet-stream;
> }
> 
> it's a very simple one, no nested includes other than mime.types. But when I
> try to start my server, I have the following error :
> 
> "pid" directive is duplicate in /etc/nginx/nginx.conf
> 
> And I don't know why, as there are no other "pid" directive. If I comment
> the "pid" line, it's ok.
> 
> Can you explain me what am I missing ?
> 
> Thanks in advance
> 
> Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267309,267309#msg-267309
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx


From agentzh at gmail.com  Sat Jun  4 05:39:46 2016
From: agentzh at gmail.com (Yichun Zhang (agentzh))
Date: Fri, 3 Jun 2016 22:39:46 -0700
Subject: [ANN] OpenResty 1.9.15.1 released
Message-ID: <CAB4Tn6Pq3cneHGEpYDN_XicMa_tTZ6Lddv=aQNbPFgzN1_KQ8g@mail.gmail.com>

Hi folks,

I am happy to announce the new formal release, 1.9.15.1, of the
OpenResty web platform based on NGINX and LuaJIT:

    https://openresty.org/en/download.html

Both the (portable) source code distribution and the Win32 binary
distribution are provided on this Download page.

The highlights of this release are:

1. New NGINX 1.9.15 core.

2. LuaJIT now supports (almost) the full 2GB address space for its
GC-managed memory per VM instance on x86_64 (as compared to the
previous 1GB memory limit on x86_64).

3. the new restydoc command-line utility. Ensure you have added
<prefix>/bin to your PATH
environment, as in

    export PATH=/usr/local/openresty/bin:$PATH

assuming your are using the default OpenResty prefix
(/usr/local/openresty). Then you can try the following commands from
your terminal:

    restydoc -s listen

    restydoc -s content_by_lua

    restydoc resty.lrucache

    restydoc -s ngx.re.match ngx_lua

    restydoc ngx_proxy

    restydoc ngx_stream_proxy

    restydoc -s '$request_uri'

Hopefully you'll have fun with this tool :)

Special thanks go to all our developers and contributors!

Complete list of changes since the last (formal) release, 1.9.7.5:

 *   upgraded the Nginx core to 1.9.15.

     *   see the changes here: http://nginx.org/en/CHANGES

 *   bugfix: applied the patch for nginx security advisory
     (CVE-2016-4450) to the nginx 1.9.15 core.

 *   feature: added restydoc documentation indexes for the official
     nginx core and most of the official openresty components.

 *   upgraded ngx_lua to 0.10.5.

     *   bugfix: use of ssl_certificate_by_lua* in the "http {}"
         scope could lead to process crashes. thanks Andreas Lubbe
         for the report.

     *   bugfix: ngx.print("") did not trigger response header
         sending.

     *   feature: linux x64: now we try limiting the growth of the
         data segment of the nginx processes to preserve as much
         lowest address space for LuaJIT as possible. thanks Shuxin
         Yang for the help.

     *   bugfix: init_worker_by_lua* did not honor "http {}"
         top-level configurations like lua_ssl_verify_depth and
         lua_ssl_trusted_certificate. thanks Vladimir Shaykovskiy for
         the report.

     *   bugfix: ngx.exit() could not be used in the context of
         balancer_by_lua* when lua-resty-core was used.

     *   bugfix: *_by_lua_block: fixed Lua long bracket parsing at
         buffer boundaries. thanks Maxim Ivanov and Tom Thorogood for
         the report.

     *   bugfix: ngx.req.append_body() might enter infinite loops
         when ngx.req.init_body() has not specified a buffer size and
         the request header "Content-Length" is 0 (or
         client_body_buffer_size is configured to 0). thanks Hai for
         the report and Dejiang Zhu for the patch.

     *   bugfix: ngx.re.match: the 5th argument hid the 4th one.
         thanks iorichina for the report and rako9000 for the
         original patch.

     *   bugfix: ngx.worker.id() should return "nil" in non-worker
         processes like nginx's cache managers. thanks Weixie Cui for
         the patch.

     *   bugfix: fixed a memory leak in cert_pem_to_der(), caught by
         valgrind.

     *   bugfix: ignore unexpected closing long-brackets in
         *_by_lua_block directives. thanks Thibault Charbonnier for
         the patch.

     *   bugfix: changing peers in balancer_by_lua* might lead to
         stale values of $upstream_addr.

     *   bugfix: clear errors in ngx.ssl and ngx.ocsp functions to
         avoid flooding nginx error logs. thanks Hamish for the
         original patch.

     *   bugfix: tcpsock:sslhandshake() did not correctly check
         argument count. thanks Ilya Shipitsin for the report.

     *   bugfix: tcpsock:sslhandshake() accepts up to 5 arguments now
         (including the object itself).

     *   bugfix: assignment to ngx.status might not affect subsequent
         ngx.status reads when error_page had already taken place.
         thanks wangwei4514 for the report.

     *   refactor: refactored the implementation of the ngx.semaphore
         API. thanks Weixie Cui for the patch.

     *   doc: typo fixes from Christos Trochalakis.

 *   upgraded lua-resty-core to 0.1.6.

     *   feature: implemented ngx.worker.id() and ngx.worker.count()
         with FFI. thanks Yuansheng Wang for the patch.

     *   bugfix: Lua's tail-call optimization might unexpectedly make
         ngx.semaphore objects get garbage-collected prematurely even
         when there're still waiters. this could happen when
         lua_check_client_abort is enabled. thanks Dejiang Zhu for
         the patch.

     *   doc: ngx.semaphore: documented the "timeout" argument of
         "wait()" in more detail.

     *   doc: typo fixes from Alessandro Ghedini.

     *   doc: formatting fixes from ms2008.

 *   upgraded lua-resty-redis to 0.24.

     *   bugfix: added a "tostring()" call to avoid the "attempt to
         concatenate local 'prefix' (a nil value)" error in Lua
         function "_read_reply()".

     *   optimize: we now alway call "tostring()" upon args in Redis
         query methods.

     *   optimize: reduced Lua string concatenations in redis query
         composition.

 *   upgraded lua-resty-dns to 0.16.

     *   bugfix: when the "AD" and "CD" bits are set in the DNS
         responses as per RFC 2065, they would erroneously be treated
         as a part of the error code ("RCODE"). thanks Celebi Lui for
         the report and patch.

 *   upgraded lua-resty-memcached to 0.14.

     *   optimize: reduced table.concat() calls while constructing
         memcached requests, which can lead to fewer Lua string
         creation operations.

     *   bugfix: "get()" did not return server error responses.
         thanks Lorenz Bauer for the report.

     *   bugfix: "gets()" did not return server error responses.
         thanks Lorenz Bauer for the report.

     *   bugfix: "get()": simplified the error messages so that the
         caller can check the error more easily.

     *   feature: "set_timeout()" now returns the result of the
         operation. thanks Guanlan Dai for the report.

 *   upgraded lua-resty-mysql to 0.16.

     *   bugfix: "close()": we did not send the "COM_QUIT" packet to
         the MySQL server. thanks Andreas Fischer for the report.

     *   bugfix: fixed the Lua exception "attempt to concatenate
         field 'state' (a nil value)". thanks heyuanlong for the
         report.

     *   doc: typo fixes from Boris Nagaev.

 *   upgraded resty-cli to 0.12.

     *   feature: "resty": multiple "-e" options, along with the file
         argument, are supported.

     *   feature: added new command-line utility, restydoc, for
         viewing OpenResty/Nginx documentation on the terminal
         (inspired by Perl's "perldoc" utility) via "groff" (used by
         "man" as well).

     *   feature: added new command-line utility, md2pod.pl, for
         converting GitHub-flavored Markdown source to Perl's POD
         format.

     *   feature: added new command-line utility, restydoc-index, for
         generating the documentation indexes by scanning Markdown
         and POD document files in user-specified directories, which
         can be used by the restydoc tool.

     *   feature: added new command-line utility, nginx-xml2pod, for
         converting NGINX's official XML-formatted documentation to
         Perl's POD format.

     *   bugfix: "resty": the "--valgrind" command-line option was
         broken.

 *   upgraded lua-cjson to 2.1.0.4.

     *   feature: added the "cjson.as_array" metamethod to enforce
         empty array encoding. thanks Thibault Charbonnier for the
         patch.

     *   bugfix: fixed the 16 decimal number encoding assertion.
         thanks Thibault Charbonnier for the patch.

     *   doc: added proper documentation for OpenResty's fork of
         lua-cjson. thanks Thibault Charbonnier for the patch.

 *   upgraded LuaJIT to v2.1-20160517:
     https://github.com/openresty/luajit2/tags

     *   imported Mike Pall's latest changes:

         *   Rollback due to "HREFK" + load fwd must restore
             guardemit state.

         *   Always merge snapshots without instructions inbetween.

         *   FFI: Parse "#line NN" and "#NN".

         *   MIPS: Switch to dual-number mode. Fix soft-float
             interpreter.

         *   PS4: Switch default build to amalgamated and "LJ_GC64"
             mode.

         *   MIPS: Add soft-float support to JIT compiler backend.

         *   Don't allocate unused 2nd result register in JIT
             compiler backend.

         *   Use internal implementation for converting FP numbers to
             strings.

         *   MIPS soft-float: Fix code generation for HREF.

         *   ARM: Fix build problem with external frame unwinding.

         *   Fix display of "NULL" (light)userdata in "-jdump".

         *   x64/LJ_GC64: Fix JIT glue code in interpreter.

         *   x86: Detect "BMI2" instruction support.

         *   x86: Generate "BMI2" shifts and rotates, if available.

         *   MIPS: Fix use of ffgccheck delay slots in interpreter.

         *   Windows/x64/LJ_GC64: Fix "math.frexp()" and
             "math.modf()".

         *   Cygwin: Allow cross-builds to non-Cygwin targets.

         *   Fix recording of "select(n, ...)" with off-trace
             varargs.

         *   x86: Improve disassembly of BMI2 instructions.

         *   x64/LJ_GC64: Fix "BC_UCLO" check for fast-path.

         *   MIPS: Fix "BC_ISNEXT" fallback path.

         *   Rewrite memory block allocator.

             Use a mix of linear probing and pseudo-random probing.
             Workaround for 1GB "MAP_32BIT" limit on Linux/x64. Now
             2GB with "!LJ_GC64". Enforce 128TB "LJ_GC64" limit for >
             47 bit memory layouts (ARM64).

         *   x86/x64: Search for exit jumps with instruction length
             decoder.

         *   Fix handling of non-numeric strings in arithmetic
             coercions.

         *   Fix GCC 6 -Wmisleading-indentation warnings.

         *   Constrain value range of "lj_ir_kptr()" to unsigned 32
             bit pointers.

 *   upgraded ngx_srcache to 0.31.

     *   bugfix: this module should not depend on builtin modules
         like ngx_http_ssi and ngx_http_addition to pull in the
         ngx_http_postpone module to function properly. thanks
         Dejiang Zhu for the original patch.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure". thanks Hiroaki Nakamura for the
         original patch.

     *   bugfix: fixed errors and warnings with C compilers without
         variadic macro support.

     *   doc: clarified what "0s" means for the default expiration
         time. thanks matlloyd for the patch.

     *   doc: documented the memcached maximum key length and the
         set_md5 directive. thanks J?r?my Lal for the patch.

 *   upgraded ngx_form_input to 0.12.

     *   bugfix: avoided use of C global variables in configuration
         phase since it might cause problems in failed HUP reloads.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

 *   upgraded ngx_devel_kit to 0.3.0.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure". thanks Andrei Belov for the patch.

     *   bugfix: compiler errors: comparison between signed and
         unsigned integer expressions. thanks Xiaochen Wang for the
         patch.

     *   doc: added the new section "Modules using NDK".

 *   upgraded ngx_encrypted_session to 0.05.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

 *   upgraded ngx_headers_more to 0.30.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure". thanks Sjir Bagmeijer for the
         original patch.

 *   upgraded ngx_echo to 0.59.

     *   feature: added support for nginx 1.9.11+ when no nginx
         builtin modules pull in the ngx_http_postpone module.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

     *   bugfix: fixed warnings with C compilers without variadic
         macro support.

 *   upgraded ngx_memc to 0.17.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

     *   bugfix: fixed errors and warnings with C compilers without
         variadic macro support.

 *   upgraded ngx_redis2 to 0.13.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

     *   bugfix: fixed errors and warnings with C compilers without
         variadic macro support.

 *   upgraded ngx_iconv to 0.14.

     *   feature: this module can now be compiled as a dynamic module
         with NGINX 1.9.11+ via the "--with-dynamic-module=PATH"
         option of "./configure".

The HTML version of the change log with lots of helpful hyper-links
can be browsed here:

    https://openresty.org/en/changelog-1009015.html

OpenResty (aka. ngx_openresty) is a full-fledged web platform
by bundling the standard Nginx core, Lua/LuaJIT, lots of
3rd-party Nginx modules and Lua libraries, as well as most of their external
dependencies. See OpenResty's homepage for details:

    https://openresty.org/

We have run extensive testing on our Amazon EC2 test cluster and
ensured that all the components (including the Nginx core) play well
together. The latest test report can always be found here:

    https://qa.openresty.org/

Enjoy!
-agentzh


From reallfqq-nginx at yahoo.fr  Sat Jun  4 17:53:47 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Sat, 4 Jun 2016 19:53:47 +0200
Subject: Problem
In-Reply-To: <BLUPR80MB078721D8F6C43D682C8CDEC3C3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
References: <GRUPR80MB079549ADA28CB83991CB1911C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <GRUPR80MB0795757B91A01CEBBA2F0029C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <83D70D08-E304-41AC-AF0E-1469A3655A30@fearnothingproductions.net>
 <GRUPR80MB079558071F820A6EFF4FA830C3590@GRUPR80MB0795.lamprd80.prod.outlook.com>
 <09C562A4-A622-43A4-9235-BB094CAC6514@fearnothingproductions.net>
 <20160603043314.5451859.33870.4071@lazygranch.com>
 <43872302-db51-a576-0209-0142c709442c@nginx.com>
 <CA+p3EyxvsLv_NFnEtKHgsSZCf6ktfZJKMmiizq20+Z=6WtJuQQ@mail.gmail.com>
 <BLUPR80MB078721D8F6C43D682C8CDEC3C3590@BLUPR80MB0787.lamprd80.prod.outlook.com>
Message-ID: <CALqce=0VGrcN7Jdxk8mN3YnxAkhxUKq7XaMk7Chj-3qzdbsuNw@mail.gmail.com>

Rhetorical questions: Are you a troll? Or simply deeply troubled and
paranoid?

Emails you send to a public mailing list are:

   1. Sent to every subscriber (there is a link to unsubscribe at the
   bottom of every message: http://mailman.nginx.org/mailman/listinfo/nginx)
   2. Archived in different ways (at the top of the previously linked page
   there are archives, forum.nginx.org is another spot to find them, sorted
   as a forum)

None of us can help you with your original problem, since you simply are at
the wrong place.

You chose to write to the user mailling list of the nginx technology, using
an email address of your choice. No-one pumped you for any of this.

?Please, get justice (and bring me some, I am short on it).?
---
*B. R.*

On Fri, Jun 3, 2016 at 8:18 PM, Tha?s Dauto <thaisdauto at hotmail.com> wrote:

> Hi
>
> I do not want to receive these emails . I received a lot of emails and none were really to me or to help me in what I said. So now I want to stop receiving these emails . I sent an email to " nginx at nginx.org " I sent my personal email , I use to serious things , I would like to know why the email is that web page !? https://forum.nginx.org/read.php?2,267331,267333 exposing my email and the material contained therein , the google search ! And I just looked for a " nginx " to get an error page of google searches, page which contained and still contains some personal documents. Look I'm trying to do the easy method , but I think I'll have to get justice.
>
>
>
>
>
> ------------------------------
> *De:* nginx <nginx-bounces at nginx.org> em nome de CJ Ess <
> zxcvbn4038 at gmail.com>
> *Enviado:* sexta-feira, 3 de junho de 2016 14:05
> *Para:* nginx at nginx.org
> *Assunto:* Re: Problem
>
> I once knew a guy who convinced someone they had hacked their site by
> making a DNS entry to 127.0.0.1. So when the guy tried to access the
> "other" site his passwords worked, all his files were there, it was even
> running the same software! He made changes on his site and they instantly
> appeared on the "other" site. He deleted files off the "other" site and
> they were removed from his site - obviously in retaliation!. So after an
> hour or so of trying to figure out how his server is being accessed the guy
> just goes completely ballistic and starts calling the police and then the
> FBI (this was in the US). The FBI did investigate and visited the prankster
> in person. He explained what loopback was and how the prank worked, and the
> FBI agents thought it was pretty funny - they do have a sense of humor
> after all.
>
>
> On Fri, Jun 3, 2016 at 3:39 AM, Maxim Konovalov <maxim at nginx.com> wrote:
>
>> On 6/3/16 7:33 AM, lists at lazygranch.com wrote:
>> > Perhaps in a future release of Nginx, the error pages should not
>> > contain any reference to nginx. That is the only way I can figure
>> > out this person came up with the idea of complaining to the list.
>> > (Assuming this isn't spam to encourage use to click on that website
>> > link.)
>> >
>> Actually, a number of such complains is still surprisingly low.
>>
>> > I think another mistake is to have the error page indicate the rev
>> > of nginx. That is an easy way for someone to spot a vulnerable rev
>> > of the nginx on a server.
>> >
>>
>> --
>> Maxim Konovalov
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160604/c1184880/attachment.html>

From nginx-forum at forum.nginx.org  Sat Jun  4 23:17:26 2016
From: nginx-forum at forum.nginx.org (ZaneCEO)
Date: Sat, 04 Jun 2016 19:17:26 -0400
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
Message-ID: <96d68b45d3960171c30dff44322a550b.NginxMailingListEnglish@forum.nginx.org>

Hi guys,
I'm at my first deploy of Nginx with php-fpm after 10+ years of love with
Apache and mod_php. So far so (very) good.

I just have a peculiar issue with Safari on iOS. As you can read here
http://stackoverflow.com/questions/37635277/safari-on-ios-fails-to-ajax-upload-some-image-file-cannot-connect-to-server
, my webapp allows the user to select an image, client-resize it via JS and
then upload it via jQuery.

The problem is that Safari on iOS 9 sometimes fails the upload with the
error

POST <my upload url>, Could not connect to the server.

I just found out that  when I disabled the HTTP/2 form my server config the
issue vanishes.

Is this a known issue somehow? Is there any other solution that doesn't
require me to go nuclear on HTTP/2?

Thanks for your help!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267385,267385#msg-267385


From lucas at slcoding.com  Sat Jun  4 23:30:29 2016
From: lucas at slcoding.com (Lucas Rolff)
Date: Sun, 05 Jun 2016 01:30:29 +0200
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <96d68b45d3960171c30dff44322a550b.NginxMailingListEnglish@forum.nginx.org>
References: <96d68b45d3960171c30dff44322a550b.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <57536495.7030902@slcoding.com>

https://trac.nginx.org/nginx/ticket/979
https://trac.nginx.org/nginx/ticket/959

It's a known bug

> ZaneCEO <mailto:nginx-forum at forum.nginx.org>
> 5 June 2016 at 01:17
> Hi guys,
> I'm at my first deploy of Nginx with php-fpm after 10+ years of love with
> Apache and mod_php. So far so (very) good.
>
> I just have a peculiar issue with Safari on iOS. As you can read here
> http://stackoverflow.com/questions/37635277/safari-on-ios-fails-to-ajax-upload-some-image-file-cannot-connect-to-server
> , my webapp allows the user to select an image, client-resize it via 
> JS and
> then upload it via jQuery.
>
> The problem is that Safari on iOS 9 sometimes fails the upload with the
> error
>
> POST <my upload url>, Could not connect to the server.
>
> I just found out that when I disabled the HTTP/2 form my server config the
> issue vanishes.
>
> Is this a known issue somehow? Is there any other solution that doesn't
> require me to go nuclear on HTTP/2?
>
> Thanks for your help!
>
> Posted at Nginx Forum: 
> https://forum.nginx.org/read.php?2,267385,267385#msg-267385
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160605/36e18c02/attachment.html>

From nginx-forum at forum.nginx.org  Sun Jun  5 15:32:35 2016
From: nginx-forum at forum.nginx.org (b4a456fb-1402)
Date: Sun, 05 Jun 2016 11:32:35 -0400
Subject: nginx fastcgi_cache not freeing deleted items causing excessive disk
 usage
Message-ID: <d63d507023cccfe7f83e63c49d1c2311.NginxMailingListEnglish@forum.nginx.org>

Hello,

I'm using nginx 1.10.0 and the nginx_fastcgi_cache option. I've noticed that
with a high amount of requests per second (I'm not sure when it occurs
exactly, but we have ~2500RPS with about 2Gbit/s of outgoing traffic
responses) there is an issue with the fastcgi_cache files not being freed.
lsof shows a huge amount of files as (deleted) but the space it not being
freed. Eventually the entire partition fills up like this.

The keys_zone and max_size are both set to 500m
The fastcgi_cache_valid is set to 1m

Even when the server is idle for a while (30+ minutes) the space is not
being freed. Obviously restarting nginx manually immediately frees the
space.

Is this a bug or is there a setting I can use to perform some sort of
garbage collection?

Cheers,
Niels

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267401,267401#msg-267401


From odyssey471 at gmail.com  Mon Jun  6 01:08:08 2016
From: odyssey471 at gmail.com (=?UTF-8?B?5Zub5bym?=)
Date: Mon, 6 Jun 2016 09:08:08 +0800
Subject: I think we can add a new section called 'ssl'
Message-ID: <CADzQ+Kpuhp1G6+x9o_Ga=F84DMuG=vd2M+6AFnGD2vvOGkAhvA@mail.gmail.com>

Hello,
When the nginx-1.11.0 released,'ssl_certficate' and 'ssl_certificate_key'
options can be use several times to load different kinds of
certificates.But,if you use the module 'nginx-ct' to enable 'Certificate
Transperancy' policy(the module allow you to submit your certificate to
'Certificate Transperancy Logs' server and get the 'SCT' which can be used
to sent to browser to enable 'Certificate Transperancy'.And it added two
options:'ssl_ct on/off;' and 'ssl_ct_static_scts
/path/to/sct/directory;')So,if you use ECDSA and RSA dual-certificates,you
can only put SCT of each other in a directory.In chrome 50,you will see '1
vaild SCT,1 invaild SCT',and in some lower version chrome,you click the
'Lock' on the left of the address bar,it will display a red 'Lock' with a
'?' in the pop-up menu,although the text beside is 'The server provides a
valid certificate, and provide a valid Certificate Transperancy
information'.
And it also says:'Your connection is not private connection.'

So,why don't we add a section called 'ssl'?It can allow us to have some
different settings according to the type of certificates.Likes follow:
ssl{

ssl_certificate ...;

ssl_certificate_key ...;

ssl_ct on;

ssl_ct_static_sct /path/to/ecc/sct;

}
ssl{

ssl_certificate ...;
ssl_certificate_key ...;
ssl_ct on;
ssl_ct_static_sct /path/to/rsa/sct;

}
How do you think of my advice?
Thank you.
P.S:My mother tongue is not English,so if there are some grammar errors in
my e-mail,please forgive,thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/103fa45a/attachment.html>

From shilei at qiyi.com  Mon Jun  6 01:50:28 2016
From: shilei at qiyi.com (=?gb2312?B?yq/A2g==?=)
Date: Mon, 6 Jun 2016 01:50:28 +0000
Subject: How to reproduce issue CVE-2016-4450?
Message-ID: <29becfcbde1f47f5ac55ed8cd210cf70@EXCH04.iqiyi.pps>

Thank you very much for the quick response.
So can I say that if the nginx do not read the request body, it will not have the ?CVE-2016-4450? issue?

Thanks!

From: ??
Sent: Friday, June 03, 2016 2:55 PM
To: 'nginx at nginx.org'
Subject: How to reproduce issue CVE-2016-4450?

Hi,

I am working on the fixing of issue CVE-2016-4450, it seems that if the request body is neither saved in the memory nor in file, it might crash when save the request body to the temp file.
Could you instruct me what kind of request body can trigger this issue? I want to reproduce it, and evaluate the whether upgrade our nginx server.

Refer to CVE-2016-4450:
A problem was identified in nginx code responsible for saving
client request body to a temporary file.  A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).

Thanks!


?  ?
?????????????

[????logo]

?????
??????????????2???????17?
???100080
????86 138 1180 3496
???
????86 10 6267 7000
???shilei at qiyi.com<mailto:shilei at qiyi.com>
???www.iQIYI.com<http://www.iQIYI.com>  www.ppstream.com<http://www.ppstream.com/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/2d338758/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 25521 bytes
Desc: image001.jpg
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/2d338758/attachment.jpg>

From nginx-forum at forum.nginx.org  Mon Jun  6 07:53:43 2016
From: nginx-forum at forum.nginx.org (ZaneCEO)
Date: Mon, 06 Jun 2016 03:53:43 -0400
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <57536495.7030902@slcoding.com>
References: <57536495.7030902@slcoding.com>
Message-ID: <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>

Thank you very much!! At least now I know what's going on! Let's wait for a
patch...

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267385,267408#msg-267408


From maxim at nginx.com  Mon Jun  6 08:01:46 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Mon, 6 Jun 2016 11:01:46 +0300
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>
References: <57536495.7030902@slcoding.com>
 <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <5003877e-277d-01d7-4ffd-c154195a6e7e@nginx.com>

On 6/6/16 10:53 AM, ZaneCEO wrote:
> Thank you very much!! At least now I know what's going on! Let's wait for a
> patch...
> 
It was fixed in 1.11.0 two weeks ago.

-- 
Maxim Konovalov


From sca at andreasschulze.de  Mon Jun  6 10:00:37 2016
From: sca at andreasschulze.de (A. Schulze)
Date: Mon, 06 Jun 2016 12:00:37 +0200
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <5003877e-277d-01d7-4ffd-c154195a6e7e@nginx.com>
References: <57536495.7030902@slcoding.com>
 <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>
 <5003877e-277d-01d7-4ffd-c154195a6e7e@nginx.com>
Message-ID: <20160606120037.Horde.DUQpGcg66Of5WsVyGP52G7L@andreasschulze.de>


Hello,

I'm using horde and observe similar errors since some weeks.
Unsure if the same problem would be the reason.

Maxim Konovalov:
> It was fixed in 1.11.0 two weeks ago.

I found one patch 'preread_buffer.patch" attachtd to  
https://trac.nginx.org/nginx/ticket/959
That patch looks not trivial (to me)
Would it be possible to publish a version for nginx-1.10.1, too

I would try if that solve the errors I observe.

Thanks
Andreas



From maxim at nginx.com  Mon Jun  6 10:05:42 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Mon, 6 Jun 2016 13:05:42 +0300
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <20160606120037.Horde.DUQpGcg66Of5WsVyGP52G7L@andreasschulze.de>
References: <57536495.7030902@slcoding.com>
 <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>
 <5003877e-277d-01d7-4ffd-c154195a6e7e@nginx.com>
 <20160606120037.Horde.DUQpGcg66Of5WsVyGP52G7L@andreasschulze.de>
Message-ID: <6f572b19-fbe6-3979-1b93-a13b4340ad23@nginx.com>

On 6/6/16 1:00 PM, A. Schulze wrote:
> 
> Hello,
> 
> I'm using horde and observe similar errors since some weeks.
> Unsure if the same problem would be the reason.
> 
> Maxim Konovalov:
>> It was fixed in 1.11.0 two weeks ago.
> 
> I found one patch 'preread_buffer.patch" attachtd to
> https://trac.nginx.org/nginx/ticket/959
> That patch looks not trivial (to me)
> Would it be possible to publish a version for nginx-1.10.1, too
> 
> I would try if that solve the errors I observe.
> 
Why don't you just try 1.11.1?

The code difference between it and 1.10.1 (already released a week
ago) is marginal.

-- 
Maxim Konovalov


From mdounin at mdounin.ru  Mon Jun  6 10:29:41 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 6 Jun 2016 13:29:41 +0300
Subject: I think we can add a new section called 'ssl'
In-Reply-To: <CADzQ+Kpuhp1G6+x9o_Ga=F84DMuG=vd2M+6AFnGD2vvOGkAhvA@mail.gmail.com>
References: <CADzQ+Kpuhp1G6+x9o_Ga=F84DMuG=vd2M+6AFnGD2vvOGkAhvA@mail.gmail.com>
Message-ID: <20160606102941.GS36620@mdounin.ru>

Hello!

On Mon, Jun 06, 2016 at 09:08:08AM +0800, ?? wrote:

> Hello,
> When the nginx-1.11.0 released,'ssl_certficate' and 'ssl_certificate_key'
> options can be use several times to load different kinds of
> certificates.But,if you use the module 'nginx-ct' to enable 'Certificate
> Transperancy' policy(the module allow you to submit your certificate to
> 'Certificate Transperancy Logs' server and get the 'SCT' which can be used
> to sent to browser to enable 'Certificate Transperancy'.And it added two
> options:'ssl_ct on/off;' and 'ssl_ct_static_scts
> /path/to/sct/directory;')So,if you use ECDSA and RSA dual-certificates,you
> can only put SCT of each other in a directory.In chrome 50,you will see '1
> vaild SCT,1 invaild SCT',and in some lower version chrome,you click the
> 'Lock' on the left of the address bar,it will display a red 'Lock' with a
> '?' in the pop-up menu,although the text beside is 'The server provides a
> valid certificate, and provide a valid Certificate Transperancy
> information'.
> And it also says:'Your connection is not private connection.'
> 
> So,why don't we add a section called 'ssl'?It can allow us to have some
> different settings according to the type of certificates.Likes follow:
> ssl{
> 
> ssl_certificate ...;
> 
> ssl_certificate_key ...;
> 
> ssl_ct on;
> 
> ssl_ct_static_sct /path/to/ecc/sct;
> 
> }
> ssl{
> 
> ssl_certificate ...;
> ssl_certificate_key ...;
> ssl_ct on;
> ssl_ct_static_sct /path/to/rsa/sct;
> 
> }
> How do you think of my advice?

Rather, I would think about somehow selecting different server{} 
blocks based on SSL options (e.g., ciphers supported by a client).

-- 
Maxim Dounin
http://nginx.org/


From mdounin at mdounin.ru  Mon Jun  6 10:45:29 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 6 Jun 2016 13:45:29 +0300
Subject: nginx fastcgi_cache not freeing deleted items causing excessive
 disk usage
In-Reply-To: <d63d507023cccfe7f83e63c49d1c2311.NginxMailingListEnglish@forum.nginx.org>
References: <d63d507023cccfe7f83e63c49d1c2311.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160606104529.GT36620@mdounin.ru>

Hello!

On Sun, Jun 05, 2016 at 11:32:35AM -0400, b4a456fb-1402 wrote:

> Hello,
> 
> I'm using nginx 1.10.0 and the nginx_fastcgi_cache option. I've noticed that
> with a high amount of requests per second (I'm not sure when it occurs
> exactly, but we have ~2500RPS with about 2Gbit/s of outgoing traffic
> responses) there is an issue with the fastcgi_cache files not being freed.
> lsof shows a huge amount of files as (deleted) but the space it not being
> freed. Eventually the entire partition fills up like this.
> 
> The keys_zone and max_size are both set to 500m
> The fastcgi_cache_valid is set to 1m
> 
> Even when the server is idle for a while (30+ minutes) the space is not
> being freed. Obviously restarting nginx manually immediately frees the
> space.
> 
> Is this a bug or is there a setting I can use to perform some sort of
> garbage collection?

The fact that a file is shown as "deleted" indicates that it was 
deleted but is still open.  This may happen due to legitimate 
reasons - e.g., the file was deleted, but is current being served 
to a client and hence it is still open.  But if you see no changes 
with 30+ minutes without load, there is likely a problem 
somewhere.  You may try debugging it further.

Some basic things to consider:

- Make sure you are not using open_file_cache with some insane 
  parameters.  If you use open_file_cache, comment it out and check 
  if you are still able to reproduce the problem.

- Check if "nginx -V" shows any 3rd party modules.  If it does, 
  try reproducing the problem without them.

- When leaving the server idle, wait to make sure all client 
  connections are actually closed on socket level by clients - 
  that is, no connections in the ESTABLISHED state.  Check lsof 
  when this happens.

-- 
Maxim Dounin
http://nginx.org/


From mdounin at mdounin.ru  Mon Jun  6 13:13:04 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 6 Jun 2016 16:13:04 +0300
Subject: Module: Configuring upstream params (eg fastcgi_param) per request
In-Reply-To: <41e5aa2ab2f8d4d35c4f4d6e2958114c.NginxMailingListEnglish@forum.nginx.org>
References: <9a6fbba09081e44ecf72c31f21f9d9a4.NginxMailingListEnglish@forum.nginx.org>
 <41e5aa2ab2f8d4d35c4f4d6e2958114c.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160606131304.GV36620@mdounin.ru>

Hello!

On Thu, Jun 02, 2016 at 12:05:17AM -0400, davidjb wrote:

> Anyone have any thoughts?  Even if it's just to say "this isn't possible".

When working with multiple servers within a single upstream{} 
block, nginx creates a request only once.  If a server fails, 
nginx will re-try the same request to a different server.  So it's 
not possible to supply different parameters for different servers - 
because the request is already created.

If you want to send different requests, you have to use other 
mechanisms available in nginx, such as error_page fallback.  Then 
it will be possible to create another request with different 
headers / FastCGI parameters.

-- 
Maxim Dounin
http://nginx.org/


From odyssey471 at gmail.com  Mon Jun  6 13:20:09 2016
From: odyssey471 at gmail.com (=?UTF-8?B?5Zub5bym?=)
Date: Mon, 6 Jun 2016 21:20:09 +0800
Subject: I think we can add a new section called 'ssl'
In-Reply-To: <20160606102941.GS36620@mdounin.ru>
References: <CADzQ+Kpuhp1G6+x9o_Ga=F84DMuG=vd2M+6AFnGD2vvOGkAhvA@mail.gmail.com>
 <20160606102941.GS36620@mdounin.ru>
Message-ID: <CADzQ+KpzxOU_DNo5_BQE78EQNEAs0znP6inTGNCfH3xoOFFiqQ@mail.gmail.com>

Hello,
That's a good idea.BoringSSL supports Equivalent encryption algorithm
group,likes follow:
[ECDHE_ECDSA_CHACHA20_POLY1305_SHA384|ECDHE_ECDSA_AES_128_GCM_SHA384]:...
Cipher suites which are included by [] are equivalent,when TLS
handshaking,the feature can choose the best cipher suites by clients'
platform.
But it is hard to complie nginx with boringssl,and it dosen't support OCSP
Stapling,that's too bad.
I think your idea will be interesting if it can be come true.


2016-06-06 18:29 GMT+08:00 Maxim Dounin <mdounin at mdounin.ru>:

> Hello!
>
> On Mon, Jun 06, 2016 at 09:08:08AM +0800, ?? wrote:
>
> > Hello,
> > When the nginx-1.11.0 released,'ssl_certficate' and 'ssl_certificate_key'
> > options can be use several times to load different kinds of
> > certificates.But,if you use the module 'nginx-ct' to enable 'Certificate
> > Transperancy' policy(the module allow you to submit your certificate to
> > 'Certificate Transperancy Logs' server and get the 'SCT' which can be
> used
> > to sent to browser to enable 'Certificate Transperancy'.And it added two
> > options:'ssl_ct on/off;' and 'ssl_ct_static_scts
> > /path/to/sct/directory;')So,if you use ECDSA and RSA
> dual-certificates,you
> > can only put SCT of each other in a directory.In chrome 50,you will see
> '1
> > vaild SCT,1 invaild SCT',and in some lower version chrome,you click the
> > 'Lock' on the left of the address bar,it will display a red 'Lock' with a
> > '?' in the pop-up menu,although the text beside is 'The server provides a
> > valid certificate, and provide a valid Certificate Transperancy
> > information'.
> > And it also says:'Your connection is not private connection.'
> >
> > So,why don't we add a section called 'ssl'?It can allow us to have some
> > different settings according to the type of certificates.Likes follow:
> > ssl{
> >
> > ssl_certificate ...;
> >
> > ssl_certificate_key ...;
> >
> > ssl_ct on;
> >
> > ssl_ct_static_sct /path/to/ecc/sct;
> >
> > }
> > ssl{
> >
> > ssl_certificate ...;
> > ssl_certificate_key ...;
> > ssl_ct on;
> > ssl_ct_static_sct /path/to/rsa/sct;
> >
> > }
> > How do you think of my advice?
>
> Rather, I would think about somehow selecting different server{}
> blocks based on SSL options (e.g., ciphers supported by a client).
>
> --
> Maxim Dounin
> http://nginx.org/
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/38cc26ee/attachment.html>

From ahall at autodist.com  Mon Jun  6 13:35:41 2016
From: ahall at autodist.com (Alex Hall)
Date: Mon, 6 Jun 2016 09:35:41 -0400
Subject: allow/deny by name?
Message-ID: <CA+Q8_JfegoFggOA_Yi2pXU+Mj+6b4COptnW_eWEyQnyfSQh_gg@mail.gmail.com>

Hi all,
Is there a way to allow or deny based on name? For instance, I currently
have my site restricted to intranet traffic only, but I need to allow a
remote SMTP server access. Can I do something like
allow smtp.mysmtp.com;
Thanks.

-- 
Alex Hall
Automatic Distributors, IT department
ahall at autodist.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/65d8b3ca/attachment.html>

From kbuchs at frontlinetechnologies.com  Mon Jun  6 13:46:51 2016
From: kbuchs at frontlinetechnologies.com (Kevin Buchs)
Date: Mon, 6 Jun 2016 13:46:51 +0000
Subject: Configuring Nginx OS to perform advanced web proxy function
Message-ID: <BLUPR15MB0147CE2D8BEAF9FF43142BD2DE5C0@BLUPR15MB0147.namprd15.prod.outlook.com>

Hello,

I am certainly a newbie at Nginx. We have a need to implement a web proxy which performs the following functions:

1)      Receive HTTPS SOAP transactions from 40 other source servers and receive those on ports in the range 56000-56100

2)      The port number will be mapped to a specific destination server (100 destinations)

3)      The SSL transaction should be decrypted and the HTTP header edited to alter the hostname (and remove port specifier)

4)      Pass on the SOAP transaction via SSL to the destination server selected by the port number, with NATing for the source IP port.

5)      Receive the return messages and reverse the process with them back to the originating source server.

I am told by Nginx support this can be readily done with Nginx. If anyone can provide pointers, suggestions or other help, it would be greatly appreciated.

Kevin Buchs | Senior Systems Engineer

Frontline Technologies | 200 West Monroe, Chicago, IL 60606 | p: 484.328.4110 | kbuchs at frontlinetechnologies.com<mailto:kbuchs at frontlinetechnologies.com> | www.FrontlineTechnologies.com<http://www.frontlinetechnologies.com/>

This email may contain information that is confidential or attorney-client privileged and may constitute inside information. The contents of this email are intended only for the recipient(s) listed above. If you are not the intended recipient, you are directed not to read, disclose, distribute or otherwise use this transmission. If you have received this email in error, please notify the sender immediately and delete the transmission. Delivery of this message is not intended to waive any applicable privileges.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/aaea0052/attachment.html>

From rpaprocki at fearnothingproductions.net  Mon Jun  6 14:06:51 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Mon, 6 Jun 2016 07:06:51 -0700
Subject: Configuring Nginx OS to perform advanced web proxy function
In-Reply-To: <BLUPR15MB0147CE2D8BEAF9FF43142BD2DE5C0@BLUPR15MB0147.namprd15.prod.outlook.com>
References: <BLUPR15MB0147CE2D8BEAF9FF43142BD2DE5C0@BLUPR15MB0147.namprd15.prod.outlook.com>
Message-ID: <437BCD59-8811-4A4B-B22F-1CFB5028F9CE@fearnothingproductions.net>

> On Jun 6, 2016, at 06:46, Kevin Buchs <kbuchs at frontlinetechnologies.com> wrote:
> 
> Hello,
>  
> I am certainly a newbie at Nginx. We have a need to implement a web proxy which performs the following functions:

...

> I am told by Nginx support this can be readily done with Nginx. If anyone can provide pointers, suggestions or other help, it would be greatly appreciated.

Have you tried looking through any of the documentation or existing literature to build your config?

https://nginx.org/en/docs/

If you have a specific problem or are running into undocumented issues a public forum may be able to help, but I don't think spoon feeding will help. Sounds like you essentially want a reverse proxy. https://nginx.org/en/docs/http/ngx_http_proxy_module.html may be a good place to start.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/ae141f7b/attachment.html>

From reallfqq-nginx at yahoo.fr  Mon Jun  6 18:20:00 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Mon, 6 Jun 2016 20:20:00 +0200
Subject: Issue with HTTP/2 and async file upload from Safari on iOS
In-Reply-To: <6f572b19-fbe6-3979-1b93-a13b4340ad23@nginx.com>
References: <57536495.7030902@slcoding.com>
 <adba21becc5f202723de535adc8a60db.NginxMailingListEnglish@forum.nginx.org>
 <5003877e-277d-01d7-4ffd-c154195a6e7e@nginx.com>
 <20160606120037.Horde.DUQpGcg66Of5WsVyGP52G7L@andreasschulze.de>
 <6f572b19-fbe6-3979-1b93-a13b4340ad23@nginx.com>
Message-ID: <CALqce=3Ry-RZn-MHSwy-SC9yagfjPMvkKfnjSH5EsXvGuXofSg@mail.gmail.com>

The problem is, if (s)he is using the official packages, he will get the
updates of the mainline channel, thus differing more and more from the
stable channel which is supposed to be cheaper on features but with usable
ones.

My 2 cents,
---
*B. R.*

On Mon, Jun 6, 2016 at 12:05 PM, Maxim Konovalov <maxim at nginx.com> wrote:

> On 6/6/16 1:00 PM, A. Schulze wrote:
> >
> > Hello,
> >
> > I'm using horde and observe similar errors since some weeks.
> > Unsure if the same problem would be the reason.
> >
> > Maxim Konovalov:
> >> It was fixed in 1.11.0 two weeks ago.
> >
> > I found one patch 'preread_buffer.patch" attachtd to
> > https://trac.nginx.org/nginx/ticket/959
> > That patch looks not trivial (to me)
> > Would it be possible to publish a version for nginx-1.10.1, too
> >
> > I would try if that solve the errors I observe.
> >
> Why don't you just try 1.11.1?
>
> The code difference between it and 1.10.1 (already released a week
> ago) is marginal.
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160606/6c8644c3/attachment.html>

From gfrankliu at gmail.com  Tue Jun  7 21:03:55 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Tue, 7 Jun 2016 14:03:55 -0700
Subject: Passive health check in stream_proxy module
Message-ID: <CAOXPdC9_QUqi4iicr6ydSiRQcCDY22au2C_+Oib0RnvQYoH9hA@mail.gmail.com>

How does passive health check work in stream_proxy module? especially for
UDP which is connectionless. How does nginx detect if it is a failed
connection and retry next?

Thanks!
Frank
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160607/48118a8b/attachment.html>

From medvedev.yp at gmail.com  Tue Jun  7 22:45:23 2016
From: medvedev.yp at gmail.com (Yuriy Medvedev)
Date: Wed, 8 Jun 2016 01:45:23 +0300
Subject: Passive health check in stream_proxy module
In-Reply-To: <CAOXPdC9_QUqi4iicr6ydSiRQcCDY22au2C_+Oib0RnvQYoH9hA@mail.gmail.com>
References: <CAOXPdC9_QUqi4iicr6ydSiRQcCDY22au2C_+Oib0RnvQYoH9hA@mail.gmail.com>
Message-ID: <CABDaVUPOZyzywBahSisEq=K6j-pyqPu4Q4PT4BH-qBaN5Mi6nA@mail.gmail.com>

Hi, https://www.nginx.com/resources/admin-guide/load-balancer/

2016-06-08 0:03 GMT+03:00 Frank Liu <gfrankliu at gmail.com>:

> How does passive health check work in stream_proxy module? especially for
> UDP which is connectionless. How does nginx detect if it is a failed
> connection and retry next?
>
> Thanks!
> Frank
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160608/ac666fe1/attachment.html>

From gfrankliu at gmail.com  Tue Jun  7 23:16:39 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Tue, 7 Jun 2016 16:16:39 -0700
Subject: Passive health check in stream_proxy module
In-Reply-To: <CABDaVUPOZyzywBahSisEq=K6j-pyqPu4Q4PT4BH-qBaN5Mi6nA@mail.gmail.com>
References: <CAOXPdC9_QUqi4iicr6ydSiRQcCDY22au2C_+Oib0RnvQYoH9hA@mail.gmail.com>
 <CABDaVUPOZyzywBahSisEq=K6j-pyqPu4Q4PT4BH-qBaN5Mi6nA@mail.gmail.com>
Message-ID: <CAOXPdC8hhHNKCpgPvDvSMZkW+XvHLYHxn2HYhGBTv0E0-g8hjw@mail.gmail.com>

I checked that page before sending the email.
The "Passive Health Monitoring" section of that page wasn't clear on how
nginx would consider a "failed attempt", especially in case of UDP where
there is no "handshake".

On Tue, Jun 7, 2016 at 3:45 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
wrote:

> Hi, https://www.nginx.com/resources/admin-guide/load-balancer/
>
> 2016-06-08 0:03 GMT+03:00 Frank Liu <gfrankliu at gmail.com>:
>
>> How does passive health check work in stream_proxy module? especially for
>> UDP which is connectionless. How does nginx detect if it is a failed
>> connection and retry next?
>>
>> Thanks!
>> Frank
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160607/b9ef7134/attachment.html>

From arut at nginx.com  Wed Jun  8 21:46:24 2016
From: arut at nginx.com (Roman Arutyunyan)
Date: Thu, 9 Jun 2016 00:46:24 +0300
Subject: Passive health check in stream_proxy module
In-Reply-To: <CAOXPdC8hhHNKCpgPvDvSMZkW+XvHLYHxn2HYhGBTv0E0-g8hjw@mail.gmail.com>
References: <CAOXPdC9_QUqi4iicr6ydSiRQcCDY22au2C_+Oib0RnvQYoH9hA@mail.gmail.com>
 <CABDaVUPOZyzywBahSisEq=K6j-pyqPu4Q4PT4BH-qBaN5Mi6nA@mail.gmail.com>
 <CAOXPdC8hhHNKCpgPvDvSMZkW+XvHLYHxn2HYhGBTv0E0-g8hjw@mail.gmail.com>
Message-ID: <20160608214624.GD36442@Romans-MacBook-Air.local>

Hi Frank,

On Tue, Jun 07, 2016 at 04:16:39PM -0700, Frank Liu wrote:
> I checked that page before sending the email.
> The "Passive Health Monitoring" section of that page wasn't clear on how
> nginx would consider a "failed attempt", especially in case of UDP where
> there is no "handshake".
> 
> On Tue, Jun 7, 2016 at 3:45 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
> wrote:
> 
> > Hi, https://www.nginx.com/resources/admin-guide/load-balancer/
> >
> > 2016-06-08 0:03 GMT+03:00 Frank Liu <gfrankliu at gmail.com>:
> >
> >> How does passive health check work in stream_proxy module? especially for
> >> UDP which is connectionless. How does nginx detect if it is a failed
> >> connection and retry next?

There are two types of such errors.

If proxy_responses is not zero, ICMP Destination Unreachable signals a UDP
error.  This results in socket read error.

If proxy_responses is not default, proxy_timeout expiration is considered a UDP
connection error too.

-- 
Roman Arutyunyan


From nginx at netdirect.fr  Fri Jun 10 08:08:14 2016
From: nginx at netdirect.fr (Artur)
Date: Fri, 10 Jun 2016 10:08:14 +0200
Subject: Reverse proxy tuning
Message-ID: <f1f9be61-0138-a1d6-dae9-58e80ebbc44f@netdirect.fr>

Hello !

I have a nginx reverse proxy http/https for a node.js application with
websockets (an extract of the nginx config follows).

I would like to know if there is a way to :

- force nginx to retry connection to the same upstream if there is any
problem with the initial request to the upstream (timeout,
reading/writing timeouts, ...)

- do not blacklist an upstream if any error occurs

- do not retry on another upstream

- adjust timeouts on communications between nginx and upstreams
(connexion, read, write, ...)

I tested some parameters in the 'tests' block below but i'm not sure
that there is any other paramater I can play with.

http {
    upstream application {
        server 127.0.0.1:3030;
        server 127.0.0.1:3031;
        server 127.0.0.1:3032;
    }
}

server {
        location /nodejs/application/ {
                proxy_pass http://application;
                proxy_redirect off; 

                # prevents 502 bad gateway error
                proxy_buffers 8 32k;
                proxy_buffer_size 64k;

                # enables WS support
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;

                # tests
                proxy_connect_timeout 75s;
                proxy_read_timeout 300s;
                proxy_send_timeout 300s;
                proxy_next_upstream off;
       }
}

Thank you for your feedback.

-- 

Best regards,
Artur.


From reallfqq-nginx at yahoo.fr  Fri Jun 10 17:34:42 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Fri, 10 Jun 2016 19:34:42 +0200
Subject: Reverse proxy tuning
In-Reply-To: <f1f9be61-0138-a1d6-dae9-58e80ebbc44f@netdirect.fr>
References: <f1f9be61-0138-a1d6-dae9-58e80ebbc44f@netdirect.fr>
Message-ID: <CALqce=2e7x4sFVn2CLNzRQ1zeV_wQ9W_nCLnTRV2xT3aRYo3Ew@mail.gmail.com>

RTFM:
- upstream <http://nginx.org/en/docs/http/ngx_http_upstream_module.html>
module (specifically the server
<http://nginx.org/en/docs/http/ngx_http_upstream_module.html#server>
directive)
- *_next_upstream & *_*_timeout directives, for each backend communication
module and type of timeout

?The names are so close to your requests I suspect you have not made your
part of the deal <http://www.catb.org/esr/faqs/smart-questions.html>.?
---
*B. R.*

On Fri, Jun 10, 2016 at 10:08 AM, Artur <nginx at netdirect.fr> wrote:

> Hello !
>
> I have a nginx reverse proxy http/https for a node.js application with
> websockets (an extract of the nginx config follows).
>
> I would like to know if there is a way to :
>
> - force nginx to retry connection to the same upstream if there is any
> problem with the initial request to the upstream (timeout,
> reading/writing timeouts, ...)
>
> - do not blacklist an upstream if any error occurs
>
> - do not retry on another upstream
>
> - adjust timeouts on communications between nginx and upstreams
> (connexion, read, write, ...)
>
> I tested some parameters in the 'tests' block below but i'm not sure
> that there is any other paramater I can play with.
>
> http {
>     upstream application {
>         server 127.0.0.1:3030;
>         server 127.0.0.1:3031;
>         server 127.0.0.1:3032;
>     }
> }
>
> server {
>         location /nodejs/application/ {
>                 proxy_pass http://application;
>                 proxy_redirect off;
>
>                 # prevents 502 bad gateway error
>                 proxy_buffers 8 32k;
>                 proxy_buffer_size 64k;
>
>                 # enables WS support
>                 proxy_http_version 1.1;
>                 proxy_set_header Upgrade $http_upgrade;
>                 proxy_set_header Connection $connection_upgrade;
>
>                 # tests
>                 proxy_connect_timeout 75s;
>                 proxy_read_timeout 300s;
>                 proxy_send_timeout 300s;
>                 proxy_next_upstream off;
>        }
> }
>
> Thank you for your feedback.
>
> --
>
> Best regards,
> Artur.
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160610/57070730/attachment.html>

From nginx-forum at forum.nginx.org  Mon Jun 13 07:00:16 2016
From: nginx-forum at forum.nginx.org (gitl)
Date: Mon, 13 Jun 2016 03:00:16 -0400
Subject: ssl session id and spdy/http2 traffic
Message-ID: <ebcbe57fb0ff7db7d5af4e887e97d769.NginxMailingListEnglish@forum.nginx.org>

I have noticed that the variables ssl_session_id and ssl_session_reused are
always empty for http2 traffic (and for spdy before that). Under http 1.1
they are set as expected and documented.
What's the reason for this? Why not list the ID of the single connection
that is used for the multiplexing?
A big reason why I am logging both variables is to make sure that ssl
connections are being reused for http2 and to be able to check if the ssl
cache
overruns. If the those two variables are not available, what do you suggest
to use instead?

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267548,267548#msg-267548


From nginx-forum at forum.nginx.org  Tue Jun 14 07:55:57 2016
From: nginx-forum at forum.nginx.org (aanchalj)
Date: Tue, 14 Jun 2016 03:55:57 -0400
Subject: worker_connections are not enough
In-Reply-To: <20120521154910.GN31671@mdounin.ru>
References: <20120521154910.GN31671@mdounin.ru>
Message-ID: <920c4e39a3cd483ba7806eacbbb41178.NginxMailingListEnglish@forum.nginx.org>

So in this case the worker_connections should be set to at least (2 + 4 + 4)
= 10.  But what should be the optimal value for this? What are the
implications of using a high number of worker connections in this case?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,226691,267552#msg-267552


From nginx-forum at forum.nginx.org  Tue Jun 14 08:09:06 2016
From: nginx-forum at forum.nginx.org (aanchalj)
Date: Tue, 14 Jun 2016 04:09:06 -0400
Subject: Trying to Understand Upstream Keepalive
In-Reply-To: <9812cc7c3c328792aa8c6a38ca41a438.NginxMailingListEnglish@forum.nginx.org>
References: <9812cc7c3c328792aa8c6a38ca41a438.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <23d0cc66025177ddb3f0c692703869fc.NginxMailingListEnglish@forum.nginx.org>

As stated in
http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive that
"It should be particularly noted that the keepalive directive does not limit
the total number of connections to upstream servers that an nginx worker
process can open. The connections parameter should be set to a number small
enough to let upstream servers process new incoming connections as well."  I
want to understand if a new client comes, why can't they use existing
keep-alive connections? Do they need to create a new connection with
upstream?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,249924,267553#msg-267553


From azfarhashmi at gmail.com  Tue Jun 14 09:31:56 2016
From: azfarhashmi at gmail.com (Azfar Hashmi)
Date: Tue, 14 Jun 2016 13:31:56 +0400
Subject: Cant load perl module
Message-ID: <CAPtpY6jep3jukvRtMZ6YOHX3sSrbxAyZq89mfPuacsAU2gg3fg@mail.gmail.com>

Hi,

I just upgraded nginx to 1.10.1 but I am getting below error.

nginx: [emerg] unknown directive "perl_modules" in /etc/nginx/nginx.conf:90

My package is already compiled with perl (nginx -V), I am on Wheezy and
using dotdeb.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/d6218135/attachment.html>

From medvedev.yp at gmail.com  Tue Jun 14 10:23:27 2016
From: medvedev.yp at gmail.com (Yuriy Medvedev)
Date: Tue, 14 Jun 2016 13:23:27 +0300
Subject: Cant load perl module
In-Reply-To: <CABDaVUP1=0qgFzmEJvmfvbp60pGsnBP4fkOE=jYKTtR+-5E4oQ@mail.gmail.com>
References: <CAPtpY6jep3jukvRtMZ6YOHX3sSrbxAyZq89mfPuacsAU2gg3fg@mail.gmail.com>
 <CABDaVUP1=0qgFzmEJvmfvbp60pGsnBP4fkOE=jYKTtR+-5E4oQ@mail.gmail.com>
Message-ID: <CABDaVUOsS8-LB-FOtRjjb8L0nw5O65YX0h=7M0P1Gg+KfoqaYg@mail.gmail.com>

Hi, please show output nginx -V
14 ???? 2016 ?. 12:32 ???????????? "Azfar Hashmi" <azfarhashmi at gmail.com>
???????:

Hi,

I just upgraded nginx to 1.10.1 but I am getting below error.

nginx: [emerg] unknown directive "perl_modules" in /etc/nginx/nginx.conf:90

My package is already compiled with perl (nginx -V), I am on Wheezy and
using dotdeb.



_______________________________________________
nginx mailing list
nginx at nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/9e09ac6f/attachment.html>

From azfarhashmi at gmail.com  Tue Jun 14 10:34:17 2016
From: azfarhashmi at gmail.com (Azfar Hashmi)
Date: Tue, 14 Jun 2016 14:34:17 +0400
Subject: Cant load perl module
In-Reply-To: <CABDaVUOsS8-LB-FOtRjjb8L0nw5O65YX0h=7M0P1Gg+KfoqaYg@mail.gmail.com>
References: <CAPtpY6jep3jukvRtMZ6YOHX3sSrbxAyZq89mfPuacsAU2gg3fg@mail.gmail.com>
 <CABDaVUP1=0qgFzmEJvmfvbp60pGsnBP4fkOE=jYKTtR+-5E4oQ@mail.gmail.com>
 <CABDaVUOsS8-LB-FOtRjjb8L0nw5O65YX0h=7M0P1Gg+KfoqaYg@mail.gmail.com>
Message-ID: <CAPtpY6hO-E1Co+8eGXcx3tqqor=N3q0WNCzthbavqhjqDHPbNw@mail.gmail.com>

Below is the output of nginx -V


nginx version: nginx/1.10.1
built with OpenSSL 1.0.1k 8 Jan 2015 (running with OpenSSL 1.0.1t  3 May
2016)
TLS SNI support enabled
configure arguments:
--add-module=/usr/src/builddir/debian/modules/naxsi/naxsi_src
--with-cc-opt='-g -O2 -fstack-protector-strong -Wformat
-Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro
-Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf
--http-log-path=/var/log/nginx/access.log
--error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock
--pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules
--http-client-body-temp-path=/var/lib/nginx/body
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--http-proxy-temp-path=/var/lib/nginx/proxy
--http-scgi-temp-path=/var/lib/nginx/scgi
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit
--with-ipv6 --with-http_ssl_module --with-http_stub_status_module
--with-http_realip_module --with-http_auth_request_module
--with-http_v2_module --with-http_dav_module --with-file-aio --with-threads
--with-http_addition_module --with-http_flv_module
--with-http_geoip_module=dynamic --with-http_gunzip_module
--with-http_gzip_static_module --with-http_image_filter_module=dynamic
--with-http_mp4_module --with-http_perl_module=dynamic
--with-http_random_index_module --with-http_secure_link_module
--with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic
--with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module
--add-module=/usr/src/builddir/debian/modules/headers-more-nginx-module
--add-dynamic-module=/usr/src/builddir/debian/modules/nginx-auth-pam
--add-module=/usr/src/builddir/debian/modules/nginx-cache-purge
--add-module=/usr/src/builddir/debian/modules/nginx-dav-ext-module
--add-dynamic-module=/usr/src/builddir/debian/modules/nginx-development-kit
--add-module=/usr/src/builddir/debian/modules/nginx-echo
--add-module=/usr/src/builddir/debian/modules/ngx-fancyindex
--add-module=/usr/src/builddir/debian/modules/nginx-push-stream-module
--add-dynamic-module=/usr/src/builddir/debian/modules/nginx-lua
--add-module=/usr/src/builddir/debian/modules/nginx-upload-progress
--add-module=/usr/src/builddir/debian/modules/nginx-upstream-fair
--add-module=/usr/src/builddir/debian/modules/ngx_http_substitutions_filter_module
--add-module=/usr/src/builddir/debian/modules/nginx-auth-ldap
--add-module=/usr/src/builddir/debian/modules/ngx_http_pinba_module
--add-module=/usr/src/builddir/debian/modules/ngx_pagespeed
--add-module=/usr/src/builddir/debian/modules/nginx-x-rid-header
--add-module=/usr/src/builddir/debian/modules/nginx-rtmp-module
--with-ld-opt=-lossp-uuid


On Tue, Jun 14, 2016 at 2:23 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
wrote:

> Hi, please show output nginx -V
> 14 ???? 2016 ?. 12:32 ???????????? "Azfar Hashmi" <azfarhashmi at gmail.com>
> ???????:
>
> Hi,
>
> I just upgraded nginx to 1.10.1 but I am getting below error.
>
> nginx: [emerg] unknown directive "perl_modules" in /etc/nginx/nginx.conf:90
>
> My package is already compiled with perl (nginx -V), I am on Wheezy and
> using dotdeb.
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/0a7cd6ab/attachment.html>

From medvedev.yp at gmail.com  Tue Jun 14 10:55:07 2016
From: medvedev.yp at gmail.com (Yuriy Medvedev)
Date: Tue, 14 Jun 2016 13:55:07 +0300
Subject: Cant load perl module
In-Reply-To: <CAPtpY6hO-E1Co+8eGXcx3tqqor=N3q0WNCzthbavqhjqDHPbNw@mail.gmail.com>
References: <CAPtpY6jep3jukvRtMZ6YOHX3sSrbxAyZq89mfPuacsAU2gg3fg@mail.gmail.com>
 <CABDaVUP1=0qgFzmEJvmfvbp60pGsnBP4fkOE=jYKTtR+-5E4oQ@mail.gmail.com>
 <CABDaVUOsS8-LB-FOtRjjb8L0nw5O65YX0h=7M0P1Gg+KfoqaYg@mail.gmail.com>
 <CAPtpY6hO-E1Co+8eGXcx3tqqor=N3q0WNCzthbavqhjqDHPbNw@mail.gmail.com>
Message-ID: <CABDaVUOrab0d2KTj_9qMD1j8Uzg-yG4EzGxLYkEb89LBxt1z1w@mail.gmail.com>

>
> --with-http_perl_module=dynamic

You must include dynamic module in nginx main config file. Use load_module


2016-06-14 13:34 GMT+03:00 Azfar Hashmi <azfarhashmi at gmail.com>:

> Below is the output of nginx -V
>
>
> nginx version: nginx/1.10.1
> built with OpenSSL 1.0.1k 8 Jan 2015 (running with OpenSSL 1.0.1t  3 May
> 2016)
> TLS SNI support enabled
> configure arguments:
> --add-module=/usr/src/builddir/debian/modules/naxsi/naxsi_src
> --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat
> -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro
> -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf
> --http-log-path=/var/log/nginx/access.log
> --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock
> --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules
> --http-client-body-temp-path=/var/lib/nginx/body
> --http-fastcgi-temp-path=/var/lib/nginx/fastcgi
> --http-proxy-temp-path=/var/lib/nginx/proxy
> --http-scgi-temp-path=/var/lib/nginx/scgi
> --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit
> --with-ipv6 --with-http_ssl_module --with-http_stub_status_module
> --with-http_realip_module --with-http_auth_request_module
> --with-http_v2_module --with-http_dav_module --with-file-aio --with-threads
> --with-http_addition_module --with-http_flv_module
> --with-http_geoip_module=dynamic --with-http_gunzip_module
> --with-http_gzip_static_module --with-http_image_filter_module=dynamic
> --with-http_mp4_module --with-http_perl_module=dynamic
> --with-http_random_index_module --with-http_secure_link_module
> --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic
> --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module
> --add-module=/usr/src/builddir/debian/modules/headers-more-nginx-module
> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-auth-pam
> --add-module=/usr/src/builddir/debian/modules/nginx-cache-purge
> --add-module=/usr/src/builddir/debian/modules/nginx-dav-ext-module
> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-development-kit
> --add-module=/usr/src/builddir/debian/modules/nginx-echo
> --add-module=/usr/src/builddir/debian/modules/ngx-fancyindex
> --add-module=/usr/src/builddir/debian/modules/nginx-push-stream-module
> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-lua
> --add-module=/usr/src/builddir/debian/modules/nginx-upload-progress
> --add-module=/usr/src/builddir/debian/modules/nginx-upstream-fair
> --add-module=/usr/src/builddir/debian/modules/ngx_http_substitutions_filter_module
> --add-module=/usr/src/builddir/debian/modules/nginx-auth-ldap
> --add-module=/usr/src/builddir/debian/modules/ngx_http_pinba_module
> --add-module=/usr/src/builddir/debian/modules/ngx_pagespeed
> --add-module=/usr/src/builddir/debian/modules/nginx-x-rid-header
> --add-module=/usr/src/builddir/debian/modules/nginx-rtmp-module
> --with-ld-opt=-lossp-uuid
>
>
> On Tue, Jun 14, 2016 at 2:23 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
> wrote:
>
>> Hi, please show output nginx -V
>> 14 ???? 2016 ?. 12:32 ???????????? "Azfar Hashmi" <azfarhashmi at gmail.com>
>> ???????:
>>
>> Hi,
>>
>> I just upgraded nginx to 1.10.1 but I am getting below error.
>>
>> nginx: [emerg] unknown directive "perl_modules" in
>> /etc/nginx/nginx.conf:90
>>
>> My package is already compiled with perl (nginx -V), I am on Wheezy and
>> using dotdeb.
>>
>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/a16d9186/attachment.html>

From azfarhashmi at gmail.com  Tue Jun 14 11:24:08 2016
From: azfarhashmi at gmail.com (Azfar Hashmi)
Date: Tue, 14 Jun 2016 15:24:08 +0400
Subject: Cant load perl module
In-Reply-To: <CABDaVUOrab0d2KTj_9qMD1j8Uzg-yG4EzGxLYkEb89LBxt1z1w@mail.gmail.com>
References: <CAPtpY6jep3jukvRtMZ6YOHX3sSrbxAyZq89mfPuacsAU2gg3fg@mail.gmail.com>
 <CABDaVUP1=0qgFzmEJvmfvbp60pGsnBP4fkOE=jYKTtR+-5E4oQ@mail.gmail.com>
 <CABDaVUOsS8-LB-FOtRjjb8L0nw5O65YX0h=7M0P1Gg+KfoqaYg@mail.gmail.com>
 <CAPtpY6hO-E1Co+8eGXcx3tqqor=N3q0WNCzthbavqhjqDHPbNw@mail.gmail.com>
 <CABDaVUOrab0d2KTj_9qMD1j8Uzg-yG4EzGxLYkEb89LBxt1z1w@mail.gmail.com>
Message-ID: <CAPtpY6j_HFEQ4DMc98t94DYaX4BhA+YCQjrmn0Ap5kivGjLdeQ@mail.gmail.com>

Thank you. got it working.

On Tue, Jun 14, 2016 at 2:55 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
wrote:

> --with-http_perl_module=dynamic
>
> You must include dynamic module in nginx main config file. Use load_module
>
>
> 2016-06-14 13:34 GMT+03:00 Azfar Hashmi <azfarhashmi at gmail.com>:
>
>> Below is the output of nginx -V
>>
>>
>> nginx version: nginx/1.10.1
>> built with OpenSSL 1.0.1k 8 Jan 2015 (running with OpenSSL 1.0.1t  3 May
>> 2016)
>> TLS SNI support enabled
>> configure arguments:
>> --add-module=/usr/src/builddir/debian/modules/naxsi/naxsi_src
>> --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat
>> -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro
>> -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf
>> --http-log-path=/var/log/nginx/access.log
>> --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock
>> --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules
>> --http-client-body-temp-path=/var/lib/nginx/body
>> --http-fastcgi-temp-path=/var/lib/nginx/fastcgi
>> --http-proxy-temp-path=/var/lib/nginx/proxy
>> --http-scgi-temp-path=/var/lib/nginx/scgi
>> --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit
>> --with-ipv6 --with-http_ssl_module --with-http_stub_status_module
>> --with-http_realip_module --with-http_auth_request_module
>> --with-http_v2_module --with-http_dav_module --with-file-aio --with-threads
>> --with-http_addition_module --with-http_flv_module
>> --with-http_geoip_module=dynamic --with-http_gunzip_module
>> --with-http_gzip_static_module --with-http_image_filter_module=dynamic
>> --with-http_mp4_module --with-http_perl_module=dynamic
>> --with-http_random_index_module --with-http_secure_link_module
>> --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic
>> --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module
>> --add-module=/usr/src/builddir/debian/modules/headers-more-nginx-module
>> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-auth-pam
>> --add-module=/usr/src/builddir/debian/modules/nginx-cache-purge
>> --add-module=/usr/src/builddir/debian/modules/nginx-dav-ext-module
>> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-development-kit
>> --add-module=/usr/src/builddir/debian/modules/nginx-echo
>> --add-module=/usr/src/builddir/debian/modules/ngx-fancyindex
>> --add-module=/usr/src/builddir/debian/modules/nginx-push-stream-module
>> --add-dynamic-module=/usr/src/builddir/debian/modules/nginx-lua
>> --add-module=/usr/src/builddir/debian/modules/nginx-upload-progress
>> --add-module=/usr/src/builddir/debian/modules/nginx-upstream-fair
>> --add-module=/usr/src/builddir/debian/modules/ngx_http_substitutions_filter_module
>> --add-module=/usr/src/builddir/debian/modules/nginx-auth-ldap
>> --add-module=/usr/src/builddir/debian/modules/ngx_http_pinba_module
>> --add-module=/usr/src/builddir/debian/modules/ngx_pagespeed
>> --add-module=/usr/src/builddir/debian/modules/nginx-x-rid-header
>> --add-module=/usr/src/builddir/debian/modules/nginx-rtmp-module
>> --with-ld-opt=-lossp-uuid
>>
>>
>> On Tue, Jun 14, 2016 at 2:23 PM, Yuriy Medvedev <medvedev.yp at gmail.com>
>> wrote:
>>
>>> Hi, please show output nginx -V
>>> 14 ???? 2016 ?. 12:32 ???????????? "Azfar Hashmi" <azfarhashmi at gmail.com>
>>> ???????:
>>>
>>> Hi,
>>>
>>> I just upgraded nginx to 1.10.1 but I am getting below error.
>>>
>>> nginx: [emerg] unknown directive "perl_modules" in
>>> /etc/nginx/nginx.conf:90
>>>
>>> My package is already compiled with perl (nginx -V), I am on Wheezy and
>>> using dotdeb.
>>>
>>>
>>>
>>> _______________________________________________
>>> nginx mailing list
>>> nginx at nginx.org
>>> http://mailman.nginx.org/mailman/listinfo/nginx
>>>
>>>
>>> _______________________________________________
>>> nginx mailing list
>>> nginx at nginx.org
>>> http://mailman.nginx.org/mailman/listinfo/nginx
>>>
>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/9d4b0886/attachment.html>

From vbart at nginx.com  Tue Jun 14 12:12:55 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Tue, 14 Jun 2016 15:12:55 +0300
Subject: Trying to Understand Upstream Keepalive
In-Reply-To: <23d0cc66025177ddb3f0c692703869fc.NginxMailingListEnglish@forum.nginx.org>
References: <9812cc7c3c328792aa8c6a38ca41a438.NginxMailingListEnglish@forum.nginx.org>
 <23d0cc66025177ddb3f0c692703869fc.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1775928.MK1CvVKr6N@vbart-workstation>

On Tuesday 14 June 2016 04:09:06 aanchalj wrote:
> As stated in
> http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive that
> "It should be particularly noted that the keepalive directive does not limit
> the total number of connections to upstream servers that an nginx worker
> process can open. The connections parameter should be set to a number small
> enough to let upstream servers process new incoming connections as well."  I
> want to understand if a new client comes, why can't they use existing
> keep-alive connections? Do they need to create a new connection with
> upstream?
> 
[..]

It's about the case when all of the existing keep-alive connections are already
in use and processing other client requests.

  wbr, Valentin V. Bartenev


From nginx-forum at forum.nginx.org  Tue Jun 14 13:23:40 2016
From: nginx-forum at forum.nginx.org (madvas)
Date: Tue, 14 Jun 2016 09:23:40 -0400
Subject: nginx big bug
In-Reply-To: <d55b5f18769ea2d7ca1581fed071d2f5.NginxMailingListEnglish@forum.nginx.org>
References: <20120307190924.GD67687@mdounin.ru>
 <d55b5f18769ea2d7ca1581fed071d2f5.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <a9dac037773431ea940ad6ef4f3a9dae.NginxMailingListEnglish@forum.nginx.org>

8712#14268: *2060 WSARecv() failed (10054: An existing connection was
forcibly closed by the remote host) while reading response header from
upstream, client:0.xx.xx.0

Can any one help me on this. 
I have site A , site B.
Site B is front end with nginx...
I am getting this error 10/3 times of request.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,223594,267563#msg-267563


From nginx-forum at forum.nginx.org  Tue Jun 14 13:24:59 2016
From: nginx-forum at forum.nginx.org (madvas)
Date: Tue, 14 Jun 2016 09:24:59 -0400
Subject: 10054: An existing connection was forcibly closed by the remote host
Message-ID: <42b94aba28ed83dd4a92a08ab347ec43.NginxMailingListEnglish@forum.nginx.org>

8712#14268: *2060 WSARecv() failed (10054: An existing connection was
forcibly closed by the remote host) while reading response header from
upstream, client:0.xx.xx.0 

Can any one help me on this please. 
I have site A , site B. 
Site B is front end with nginx... 
I am getting this error 10/3 times of request.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267564,267564#msg-267564


From mdounin at mdounin.ru  Tue Jun 14 14:28:28 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Tue, 14 Jun 2016 17:28:28 +0300
Subject: ssl session id and spdy/http2 traffic
In-Reply-To: <ebcbe57fb0ff7db7d5af4e887e97d769.NginxMailingListEnglish@forum.nginx.org>
References: <ebcbe57fb0ff7db7d5af4e887e97d769.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160614142828.GD36620@mdounin.ru>

Hello!

On Mon, Jun 13, 2016 at 03:00:16AM -0400, gitl wrote:

> I have noticed that the variables ssl_session_id and ssl_session_reused are
> always empty for http2 traffic (and for spdy before that). Under http 1.1
> they are set as expected and documented.
> What's the reason for this? Why not list the ID of the single connection
> that is used for the multiplexing?
> A big reason why I am logging both variables is to make sure that ssl
> connections are being reused for http2 and to be able to check if the ssl
> cache
> overruns. If the those two variables are not available, what do you suggest
> to use instead?

The $ssl_session_id and $ssl_session_reused variables are 
available with HTTP/2 much like with normal HTTP.  There are 
couple of nuances though:

- $ssl_session_id is not available when using session tickets, at 
  least till a session is actually reused, see detailed 
  explanation at http://trac.nginx.org/nginx/ticket/927#comment:1;

- in HTTP/2 connections are usually kept open for a long time, and you 
  aren't likely to see actual SSL session reuse due to this - in most 
  cases you will see just another request in an already opened 
  connection.

-- 
Maxim Dounin
http://nginx.org/


From nginx-forum at forum.nginx.org  Tue Jun 14 14:44:32 2016
From: nginx-forum at forum.nginx.org (philipp)
Date: Tue, 14 Jun 2016 10:44:32 -0400
Subject: error log truncates important infos
Message-ID: <5c61de5a539359209fac937b142e1766.NginxMailingListEnglish@forum.nginx.org>

We have error logs like this:

2016/06/14 12:47:45 [error] 21036#21036: *378143 FastCGI sent in stderr:
"PHP message: PHP Notice:  Undefined index: model_name in
/data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
line 20
PHP message: PHP Notice:  Undefined index: model_name in
/data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
line 21
PHP message: PHP Notice:  Undefined index: model_name in
/data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
line 23
PHP message: PHP Notice:  Undefined index: reducedprice in
/data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
line 24
PHP message: PHP Notice:  Undefined index: currentprice in
/data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
line 24" while reading response header from upstream, client: 127.0.0.1,
server: example.com, request: "GET / HTTP/1.1", upstream:
"fastcgi://unix:/var/run/php-fpm-example.com.sock:", host: "127.0.0.1"

For us the most important parts are the values in the last line like client,
server and so on.

Sometimes we see erros like this:

2016/06/14 12:47:23 [error] 31450#31450: *177931 FastCGI sent in stderr:
"PHP message: PHP Notice:  pg_execute(): Cannot set connection to blocking
mode in
/data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
on line 228
PHP message: PHP Fatal error:  Uncaught exception
'Zend\Db\Adapter\Exception\InvalidQueryException' with message 'FATAL: 
terminating connection due to administrator command
SSL connection has been closed unexpectedly' in
/data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php:235
Stack trace:
#0
/data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(238):
Zend\Db\Adapter\Driver\Pgsql\Statement->execute()
#1
/data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(208):
Zend\Db\TableGateway\AbstractTableGateway->executeSelect(Object(Zend\Db\Sql\Select))
#2 /data/example.com/corporate/XYZ/src/XYZ/Table/Table.php(758):
Zend\Db\TableGateway\AbstractTableGateway->selectWith(Object(Zend\Db\Sql\Select))
#3 /data/example.com/module/Product/src/Product/Table/Product.php(835):
XYZ\Table\Table->selectWith(Object(Zend\Db\Sql\Select))
#4
/data/example.com/module/Product/src/Product/DataService/ProductDataService.php(232):
Product\Table\P...
PHP message: PHP Notice:  pg_prepare(): Cannot set connection to blocking
mode in
/data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
on line 179
PHP message: PHP Notice:  pg_execute(): Cannot set connection to blocking
mode in
/data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
on line 228
PHP message: PHP Fatal error:  Uncaught exception
'Zend\Db\Adapter\Exception\InvalidQueryException' with message 'FATAL: 
terminating connection due to administrator command
SSL connection has been closed unexpectedly' in
/data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php:235
Stack trace:
#0
/data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(238):
Z

It looks like they are truncated. We miss a lot of important information
like client ip and so on. Is this a known limitation or bug in nginx?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267568,267568#msg-267568


From rpaprocki at fearnothingproductions.net  Tue Jun 14 14:52:25 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Tue, 14 Jun 2016 07:52:25 -0700
Subject: error log truncates important infos
In-Reply-To: <5c61de5a539359209fac937b142e1766.NginxMailingListEnglish@forum.nginx.org>
References: <5c61de5a539359209fac937b142e1766.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <3803533F-CFB6-4EA1-A638-4B57570F1F00@fearnothingproductions.net>

Error logs have a hard coded length limit of 2048 bytes iirc, to prevent runaway log entries. You might be better off configuring your app to dump stack traces instead of relying on a proxy. 

> On Jun 14, 2016, at 07:44, philipp <nginx-forum at forum.nginx.org> wrote:
> 
> We have error logs like this:
> 
> 2016/06/14 12:47:45 [error] 21036#21036: *378143 FastCGI sent in stderr:
> "PHP message: PHP Notice:  Undefined index: model_name in
> /data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
> line 20
> PHP message: PHP Notice:  Undefined index: model_name in
> /data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
> line 21
> PHP message: PHP Notice:  Undefined index: model_name in
> /data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
> line 23
> PHP message: PHP Notice:  Undefined index: reducedprice in
> /data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
> line 24
> PHP message: PHP Notice:  Undefined index: currentprice in
> /data/example.com/module/SalesFloor/view/partial/flyout/product.phtml on
> line 24" while reading response header from upstream, client: 127.0.0.1,
> server: example.com, request: "GET / HTTP/1.1", upstream:
> "fastcgi://unix:/var/run/php-fpm-example.com.sock:", host: "127.0.0.1"
> 
> For us the most important parts are the values in the last line like client,
> server and so on.
> 
> Sometimes we see erros like this:
> 
> 2016/06/14 12:47:23 [error] 31450#31450: *177931 FastCGI sent in stderr:
> "PHP message: PHP Notice:  pg_execute(): Cannot set connection to blocking
> mode in
> /data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
> on line 228
> PHP message: PHP Fatal error:  Uncaught exception
> 'Zend\Db\Adapter\Exception\InvalidQueryException' with message 'FATAL: 
> terminating connection due to administrator command
> SSL connection has been closed unexpectedly' in
> /data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php:235
> Stack trace:
> #0
> /data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(238):
> Zend\Db\Adapter\Driver\Pgsql\Statement->execute()
> #1
> /data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(208):
> Zend\Db\TableGateway\AbstractTableGateway->executeSelect(Object(Zend\Db\Sql\Select))
> #2 /data/example.com/corporate/XYZ/src/XYZ/Table/Table.php(758):
> Zend\Db\TableGateway\AbstractTableGateway->selectWith(Object(Zend\Db\Sql\Select))
> #3 /data/example.com/module/Product/src/Product/Table/Product.php(835):
> XYZ\Table\Table->selectWith(Object(Zend\Db\Sql\Select))
> #4
> /data/example.com/module/Product/src/Product/DataService/ProductDataService.php(232):
> Product\Table\P...
> PHP message: PHP Notice:  pg_prepare(): Cannot set connection to blocking
> mode in
> /data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
> on line 179
> PHP message: PHP Notice:  pg_execute(): Cannot set connection to blocking
> mode in
> /data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php
> on line 228
> PHP message: PHP Fatal error:  Uncaught exception
> 'Zend\Db\Adapter\Exception\InvalidQueryException' with message 'FATAL: 
> terminating connection due to administrator command
> SSL connection has been closed unexpectedly' in
> /data/example.com/vendor/zendframework/zend-db/src/Adapter/Driver/Pgsql/Statement.php:235
> Stack trace:
> #0
> /data/example.com/vendor/zendframework/zend-db/src/TableGateway/AbstractTableGateway.php(238):
> Z
> 
> It looks like they are truncated. We miss a lot of important information
> like client ip and so on. Is this a known limitation or bug in nginx?
> 
> Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267568,267568#msg-267568
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx


From mdounin at mdounin.ru  Tue Jun 14 14:59:20 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Tue, 14 Jun 2016 17:59:20 +0300
Subject: error log truncates important infos
In-Reply-To: <5c61de5a539359209fac937b142e1766.NginxMailingListEnglish@forum.nginx.org>
References: <5c61de5a539359209fac937b142e1766.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160614145920.GE36620@mdounin.ru>

Hello!

On Tue, Jun 14, 2016 at 10:44:32AM -0400, philipp wrote:

[...]

> Sometimes we see erros like this:

[...]

> It looks like they are truncated. We miss a lot of important information
> like client ip and so on. Is this a known limitation or bug in nginx?

This is a known limitation.  To allow error logging without any 
memory allocations, a 2048-bytes buffer is used.  This limits 
maximum length of error log lines accordingly.

-- 
Maxim Dounin
http://nginx.org/


From jbrock at everettcc.edu  Tue Jun 14 15:01:36 2016
From: jbrock at everettcc.edu (Jeremiah Brock)
Date: Tue, 14 Jun 2016 08:01:36 -0700
Subject: Drupal 7 and Coldfusion Proxy
Message-ID: <CACvqjeE+yCWtwL=U_KQObs4W1VmLcDhXOoP21rdC48psEVM1sQ@mail.gmail.com>

Good morning everyone!

    I have an issue that I am hoping is just a simple error on my part and
the collective wisdom of the gurus here might solve it.

    My setup : RHEL 7, Nginx 1.10, PHP 7 and Drupal 7

    My issue : trying to serve seamless paths for both Drupal and
ColdFusion without having to specify every possible path that coldfusion
applications exist in.  I was hoping index.cfm would be automatically used
via the index parameters but apparently only when try_files contains
$uri/.  However that breaks drupal paths that aren't physical folders...

    The following config works - but as you can see the regex listing for
coldfusion application paths is less than stellar...

root /var/www/drupal;
index index.html index.php index.cfm;

location / {
   try_files $uri /index.php?$query_string; # For Drupal >= 7
}

location @rewrite {
   rewrite ^/(.*)$ /index.php?q=$1;
}

location ~ ^/sites/.*/files/styles/ {
    try_files $uri @rewrite;
}

location ~* \.php$ {
    ##
    # Fastcgi cache
    ##
    set $skip_cache 1;
    if ($cache_uri != "null cache") {
        add_header X-Cache-Debug "$cache_uri $cookie_nocache
$arg_nocache$arg_comment $http_pragma $http_authorization";
        set $skip_cache 0;
    }
    fastcgi_cache_bypass $skip_cache;
    fastcgi_cache evcccache;
    fastcgi_cache_key $scheme$host$request_uri$request_method;
    fastcgi_cache_valid any 5m;
    #fastcgi_cache_use_stale updating;
    fastcgi_cache_bypass $http_pragma;
    fastcgi_cache_use_stale updating error timeout invalid_header http_500;
    try_files $uri $uri/ =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    include fastcgi_params;
    fastcgi_read_timeout 300;
    fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/var/run/php-fpm.sock;
    fastcgi_intercept_errors on;
}

# ColdFusion Proxy
##################
#find /var/www/drupal -type f -name 'index.cfm' |sed 's#\(.*\)/.*#\1#'
|sort -u
location ~* \.(cfm|cfc)$ {
    proxy_pass  https://coldfusion_servers;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_intercept_errors on;
}

location ~*
^(/longpath/someapp|/anotherpath/anotherapp|/yetanotherpath/andanotherapp|anotherapppath/etcapp)
{
    proxy_pass  https://coldfusion_servers;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_intercept_errors on;
}

~Jeremy

-- 
Jeremiah Brock
IT Web, Data and Development Services / Information Security
425-259-8707
jbrock at everettcc.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/300689ca/attachment.html>

From ben+nginx at list-subs.com  Tue Jun 14 17:28:55 2016
From: ben+nginx at list-subs.com (Ben)
Date: Tue, 14 Jun 2016 18:28:55 +0100
Subject: REST URLs and NGINX (config help needed)
Message-ID: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>

Hi,

Based on scraps found in the NGINX docs, I have a semi-working config 
that looks as follows :

#####
	location /demo {
		allow 10.0.0.0/8;
		deny all;
		try_files $uri @pdemo;
	}
	location @pdemo {
		fastcgi_param SCRIPT_FILENAME /path/to/demo.php;
		fastcgi_param SCRIPT_NAME /demo.php;
		fastcgi_param  PATH_INFO        $fastcgi_path_info;
		fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
		fastcgi_param QUERY_STRING    $args;
		include fastcgi_params;
	}

#####


I say this config is "semi-working" because :

A base-call to http://example.com/demo returns the hello-world output 
from my PHP router. No problems there.

But, if I call, say, http://example.com/demo/hello/x, the PHP router 
doesn't match the route (despite expecting hello/x as the path).

If it helps, I'm using bramus router and my configured paths are as 
follows :

$router->get('/', function() { echo "hello world"};
$router->get('hello/(\w+)', function($name) {echo "hello".$name};

However bramus returns a 404, and it doesn't matter if I prefix the 
hello path with a forwad slash in bramus.

Therefore I am guessing my nginx config is broken ?


From me at myconan.net  Tue Jun 14 18:09:13 2016
From: me at myconan.net (Edho Arief)
Date: Wed, 15 Jun 2016 03:09:13 +0900
Subject: REST URLs and NGINX (config help needed)
In-Reply-To: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
References: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
Message-ID: <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>

Hi

On Wed, Jun 15, 2016, at 02:28, Ben wrote:
> Hi,
> 
> Based on scraps found in the NGINX docs, I have a semi-working config 
> that looks as follows :
> 
> #####
> 	location /demo {
> 		allow 10.0.0.0/8;
> 		deny all;
> 		try_files $uri @pdemo;
> 	}
> 	location @pdemo {
> 		fastcgi_param SCRIPT_FILENAME /path/to/demo.php;
> 		fastcgi_param SCRIPT_NAME /demo.php;
> 		fastcgi_param  PATH_INFO        $fastcgi_path_info;
> 		fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
> 		fastcgi_param QUERY_STRING    $args;
> 		include fastcgi_params;
> 	}
> 
> #####
> 
> 
> I say this config is "semi-working" because :
> 
> A base-call to http://example.com/demo returns the hello-world output 
> from my PHP router. No problems there.
> 
> But, if I call, say, http://example.com/demo/hello/x, the PHP router 
> doesn't match the route (despite expecting hello/x as the path).
> 
> If it helps, I'm using bramus router and my configured paths are as 
> follows :
> 

Looks like the logic for getting base path is a bit interesting. Try
this for related line:

fastcgi_param SCRIPT_NAME /demo/;


From francis at daoine.org  Tue Jun 14 21:59:34 2016
From: francis at daoine.org (Francis Daly)
Date: Tue, 14 Jun 2016 22:59:34 +0100
Subject: Drupal 7 and Coldfusion Proxy
In-Reply-To: <CACvqjeE+yCWtwL=U_KQObs4W1VmLcDhXOoP21rdC48psEVM1sQ@mail.gmail.com>
References: <CACvqjeE+yCWtwL=U_KQObs4W1VmLcDhXOoP21rdC48psEVM1sQ@mail.gmail.com>
Message-ID: <20160614215934.GH2852@daoine.org>

On Tue, Jun 14, 2016 at 08:01:36AM -0700, Jeremiah Brock wrote:

Hi there,

>     My issue : trying to serve seamless paths for both Drupal and
> ColdFusion without having to specify every possible path that coldfusion
> applications exist in.

You may find it easiest to have a simple split in your url hierarchy
-- perhaps have everything that should be handled by drupal be below
/drupal/; or have everything that should be handled by coldfusion be
below /coldfusion/; or do both of them.

nginx is not magic.

If you mix your urls with no easy way to know which should be handled by
drupal and which by coldfusion and which by something else, then you end
up with a complicated way to tell nginx how it should handle each request.

> I was hoping index.cfm would be automatically used
> via the index parameters but apparently only when try_files contains
> $uri/.  However that breaks drupal paths that aren't physical folders...

I don't fully follow what you mean by that paragraph.

I suspect that that does not matter.

A request comes in. You want nginx to handle it in a particular way. The
way you tell nginx how to handle it is by writing in nginx.conf.

>     The following config works - but as you can see the regex listing for
> coldfusion application paths is less than stellar...

That is:

> location ~*
> ^(/longpath/someapp|/anotherpath/anotherapp|/yetanotherpath/andanotherapp|anotherapppath/etcapp)

That suggests that a request for /longpath/something should be handled
by drupal and not by coldfusion, yes?

And (with the rest of your config) a request for /longpath/someapp/a.php
should be handled by drupal too.

If you want to mix urls in a complicated way, you're going to have to
unmix them in a complicated way in nginx.conf.

If you don't want to unmix them in a complicated way in nginx.conf,
the easiest thing to do is not to mix them in a complicated way in the
first place.


I suppose you *could* (at the cost of significant efficiency, I suspect)
proxy everything to coldfusion, and then handle any 404 responses by
trying drupal. That might lead to a smaller or less-frequently-updated
nginx.conf.

But if you have the option to reorganise at least one of the "upstream"
url hierarchies, I'd suggest doing that instead.

Good luck with it,

	f
-- 
Francis Daly        francis at daoine.org


From francis at daoine.org  Tue Jun 14 22:04:36 2016
From: francis at daoine.org (Francis Daly)
Date: Tue, 14 Jun 2016 23:04:36 +0100
Subject: 10054: An existing connection was forcibly closed by the remote
 host
In-Reply-To: <42b94aba28ed83dd4a92a08ab347ec43.NginxMailingListEnglish@forum.nginx.org>
References: <42b94aba28ed83dd4a92a08ab347ec43.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160614220436.GI2852@daoine.org>

On Tue, Jun 14, 2016 at 09:24:59AM -0400, madvas wrote:

Hi there,

> 8712#14268: *2060 WSARecv() failed (10054: An existing connection was
> forcibly closed by the remote host) while reading response header from
> upstream, client:0.xx.xx.0 

If that error message is in nginx's error log, it suggests that nginx
thinks that something else closed the connection.

What is "upstream", in your case? Does it have any logs to indicate
a problem?

An old reply to the other thread you mailed this to indicated that it
may have been using a php server with not enough php children available.

	f
-- 
Francis Daly        francis at daoine.org


From jbrock at everettcc.edu  Tue Jun 14 22:11:08 2016
From: jbrock at everettcc.edu (Jeremiah Brock)
Date: Tue, 14 Jun 2016 15:11:08 -0700
Subject: Drupal 7 and Coldfusion Proxy
In-Reply-To: <20160614215934.GH2852@daoine.org>
References: <CACvqjeE+yCWtwL=U_KQObs4W1VmLcDhXOoP21rdC48psEVM1sQ@mail.gmail.com>
 <20160614215934.GH2852@daoine.org>
Message-ID: <CACvqjeHy_DoKiWaZEjOjrzXWj6Va0gmLRiv43Zqfp-6DdfDQ=g@mail.gmail.com>

Thank you for the response Francis.

Unfortunately - I don't have the luxury of separating out via a hierarchy.

I have determined that what I am wanting to do is just simply not possible
: ( .

~Jeremy

On Tue, Jun 14, 2016 at 2:59 PM, Francis Daly <francis at daoine.org> wrote:

> On Tue, Jun 14, 2016 at 08:01:36AM -0700, Jeremiah Brock wrote:
>
> Hi there,
>
> >     My issue : trying to serve seamless paths for both Drupal and
> > ColdFusion without having to specify every possible path that coldfusion
> > applications exist in.
>
> You may find it easiest to have a simple split in your url hierarchy
> -- perhaps have everything that should be handled by drupal be below
> /drupal/; or have everything that should be handled by coldfusion be
> below /coldfusion/; or do both of them.
>
> nginx is not magic.
>
> If you mix your urls with no easy way to know which should be handled by
> drupal and which by coldfusion and which by something else, then you end
> up with a complicated way to tell nginx how it should handle each request.
>
> > I was hoping index.cfm would be automatically used
> > via the index parameters but apparently only when try_files contains
> > $uri/.  However that breaks drupal paths that aren't physical folders...
>
> I don't fully follow what you mean by that paragraph.
>
> I suspect that that does not matter.
>
> A request comes in. You want nginx to handle it in a particular way. The
> way you tell nginx how to handle it is by writing in nginx.conf.
>
> >     The following config works - but as you can see the regex listing for
> > coldfusion application paths is less than stellar...
>
> That is:
>
> > location ~*
> >
> ^(/longpath/someapp|/anotherpath/anotherapp|/yetanotherpath/andanotherapp|anotherapppath/etcapp)
>
> That suggests that a request for /longpath/something should be handled
> by drupal and not by coldfusion, yes?
>
> And (with the rest of your config) a request for /longpath/someapp/a.php
> should be handled by drupal too.
>
> If you want to mix urls in a complicated way, you're going to have to
> unmix them in a complicated way in nginx.conf.
>
> If you don't want to unmix them in a complicated way in nginx.conf,
> the easiest thing to do is not to mix them in a complicated way in the
> first place.
>
>
> I suppose you *could* (at the cost of significant efficiency, I suspect)
> proxy everything to coldfusion, and then handle any 404 responses by
> trying drupal. That might lead to a smaller or less-frequently-updated
> nginx.conf.
>
> But if you have the option to reorganise at least one of the "upstream"
> url hierarchies, I'd suggest doing that instead.
>
> Good luck with it,
>
>         f
> --
> Francis Daly        francis at daoine.org
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>



-- 
Jeremiah Brock
IT Web, Data and Development Services / Information Security
425-259-8707
jbrock at everettcc.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160614/253cf485/attachment.html>

From nginx-forum at forum.nginx.org  Tue Jun 14 23:20:00 2016
From: nginx-forum at forum.nginx.org (webdel)
Date: Tue, 14 Jun 2016 19:20:00 -0400
Subject: Response from proxy server buffered in memory?
Message-ID: <3dfc425a06333db5b07ce1b8b0e60f57.NginxMailingListEnglish@forum.nginx.org>

I configured nginx as reverse proxy to an application server java disabling
the proxy buffering:

proxy_buffering off;
proxy_request_buffering off;

I noticed that when a client makes a request to the java server (e.g.
download a file), nginx  buffered  the response in memory (around 3Mb). 
I would like to configure nginx so as not buffered the response (or at least
minimize this buffer) it is possible?


Thanks,
Danilo Limatola Esterno

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267583,267583#msg-267583


From nginx-forum at forum.nginx.org  Tue Jun 14 23:37:07 2016
From: nginx-forum at forum.nginx.org (Supersmile2009)
Date: Tue, 14 Jun 2016 19:37:07 -0400
Subject: Mapping non-empty $query_string
Message-ID: <0a52bc338460029a249aec4c8bdfcacf.NginxMailingListEnglish@forum.nginx.org>

Hi!
I'm running a Wordpress based website on my server, I've set up fastcgi
cache recently. Now I want to get rid of evil-ifs, that are used to detect
cache skipping cases, and replace them with map.

I managed to convert all common ifs except this one,

if ($query_string != "") {
     set $skip_cache 1;
}

I'm trying to replace it with non-evil map in http section.

#skip cache if query string has at least one character 
map $query_string $skip_cache {
       "~.+" "1";
}

For some reason it doesn't work as intended. It starts bypassing cache on
ALL pages except main page.

Thanks for any help.
Alex

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267584,267584#msg-267584


From igor at sysoev.ru  Wed Jun 15 05:58:55 2016
From: igor at sysoev.ru (Igor Sysoev)
Date: Wed, 15 Jun 2016 08:58:55 +0300
Subject: Mapping non-empty $query_string
In-Reply-To: <0a52bc338460029a249aec4c8bdfcacf.NginxMailingListEnglish@forum.nginx.org>
References: <0a52bc338460029a249aec4c8bdfcacf.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <D4B2ECA6-29D6-4957-91B3-8AF53F6DA62B@sysoev.ru>

On 15 Jun 2016, at 02:37, Supersmile2009 <nginx-forum at forum.nginx.org> wrote:

> Hi!
> I'm running a Wordpress based website on my server, I've set up fastcgi
> cache recently. Now I want to get rid of evil-ifs, that are used to detect
> cache skipping cases, and replace them with map.
> 
> I managed to convert all common ifs except this one,
> 
> if ($query_string != "") {
>     set $skip_cache 1;
> }
> 
> I'm trying to replace it with non-evil map in http section.
> 
> #skip cache if query string has at least one character 
> map $query_string $skip_cache {
>       "~.+" "1";
> }
> 
> For some reason it doesn't work as intended. It starts bypassing cache on
> ALL pages except main page.

map $query_string $skip_cache {
    ""            0;
    default       1;
}


-- 
Igor Sysoev
http://nginx.com


From nginx-forum at forum.nginx.org  Wed Jun 15 12:12:18 2016
From: nginx-forum at forum.nginx.org (Supersmile2009)
Date: Wed, 15 Jun 2016 08:12:18 -0400
Subject: Mapping non-empty $query_string
In-Reply-To: <D4B2ECA6-29D6-4957-91B3-8AF53F6DA62B@sysoev.ru>
References: <D4B2ECA6-29D6-4957-91B3-8AF53F6DA62B@sysoev.ru>
Message-ID: <7c65d20d84d84b08786104cd59ae11d0.NginxMailingListEnglish@forum.nginx.org>

Already tried it, same result. Main page hits the cache, everything else -
bypasses.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267584,267590#msg-267590


From nginx-forum at forum.nginx.org  Wed Jun 15 13:51:43 2016
From: nginx-forum at forum.nginx.org (philipp)
Date: Wed, 15 Jun 2016 09:51:43 -0400
Subject: error log truncates important infos
In-Reply-To: <20160614145920.GE36620@mdounin.ru>
References: <20160614145920.GE36620@mdounin.ru>
Message-ID: <c166d441836b700c5dcabfda5b1c8856.NginxMailingListEnglish@forum.nginx.org>

Hmm I understand that limitation. But an attacker or a bad application can
hide the important information which we need to identify the source of the
problem.

What about limiting the fastcgi output to 1024 bytes and appending this info
with max 1024 bytes.
client: 127.0.0.1, server: example.com, upstream:
"fastcgi://unix:/var/run/php-fpm-example.com.sock:", host: "127.0.0.1" ,
request: "GET / HTTP/1.1"

[fastcgi - output max 1024][request info: client, server, upstream, host,
request - max 1024]

This would ensure that client, server and upstream are always provided. Host
and Request can be filled with "user generated" content, so you should put
it to the end. This would ensure that an attacker cannot hide the important
fields.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267568,267592#msg-267592


From rpaprocki at fearnothingproductions.net  Wed Jun 15 15:53:47 2016
From: rpaprocki at fearnothingproductions.net (Robert Paprocki)
Date: Wed, 15 Jun 2016 08:53:47 -0700
Subject: error log truncates important infos
In-Reply-To: <c166d441836b700c5dcabfda5b1c8856.NginxMailingListEnglish@forum.nginx.org>
References: <20160614145920.GE36620@mdounin.ru>
 <c166d441836b700c5dcabfda5b1c8856.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CAEuShZcn3Y-jScGdq44Ym+pSnn3jmHaA9dOq-7gE-wC4R2mQKg@mail.gmail.com>

If you're allowing user-generated output to be written directly to your
logs without any sort of sanitation, you've got bigger problems to worry
about :p  Again, it doesn't really make sense to have your fcgi error sent
here- why can't your fcgi process log elsewhere, and leaving the nginx
error log for nginx issues?

On Wed, Jun 15, 2016 at 6:51 AM, philipp <nginx-forum at forum.nginx.org>
wrote:

> Hmm I understand that limitation. But an attacker or a bad application can
> hide the important information which we need to identify the source of the
> problem.
>
> What about limiting the fastcgi output to 1024 bytes and appending this
> info
> with max 1024 bytes.
> client: 127.0.0.1, server: example.com, upstream:
> "fastcgi://unix:/var/run/php-fpm-example.com.sock:", host: "127.0.0.1" ,
> request: "GET / HTTP/1.1"
>
> [fastcgi - output max 1024][request info: client, server, upstream, host,
> request - max 1024]
>
> This would ensure that client, server and upstream are always provided.
> Host
> and Request can be filled with "user generated" content, so you should put
> it to the end. This would ensure that an attacker cannot hide the important
> fields.
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,267568,267592#msg-267592
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160615/f872bc53/attachment.html>

From reallfqq-nginx at yahoo.fr  Wed Jun 15 17:16:37 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Wed, 15 Jun 2016 19:16:37 +0200
Subject: Mapping non-empty $query_string
In-Reply-To: <7c65d20d84d84b08786104cd59ae11d0.NginxMailingListEnglish@forum.nginx.org>
References: <D4B2ECA6-29D6-4957-91B3-8AF53F6DA62B@sysoev.ru>
 <7c65d20d84d84b08786104cd59ae11d0.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CALqce=1-E=-ubiptBx_5v6pLsDYcmKOTWMke8x=uDAToUt-yNg@mail.gmail.com>

Are you sure your requests are processed by the right block?

Are you sure the configuration is being loaded? Since v1.9.2, you can use
the -T command-line parameter to show loaded configuration.
On reloading configuration by sending the HUP signal, ensure there is no
error message popping up in the error logs.

If this still does not work no-one cannot help you without further details
on the used configuration.
---
*B. R.*

On Wed, Jun 15, 2016 at 2:12 PM, Supersmile2009 <nginx-forum at forum.nginx.org
> wrote:

> Already tried it, same result. Main page hits the cache, everything else -
> bypasses.
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,267584,267590#msg-267590
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160615/f0536eda/attachment.html>

From reallfqq-nginx at yahoo.fr  Wed Jun 15 17:21:26 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Wed, 15 Jun 2016 19:21:26 +0200
Subject: error log truncates important infos
In-Reply-To: <CAEuShZcn3Y-jScGdq44Ym+pSnn3jmHaA9dOq-7gE-wC4R2mQKg@mail.gmail.com>
References: <20160614145920.GE36620@mdounin.ru>
 <c166d441836b700c5dcabfda5b1c8856.NginxMailingListEnglish@forum.nginx.org>
 <CAEuShZcn3Y-jScGdq44Ym+pSnn3jmHaA9dOq-7gE-wC4R2mQKg@mail.gmail.com>
Message-ID: <CALqce=3kL=Mb6u-9uoYVd1+7uWiSBS334793NUuh=zPEeDQCfQ@mail.gmail.com>

PHP-FPM allows generating its own log files.
The default behavior of having errors sent back the FastCGI tube can be
overridden with proper error logging on PHP-FPM side.
2048 bytes for each line of log is more than enough on the web server side.

Do your homework: read the PHP docs. If you are still struggling, ask some
PHP community to help you through.
---
*B. R.*

On Wed, Jun 15, 2016 at 5:53 PM, Robert Paprocki <
rpaprocki at fearnothingproductions.net> wrote:

> If you're allowing user-generated output to be written directly to your
> logs without any sort of sanitation, you've got bigger problems to worry
> about :p  Again, it doesn't really make sense to have your fcgi error sent
> here- why can't your fcgi process log elsewhere, and leaving the nginx
> error log for nginx issues?
>
> On Wed, Jun 15, 2016 at 6:51 AM, philipp <nginx-forum at forum.nginx.org>
> wrote:
>
>> Hmm I understand that limitation. But an attacker or a bad application can
>> hide the important information which we need to identify the source of the
>> problem.
>>
>> What about limiting the fastcgi output to 1024 bytes and appending this
>> info
>> with max 1024 bytes.
>> client: 127.0.0.1, server: example.com, upstream:
>> "fastcgi://unix:/var/run/php-fpm-example.com.sock:", host: "127.0.0.1" ,
>> request: "GET / HTTP/1.1"
>>
>> [fastcgi - output max 1024][request info: client, server, upstream, host,
>> request - max 1024]
>>
>> This would ensure that client, server and upstream are always provided.
>> Host
>> and Request can be filled with "user generated" content, so you should put
>> it to the end. This would ensure that an attacker cannot hide the
>> important
>> fields.
>>
>> Posted at Nginx Forum:
>> https://forum.nginx.org/read.php?2,267568,267592#msg-267592
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160615/bf4cb507/attachment.html>

From nginx-forum at forum.nginx.org  Wed Jun 15 21:10:11 2016
From: nginx-forum at forum.nginx.org (de_nginx_noob)
Date: Wed, 15 Jun 2016 17:10:11 -0400
Subject: nginx custom module multi process help
Message-ID: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>

Hi,

I'm new to nginx development and I have to work on a custom nginx module.

The module is designed to provide a list of variables for the user to use in
the nginx.conf file. Whenever those variables are used, the module makes a
udp request to a helper server to get the correct value of that variable. 

Example (log_format directive)

log_format test_log '$closest_chinese_restaurant $closest_ice_cream_shop';

As it's set up now (I wrote this a few months ago using Emiller's guide to
nginx module development and this module on github
https://github.com/leev/ngx_http_geoip2_module/blob/master/ngx_http_geoip2_module.c),

Whenever one of those variables ($closest_ice_cream_shop) is accessed, the
module makes a call to the database and gets the value based on the
connections ip address and returns it for use in the conf file. The problem
is that many of the variables in the module can be retrieved with a single
query to the helper server. As it stands now, that log directive will make
two calls to the helper server : one for $closest_chinese_restaurant and one
for $closest_ice_cream_shop.

How can I make it so that I only have to do one query for multiple
variables? Can I get/set environment variables for use in the conf file from
inside the module code? I considered making structs to hold the data so that
any request will check if the ip address is the same as previously queried -
and if it is, then retrieve the cached value from the structs. I'm just
worried that if the server gets busy enough, there will be multiple
instances of my module in different worker processes, which will lead to
multiple caching arrays/structs and trying to retrieve what might not exist
for that particular instance. 

Right now, I have 3 getters for all of my variables : one for ints, one for
floats, one for strings. They make a query to the helper server each time a
variable is accessed in the conf file. Each of those setters is similar to
ngx_http_geoip2_variable() in the geoip2 module linked above (they get the
data via a query and set the ngx_http_variable_value_t *v).

Please help. Thanks.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267611,267611#msg-267611


From nginx-forum at forum.nginx.org  Wed Jun 15 21:54:03 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Wed, 15 Jun 2016 17:54:03 -0400
Subject: nginx custom module multi process help
In-Reply-To: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>
References: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <f0aaa94c8ecdac7557e1ba672aeeea22.NginxMailingListEnglish@forum.nginx.org>

Why not use Lua, collect the data from your variables, run the query (and
optionally store them in a Lua cache) and process it all real-time,
none-blocking and without any (extra) module.

Examples:
http://stackoverflow.com/questions/25955869/how-do-i-use-mysql-for-dynamic-doc-root-with-nginx
https://github.com/openresty/lua-resty-mysql

https://github.com/openresty/lua-nginx-module

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267611,267612#msg-267612


From chencw1982 at gmail.com  Thu Jun 16 04:03:07 2016
From: chencw1982 at gmail.com (Chuanwen Chen)
Date: Thu, 16 Jun 2016 12:03:07 +0800
Subject: add limit_upstream to nginx
Message-ID: <CAKPCrs0pTahiMrJFJq-M8GiRuS-rq116=y+vp_KME+eqTvGzNg@mail.gmail.com>

I wrote a module for nginx 4 years ago which limited the number of
connections to upstream in order that the upstream servers would not be too
busy to work efficiently. Now I think this module is stable, and expect it
to be merged into nginx official if possible.

the code is here:
*https://github.com/cfsego/nginx-limit-upstream
<https://github.com/cfsego/nginx-limit-upstream>*

sincerely
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160616/57d0cf9c/attachment.html>

From ben+nginx at list-subs.com  Thu Jun 16 13:06:50 2016
From: ben+nginx at list-subs.com (Ben)
Date: Thu, 16 Jun 2016 14:06:50 +0100
Subject: REST URLs and NGINX (config help needed)
In-Reply-To: <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>
References: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
 <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>
Message-ID: <15556741-fc87-5128-f135-5352ceb39968@list-subs.com>


 >>
 >> If it helps, I'm using bramus router and my configured paths are as
 >> follows :
 >>
 >
 > Looks like the logic for getting base path is a bit interesting. Try
 > this for related line:
 >
 > fastcgi_param SCRIPT_NAME /demo/;
 >

That didn't work unfortunatley.

Just dug up their code and I see what you mean !

I put their "implode('/', array_slice(explode('/', 
$_SERVER['SCRIPT_NAME']), 0, -1)) . '/';" into my PHP and

for /demo/ it prints "/demo/"
and
for /demo/hello/x it prints "/demo/hello"

Which looks like their "auto base-path" is setting moving goalposts !!

Any other alternative NGINX configs I could try ?  I've tried reporting 
their base path but they're not particularly interested in fixing it!


I have also tried :

try_files $uri $uri/ /demo/demo.php;

But that only seems to work intermittently (which I guess is why NGINX 
recommend the original method I posted !).


From me at myconan.net  Thu Jun 16 13:11:19 2016
From: me at myconan.net (Edho Arief)
Date: Thu, 16 Jun 2016 22:11:19 +0900
Subject: REST URLs and NGINX (config help needed)
In-Reply-To: <15556741-fc87-5128-f135-5352ceb39968@list-subs.com>
References: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
 <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>
 <15556741-fc87-5128-f135-5352ceb39968@list-subs.com>
Message-ID: <1466082679.1103327.639588657.6371F6AA@webmail.messagingengine.com>

Hi

On Thu, Jun 16, 2016, at 22:06, Ben wrote:
> 
>  >>
>  >> If it helps, I'm using bramus router and my configured paths are as
>  >> follows :
>  >>
>  >
>  > Looks like the logic for getting base path is a bit interesting. Try
>  > this for related line:
>  >
>  > fastcgi_param SCRIPT_NAME /demo/;
>  >
> 
> That didn't work unfortunatley.
> 
> Just dug up their code and I see what you mean !
> 
> I put their "implode('/', array_slice(explode('/', 
> $_SERVER['SCRIPT_NAME']), 0, -1)) . '/';" into my PHP and
> 
> for /demo/ it prints "/demo/"
> and
> for /demo/hello/x it prints "/demo/hello"
> 
> Which looks like their "auto base-path" is setting moving goalposts !!
> 

That doesn't make sense if you actually use my configuration since
SCRIPT_NAME is static.


From me at myconan.net  Thu Jun 16 13:14:07 2016
From: me at myconan.net (Edho Arief)
Date: Thu, 16 Jun 2016 22:14:07 +0900
Subject: REST URLs and NGINX (config help needed)
In-Reply-To: <1466082679.1103327.639588657.6371F6AA@webmail.messagingengine.com>
References: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
 <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>
 <15556741-fc87-5128-f135-5352ceb39968@list-subs.com>
 <1466082679.1103327.639588657.6371F6AA@webmail.messagingengine.com>
Message-ID: <1466082847.1103709.639591609.55DCCF5C@webmail.messagingengine.com>

Hi

On Thu, Jun 16, 2016, at 22:11, Edho Arief wrote:
> > 
> > for /demo/ it prints "/demo/"
> > and
> > for /demo/hello/x it prints "/demo/hello"
> > 
> > Which looks like their "auto base-path" is setting moving goalposts !!
> > 
> 
> That doesn't make sense if you actually use my configuration since
> SCRIPT_NAME is static.
> 

Looking again, you probably need to include fastcgi_params first.

Here's the config I'm using:

 12   location @pdemo {
 13     include fastcgi_params;
 14     fastcgi_param SCRIPT_FILENAME /path/to/demo.php;
 15     fastcgi_param SCRIPT_NAME /demo/;
 16     fastcgi_pass 127.0.0.1:9000;
 17   }


From ben+nginx at list-subs.com  Thu Jun 16 13:34:40 2016
From: ben+nginx at list-subs.com (Ben)
Date: Thu, 16 Jun 2016 14:34:40 +0100
Subject: REST URLs and NGINX (config help needed)
In-Reply-To: <1466082847.1103709.639591609.55DCCF5C@webmail.messagingengine.com>
References: <4cfc19ed-dd40-52c9-5826-82b543dfc6a3@list-subs.com>
 <1465927753.3189057.637586129.7EF72E66@webmail.messagingengine.com>
 <15556741-fc87-5128-f135-5352ceb39968@list-subs.com>
 <1466082679.1103327.639588657.6371F6AA@webmail.messagingengine.com>
 <1466082847.1103709.639591609.55DCCF5C@webmail.messagingengine.com>
Message-ID: <ea40460e-128e-7b0f-7a12-a9fa13d4cc80@list-subs.com>



On 16/06/2016 14:14, Edho Arief wrote:
> Hi
>
> On Thu, Jun 16, 2016, at 22:11, Edho Arief wrote:
>>>
>>> for /demo/ it prints "/demo/"
>>> and
>>> for /demo/hello/x it prints "/demo/hello"
>>>
>>> Which looks like their "auto base-path" is setting moving goalposts !!
>>>
>>
>> That doesn't make sense if you actually use my configuration since
>> SCRIPT_NAME is static.
>>
>
> Looking again, you probably need to include fastcgi_params first.
>
> Here's the config I'm using:
>
>  12   location @pdemo {
>  13     include fastcgi_params;
>  14     fastcgi_param SCRIPT_FILENAME /path/to/demo.php;
>  15     fastcgi_param SCRIPT_NAME /demo/;
>  16     fastcgi_pass 127.0.0.1:9000;
>  17   }
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>

Doing some testing but that seems to have done the trick in the few 
things I've tried so far.

Thanks !


From nginx-forum at forum.nginx.org  Thu Jun 16 13:36:11 2016
From: nginx-forum at forum.nginx.org (de_nginx_noob)
Date: Thu, 16 Jun 2016 09:36:11 -0400
Subject: nginx custom module multi process help
In-Reply-To: <f0aaa94c8ecdac7557e1ba672aeeea22.NginxMailingListEnglish@forum.nginx.org>
References: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>
 <f0aaa94c8ecdac7557e1ba672aeeea22.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <5ee79ac75c94635c37528768417d0b81.NginxMailingListEnglish@forum.nginx.org>

If the external server that I'm getting the data from doesn't have a
relational database (and instead responds to udp requests), will I still be
able to cache multiple fields from one udp request using Lua so that I can
access them in the conf file later? Can you clarify what you mean by Lua
cache? Thank you for your help!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267611,267640#msg-267640


From nginx-forum at forum.nginx.org  Thu Jun 16 14:25:28 2016
From: nginx-forum at forum.nginx.org (gitl)
Date: Thu, 16 Jun 2016 10:25:28 -0400
Subject: pcre2
In-Reply-To: <a1619cf4ce19d742fb3b72edc566a693.NginxMailingListEnglish@forum.nginx.org>
References: <a1619cf4ce19d742fb3b72edc566a693.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <475788de5d2f5a29d6b3044ec01be393.NginxMailingListEnglish@forum.nginx.org>

Are there any plans to move from pcre (8.x) to pcre2 (10.x)? I realize that
the API changed quite a bit but it would be awesome if there was a migration
plan for it.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,265726,267649#msg-267649


From nginx-forum at forum.nginx.org  Thu Jun 16 15:23:02 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Thu, 16 Jun 2016 11:23:02 -0400
Subject: nginx custom module multi process help
In-Reply-To: <5ee79ac75c94635c37528768417d0b81.NginxMailingListEnglish@forum.nginx.org>
References: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>
 <f0aaa94c8ecdac7557e1ba672aeeea22.NginxMailingListEnglish@forum.nginx.org>
 <5ee79ac75c94635c37528768417d0b81.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <bb0e7ba27c681bc70c6caecf737e9aae.NginxMailingListEnglish@forum.nginx.org>

Theoretically yes, it all depends how and by what means this data is
collected and if you need to wait for some parts, have a look at the example
Urls I send before or join the openresty forum on googlegroups with some
example code/description what your after.

nb. a Lua cache is an in-memory cache of requests/answers that would be the
same if run again, if so you serve them from cache (which is fast) instead
of querying the database (which is 'slow') again.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267611,267650#msg-267650


From nginx-forum at forum.nginx.org  Thu Jun 16 15:41:01 2016
From: nginx-forum at forum.nginx.org (Ortal)
Date: Thu, 16 Jun 2016 11:41:01 -0400
Subject: send_header with NGX_HTTP_INTERNAL_SERVER_ERROR code
Message-ID: <5313ee5c620005cff74098e3a0d1b2d4.NginxMailingListEnglish@forum.nginx.org>

Hello, I have created my own NGINX module, which get rest request and return
a response. 
When I send a response with status 500 (NGX_HTTP_INTERNAL_SERVER_ERROR) or
404 (NGX_HTTP_BAD_REQUEST) I see on the memory uses that the nginx processes
is growing up 
 PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND 
 8734 ortal      20   0 7761628 7.335g   1736 S     69.0       47.9    
0:28.37 nginx                                           

I am using the function 'ngx_http_send_header' which I saw uses
'ngx_http_headers_filter' which hadnle the cases of
NGX_HTTP_INTERNAL_SERVER_ERROR and NGX_HTTP_BAD_REQUEST different then
NGX_HTTP_OK for example.

What am I doing wrong? Which function should I use to send a bad response?

Thanks

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267651,267651#msg-267651


From mdounin at mdounin.ru  Thu Jun 16 15:59:41 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Thu, 16 Jun 2016 18:59:41 +0300
Subject: pcre2
In-Reply-To: <475788de5d2f5a29d6b3044ec01be393.NginxMailingListEnglish@forum.nginx.org>
References: <a1619cf4ce19d742fb3b72edc566a693.NginxMailingListEnglish@forum.nginx.org>
 <475788de5d2f5a29d6b3044ec01be393.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160616155941.GV36620@mdounin.ru>

Hello!

On Thu, Jun 16, 2016 at 10:25:28AM -0400, gitl wrote:

> Are there any plans to move from pcre (8.x) to pcre2 (10.x)? I realize that
> the API changed quite a bit but it would be awesome if there was a migration
> plan for it.

As of now there are no plans, but we are keeping eye on it.  The 
most interesting question for me is when Exim will switch to 
PCRE2.

-- 
Maxim Dounin
http://nginx.org/


From nginx-forum at forum.nginx.org  Thu Jun 16 16:11:46 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Thu, 16 Jun 2016 12:11:46 -0400
Subject: send_header with NGX_HTTP_INTERNAL_SERVER_ERROR code
In-Reply-To: <5313ee5c620005cff74098e3a0d1b2d4.NginxMailingListEnglish@forum.nginx.org>
References: <5313ee5c620005cff74098e3a0d1b2d4.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <3e38c15dd4159b0d1dd6bc1fe3b44871.NginxMailingListEnglish@forum.nginx.org>

This is a general remark, adding stuff to handle a bad request, ea., will
eventually kill the performance, sending bad requests is a popular way to
create a DOS/DDOS attack since the server(the added module) has to process
them and do something while technically it makes no sense to do anything at
all.

All other normal requests have plenty of ways to handle overloading/doss-ing
without affecting other users, if you want to handle a bad request your
going to need to handle that as well, ergo leave bad requests to nginx.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267651,267653#msg-267653


From nginx-forum at forum.nginx.org  Thu Jun 16 17:19:48 2016
From: nginx-forum at forum.nginx.org (de_nginx_noob)
Date: Thu, 16 Jun 2016 13:19:48 -0400
Subject: nginx custom module multi process help
In-Reply-To: <bb0e7ba27c681bc70c6caecf737e9aae.NginxMailingListEnglish@forum.nginx.org>
References: <3e85f8d9805e1b9e96e7733b0c5a78a5.NginxMailingListEnglish@forum.nginx.org>
 <f0aaa94c8ecdac7557e1ba672aeeea22.NginxMailingListEnglish@forum.nginx.org>
 <5ee79ac75c94635c37528768417d0b81.NginxMailingListEnglish@forum.nginx.org>
 <bb0e7ba27c681bc70c6caecf737e9aae.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <73f2f61d02e8938ffc6598f761feda4b.NginxMailingListEnglish@forum.nginx.org>

I will definitely join the google group and check out Lua. Thanks for your
help!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267611,267654#msg-267654


From thresh at nginx.com  Thu Jun 16 17:21:35 2016
From: thresh at nginx.com (Konstantin Pavlov)
Date: Thu, 16 Jun 2016 20:21:35 +0300
Subject: nginx.org packages GPG key expiration & update
Message-ID: <509004c7-d8e4-0c58-81f9-7c5967583569@nginx.com>

Hello,

As some might have noticed, the expiration date of the GPG key we use to
sign repos and packages for Linux distributions [1] was getting close
(2016-08-17), so I've prolonged the key validity until 2024-06-14. The
ID of the key stays the same.


If you're using Debian/Ubuntu packages from nginx.org, you should
re-fetch and add the updated key to the APT keyring:

# wget https://nginx.org/keys/nginx_signing.key && apt-key add
./nginx_signing.key


If you're using CentOS/RHEL/SLES:

# wget https://nginx.org/keys/nginx_signing.key && rpm --import
./nginx_signing.key


I've also uploaded the updated key to keys.gnupg.net/pgp.mit.edu, though
it might take some time for the pool to catch up on that change.

And finally for the sake of search engines visibility, here's the apt
output Debian/Ubuntu users will see after 2016-08-17 with the old key:

W: GPG error: http://nginx.org jessie Release: The following signatures
were invalid: KEYEXPIRED 1471427554

Have a nice day,


[1]: http://nginx.org/en/linux_packages.html

-- 
Konstantin Pavlov

Build & Deliver Applications, Flawlessly.
nginx.conf 2016: September 7-9, Austin, TX
https://nginx.com/nginxconf/


From krish at aahan.me  Fri Jun 17 08:49:02 2016
From: krish at aahan.me (Aahan Krish)
Date: Fri, 17 Jun 2016 14:19:02 +0530
Subject: What exactly does keepalive_timeout work?
Message-ID: <CAFaCOgxWm0eM+zRD8+65oLg7v3zz6bKqWoCw3N4XZ0tikLtYeg@mail.gmail.com>

Hi,

I'd like to understand how `keepalive_timeout` works. The description
in the documentation isn't very clear and I couldn't get an answer to
my satisfaction on #nginx IRC.

People seem to have their own understanding of how `keepalive_timeout`
works and they are very different.

1. For e.g. <https://github.com/roots/trellis/blob/master/roles/nginx/templates/nginx.conf.j2>
describes the directive like this:

    # How long to allow each connection to stay idle; longer values are better
    # for each individual client, particularly for SSL, but means that worker
    # connections are tied up longer. (Default: 65)

So according to the statement `keepalive_timeout` is to be used to
tell how long a server needs to keep the connection alive AFTER
serving all the requests.

And this commenter seems to agree:
<http://serverfault.com/q/331762#comment665957_331764>

> [It's] only a timeout during which server waits for another request
> up to [the limit set by] `keepalive_requests`. So it is not important
> how much time it takes for the full page to load [...] BTW the max.
> time connection is kept open is almost:
>
>     keepalive_timeout * keepalive_requests

2. Then there are people understand the function of
`keepalive_timeout` like so: http://stackoverflow.com/a/10202959

> HTTP Keep-Alive is a feature of HTTP protocol. The web-server,
> implementing Keep-Alive Feature, has to check the connection/socket
> periodically (for incoming HTTP request) for the time span since it
> sent the last HTTP response (in case there was corresponding HTTP
> Request). If no HTTP request is received by the time of the configured
> keep-alive time (seconds) the web server closes the connection.

Similar opinion from another: http://serverfault.com/a/331764

> There isn't a good one-size-fits-all answer; if most client browsers
> are able to load all the resources on a page in 5 seconds then 5
> seconds is just fine [...]

So according to these people the directive is to be calculated in such
a way that in that given time (on an average) a web page on your site
and its contents (HTML, CSS, JS, images) are completely loaded on most
clients.

THE QUESTION: So which one is it? (1) or (2)? Who's right?


From nginx-forum at forum.nginx.org  Fri Jun 17 11:30:26 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Fri, 17 Jun 2016 07:30:26 -0400
Subject: nginx core dump explodes
Message-ID: <70e5c179529a8f5d9471cd3810cd9995.NginxMailingListEnglish@forum.nginx.org>

nginx version: nginx/1.11.1
built with OpenSSL 1.0.2h  3 May 2016

I try to debug those alerts currently, which only appear after a reload:

2016/06/17 13:10:49 [alert] 14624#0: *15709 open socket #626 left in
connection 628

I compiled nginx with --with-debug and set the flags CFLAGS="-g -O0"
./configure...

The following core dump settings are defined:

debug_points abort;
working_directory /var/tmp/cores/;
worker_rlimit_core 512M;
error_log /var/log/nginx/error.log debug;

I can see that it starts to generate the core file but it becomes very large
(>500GB) and removes it at the end.

Any idea what I'm doing wrong here?

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267669#msg-267669


From r1ch+nginx at teamliquid.net  Fri Jun 17 16:27:46 2016
From: r1ch+nginx at teamliquid.net (Richard Stanway)
Date: Fri, 17 Jun 2016 18:27:46 +0200
Subject: What exactly does keepalive_timeout work?
In-Reply-To: <CAFaCOgxWm0eM+zRD8+65oLg7v3zz6bKqWoCw3N4XZ0tikLtYeg@mail.gmail.com>
References: <CAFaCOgxWm0eM+zRD8+65oLg7v3zz6bKqWoCw3N4XZ0tikLtYeg@mail.gmail.com>
Message-ID: <CAKWQeygdwEp5ZF+COGtop69KPvZZgsRywrTukHN1Y8uJ4+Ksbg@mail.gmail.com>

You generally want as long a keepalive timeout as you're able to tolerate.
Closing the connection after 5 seconds for example means a full new TCP and
TLS handshake has to occur if the user clicks a link after 5 seconds,
resulting in a minimum of two RTTs before content, causing a slow loading
experience. If you have long pages that could take minutes to read before a
user loads another page, then for best performance you want keepalive at 5+
minutes for example. Keep in mind this is an upper limit - the browser is
free to choose when to close the connection on the client too.

The reason you will sometimes see recommendations to have a low keepalive
timeout is to improve performance of legacy forking web servers where each
client connection consumed an entire process and thus lots of memory.
Having lots of idle clients on such servers caused heavy memory usage and
was not recommended. Of course nginx has no such problem since it's event
based.

On Fri, Jun 17, 2016 at 10:49 AM, Aahan Krish <krish at aahan.me> wrote:

> Hi,
>
> I'd like to understand how `keepalive_timeout` works. The description
> in the documentation isn't very clear and I couldn't get an answer to
> my satisfaction on #nginx IRC.
>
> People seem to have their own understanding of how `keepalive_timeout`
> works and they are very different.
>
> 1. For e.g. <
> https://github.com/roots/trellis/blob/master/roles/nginx/templates/nginx.conf.j2
> >
> describes the directive like this:
>
>     # How long to allow each connection to stay idle; longer values are
> better
>     # for each individual client, particularly for SSL, but means that
> worker
>     # connections are tied up longer. (Default: 65)
>
> So according to the statement `keepalive_timeout` is to be used to
> tell how long a server needs to keep the connection alive AFTER
> serving all the requests.
>
> And this commenter seems to agree:
> <http://serverfault.com/q/331762#comment665957_331764>
>
> > [It's] only a timeout during which server waits for another request
> > up to [the limit set by] `keepalive_requests`. So it is not important
> > how much time it takes for the full page to load [...] BTW the max.
> > time connection is kept open is almost:
> >
> >     keepalive_timeout * keepalive_requests
>
> 2. Then there are people understand the function of
> `keepalive_timeout` like so: http://stackoverflow.com/a/10202959
>
> > HTTP Keep-Alive is a feature of HTTP protocol. The web-server,
> > implementing Keep-Alive Feature, has to check the connection/socket
> > periodically (for incoming HTTP request) for the time span since it
> > sent the last HTTP response (in case there was corresponding HTTP
> > Request). If no HTTP request is received by the time of the configured
> > keep-alive time (seconds) the web server closes the connection.
>
> Similar opinion from another: http://serverfault.com/a/331764
>
> > There isn't a good one-size-fits-all answer; if most client browsers
> > are able to load all the resources on a page in 5 seconds then 5
> > seconds is just fine [...]
>
> So according to these people the directive is to be calculated in such
> a way that in that given time (on an average) a web page on your site
> and its contents (HTML, CSS, JS, images) are completely loaded on most
> clients.
>
> THE QUESTION: So which one is it? (1) or (2)? Who's right?
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160617/939fc94f/attachment.html>

From nginx-forum at forum.nginx.org  Fri Jun 17 21:48:31 2016
From: nginx-forum at forum.nginx.org (jordan.davidson)
Date: Fri, 17 Jun 2016 17:48:31 -0400
Subject: TCP hostname routing using SNI
Message-ID: <809adf2efbdbd443efaf63ac76930333.NginxMailingListEnglish@forum.nginx.org>

We need TCP (not http) hostname routing for an environment we are creating
using k8s and ingress with the nginx ingress controller. We are trying to
figure out if there is a way to create an nginx server with a config that
will route TCP calls to a single host:port to different host:port combos
based on the hostname held in the SNI information.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267677,267677#msg-267677


From moseleymark at gmail.com  Fri Jun 17 21:54:08 2016
From: moseleymark at gmail.com (Mark Moseley)
Date: Fri, 17 Jun 2016 14:54:08 -0700
Subject: TCP hostname routing using SNI
In-Reply-To: <809adf2efbdbd443efaf63ac76930333.NginxMailingListEnglish@forum.nginx.org>
References: <809adf2efbdbd443efaf63ac76930333.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CAOH1cHnx0OkkDmx7dO2c95i9n_ZBZk61vEuAu5FJEgHyj0bAvA@mail.gmail.com>

On Fri, Jun 17, 2016 at 2:48 PM, jordan.davidson <
nginx-forum at forum.nginx.org> wrote:

> We need TCP (not http) hostname routing for an environment we are creating
> using k8s and ingress with the nginx ingress controller. We are trying to
> figure out if there is a way to create an nginx server with a config that
> will route TCP calls to a single host:port to different host:port combos
> based on the hostname held in the SNI information.
>
>
This isn't to say that there's not a fully-formed module, but just wanted
to point out that the nginx+lua extensions allow you to get at that
information. And then you could presumably use the balancer-by-lua stuff to
route.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160617/8afcd7bc/attachment.html>

From envek at envek.name  Sat Jun 18 08:29:49 2016
From: envek at envek.name (Andrey Novikov)
Date: Sat, 18 Jun 2016 11:29:49 +0300
Subject: SSL handshake failed with mutual TLS
Message-ID: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>

Hello everyone.

I'm setting up an internal web server that will accept requests from
another systems (mostly enterprise-ish something) authenticated with
client certificates.

We've successfully configured interaction with two of these systems
(all with mutual TLS), and when pointed another one to this server
we've got next message in the error.log (log level for error log is
set to debug):

2016/06/16 18:07:55 [info] 21742#0: *179610 SSL_do_handshake() failed
(SSL: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad
certificate:SSL alert number 42) while SSL handshaking, client:
10.117.252.168, server: 0.0.0.0:8443

What can cause this message? How to debug it?

Our setup is: Red Hat Enterprise Linux 7.1, Nginx 1.8.0 compiled from
sources and run from unprivileged user, internet not available, root
or sudo access not available too.

Requests from other systems handled well.

SSL configuration in nginx.conf as follows:

    ssl_certificate         /home/strela/ssl/strela.crt;
    ssl_certificate_key     /home/strela/ssl/strela.key;
    ssl_client_certificate  /home/strela/ssl/client-ca.crt; // Both
root and intermediate certs which signed client certs are included in
this file
    ssl_verify_client       on;
    ssl_verify_depth        2;
    ssl_session_cache       shared:SSL:10m;
    ssl_session_timeout     10m;

Thank you in advance, please ask for any additional info if required.

With best regards, Andrey Novikov.


From krish at aahan.me  Sat Jun 18 11:04:09 2016
From: krish at aahan.me (Aahan Krish)
Date: Sat, 18 Jun 2016 16:34:09 +0530
Subject: What exactly does keepalive_timeout work?
In-Reply-To: <CAKWQeygdwEp5ZF+COGtop69KPvZZgsRywrTukHN1Y8uJ4+Ksbg@mail.gmail.com>
References: <CAFaCOgxWm0eM+zRD8+65oLg7v3zz6bKqWoCw3N4XZ0tikLtYeg@mail.gmail.com>
 <CAKWQeygdwEp5ZF+COGtop69KPvZZgsRywrTukHN1Y8uJ4+Ksbg@mail.gmail.com>
Message-ID: <CAFaCOgxAXpcXbFS4xFUazPLaL15MHTOoXj2VQCgdnBy_mbjTtA@mail.gmail.com>

Hi Richard, thank you for your reply.

Since posting on this mailing-list I've come across some very good
(and credible) descriptions of Keep-Alive, and the best thing is that
they are all in agreement, i.e. no conflicting views. I'll quote them
here as a note to self and for everyone; they explain it all.

((1)) <https://tweaked.io/guide/general/webservers/>

""The purpose of keep-alive is simple in theory; rather than clients
having to open a fresh connection to your server for each request they
make (index, then CSS, then images), they open one connection.

When the initial connection is made that socket is kept open, rather
than beign closed, such that further requests can be using it.

>From the client point of view this improves things, as rather than
making the overhead to establish, use, and close, multiple connections
only one is used.

However the server is left keeping sockets open in the hope that
further requests will come, and if they don't resources are being
needlessly consumed which could be better spent on handling fresh
visitors.

Generally people suggest leaving a small number of sockets available
for keep-alive, or only keeping sockets open for a short period of
time - such as five seconds - after which time the chances of a
further request are minimal.""

((2)) <https://support.microsoft.com/en-us/kb/813827>

""When Internet Explorer establishes a persistent HTTP connection with
a Web server (by using Connection: Keep-Alive headers), Internet
Explorer reuses the same TCP/IP socket that was used to receive the
initial request until the socket is idle for one minute. After the
connection is idle for one minute, Internet Explorer resets the
connection. A new TCP/IP socket is used to receive additional
requests. You may want to change the HTTP KeepAliveTimeout value in
Internet Explorer.

If either the client browser (Internet Explorer) or the Web server has
a lower KeepAlive value, it is the limiting factor. For example, if
the client has a two-minute timeout, and the Web server has a
one-minute timeout, the maximum timeout is one minute. Either the
client or the server can be the limiting factor.

By default, Internet Explorer has a KeepAliveTimeout value of one
minute and an additional limiting factor (ServerInfoTimeout) of two
minutes. Either setting can cause Internet Explorer to reset the
socket.""

((3)) <http://kb.mozillazine.org/Network.http.keep-alive.timeout>

""Amount of time in seconds to keep keep-alive connections alive.
Default: 115 seconds.

Setting this to more than 115 probably won't help and will make things worse.""

NOTE: More on this in ((5)).

((4)) <http://kb.mozillazine.org/Network.http.max-persistent-connections-per-server>

On the maximum number of HTTP keep-alive connections the application
can have open at once to a single server: "Anything above 10 is
excessive."

((5)) <https://blog.fastmail.com/2011/06/28/http-keep-alive-connection-timeouts/>

NOTE: That blog post is a must-read and also states when one would
want to have long HTTP keep-alive timeout on their server.

After following 4/5 links above, I have no questions on how the
`keepalive_timeout` directive works or what it's intended for. I'm
satisfied!


From krish at aahan.me  Sat Jun 18 11:26:00 2016
From: krish at aahan.me (Aahan Krish)
Date: Sat, 18 Jun 2016 16:56:00 +0530
Subject: Why set keepalive_timeout to a short period when Nginx is great at
 handling them?
Message-ID: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>

I read something interesting today:
<https://blog.martinfjordvald.com/2011/04/optimizing-nginx-for-high-traffic-loads/>

"Keep alive is a HTTP feature which allows user agents to keep the
connection to your server open for a number of requests or until the
specified time out is reached. This won?t actually change the
performance of our nginx server very much as it handles idle
connections very well. The author of nginx claims that 10,000 idle
connections will use only 2.5 MB of memory, and from what I?ve seen
this seems to be correct.""

So why is it that people on the web (and in IRC) still recommend
setting `keepalive_timeout` to a short period (< 30 seconds) when
Nginx can handle idle keep-alive connections like a champ (using very
little resources) while serving active ones? Is that bad advise?

I get this advise so often that I believe there must be something that
I am missing. What's it?


From reallfqq-nginx at yahoo.fr  Sat Jun 18 12:12:31 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Sat, 18 Jun 2016 14:12:31 +0200
Subject: Why set keepalive_timeout to a short period when Nginx is great
 at handling them?
In-Reply-To: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
Message-ID: <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>

There is no downside on the server application I suppose, especially since,
as you recalled, nginx got no trouble for it.

One big problem is, there might be socket exhaustion on the TCP stack of
your front-end machine(s). Remember a socket is defined by a triple
<protocol, address, port> and the number of available ports is 65535 (layer
4) for every IP (layer 3) double <protocol, address>.
The baseline is, for TCP connections underlying your HTTP communication,
you have 65535 port for each IP version your server handles.

Now, you have to consider the relation between new clients (thus new
connections) and the existing/open ones.
If you have very low traffic, you could set an almost infinite timeout on
your keepalive capability, that would greatly help people who never sever
connection to your website because they are so addicted to it (and never
close the tab of their browser to it).
On the contrary, if you are very intensively seing new clients, with the
same parameters, you would quickly exhaust your available sockets and be
unable to accept client connections.

On the opposite scenario where you are setting a timeout on keepalive which
is too low, you would hurt you server performance by using CPU to manage
overhead connections for a single client, thus wasting resources and
inducing latency, which are issues keepalive helps to address.

Given the 65535 ports limitation is not going to change, at least in a
recent future (hardcoded on 16 bits in nowadays protocols), you have
essentially 2 parameters to consider:
- How often you get new clients
- What is the mean time users spend connected to your server(s)

Those should help you define the most efficient keepalive timeout. nginx
sets the default time for it at 75 seconds
<http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout>.

On a side note, there are also browser trouble with it, see
keepalive_disable
<http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_disable>.

And finally, nginx provides the ability to recycle connections based on a
number of requests made (default 100).
I guess that is a way of mitigating clients with different behaviors: a
client having made 100 requests is probably considered to hav had its share
of time on the server, and it is time to put it back in the pool to give
others access in case of congestion.
On the other hand, a client taking its time to browse your website (and
thus not reaching the requests limit) should be given the whole timeout
time allocated on the server.
I see no other reason than justice/balancing here, no technical one which
is other than th already addressed one: giving each client enough time to
browse the website with minimal disconnection, while avoid resources
unfairly taken away from other people.

I might be misled, in which case I ocunt on people to correct me.
I suggest you also read:
- https://www.nginx.com/blog/tuning-nginx/ ('Keepalive Connections' part)
- and more importantly
https://www.nginx.com/blog/http-keepalives-and-web-performance/
---
*B. R.*

On Sat, Jun 18, 2016 at 1:26 PM, Aahan Krish <krish at aahan.me> wrote:

> I read something interesting today:
> <
> https://blog.martinfjordvald.com/2011/04/optimizing-nginx-for-high-traffic-loads/
> >
>
> "Keep alive is a HTTP feature which allows user agents to keep the
> connection to your server open for a number of requests or until the
> specified time out is reached. This won?t actually change the
> performance of our nginx server very much as it handles idle
> connections very well. The author of nginx claims that 10,000 idle
> connections will use only 2.5 MB of memory, and from what I?ve seen
> this seems to be correct.""
>
> So why is it that people on the web (and in IRC) still recommend
> setting `keepalive_timeout` to a short period (< 30 seconds) when
> Nginx can handle idle keep-alive connections like a champ (using very
> little resources) while serving active ones? Is that bad advise?
>
> I get this advise so often that I believe there must be something that
> I am missing. What's it?
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160618/6099e625/attachment.html>

From krish at aahan.me  Sat Jun 18 15:29:30 2016
From: krish at aahan.me (Aahan Krish)
Date: Sat, 18 Jun 2016 20:59:30 +0530
Subject: Why set keepalive_timeout to a short period when Nginx is great
 at handling them?
In-Reply-To: <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
 <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>
Message-ID: <CAFaCOgxpj4LvW=+ofc1JrJta+pL+_8XyhF4FffMBODRK8Mm+jQ@mail.gmail.com>

Hi B.R.,

You raised a good point.

So you are referring to the 4-tuple (source_IP, source_port,
server_IP, server_port) socket limitation, correct? I just came to
know about this and it's interesting. Please tell me if this
understanding of mine is correct:

    So a server identifies a user's connection based on a combination
of: user's internet connection's IP + port the user's client is
connecting from (e.g. Chrome on 8118, IE on 8080, etc.) + server IP +
server_port (80 for HTTP / 443 for HTTPS).

    And the limitation is that a maximum of ~ 65536 clients all on
same port (say all are using Chrome and therefore connecting from
8118) can connect simultaneously to a web server that is connected to
the internet via 1 public IP address and port 80 (let's say HTTP
only), IFF the resources of the server permit.

    And that means I can double the no. of connections (2x 65536 per
second) my server can handle, if it has enough resources in the first
place (i.e. sufficient RAM, CPU, I/O capacity or whatever is relevant)
by simply adding another public IP address to my server and making
sure that the traffic is load-balanced between the two public IPs of
the server.

    Am I correct?

    (If my understanding is correct, this comment was helpful:
http://stackoverflow.com/q/34079965#comment55913149_34079965)

Check out the post I recently made to this list answering my own
question about `keepalive_timeout`:
<http://mailman.nginx.org/pipermail/nginx/2016-June/051026.html>

If you follow ((5)) in the post, you'll note that `keepalive_timeout`
set to anything over 300s or 5m is probably pointless as most browsers
drop the keep-alive connection in under 2 min, and 5 minutes max. This
is just an FYI as I'd like to hear what you think.

Lastly, your suggestion on utilizing `keepalive_requests` to recycle
keep-alive connections is smart. Noted.

I think I learnt a lot today. =)


From nginx-forum at forum.nginx.org  Sat Jun 18 15:49:16 2016
From: nginx-forum at forum.nginx.org (matt_l)
Date: Sat, 18 Jun 2016 11:49:16 -0400
Subject: limit_conn is not limiting the number of connections in my use case
Message-ID: <06a0d7628a55f19b70979bb04dceafd2.NginxMailingListEnglish@forum.nginx.org>

Hello,

I have a hard time understanding limit_conn

My NGINX has the configuration below. I would expect to see 16 connections
on the backend server 192.168.10.131 defined in the "dynamic" directive. 

Yet I see ~50-60 connections.

QPS:                    3056
Active connections:     58
QPS:                    3064
Active connections:     54
QPS:                    3063
Active connections:     59

Please note the QPS (Query Per Second) limiting works well.

I would greatly appreciate any tip as to what is going on with my use of the
limit_conn.

Thank you.

upstream locallayer {
    server 127.0.0.1:7999;
    keepalive 32;
}
        
server {
    listen 8002;
    proxy_intercept_errors on;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_pass http://locallayer;
    }
    error_page 302 400 403 404 408 500 502 503 504 = /empty;
    location /empty {
        return 204;
    }
}

upstream dynamic {
    least_conn;
    server 192.168.10.131:9990; 
    keepalive 32;
}
        
limit_conn_zone $binary_remote_addr zone=peripconn:100m;
limit_conn_zone $server_name zone=perserver:10m;
limit_req_zone $binary_remote_addr zone=peripreq:1000m rate=3000r/s;
        
server {
    listen 7999;
    server_name local.com;
    proxy_intercept_errors on;
    location / {
        allow 127.0.0.1;
        deny all;
        limit_conn peripconn 32;
        limit_conn perserver 32;
        limit_req zone=peripreq burst=100 nodelay;
        limit_conn_status 503;
        limit_req_status 503;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_connect_timeout 10ms;
        proxy_send_timeout 10ms;
        proxy_read_timeout 60ms;
        proxy_pass http://dynamic;
    }
    error_page 302 400 403 404 408 500 502 503 504 = /empty;
    location /empty {
        return 204;
    }
}

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267688,267688#msg-267688


From vbart at nginx.com  Sat Jun 18 22:41:51 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Sun, 19 Jun 2016 01:41:51 +0300
Subject: limit_conn is not limiting the number of connections in my use
 case
In-Reply-To: <06a0d7628a55f19b70979bb04dceafd2.NginxMailingListEnglish@forum.nginx.org>
References: <06a0d7628a55f19b70979bb04dceafd2.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1681118.fU8EJV4dmk@vbart-laptop>

On Saturday 18 June 2016 11:49:16 matt_l wrote:
> Hello,
> 
> I have a hard time understanding limit_conn
> 
> My NGINX has the configuration below. I would expect to see 16 connections
> on the backend server 192.168.10.131 defined in the "dynamic" directive. 
> 
> Yet I see ~50-60 connections.
> 
> QPS:                    3056
> Active connections:     58
> QPS:                    3064
> Active connections:     54
> QPS:                    3063
> Active connections:     59
> 
> Please note the QPS (Query Per Second) limiting works well.
> 
> I would greatly appreciate any tip as to what is going on with my use of the
> limit_conn.
[..]

The limit_conn module doesn't limit number of connections to upstream.
It's all about client connections.

Since you have configured "keepalive 32" each worker process can keep open
up to 32 connections to your backend even without client requests.

  wbr, Valentin V. Bartenev


From nginx-forum at forum.nginx.org  Sun Jun 19 08:11:53 2016
From: nginx-forum at forum.nginx.org (Ortal)
Date: Sun, 19 Jun 2016 04:11:53 -0400
Subject: send_header with NGX_HTTP_INTERNAL_SERVER_ERROR code
In-Reply-To: <3e38c15dd4159b0d1dd6bc1fe3b44871.NginxMailingListEnglish@forum.nginx.org>
References: <5313ee5c620005cff74098e3a0d1b2d4.NginxMailingListEnglish@forum.nginx.org>
 <3e38c15dd4159b0d1dd6bc1fe3b44871.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <71bd3b83dbf52524810cd9a3dfb95a25.NginxMailingListEnglish@forum.nginx.org>

Make sense...
Thanks

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267651,267692#msg-267692


From vbart at nginx.com  Sun Jun 19 08:53:12 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Sun, 19 Jun 2016 11:53:12 +0300
Subject: Why set keepalive_timeout to a short period when Nginx is great at
 handling them?
In-Reply-To: <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
 <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>
Message-ID: <3653407.NFVnlo7gke@vbart-laptop>

On Saturday 18 June 2016 14:12:31 B.R. wrote:
> There is no downside on the server application I suppose, especially since,
> as you recalled, nginx got no trouble for it.
> 
> One big problem is, there might be socket exhaustion on the TCP stack of
> your front-end machine(s). Remember a socket is defined by a triple
> <protocol, address, port> and the number of available ports is 65535 (layer
> 4) for every IP (layer 3) double <protocol, address>.
> The baseline is, for TCP connections underlying your HTTP communication,
> you have 65535 port for each IP version your server handles.
[..]

Each TCP connection is identified by 4 parameters: source IP, source PORT,
destination IP, destination PORT.  Since usually clients have different
public IPs there's not limitation by the number of ports.


> 
> Now, you have to consider the relation between new clients (thus new
> connections) and the existing/open ones.
> If you have very low traffic, you could set an almost infinite timeout on
> your keepalive capability, that would greatly help people who never sever
> connection to your website because they are so addicted to it (and never
> close the tab of their browser to it).
> On the contrary, if you are very intensively seing new clients, with the
> same parameters, you would quickly exhaust your available sockets and be
> unable to accept client connections.

No, keep-alive connections shouldn't exhaust available sockets, because
there's "worker_connections" directive in nginx that limits number of open
connections and must be set according to other limits in your system.

[..]
> And finally, nginx provides the ability to recycle connections based on a
> number of requests made (default 100).
> I guess that is a way of mitigating clients with different behaviors: a
> client having made 100 requests is probably considered to hav had its share
> of time on the server, and it is time to put it back in the pool to give
> others access in case of congestion.

No, it's to overcome possible memory leaks of long lived connections in nginx,
because some modules may allocate memory from connection pool on each request.
It's usually save to increase this value to 1000-10000.

  wbr, Valentin V. Bartenev


From francis at daoine.org  Sun Jun 19 09:09:39 2016
From: francis at daoine.org (Francis Daly)
Date: Sun, 19 Jun 2016 10:09:39 +0100
Subject: SSL handshake failed with mutual TLS
In-Reply-To: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>
References: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>
Message-ID: <20160619090939.GJ2852@daoine.org>

On Sat, Jun 18, 2016 at 11:29:49AM +0300, Andrey Novikov wrote:

Hi there,

> We've successfully configured interaction with two of these systems
> (all with mutual TLS), and when pointed another one to this server
> we've got next message in the error.log (log level for error log is
> set to debug):
> 
> 2016/06/16 18:07:55 [info] 21742#0: *179610 SSL_do_handshake() failed
> (SSL: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad
> certificate:SSL alert number 42) while SSL handshaking, client:
> 10.117.252.168, server: 0.0.0.0:8443
> 
> What can cause this message? How to debug it?

I think that this message (can|does) mean that the far side did not like
something about your certificate.

If that is the case - are there any logs on the thing connecting to
nginx about what it thinks happened in the TLS negotiation?

Cheers,

	f
-- 
Francis Daly        francis at daoine.org


From thomas at glanzmann.de  Sun Jun 19 09:51:28 2016
From: thomas at glanzmann.de (Thomas Glanzmann)
Date: Sun, 19 Jun 2016 11:51:28 +0200
Subject: Send Strict-Transport-Security header in 401 response
Message-ID: <20160619095128.GB29903@glanzmann.de>

Hello,
I would like to send the header:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

Despite the 401 Unauthorized request. Is that possible?

Currently the header is only added after a successful authorization:

(x1) [~] curl -v https://tuvl.de
* Rebuilt URL to: https://tuvl.de/
* Hostname was NOT found in DNS cache
*   Trying 2a01:4f8:b0:2fff::2...
* Connected to tuvl.de (2a01:4f8:b0:2fff::2) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*        subject: CN=tuvl.de
*        start date: 2016-06-19 08:39:00 GMT
*        expire date: 2016-09-17 08:39:00 GMT
*        subjectAltName: tuvl.de matched
*        issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*        SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.38.0
> Host: tuvl.de
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
* Server nginx is not blacklisted
< Server: nginx
< Date: Sun, 19 Jun 2016 09:47:40 GMT
< Content-Type: text/html
< Content-Length: 188
< Connection: keep-alive
< WWW-Authenticate: Basic realm="Virtual Lab"
<
<html>
<head><title>401 Authorization Required</title></head>
<body bgcolor="white">
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host tuvl.de left intact

Cheers,
        Thomas


From francis at daoine.org  Sun Jun 19 09:57:34 2016
From: francis at daoine.org (Francis Daly)
Date: Sun, 19 Jun 2016 10:57:34 +0100
Subject: Send Strict-Transport-Security header in 401 response
In-Reply-To: <20160619095128.GB29903@glanzmann.de>
References: <20160619095128.GB29903@glanzmann.de>
Message-ID: <20160619095734.GK2852@daoine.org>

On Sun, Jun 19, 2016 at 11:51:28AM +0200, Thomas Glanzmann wrote:

Hi there,

> I would like to send the header:
> 
> add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
> 
> Despite the 401 Unauthorized request. Is that possible?

http://nginx.org/r/add_header

That suggests that you can use an "always" parameter.

Is that appropriate in this case?

If not, then possibly the third-party "headers more" module may be useful.

	f
-- 
Francis Daly        francis at daoine.org


From krish at aahan.me  Sun Jun 19 10:36:56 2016
From: krish at aahan.me (Aahan Krish)
Date: Sun, 19 Jun 2016 16:06:56 +0530
Subject: Why set keepalive_timeout to a short period when Nginx is great
 at handling them?
In-Reply-To: <3653407.NFVnlo7gke@vbart-laptop>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
 <CALqce=3LLvzAGkxj_-oaw6+fk5bo9-3EXoUEgpB5O+MsS=uVZQ@mail.gmail.com>
 <3653407.NFVnlo7gke@vbart-laptop>
Message-ID: <CAFaCOgxWnB150s3n6ZCCP5yrr8dgWH-ec78B5hRvnX7Wnun9_Q@mail.gmail.com>

Hi Valentin,

*(I repeat the same question I put to B.R. as you raised the same
point.)*

So you are referring to the 4-tuple (source_IP, source_port,
server_IP, server_port) socket limitation, correct? I just came to
know about this and it's interesting. Please tell me if this
understanding of mine is correct:

    So a server identifies a user's connection based on a combination
    of: user's internet connection's IP + port the user's client is
    connecting from (e.g. Chrome on 8118, IE on 8080, etc.) +
    server IP + server_port (80 for HTTP / 443 for HTTPS).

    And the limitation is that a maximum of ~ 65536 clients all on
    same port (say all are using Chrome and therefore connecting from
    8118) can connect simultaneously to a web server that is connected
    to the internet via 1 public IP address and port 80 (let's say
    HTTP only), IFF the resources of the server permit.

    And that means I can double the no. of connections (2x 65536 per
    second) my server can handle, if it has enough resources in the
    first place (i.e. sufficient RAM, CPU, I/O capacity or whatever
    is relevant) by simply adding another public IP address to my
    server and making sure that the traffic is load-balanced between
    the two public IPs of the server.

Am I correct?

If my understanding is correct, this comment was helpful:
http://stackoverflow.com/q/34079965#comment55913149_34079965


From vbart at nginx.com  Sun Jun 19 13:36:18 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Sun, 19 Jun 2016 16:36:18 +0300
Subject: Why set keepalive_timeout to a short period when Nginx is great at
 handling them?
In-Reply-To: <CAFaCOgxWnB150s3n6ZCCP5yrr8dgWH-ec78B5hRvnX7Wnun9_Q@mail.gmail.com>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
 <3653407.NFVnlo7gke@vbart-laptop>
 <CAFaCOgxWnB150s3n6ZCCP5yrr8dgWH-ec78B5hRvnX7Wnun9_Q@mail.gmail.com>
Message-ID: <1497532.g2meMPn2b9@vbart-laptop>

On Sunday 19 June 2016 16:06:56 Aahan Krish wrote:
> Hi Valentin,
> 
> *(I repeat the same question I put to B.R. as you raised the same
> point.)*
> 
> So you are referring to the 4-tuple (source_IP, source_port,
> server_IP, server_port) socket limitation, correct? I just came to
> know about this and it's interesting. Please tell me if this
> understanding of mine is correct:
> 
>     So a server identifies a user's connection based on a combination
>     of: user's internet connection's IP + port the user's client is
>     connecting from (e.g. Chrome on 8118, IE on 8080, etc.) +
>     server IP + server_port (80 for HTTP / 443 for HTTPS).
> 
>     And the limitation is that a maximum of ~ 65536 clients all on
>     same port (say all are using Chrome and therefore connecting from
>     8118) can connect simultaneously to a web server that is connectedl
>     to the internet via 1 public IP address and port 80 (let's say
>     HTTP only), IFF the resources of the server permit.
> 
>     And that means I can double the no. of connections (2x 65536 per
>     second) my server can handle, if it has enough resources in the
>     first place (i.e. sufficient RAM, CPU, I/O capacity or whatever
>     is relevant) by simply adding another public IP address to my
>     server and making sure that the traffic is load-balanced between
>     the two public IPs of the server.
> 
> Am I correct?
[..]

No, first of all, there's no limitation of 65535 clients.

 1. Clients usually use different IPs, so one element of 4-tuple already
    different.

    Even if they are behind NAT, that only limits number of connections
    from one public IP of that gateway, not all clients of your server.

 2. Chrome, IE, etc. don't use the same port each time for outgoing
    connections.
 
   wbr, Valentin V. Bartenev


From krish at aahan.me  Sun Jun 19 14:46:10 2016
From: krish at aahan.me (Aahan Krish)
Date: Sun, 19 Jun 2016 20:16:10 +0530
Subject: Why set keepalive_timeout to a short period when Nginx is great
 at handling them?
In-Reply-To: <1497532.g2meMPn2b9@vbart-laptop>
References: <CAFaCOgy5O2WBxsOrUC5c2Ys-OXHY3eLMSFZK8SRcAF=oPhR-Pw@mail.gmail.com>
 <3653407.NFVnlo7gke@vbart-laptop>
 <CAFaCOgxWnB150s3n6ZCCP5yrr8dgWH-ec78B5hRvnX7Wnun9_Q@mail.gmail.com>
 <1497532.g2meMPn2b9@vbart-laptop>
Message-ID: <CAFaCOgxefMV=yVX2dTUXHx-RyXDVmc4brGObXFBiNUg0cpBy_w@mail.gmail.com>

Ah, I didn't know about NAT before. So that's how we have shared IP
addresses vs. dedicated IP addresses. This is beautiful; there's so
much to learn.

So the 2^16 limitation that B.R. mentioned is nothing to worry about.
It's like worrying that there are limited IP addresses available so we
can't serve infinite number of users, heh.

Thank you very much B.R. and Valentin for answering my questions. Have
a great day!


From nginx-forum at forum.nginx.org  Sun Jun 19 21:12:27 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Sun, 19 Jun 2016 17:12:27 -0400
Subject: Double Redirect
Message-ID: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>

Hi everybody,

I'm having an issue with our site. We're trying to redirect all traffic of
http://example.com to https://www.example.com.
Testing out our site, what happens is that http://example.com redirects to
https://example.com which then redirects to https://www.example.com

We also get an error:
nginx -t
nginx: [warn] conflicting server name "example.com" on 0.0.0.0:80, ignored

My server block file is below. I should note that the SSL certificate
parameters are handled globally in the nginx.conf file and not in the server
block files.

server {
    listen 80;
    listen 443 ssl;
    server_name example.com ***IP Address***;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.example.com;
    root /home/forge/example.com/public;

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/example.com/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/example.com-error.log error;

    error_page 404 /index.php;

    location ~* ^/***A CERTAIN BLOCKED DIRECTORY**** {
        auth_basic "closed website";
        auth_basic_user_file /etc/nginx/htpasswd;
        allow IP1;
        allow IP2;
        allow IP3;
        allow IP4;
        deny all;

        location ~* .(php) {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
       fastcgi_index index.php;
        include fastcgi_params;
        }
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    # Media: images, icons, video, audio, HTC
    location ~* \.(?:jpg|jpeg|png|gif|ico|css|js|svg|woff)$ {
       expires 1M;
        add_header Cache-Control "public";
    }

    # CSS and Javascript
    location ~* \.(?:css|js)$ {
        expires 1M;
        access_log off;
        add_header Cache-Control "public";
    }

    # cache.appcache, your document html and data
    location ~* \.(?:manifest|appcache|html?|xml|json)$ {
        expires -1;
        # access_log logs/static.log; # I don't usually include a static
log
    }

    location ~ /\.ht {
        deny all;
    }

    if ($allowed_country = no) {
        return 444;
    }
}


I was wondering if there was an issue in our setup that's causing the double
redirect and the error:
nginx: [warn] conflicting server name "example.com" on 0.0.0.0:80, ignored

Thank you for your help in advance
Lebod

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267700#msg-267700


From nginx-forum at forum.nginx.org  Sun Jun 19 21:16:56 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Sun, 19 Jun 2016 17:16:56 -0400
Subject: Double Redirect
In-Reply-To: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>

Lebod Wrote:
-------------------------------------------------------
> nginx: [warn] conflicting server name "example.com" on 0.0.0.0:80,

It says it all.

> server {
>     listen 80;
remove this line: >     listen 443 ssl;
>     server_name example.com ***IP Address***;
>     return 301 https://www.example.com$request_uri;
> }
>

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267701#msg-267701


From francis at daoine.org  Sun Jun 19 23:14:44 2016
From: francis at daoine.org (Francis Daly)
Date: Mon, 20 Jun 2016 00:14:44 +0100
Subject: Double Redirect
In-Reply-To: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160619231444.GL2852@daoine.org>

On Sun, Jun 19, 2016 at 05:12:27PM -0400, Lebod wrote:

Hi there,

> I'm having an issue with our site. We're trying to redirect all traffic of
> http://example.com to https://www.example.com.
> Testing out our site, what happens is that http://example.com redirects to
> https://example.com which then redirects to https://www.example.com
> 
> We also get an error:
> nginx -t
> nginx: [warn] conflicting server name "example.com" on 0.0.0.0:80, ignored

That suggests that there is another server{} block in, or included in,
your nginx.conf that you have not shown here.

> server {
>     listen 80;
>     listen 443 ssl;
>     server_name example.com ***IP Address***;
>     return 301 https://www.example.com$request_uri;
> }

If http://example.com redirects to https://example.com, then that server{}
is not used for the http://example.com request.

> I was wondering if there was an issue in our setup that's causing the double
> redirect and the error:
> nginx: [warn] conflicting server name "example.com" on 0.0.0.0:80, ignored

nginx -T

might show you where the problem is.

	f
-- 
Francis Daly        francis at daoine.org


From peter_booth at me.com  Mon Jun 20 00:54:21 2016
From: peter_booth at me.com (Peter Booth)
Date: Sun, 19 Jun 2016 20:54:21 -0400
Subject: No subject
Message-ID: <375B5A29-649F-4425-ABAB-C1BE550E37EA@me.com>



Sent from my iPhone
> 
>> On Saturday 18 June 2016 14:12:31 B.R. wrote:
>> There is no downside on the server application I suppose, especially since,
>> as you recalled, nginx got no trouble for it.
>> 
>> One big problem is, there might be socket exhaustion on the TCP stack of
>> your front-end machine(s). Remember a socket is defined by a triple
>> <protocol, address, port> and the number of available ports is 65535 (layer
>> 4) for every IP (layer 3) double <protocol, address>.
>> The baseline is, for TCP connections underlying your HTTP communication,
>> you have 65535 port for each IP version your server handles.
> [..]
> 
> Each TCP connection is identified by 4 parameters: source IP, source PORT,
> destination IP, destination PORT.  Since usually clients have different
> public IPs there's not limitation by the number of ports.

Whenever I read discussions like this I try and remember how important context is. There's a disagreement here about whether or not there's a potential go resource exhaustion with long lived (http) persistent sockets. 

Client side port exhaustion can be an issue when you have a hardware load balancer in front of your pool of Nginx servers. Because in this case it's common practice to use NAT, so what the Nginx server sees is a TCP connection originating from an internal IP address owned by the load balancer. In that scenario, for example, it can be pretty easy to run out of client  ports. 

I imagine there are other  shops that might experience a similar issue with a firewall or an inline intrusion detection system or a dedicated http proxy.

When you build a web app you're dealing with people's expectations And today I think people are pretty accustomed to the notion that sessions timeout and that going for a three hour lunch can reasonably lead to one having to reauthenticate to an app. I'm not conflating web app sessions with http persistence. It's just that if this is an app with authentication and a typical timeout, then persistent http offers no value once a session isn't valid.





> 
>> 
>> Now, you have to consider the relation between new clients (thus new
>> connections) and the existing/open ones.
>> If you have very low traffic, you could set an almost infinite timeout on
>> your keepalive capability, that would greatly help people who never sever
>> connection to your website because they are so addicted to it (and never
>> close the tab of their browser to it).
>> On the contrary, if you are very intensively seing new clients, with the
>> same parameters, you would quickly exhaust your available sockets and be
>> unable to accept client connections.
> 
> No, keep-alive connections shouldn't exhaust available sockets, because
> there's "worker_connections" directive in nginx that limits number of open
> connections and must be set according to other limits in your system.
> 
> [..]
>> And finally, nginx provides the ability to recycle connections based on a
>> number of requests made (default 100).
>> I guess that is a way of mitigating clients with different behaviors: a
>> client having made 100 requests is probably considered to hav had its share
>> of time on the server, and it is time to put it back in the pool to give
>> others access in case of congestion.
> 
> No, it's to overcome possible memory leaks of long lived connections in nginx,
> because some modules may allocate memory from connection pool on each request.
> It's usually save to increase this value to 1000-10000.
> 
>  wbr, Valentin V. Bartenev
> 
> 
> 
> ------------------------------
> 
> Message: 2
> Date: Sun, 19 Jun 2016 10:09:39 +0100
> From: Francis Daly <francis at daoine.org>
> To: nginx at nginx.org
> Subject: Re: SSL handshake failed with mutual TLS
> Message-ID: <20160619090939.GJ2852 at daoine.org>
> Content-Type: text/plain; charset=us-ascii
> 
> On Sat, Jun 18, 2016 at 11:29:49AM +0300, Andrey Novikov wrote:
> 
> Hi there,
> 
>> We've successfully configured interaction with two of these systems
>> (all with mutual TLS), and when pointed another one to this server
>> we've got next message in the error.log (log level for error log is
>> set to debug):
>> 
>> 2016/06/16 18:07:55 [info] 21742#0: *179610 SSL_do_handshake() failed
>> (SSL: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad
>> certificate:SSL alert number 42) while SSL handshaking, client:
>> 10.117.252.168, server: 0.0.0.0:8443
>> 
>> What can cause this message? How to debug it?
> 
> I think that this message (can|does) mean that the far side did not like
> something about your certificate.
> 
> If that is the case - are there any logs on the thing connecting to
> nginx about what it thinks happened in the TLS negotiation?
> 
> Cheers,
> 
>    f
> -- 
> Francis Daly        francis at daoine.org
> 
> 
> 
> ------------------------------
> 
> Message: 3
> Date: Sun, 19 Jun 2016 11:51:28 +0200
> From: Thomas Glanzmann <thomas at glanzmann.de>
> To: nginx <nginx at nginx.org>
> Subject: Send Strict-Transport-Security header in 401 response
> Message-ID: <20160619095128.GB29903 at glanzmann.de>
> Content-Type: text/plain; charset=us-ascii
> 
> Hello,
> I would like to send the header:
> 
> add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
> 
> Despite the 401 Unauthorized request. Is that possible?
> 
> Currently the header is only added after a successful authorization:
> 
> (x1) [~] curl -v https://tuvl.de
> * Rebuilt URL to: https://tuvl.de/
> * Hostname was NOT found in DNS cache
> *   Trying 2a01:4f8:b0:2fff::2...
> * Connected to tuvl.de (2a01:4f8:b0:2fff::2) port 443 (#0)
> * successfully set certificate verify locations:
> *   CAfile: none
>  CApath: /etc/ssl/certs
> * SSLv3, TLS handshake, Client hello (1):
> * SSLv3, TLS handshake, Server hello (2):
> * SSLv3, TLS handshake, CERT (11):
> * SSLv3, TLS handshake, Server key exchange (12):
> * SSLv3, TLS handshake, Server finished (14):
> * SSLv3, TLS handshake, Client key exchange (16):
> * SSLv3, TLS change cipher, Client hello (1):
> * SSLv3, TLS handshake, Finished (20):
> * SSLv3, TLS change cipher, Client hello (1):
> * SSLv3, TLS handshake, Finished (20):
> * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
> * Server certificate:
> *        subject: CN=tuvl.de
> *        start date: 2016-06-19 08:39:00 GMT
> *        expire date: 2016-09-17 08:39:00 GMT
> *        subjectAltName: tuvl.de matched
> *        issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
> *        SSL certificate verify ok.
>> GET / HTTP/1.1
>> User-Agent: curl/7.38.0
>> Host: tuvl.de
>> Accept: */*
> < HTTP/1.1 401 Unauthorized
> * Server nginx is not blacklisted
> < Server: nginx
> < Date: Sun, 19 Jun 2016 09:47:40 GMT
> < Content-Type: text/html
> < Content-Length: 188
> < Connection: keep-alive
> < WWW-Authenticate: Basic realm="Virtual Lab"
> <
> <html>
> <head><title>401 Authorization Required</title></head>
> <body bgcolor="white">
> <center><h1>401 Authorization Required</h1></center>
> <hr><center>nginx</center>
> </body>
> </html>
> * Connection #0 to host tuvl.de left intact
> 
> Cheers,
>        Thomas
> 
> 
> 
> ------------------------------
> 
> Message: 4
> Date: Sun, 19 Jun 2016 10:57:34 +0100
> From: Francis Daly <francis at daoine.org>
> To: nginx at nginx.org
> Subject: Re: Send Strict-Transport-Security header in 401 response
> Message-ID: <20160619095734.GK2852 at daoine.org>
> Content-Type: text/plain; charset=us-ascii
> 
> On Sun, Jun 19, 2016 at 11:51:28AM +0200, Thomas Glanzmann wrote:
> 
> Hi there,
> 
>> I would like to send the header:
>> 
>> add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
>> 
>> Despite the 401 Unauthorized request. Is that possible?
> 
> http://nginx.org/r/add_header
> 
> That suggests that you can use an "always" parameter.
> 
> Is that appropriate in this case?
> 
> If not, then possibly the third-party "headers more" module may be useful.
> 
>    f
> -- 
> Francis Daly        francis at daoine.org
> 
> 
> 
> ------------------------------
> 
> Message: 5
> Date: Sun, 19 Jun 2016 16:06:56 +0530
> From: Aahan Krish <krish at aahan.me>
> To: nginx at nginx.org
> Subject: Re: Why set keepalive_timeout to a short period when Nginx is
>    great at handling them?
> Message-ID:
>    <CAFaCOgxWnB150s3n6ZCCP5yrr8dgWH-ec78B5hRvnX7Wnun9_Q at mail.gmail.com>
> Content-Type: text/plain; charset=UTF-8
> 
> Hi Valentin,
> 
> *(I repeat the same question I put to B.R. as you raised the same
> point.)*
> 
> So you are referring to the 4-tuple (source_IP, source_port,
> server_IP, server_port) socket limitation, correct? I just came to
> know about this and it's interesting. Please tell me if this
> understanding of mine is correct:
> 
>    So a server identifies a user's connection based on a combination
>    of: user's internet connection's IP + port the user's client is
>    connecting from (e.g. Chrome on 8118, IE on 8080, etc.) +
>    server IP + server_port (80 for HTTP / 443 for HTTPS).
> 
>    And the limitation is that a maximum of ~ 65536 clients all on
>    same port (say all are using Chrome and therefore connecting from
>    8118) can connect simultaneously to a web server that is connected
>    to the internet via 1 public IP address and port 80 (let's say
>    HTTP only), IFF the resources of the server permit.
> 
>    And that means I can double the no. of connections (2x 65536 per
>    second) my server can handle, if it has enough resources in the
>    first place (i.e. sufficient RAM, CPU, I/O capacity or whatever
>    is relevant) by simply adding another public IP address to my
>    server and making sure that the traffic is load-balanced between
>    the two public IPs of the server.
> 
> Am I correct?
> 
> If my understanding is correct, this comment was helpful:
> http://stackoverflow.com/q/34079965#comment55913149_34079965
> 
> 
> 
> ------------------------------
> 
> Subject: Digest Footer
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
> 
> ------------------------------
> 
> End of nginx Digest, Vol 80, Issue 18
> *************************************


From wangyu1314 at gmail.com  Mon Jun 20 05:20:00 2016
From: wangyu1314 at gmail.com (=?UTF-8?B?5LqM5oiS?=)
Date: Mon, 20 Jun 2016 13:20:00 +0800
Subject: how to forbidden other site stealing my forum attachment ?
Message-ID: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>

Hello everyone,

My forum posts and attachments have been stolen much more by other site.
and I write a nginx rule to prevent, without success, please guide.

example this forum:
http://dysmyh.com/thread-41217-1-1.html

and my attachments url as
http://www.cnprint.org/bbs/attachment.php?attachmentid=205810&d=1359965752

and my forum domain is www.cnprint.org, and forum script put into /bbs/
directory.

now I forbidden others site show my attachment, this rule don't work,
please help me.

I think should this line "location ~* ^/bbs/attachment+\.php?$" has
mistake, but I can't resolve it.

location ~* ^/bbs/attachment+\.php?$
{
valid_referers none blocked *.cnprint.org server_names ~\.google\.
~\.baidu\. ~\.360\. ~\.bing\.;
if ($invalid_referer) {
# return 403;
rewrite ^.*$ http://www.cnprint.org;
}
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160620/056bcf34/attachment.html>

From me at myconan.net  Mon Jun 20 05:30:49 2016
From: me at myconan.net (Edho Arief)
Date: Mon, 20 Jun 2016 14:30:49 +0900
Subject: how to forbidden other site stealing my forum attachment ?
In-Reply-To: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
References: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
Message-ID: <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>

Hi,

On Mon, Jun 20, 2016, at 14:20, ?? wrote:
> I think should this line "location ~* ^/bbs/attachment+\.php?$" has
> mistake, but I can't resolve it.
> 
> location ~* ^/bbs/attachment+\.php?$
> {
> valid_referers none blocked *.cnprint.org server_names ~\.google\.
> ~\.baidu\. ~\.360\. ~\.bing\.;
> if ($invalid_referer) {
> # return 403;
> rewrite ^.*$ http://www.cnprint.org;
> }
> }


1. There's probably another regexp location block matching the url
before this block is defined (something like `location ~ \.php$ { }`)
and definition order matters in regexp location.

2. You need fastcgi stuff in the block as well otherwise it'll just
return the attachment.php file.

3. The regexp, while does match /bbs/attachment.php fine, it is a bit
confusing since it also matches /bbs/attachmentttttttt.ph .

3.1. might as well use exact match (`location = /bbs/attachment.php {
}`).


From wangyu1314 at gmail.com  Mon Jun 20 05:45:48 2016
From: wangyu1314 at gmail.com (=?UTF-8?B?5LqM5oiS?=)
Date: Mon, 20 Jun 2016 13:45:48 +0800
Subject: how to forbidden other site stealing my forum attachment ?
In-Reply-To: <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>
References: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
 <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>
Message-ID: <CALAv=4LByA_Z5EYKJmaaEUZJaSTrMJsK97pmk6-any7cmBuDfg@mail.gmail.com>

Edho Arief ,

*thank you very much.*
*it's work fine now.*
*have a good day, thank again.*

2016-06-20 13:30 GMT+08:00 Edho Arief <me at myconan.net>:

> Hi,
>
> On Mon, Jun 20, 2016, at 14:20, ?? wrote:
> > I think should this line "location ~* ^/bbs/attachment+\.php?$" has
> > mistake, but I can't resolve it.
> >
> > location ~* ^/bbs/attachment+\.php?$
> > {
> > valid_referers none blocked *.cnprint.org server_names ~\.google\.
> > ~\.baidu\. ~\.360\. ~\.bing\.;
> > if ($invalid_referer) {
> > # return 403;
> > rewrite ^.*$ http://www.cnprint.org;
> > }
> > }
>
>
> 1. There's probably another regexp location block matching the url
> before this block is defined (something like `location ~ \.php$ { }`)
> and definition order matters in regexp location.
>
> 2. You need fastcgi stuff in the block as well otherwise it'll just
> return the attachment.php file.
>
> 3. The regexp, while does match /bbs/attachment.php fine, it is a bit
> confusing since it also matches /bbs/attachmentttttttt.ph .
>
> 3.1. might as well use exact match (`location = /bbs/attachment.php {
> }`).
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160620/f0c0ec96/attachment.html>

From wangyu1314 at gmail.com  Mon Jun 20 05:54:25 2016
From: wangyu1314 at gmail.com (=?UTF-8?B?5LqM5oiS?=)
Date: Mon, 20 Jun 2016 13:54:25 +0800
Subject: how to forbidden other site stealing my forum attachment ?
In-Reply-To: <CALAv=4LByA_Z5EYKJmaaEUZJaSTrMJsK97pmk6-any7cmBuDfg@mail.gmail.com>
References: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
 <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>
 <CALAv=4LByA_Z5EYKJmaaEUZJaSTrMJsK97pmk6-any7cmBuDfg@mail.gmail.com>
Message-ID: <CALAv=4JhSr+eBPnjiL8GSypZmPoVajad0eh9sPPXhNODdg9Z8A@mail.gmail.com>

sorry. I have found my forum can't show attachment now.

blow is the nginx vhost config fles, where is the mistake?

thank you.

server
{
listen 80;
server_name  www.cnprint.org;
index index.php index.html index.htm;
root  /home/website/cnprint;
location /bbs/ {
rewrite ^/bbs/((urllist|sitemap_).*\.(xml|txt)(\.gz)?)$
/bbs/vbseo_sitemap/vbseo_getsitemap.php?sitemap=$1 last;
try_files $uri $uri/ /bbs/vbseo.php?$args;
}

location ~ ^/bbs/.+\.php$ {
fastcgi_pass  127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root/bbs/vbseo.php;
include       fastcgi_params;
}

location = /bbs/attachment.php
{
valid_referers none blocked *.cnprint.org server_names ~\.google\.
~\.baidu\. ~\.360\. ~\.bing\.;
if ($invalid_referer) {
#    return 403;
   rewrite ^.*$ http://www.cnprint.org;
}
}

location ~ .*\.php?$
{
     try_files $uri =404;
     include fastcgi.conf;
     fastcgi_pass  127.0.0.1:9000;
     fastcgi_index index.php;
}

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
    expires      30d;
}

}

2016-06-20 13:45 GMT+08:00 ?? <wangyu1314 at gmail.com>:

> Edho Arief ,
>
> *thank you very much.*
> *it's work fine now.*
> *have a good day, thank again.*
>
> 2016-06-20 13:30 GMT+08:00 Edho Arief <me at myconan.net>:
>
>> Hi,
>>
>> On Mon, Jun 20, 2016, at 14:20, ?? wrote:
>> > I think should this line "location ~* ^/bbs/attachment+\.php?$" has
>> > mistake, but I can't resolve it.
>> >
>> > location ~* ^/bbs/attachment+\.php?$
>> > {
>> > valid_referers none blocked *.cnprint.org server_names ~\.google\.
>> > ~\.baidu\. ~\.360\. ~\.bing\.;
>> > if ($invalid_referer) {
>> > # return 403;
>> > rewrite ^.*$ http://www.cnprint.org;
>> > }
>> > }
>>
>>
>> 1. There's probably another regexp location block matching the url
>> before this block is defined (something like `location ~ \.php$ { }`)
>> and definition order matters in regexp location.
>>
>> 2. You need fastcgi stuff in the block as well otherwise it'll just
>> return the attachment.php file.
>>
>> 3. The regexp, while does match /bbs/attachment.php fine, it is a bit
>> confusing since it also matches /bbs/attachmentttttttt.ph .
>>
>> 3.1. might as well use exact match (`location = /bbs/attachment.php {
>> }`).
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160620/38505b5b/attachment.html>

From me at myconan.net  Mon Jun 20 05:55:39 2016
From: me at myconan.net (Edho Arief)
Date: Mon, 20 Jun 2016 14:55:39 +0900
Subject: how to forbidden other site stealing my forum attachment ?
In-Reply-To: <CALAv=4JhSr+eBPnjiL8GSypZmPoVajad0eh9sPPXhNODdg9Z8A@mail.gmail.com>
References: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
 <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>
 <CALAv=4LByA_Z5EYKJmaaEUZJaSTrMJsK97pmk6-any7cmBuDfg@mail.gmail.com>
 <CALAv=4JhSr+eBPnjiL8GSypZmPoVajad0eh9sPPXhNODdg9Z8A@mail.gmail.com>
Message-ID: <1466402139.1471736.642550841.42F20BD6@webmail.messagingengine.com>

Hi,

On Mon, Jun 20, 2016, at 14:54, ?? wrote:
> sorry. I have found my forum can't show attachment now.
> 
> blow is the nginx vhost config fles, where is the mistake?
> 
> thank you.
> 
> server
> {
> listen 80;
> server_name  www.cnprint.org;
> index index.php index.html index.htm;
> root  /home/website/cnprint;
> location /bbs/ {
> rewrite ^/bbs/((urllist|sitemap_).*\.(xml|txt)(\.gz)?)$
> /bbs/vbseo_sitemap/vbseo_getsitemap.php?sitemap=$1 last;
> try_files $uri $uri/ /bbs/vbseo.php?$args;
> }
> 
> location ~ ^/bbs/.+\.php$ {
> fastcgi_pass  127.0.0.1:9000;
> fastcgi_param SCRIPT_FILENAME $document_root/bbs/vbseo.php;
> include       fastcgi_params;
> }
> 
> location = /bbs/attachment.php
> {
> valid_referers none blocked *.cnprint.org server_names ~\.google\.
> ~\.baidu\. ~\.360\. ~\.bing\.;
> if ($invalid_referer) {
> #    return 403;
>    rewrite ^.*$ http://www.cnprint.org;
> }
> }


If you read my message:

> 2. You need fastcgi stuff in the block as well otherwise it'll just return the attachment.php file.


From wangyu1314 at gmail.com  Mon Jun 20 06:10:04 2016
From: wangyu1314 at gmail.com (=?UTF-8?B?5LqM5oiS?=)
Date: Mon, 20 Jun 2016 14:10:04 +0800
Subject: how to forbidden other site stealing my forum attachment ?
In-Reply-To: <1466402139.1471736.642550841.42F20BD6@webmail.messagingengine.com>
References: <CALAv=4+B9ftFTm29d0-y=NqB5NKakJiGdiuvPzqaJVp0SM1Y5A@mail.gmail.com>
 <1466400649.1466548.642537257.5751D1FB@webmail.messagingengine.com>
 <CALAv=4LByA_Z5EYKJmaaEUZJaSTrMJsK97pmk6-any7cmBuDfg@mail.gmail.com>
 <CALAv=4JhSr+eBPnjiL8GSypZmPoVajad0eh9sPPXhNODdg9Z8A@mail.gmail.com>
 <1466402139.1471736.642550841.42F20BD6@webmail.messagingengine.com>
Message-ID: <CALAv=4+siqpWy9pQmW+A--D2EpZCK-uCUOLRW4FyWY++wudtBw@mail.gmail.com>

Hello,Edho Arief
sorry, just be not careful to understand.
It's ok now, thank again.

2016-06-20 13:55 GMT+08:00 Edho Arief <me at myconan.net>:

> Hi,
>
> On Mon, Jun 20, 2016, at 14:54, ?? wrote:
> > sorry. I have found my forum can't show attachment now.
> >
> > blow is the nginx vhost config fles, where is the mistake?
> >
> > thank you.
> >
> > server
> > {
> > listen 80;
> > server_name  www.cnprint.org;
> > index index.php index.html index.htm;
> > root  /home/website/cnprint;
> > location /bbs/ {
> > rewrite ^/bbs/((urllist|sitemap_).*\.(xml|txt)(\.gz)?)$
> > /bbs/vbseo_sitemap/vbseo_getsitemap.php?sitemap=$1 last;
> > try_files $uri $uri/ /bbs/vbseo.php?$args;
> > }
> >
> > location ~ ^/bbs/.+\.php$ {
> > fastcgi_pass  127.0.0.1:9000;
> > fastcgi_param SCRIPT_FILENAME $document_root/bbs/vbseo.php;
> > include       fastcgi_params;
> > }
> >
> > location = /bbs/attachment.php
> > {
> > valid_referers none blocked *.cnprint.org server_names ~\.google\.
> > ~\.baidu\. ~\.360\. ~\.bing\.;
> > if ($invalid_referer) {
> > #    return 403;
> >    rewrite ^.*$ http://www.cnprint.org;
> > }
> > }
>
>
> If you read my message:
>
> > 2. You need fastcgi stuff in the block as well otherwise it'll just
> return the attachment.php file.
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160620/a00bad72/attachment.html>

From maxim at nginx.com  Mon Jun 20 06:44:15 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Mon, 20 Jun 2016 09:44:15 +0300
Subject: TCP hostname routing using SNI
In-Reply-To: <809adf2efbdbd443efaf63ac76930333.NginxMailingListEnglish@forum.nginx.org>
References: <809adf2efbdbd443efaf63ac76930333.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <ba1db7e0-f7e7-e243-f405-201549e50f4c@nginx.com>

Hello,

On 6/18/16 12:48 AM, jordan.davidson wrote:
> We need TCP (not http) hostname routing for an environment we are creating
> using k8s and ingress with the nginx ingress controller. We are trying to
> figure out if there is a way to create an nginx server with a config that
> will route TCP calls to a single host:port to different host:port combos
> based on the hostname held in the SNI information.
> 
Currently the stream (tcp/udp lb) module misses this feature.
However, we do have it in the short-term roadmap and hope to have it
implemented more or less soon.

-- 
Maxim Konovalov


From nginx-forum at forum.nginx.org  Mon Jun 20 12:55:10 2016
From: nginx-forum at forum.nginx.org (matt_l)
Date: Mon, 20 Jun 2016 08:55:10 -0400
Subject: add limit_upstream to nginx
In-Reply-To: <CAKPCrs0pTahiMrJFJq-M8GiRuS-rq116=y+vp_KME+eqTvGzNg@mail.gmail.com>
References: <CAKPCrs0pTahiMrJFJq-M8GiRuS-rq116=y+vp_KME+eqTvGzNg@mail.gmail.com>
Message-ID: <40759f5fef751cf9c7870d7dbe3a2072.NginxMailingListEnglish@forum.nginx.org>

Hi Chuanwen
Your module did not quite work for me. I opened up a ticket here.
https://github.com/cfsego/nginx-limit-upstream/issues/12

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267614,267727#msg-267727


From zxcvbn4038 at gmail.com  Mon Jun 20 15:59:16 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Mon, 20 Jun 2016 11:59:16 -0400
Subject: SSL handshake failed with mutual TLS
In-Reply-To: <20160619090939.GJ2852@daoine.org>
References: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>
 <20160619090939.GJ2852@daoine.org>
Message-ID: <CA+p3EyzHa87DUpLYJWKz0pgcAjjVCUUYHSOa9A6QWruf=Qfiag@mail.gmail.com>

Check that you have both the certificate and any intermediate certificates
in your pem file - you can skip the top-most CA certificates as those are
generally included in your browser's CA store - but the intermediates are
not.

I believe Nginx wants certs ordered from bottom-most (your cert) to
top-most (ca's cert) - it used to be picky about that I haven't retried the
ordering in a long while.


On Sun, Jun 19, 2016 at 5:09 AM, Francis Daly <francis at daoine.org> wrote:

> On Sat, Jun 18, 2016 at 11:29:49AM +0300, Andrey Novikov wrote:
>
> Hi there,
>
> > We've successfully configured interaction with two of these systems
> > (all with mutual TLS), and when pointed another one to this server
> > we've got next message in the error.log (log level for error log is
> > set to debug):
> >
> > 2016/06/16 18:07:55 [info] 21742#0: *179610 SSL_do_handshake() failed
> > (SSL: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad
> > certificate:SSL alert number 42) while SSL handshaking, client:
> > 10.117.252.168, server: 0.0.0.0:8443
> >
> > What can cause this message? How to debug it?
>
> I think that this message (can|does) mean that the far side did not like
> something about your certificate.
>
> If that is the case - are there any logs on the thing connecting to
> nginx about what it thinks happened in the TLS negotiation?
>
> Cheers,
>
>         f
> --
> Francis Daly        francis at daoine.org
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160620/3ba6cc0e/attachment.html>

From mdounin at mdounin.ru  Mon Jun 20 18:18:38 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 20 Jun 2016 21:18:38 +0300
Subject: nginx core dump explodes
In-Reply-To: <70e5c179529a8f5d9471cd3810cd9995.NginxMailingListEnglish@forum.nginx.org>
References: <70e5c179529a8f5d9471cd3810cd9995.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160620181838.GH36620@mdounin.ru>

Hello!

On Fri, Jun 17, 2016 at 07:30:26AM -0400, martinproinity wrote:

> nginx version: nginx/1.11.1
> built with OpenSSL 1.0.2h  3 May 2016
> 
> I try to debug those alerts currently, which only appear after a reload:
> 
> 2016/06/17 13:10:49 [alert] 14624#0: *15709 open socket #626 left in
> connection 628
> 
> I compiled nginx with --with-debug and set the flags CFLAGS="-g -O0"
> ./configure...
> 
> The following core dump settings are defined:
> 
> debug_points abort;
> working_directory /var/tmp/cores/;
> worker_rlimit_core 512M;
> error_log /var/log/nginx/error.log debug;
> 
> I can see that it starts to generate the core file but it becomes very large
> (>500GB) and removes it at the end.
> 
> Any idea what I'm doing wrong here?

The "worker_rlimit_core 512M" line in your configuration suggests 
that the kernel should not generate core files bigger than 512M.  
If a worker process core takes more than that, the behaviour you 
describe looks more or less normal.

-- 
Maxim Dounin
http://nginx.org/


From nginx-forum at forum.nginx.org  Mon Jun 20 21:05:17 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Mon, 20 Jun 2016 17:05:17 -0400
Subject: Double Redirect
In-Reply-To: <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
 <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <b04fec19d459b954e9bf260995fa1ebc.NginxMailingListEnglish@forum.nginx.org>

Thank you for the reply;

If we did this:

 server { 
 listen 80; 
-listen 443 ssl; 
server_name example.com ***IP Address***; 
return 301 https://www.example.com$request_uri; 
 } 

Wouldn't this stop https://example.com from re-directing to
https://www.example.com then ?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267735#msg-267735


From nginx-forum at forum.nginx.org  Mon Jun 20 21:51:54 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Mon, 20 Jun 2016 17:51:54 -0400
Subject: Double Redirect
In-Reply-To: <b04fec19d459b954e9bf260995fa1ebc.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
 <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>
 <b04fec19d459b954e9bf260995fa1ebc.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <d801c7226e027d29a28b2458593c00bb.NginxMailingListEnglish@forum.nginx.org>

Lebod Wrote:
-------------------------------------------------------
> Thank you for the reply;
> 
> If we did this:
> 
>  server { 
>  listen 80; 
> -listen 443 ssl; 
> server_name example.com ***IP Address***; 
> return 301 https://www.example.com$request_uri; 
>  } 
> 
> Wouldn't this stop https://example.com from re-directing to
> https://www.example.com then ?

What do you think this does?:  return 301
https://www.example.com$request_uri;

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267736#msg-267736


From nginx-forum at forum.nginx.org  Mon Jun 20 21:59:10 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Mon, 20 Jun 2016 17:59:10 -0400
Subject: Double Redirect
In-Reply-To: <d801c7226e027d29a28b2458593c00bb.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
 <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>
 <b04fec19d459b954e9bf260995fa1ebc.NginxMailingListEnglish@forum.nginx.org>
 <d801c7226e027d29a28b2458593c00bb.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <6667c91958ae43c944da180020440084.NginxMailingListEnglish@forum.nginx.org>

itpp2012 Wrote:
-------------------------------------------------------
> Lebod Wrote:
> -------------------------------------------------------
> > Thank you for the reply;
> > 
> > If we did this:
> > 
> >  server { 
> >  listen 80; 
> > -listen 443 ssl; 
> > server_name example.com ***IP Address***; 
> > return 301 https://www.example.com$request_uri; 
> >  } 
> > 
> > Wouldn't this stop https://example.com from re-directing to
> > https://www.example.com then ?
> 
> What do you think this does?:  return 301
> https://www.example.com$request_uri;


Doesn't that re-direct https://example.com to https://www.example.com ?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267738#msg-267738


From nginx-forum at forum.nginx.org  Mon Jun 20 22:24:18 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Mon, 20 Jun 2016 18:24:18 -0400
Subject: Double Redirect
In-Reply-To: <6667c91958ae43c944da180020440084.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
 <576342c4a9d50bb859d8154ac259bc68.NginxMailingListEnglish@forum.nginx.org>
 <b04fec19d459b954e9bf260995fa1ebc.NginxMailingListEnglish@forum.nginx.org>
 <d801c7226e027d29a28b2458593c00bb.NginxMailingListEnglish@forum.nginx.org>
 <6667c91958ae43c944da180020440084.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <7888b02c9b01e9f0237ea5e524718f13.NginxMailingListEnglish@forum.nginx.org>

Lebod Wrote:
> > What do you think this does?:  return 301
> > https://www.example.com$request_uri;
> 
> Doesn't that re-direct https://example.com to https://www.example.com
> ?

It would if you used "listen 443", maybe you should read the docs to get a
basic grasp what your doing.

https://www.nginx.com/resources/wiki/start/

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267739#msg-267739


From nginx-forum at forum.nginx.org  Tue Jun 21 06:53:48 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Tue, 21 Jun 2016 02:53:48 -0400
Subject: nginx core dump explodes
In-Reply-To: <20160620181838.GH36620@mdounin.ru>
References: <20160620181838.GH36620@mdounin.ru>
Message-ID: <426196435b84eaf6b076f70e76c2a267.NginxMailingListEnglish@forum.nginx.org>

Thanks, setting the value to 600G made it possible to get a dump. But it
took ages and the system became quite unstable.

What can cause the dump to become that large? There is almost no traffic
(<10Mbps) on this server with 32G memory.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267742#msg-267742


From mdounin at mdounin.ru  Tue Jun 21 13:24:59 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Tue, 21 Jun 2016 16:24:59 +0300
Subject: nginx core dump explodes
In-Reply-To: <426196435b84eaf6b076f70e76c2a267.NginxMailingListEnglish@forum.nginx.org>
References: <20160620181838.GH36620@mdounin.ru>
 <426196435b84eaf6b076f70e76c2a267.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160621132459.GA19067@mdounin.ru>

Hello!

On Tue, Jun 21, 2016 at 02:53:48AM -0400, martinproinity wrote:

> Thanks, setting the value to 600G made it possible to get a dump. But it
> took ages and the system became quite unstable.
> 
> What can cause the dump to become that large? There is almost no traffic
> (<10Mbps) on this server with 32G memory.

You haven't said how large the resulting dump, but in general a 
dump reflects memory used by the process.  Something like "top" or 
"ps" should give you a good idea of how large a dump is expected to 
be.

Most obvious reason why processes can use lots of memory is using 
very big shared memory zones, e.g., in proxy_cache_path keys_zone.  
Also, given the fact that you are debugging a socket leak (in a custom 
module, I guess?), processes can be large due to leaks 
accumulated.

-- 
Maxim Dounin
http://nginx.org/


From jmvbxx at gmail.com  Tue Jun 21 15:59:20 2016
From: jmvbxx at gmail.com (J B)
Date: Tue, 21 Jun 2016 10:59:20 -0500
Subject: Segmentation fault with default init.d
Message-ID: <CACm3s7PXXLH9A8mG58PoEwda5bLU3n1+Zzr0eWLgLoE1vY5_SQ@mail.gmail.com>

I installed nginx-extras and passenger from Phusion PPA and received the
following error.

/etc/init.d/nginx: line 46: 32069 Segmentation fault      (core dumped)
start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --
$DAEMON_OPTS 2> /dev/null


What's the best way to begin troubleshooting this issue?

Thank you!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160621/0f92fdc4/attachment.html>

From nginx-forum at forum.nginx.org  Tue Jun 21 20:00:53 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Tue, 21 Jun 2016 16:00:53 -0400
Subject: nginx core dump explodes
In-Reply-To: <20160621132459.GA19067@mdounin.ru>
References: <20160621132459.GA19067@mdounin.ru>
Message-ID: <8361c08a496a0877d44c637d26057e74.NginxMailingListEnglish@forum.nginx.org>

The dump was 550GB large. So I guess the only explanation for this are the
accumulated keys_zone sizes.

There are no third-party modules. We only see the leaks for specific HTTP/2
traffic at every reload.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267748#msg-267748


From steve at greengecko.co.nz  Tue Jun 21 23:23:27 2016
From: steve at greengecko.co.nz (steve)
Date: Wed, 22 Jun 2016 11:23:27 +1200
Subject: SSL handshake failed with mutual TLS
In-Reply-To: <CA+p3EyzHa87DUpLYJWKz0pgcAjjVCUUYHSOa9A6QWruf=Qfiag@mail.gmail.com>
References: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>
 <20160619090939.GJ2852@daoine.org>
 <CA+p3EyzHa87DUpLYJWKz0pgcAjjVCUUYHSOa9A6QWruf=Qfiag@mail.gmail.com>
Message-ID: <5769CC6F.6030003@greengecko.co.nz>



On 06/21/2016 03:59 AM, CJ Ess wrote:
> Check that you have both the certificate and any intermediate 
> certificates in your pem file - you can skip the top-most CA 
> certificates as those are generally included in your browser's CA 
> store - but the intermediates are not.
>
> I believe Nginx wants certs ordered from bottom-most (your cert) to 
> top-most (ca's cert) - it used to be picky about that I haven't 
> retried the ordering in a long while.
>
>
It used to be your site cert at the top of the file. Don't know whether 
this is still true, but I always do it!

I recommend using the Qualys site ( https://www.ssllabs.com/ssltest/ ) 
to check and fine tune your SSL setup. They keep very current on all the 
vulns too, which is just sooo helpful.

Steve

-- 
Steve Holdoway BSc(Hons) MIITP
http://www.greengecko.co.nz
Linkedin: http://www.linkedin.com/in/steveholdoway
Skype: sholdowa


From rajnesh.siwal at gmail.com  Wed Jun 22 05:50:30 2016
From: rajnesh.siwal at gmail.com (Rajnesh Kumar Siwal)
Date: Wed, 22 Jun 2016 11:20:30 +0530
Subject: HTTP2 site does not loads on firefox
Message-ID: <CACTshoTm_5iRRf-KfHK1S4mu+7a1-j+5KFNBO3kBBSWwPCPkQg@mail.gmail.com>

Hi,
We have recently deployed a site on http2 (with ALPN support) using nginx.
The site does not open in Firefox 47.
The site supports following ciphers :

*Protocols* TLS 1.2 Yes TLS 1.1 Yes TLS 1.0 Yes SSL 3 No SSL 2 No


*Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL
2 suites at the end)* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH
secp256r1 (eq. 3072 bits RSA)   FS 256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072
bits RSA)   FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH
secp256r1 (eq. 3072 bits RSA)   FS 256 TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
256 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256 TLS_RSA_WITH_AES_256_CBC_SHA
(0x35) 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84) 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072
bits RSA)   FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH
secp256r1 (eq. 3072 bits RSA)   FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (
0xc013)   ECDH secp256r1 (eq. 3072 bits RSA)   FS 128
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_RSA_WITH_AES_128_CBC_SHA256 (
0x3c) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41) 128
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)   ECDH secp256r1 (eq. 3072
bits RSA)   FS 112 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112

-- 
Regards,
Rajnesh Kumar Siwal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160622/ff0590a2/attachment.html>

From al-nginx at none.at  Wed Jun 22 08:09:11 2016
From: al-nginx at none.at (Aleksandar Lazic)
Date: Wed, 22 Jun 2016 10:09:11 +0200
Subject: Segmentation fault with default init.d
In-Reply-To: <CACm3s7PXXLH9A8mG58PoEwda5bLU3n1+Zzr0eWLgLoE1vY5_SQ@mail.gmail.com>
References: <CACm3s7PXXLH9A8mG58PoEwda5bLU3n1+Zzr0eWLgLoE1vY5_SQ@mail.gmail.com>
Message-ID: <96e3e68d974e390dcb847aa8c1f4d53c@none.at>

Hi J B,

Am 21-06-2016 17:59, schrieb J B:

> I installed nginx-extras and passenger from Phusion PPA and received 
> the following error.
> 
> /etc/init.d/nginx: line 46: 32069 Segmentation fault      (core dumped) 
> start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- 
> $DAEMON_OPTS 2> /dev/null
> 
> What's the best way to begin troubleshooting this issue?

Let's assume you have a ubuntu setup.
This is a heavily customized nginx which you can see with nginx -V

How about to use the official nginx inc supported package and see if 
this happens also with this package.

http://nginx.org/en/linux_packages.html#stable

or a more recent version

http://nginx.org/en/linux_packages.html#mainline

Best Regars
Aleks


From vbart at nginx.com  Wed Jun 22 10:42:28 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Wed, 22 Jun 2016 13:42:28 +0300
Subject: nginx core dump explodes
In-Reply-To: <8361c08a496a0877d44c637d26057e74.NginxMailingListEnglish@forum.nginx.org>
References: <20160621132459.GA19067@mdounin.ru>
 <8361c08a496a0877d44c637d26057e74.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <2684544.oCdzOb9UHU@vbart-workstation>

On Tuesday 21 June 2016 16:00:53 martinproinity wrote:
> The dump was 550GB large. So I guess the only explanation for this are the
> accumulated keys_zone sizes.
> 
> There are no third-party modules. We only see the leaks for specific HTTP/2
> traffic at every reload.
> 
[..]

Could you collect a debug log with these leaks?
http://nginx.org/en/docs/debugging_log.html

  wbr, Valentin V. Bartenev


From thomas at glanzmann.de  Wed Jun 22 12:55:06 2016
From: thomas at glanzmann.de (Thomas Glanzmann)
Date: Wed, 22 Jun 2016 14:55:06 +0200
Subject: Send Strict-Transport-Security header in 401 response
In-Reply-To: <20160619095734.GK2852@daoine.org>
References: <20160619095128.GB29903@glanzmann.de>
 <20160619095734.GK2852@daoine.org>
Message-ID: <20160622125506.GD6473@glanzmann.de>

Hello Francis,

* Francis Daly <francis at daoine.org> [2016-06-19 11:57]:
> http://nginx.org/r/add_header

> That suggests that you can use an "always" parameter.

> Is that appropriate in this case?

yes, thank you a lot. That solved my problem.

Cheers,
        Thomas


From nginx-forum at forum.nginx.org  Wed Jun 22 13:11:55 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Wed, 22 Jun 2016 09:11:55 -0400
Subject: nginx core dump explodes
In-Reply-To: <2684544.oCdzOb9UHU@vbart-workstation>
References: <2684544.oCdzOb9UHU@vbart-workstation>
Message-ID: <92a999467662fa94b5cce8bd5182f183.NginxMailingListEnglish@forum.nginx.org>

I already did. Is there something specific I should look after in that debug
log?

Here a little extract (note: I replaced the request with <removed>):

...
2016/06/19 19:53:11 [debug] 8724#0: *19047 event timer: 63, old:
1466358851127, new: 1466358851267
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream exit:
0000000000000000
2016/06/19 19:53:11 [debug] 8724#0: *19047 finalize http upstream request:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 finalize http proxy request
2016/06/19 19:53:11 [debug] 8724#0: *19047 free rr peer 1 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 close http upstream connection:
63
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 0000000031A9EE00, unused:
48
2016/06/19 19:53:11 [debug] 8724#0: *19047 event timer del: 63:
1466358851127
2016/06/19 19:53:11 [debug] 8724#0: *19047 reusable connection: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream temp fd: -1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http finalize request: 0,
"<removed>" a:1, c:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate request count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate cleanup count:1
blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http posted request: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate handler count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http request count:1 blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 close stream 3, queued 0,
processing 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http close request
2016/06/19 19:53:11 [debug] 8724#0: *19047 http log handler
2016/06/19 19:53:11 [debug] 8724#0: *19047 run cleanup: 000000002DDEE350
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000355360C0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000202F2600, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001E88A800, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002DDED500, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000207AF4B0, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002027BE40, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002FCE5840, unused:
1348
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000003DABCC40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D295C40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 0000000024A93CD0, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D2E8D10, unused:
828
2016/06/19 19:53:11 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 delete posted event
000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 handle connection handler
2016/06/19 19:54:12 [alert] 8724#0: *19047 open socket #236 left in
connection 181
...

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267771#msg-267771


From vbart at nginx.com  Wed Jun 22 14:26:45 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Wed, 22 Jun 2016 17:26:45 +0300
Subject: nginx core dump explodes
In-Reply-To: <92a999467662fa94b5cce8bd5182f183.NginxMailingListEnglish@forum.nginx.org>
References: <2684544.oCdzOb9UHU@vbart-workstation>
 <92a999467662fa94b5cce8bd5182f183.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <3370618.uXC7DQAANu@vbart-workstation>

On Wednesday 22 June 2016 09:11:55 martinproinity wrote:
> I already did. Is there something specific I should look after in that debug
> log?
> 
> Here a little extract (note: I replaced the request with <removed>):
> 
[..]

I need the full log since the moment when the socket was created and till
the message when it was left.

I.e.:

2016/06/19 10:08:01 [debug] 9538#9538: *19047 accept: 127.0.0.1:46586 fd:236
...
2016/06/19 19:54:12 [alert] 9538#9538: *19047 open socket #236 left in connection 181

  wbr, Valentin V. Bartenev


From nginx-forum at forum.nginx.org  Wed Jun 22 15:31:27 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Wed, 22 Jun 2016 11:31:27 -0400
Subject: nginx core dump explodes
In-Reply-To: <3370618.uXC7DQAANu@vbart-workstation>
References: <3370618.uXC7DQAANu@vbart-workstation>
Message-ID: <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>

Here more of the debug log. I had to shorten it as I did get this message
"Please shorten your messages, the body is too large". 

Thanks!

2016/06/19 19:53:09 [debug] 8724#0: *19047 accept: <removed>:54691 fd:236
2016/06/19 19:53:09 [debug] 8724#0: *19047 event timer add: 236:
60000:1466358849721
2016/06/19 19:53:09 [debug] 8724#0: *19047 reusable connection: 1
2016/06/19 19:53:09 [debug] 8724#0: *19047 epoll add event: fd:236 op:1
ev:80002001
2016/06/19 19:53:09 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:09 [debug] 8724#0: *19047 delete posted event
000000000582ABD0
2016/06/19 19:53:09 [debug] 8724#0: *19047 http check ssl handshake
2016/06/19 19:53:09 [debug] 8724#0: *19047 http recv(): 1
2016/06/19 19:53:09 [debug] 8724#0: *19047 https ssl handshake: 0x16
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL server name: "<removed>"
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL certificate status callback
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL ALPN supported by client: h2
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL ALPN supported by client:
http/1.1
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL ALPN selected: h2
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_do_handshake: -1
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_get_error: 2
2016/06/19 19:53:09 [debug] 8724#0: *19047 reusable connection: 0
2016/06/19 19:53:09 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:09 [debug] 8724#0: *19047 delete posted event
000000000582ABD0
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL handshake handler: 0
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_do_handshake: 1
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL: TLSv1.2, cipher:
"ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256)
Mac=AEAD"
2016/06/19 19:53:09 [debug] 8724#0: *19047 init http2 connection
2016/06/19 19:53:09 [debug] 8724#0: *19047 posix_memalign:
000000001F3528D0:512 @16
2016/06/19 19:53:09 [debug] 8724#0: *19047 posix_memalign:
0000000032745F00:4096 @16
2016/06/19 19:53:09 [debug] 8724#0: *19047 add cleanup: 0000000025319398
2016/06/19 19:53:09 [debug] 8724#0: *19047 posix_memalign:
0000000030012A10:512 @16
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 send SETTINGS frame ack:0
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 send WINDOW_UPDATE frame
sid:0, window:2147418112
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 read handler
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_read: 58
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_read: -1
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_get_error: 2
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 preface verified
2016/06/19 19:53:09 [debug] 8724#0: *19047 process http2 frame type:4 f:0
l:12 sid:0
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 send SETTINGS frame ack:1
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame complete
pos:0000000003E1943D end:0000000003E1944A
2016/06/19 19:53:09 [debug] 8724#0: *19047 process http2 frame type:8 f:0
l:4 sid:0
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 WINDOW_UPDATE frame sid:0
window:10420225
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame complete
pos:0000000003E1944A end:0000000003E1944A
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame out: 00000000327460B8
sid:0 bl:0 len:0
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame out: 0000000032746008
sid:0 bl:0 len:4
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame out: 0000000032745F50
sid:0 bl:0 len:18
2016/06/19 19:53:09 [debug] 8724#0: *19047 malloc: 00000000359DE090:16384
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL buf copy: 27
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL buf copy: 13
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL buf copy: 9
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL to write: 49
2016/06/19 19:53:09 [debug] 8724#0: *19047 SSL_write: 49
2016/06/19 19:53:09 [debug] 8724#0: *19047 tcp_nodelay
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame sent:
0000000032745F50 sid:0 bl:0 len:18
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame sent:
0000000032746008 sid:0 bl:0 len:4
2016/06/19 19:53:09 [debug] 8724#0: *19047 http2 frame sent:
00000000327460B8 sid:0 bl:0 len:0
2016/06/19 19:53:09 [debug] 8724#0: *19047 free: 0000000032745F00, unused:
3495
2016/06/19 19:53:09 [debug] 8724#0: *19047 free: 00000000359DE090
2016/06/19 19:53:09 [debug] 8724#0: *19047 reusable connection: 1
2016/06/19 19:53:09 [debug] 8724#0: *19047 event timer del: 236:
1466358849721
2016/06/19 19:53:09 [debug] 8724#0: *19047 event timer add: 236:
180000:1466358969975
2016/06/19 19:53:10 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:10 [debug] 8724#0: *19047 delete posted event
000000000582ABD0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 idle handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 reusable connection: 0
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
0000000024124080:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 read handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_read: -1
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_get_error: 2
2016/06/19 19:53:10 [debug] 8724#0: *19047 free: 0000000024124080, unused:
4016
2016/06/19 19:53:10 [debug] 8724#0: *19047 reusable connection: 1
2016/06/19 19:53:10 [debug] 8724#0: *19047 event timer: 236, old:
1466358969975, new: 1466358970001
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 idle handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 reusable connection: 0
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
0000000024489380:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 read handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_read: 1947
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_read: -1
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_get_error: 2
2016/06/19 19:53:10 [debug] 8724#0: *19047 process http2 frame type:1 f:5
l:1938 sid:1
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 HEADERS frame sid:1 on 0
excl:0 weight:16
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
00000000254B06B0:1024 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
000000003D78A750:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
000000003D8EA8E0:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header name: 2
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 4
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 610
2016/06/19 19:53:10 [debug] 8724#0: *19047 malloc: 000000001B070A80:977
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
":path: <removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 malloc: 000000001F2E7E20:512
2016/06/19 19:53:10 [debug] 8724#0: *19047 malloc: 000000003D93F010:4096
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 826
free:4096
2016/06/19 19:53:10 [debug] 8724#0: *19047 http uri: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http args: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http exten: "php"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 1
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 10
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
":authority: <removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 55
free:3270
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header name: 7
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 19
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 37
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
"accept: text/html, application/xhtml+xml, image/jxr, */*"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 86
free:3215
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http header: "accept:
text/html, application/xhtml+xml, image/jxr, */*"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 51
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 282
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
"referer: <removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 423
free:3129
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http header: "referer:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 17
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 28
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
"accept-language: de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 82
free:2706
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http header:
"accept-language: de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 58
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 97
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 169
free:2624
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
0000000020C10000:512 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http header: "user-agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header name:
16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http header:
"accept-encoding: gzip, deflate"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 get indexed header: 32
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack encoded string
length: 851
2016/06/19 19:53:10 [debug] 8724#0: *19047 malloc: 000000003DB55BC0:1362
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 add header to hpack table:
"cookie: <removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 hpack table account: 1117
free:2455
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 http request line: "GET
<removed> HTTP/2.0"
2016/06/19 19:53:10 [debug] 8724#0: *19047 rewrite phase: 0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script value: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script set <removed>
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script value: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script set <removed>
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var
2016/06/19 19:53:10 [debug] 8724#0: *19047 http map started
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586"
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
000000003D8FED10:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http map: "Mozilla/5.0 (Windows
NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586" "0"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "0"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script if
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script if: false
2016/06/19 19:53:10 [debug] 8724#0: *19047 test location: "/"
2016/06/19 19:53:10 [debug] 8724#0: *19047 test location: "robots.txt"
2016/06/19 19:53:10 [debug] 8724#0: *19047 test location: "error/"
2016/06/19 19:53:10 [debug] 8724#0: *19047 using configuration "/"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http cl:-1 max:10485760
2016/06/19 19:53:10 [debug] 8724#0: *19047 rewrite phase: 2
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script if
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script if: false
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script value: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script set <removed>
2016/06/19 19:53:10 [debug] 8724#0: *19047 post rewrite phase: 3
2016/06/19 19:53:10 [debug] 8724#0: *19047 generic phase: 4
2016/06/19 19:53:10 [debug] 8724#0: *19047 generic phase: 5
2016/06/19 19:53:10 [debug] 8724#0: *19047 access phase: 6
2016/06/19 19:53:10 [debug] 8724#0: *19047 access phase: 7
2016/06/19 19:53:10 [debug] 8724#0: *19047 post access phase: 8
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http body new buf t:0 f:0
0000000000000000, pos 0000000000000000, size: 0 file: 0, size: 0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http init upstream, client timer:
0
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
000000002152A130:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http cache key: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 add cleanup: 000000003D8FFB60
2016/06/19 19:53:10 [debug] 8724#0: *19047 http file cache exists: -5 e:0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream cache: 8
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "Host: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy:
"X-Forwarded-Host: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy:
"X-Forwarded-For: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy:
"Accept-Encoding: gzip
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "Connection:
close
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy:
"Content-Length: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script var: "0"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: "
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: ""
2016/06/19 19:53:10 [debug] 8724#0: *19047 http script copy: ""
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "accept:
text/html, application/xhtml+xml, image/jxr, */*"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "referer:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
"accept-language: de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "user-agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
2016/06/19 19:53:10 [debug] 8724#0: *19047 http cleanup add:
000000003D8FFCB8
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream resolve:
"<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 name was resolved to <removed>
2016/06/19 19:53:10 [debug] 8724#0: *19047 get rr peer, try: 1
2016/06/19 19:53:10 [debug] 8724#0: *19047 stream socket 306
2016/06/19 19:53:10 [debug] 8724#0: *19047 epoll add connection: fd:306
ev:80002005
2016/06/19 19:53:10 [debug] 8724#0: *19047 connect to <removed>:80, fd:306
#19097
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream connect: -2
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
000000001D23A100:128 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 event timer add: 306:
60000:1466358850013
2016/06/19 19:53:10 [debug] 8724#0: *19047 http finalize request: -4,
"<removed>" a:1, c:2
2016/06/19 19:53:10 [debug] 8724#0: *19047 http request count:2 blk:0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 frame complete
pos:0000000003E19BAB end:0000000003E19BAB
2016/06/19 19:53:10 [debug] 8724#0: *19047 event timer del: 236:
1466358969975
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream request:
"<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream send request
handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream send request
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream send request body
2016/06/19 19:53:10 [debug] 8724#0: *19047 chain writer buf fl:0 s:2734
2016/06/19 19:53:10 [debug] 8724#0: *19047 chain writer buf fl:1 s:0
2016/06/19 19:53:10 [debug] 8724#0: *19047 chain writer in:
000000002152B0B0
2016/06/19 19:53:10 [debug] 8724#0: *19047 writev: 2734 of 2734
2016/06/19 19:53:10 [debug] 8724#0: *19047 chain writer out:
0000000000000000
2016/06/19 19:53:10 [debug] 8724#0: *19047 event timer del: 306:
1466358850013
2016/06/19 19:53:10 [debug] 8724#0: *19047 event timer add: 306:
60000:1466358850118
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 read handler
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_read: 9
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_read: -1
2016/06/19 19:53:10 [debug] 8724#0: *19047 SSL_get_error: 2
2016/06/19 19:53:10 [debug] 8724#0: *19047 process http2 frame type:4 f:1
l:0 sid:0
2016/06/19 19:53:10 [debug] 8724#0: *19047 http2 frame complete
pos:0000000003E19419 end:0000000003E19419
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream request:
"<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http upstream process header
2016/06/19 19:53:10 [debug] 8724#0: *19047 malloc: 0000000030EB0420:16384
2016/06/19 19:53:10 [debug] 8724#0: *19047 posix_memalign:
0000000022657FD0:4096 @16
2016/06/19 19:53:10 [debug] 8724#0: *19047 recv: eof:0, avail:1
2016/06/19 19:53:10 [debug] 8724#0: *19047 recv: fd:306 2811 of 15427
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy status 200 "200 OK"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Server:
Apache/2.2.22 (Debian)"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "X-Powered-By:
PHP/5.4.45-1~dotdeb+7.1"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "P3P:
CP="<removed>""
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Set-Cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Set-Cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Set-Cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Set-Cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Set-Cookie:
<removed>"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
"Cache-Control: no-cache"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Vary:
Accept-Encoding"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
"Content-Encoding: gzip"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Content-Type:
text/html"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
"Content-Length: 3582"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header:
"Accept-Ranges: bytes"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Date: Sun, 19
Jun 2016 17:53:10 GMT"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "X-Varnish:
491225986"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Age: 0"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Via: 1.1
varnish"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header: "Connection:
close"
2016/06/19 19:53:10 [debug] 8724#0: *19047 http proxy header done

...

2016/06/19 19:53:11 [debug] 8724#0: *19047 http file cache free, fd: -1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy filter init s:200 h:0
c:0 l:3582
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream process upstream
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe read upstream: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe preread: 572
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe buf free s:0 t:1 f:0
00000000355360C0, pos 00000000355367E4, size: 572 file: 0, size: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe length: 3582
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe write downstream: 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe write busy: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe write: out:0000000000000000,
f:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe read upstream: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe buf free s:0 t:1 f:0
00000000355360C0, pos 00000000355367E4, size: 572 file: 0, size: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe length: 3582
2016/06/19 19:53:11 [debug] 8724#0: *19047 event timer: 63, old:
1466358851127, new: 1466358851267
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream request:
"<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream dummy handler
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream request:
"<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream process upstream
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe read upstream: 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 readv: eof:1, avail:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 readv: 1, last:13984
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe recv chain: 3010
2016/06/19 19:53:11 [debug] 8724#0: *19047 readv: eof:1, avail:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 readv: 1, last:10974
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe recv chain: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe buf free s:0 t:1 f:0
00000000355360C0, pos 00000000355367E4, size: 3582 file: 0, size: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe length: 3582
2016/06/19 19:53:11 [debug] 8724#0: *19047 input buf #0
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe write downstream: 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 pipe write downstream flush in
2016/06/19 19:53:11 [debug] 8724#0: *19047 http output filter "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http copy filter: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http postpone filter "<removed>"
000000002027C008
2016/06/19 19:53:11 [debug] 8724#0: *19047 http copy filter: -1 "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 event timer: 63, old:
1466358851127, new: 1466358851267
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream exit:
0000000000000000
2016/06/19 19:53:11 [debug] 8724#0: *19047 finalize http upstream request:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 finalize http proxy request
2016/06/19 19:53:11 [debug] 8724#0: *19047 free rr peer 1 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 close http upstream connection:
63
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 0000000031A9EE00, unused:
48
2016/06/19 19:53:11 [debug] 8724#0: *19047 event timer del: 63:
1466358851127
2016/06/19 19:53:11 [debug] 8724#0: *19047 reusable connection: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream temp fd: -1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http finalize request: 0,
"<removed>" a:1, c:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate request count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate cleanup count:1
blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http posted request: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate handler count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http request count:1 blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 close stream 3, queued 0,
processing 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http close request
2016/06/19 19:53:11 [debug] 8724#0: *19047 http log handler
2016/06/19 19:53:11 [debug] 8724#0: *19047 run cleanup: 000000002DDEE350
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000355360C0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000202F2600, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001E88A800, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002DDED500, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000207AF4B0, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002027BE40, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002FCE5840, unused:
1348
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000003DABCC40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D295C40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 0000000024A93CD0, unused:
0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D2E8D10, unused:
828
2016/06/19 19:53:11 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 delete posted event
000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 handle connection handler
2016/06/19 19:54:12 [alert] 8724#0: *19047 open socket #236 left in
connection 181

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267779#msg-267779


From vbart at nginx.com  Wed Jun 22 18:34:15 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Wed, 22 Jun 2016 21:34:15 +0300
Subject: nginx core dump explodes
In-Reply-To: <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>
References: <3370618.uXC7DQAANu@vbart-workstation>
 <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1581444.yDtYsXo9Kz@vbart-workstation>

On Wednesday 22 June 2016 11:31:27 martinproinity wrote:
> Here more of the debug log. I had to shorten it as I did get this message
> "Please shorten your messages, the body is too large". 
[..]

Partial log doesn't help because I need to follow up all the events in the
connection till it has lost.

You can upload your log to any file sharing service like Google Drive and
post a link here.

  wbr, Valentin V. Bartenev


From jlorgal at gmail.com  Wed Jun 22 18:35:34 2016
From: jlorgal at gmail.com (Jorge L.)
Date: Wed, 22 Jun 2016 20:35:34 +0200
Subject: nginScript (njs) feedback
Message-ID: <CAJ0Nof5RiyxSiDsn-7ZDTgQe_a0rS0UDib6QZK9MR3eHbC=6HA@mail.gmail.com>

I'm trying to implement a routing logic with nginScript. I haven't been
successful because I miss important javascript feature.

I would like to give you my feedback just in case it may help to improve
njs (from more important/blocking to less important):


   - There is no way to iterate through the keys of an object. It is not
   supported none of the following methods:
      - Object.keys
      - Object.getOwnPropertyNames()
      - for ... in
   - I would like to use/import nginx variables. Something like
   http://mailman.nginx.org/pipermail/nginx-devel/2016-May/008207.html would
   be great.
   - I miss string.split function. Probably map, reduce, and many other
   methods as well.
   - It would be nice to have some "singleton" support where I could set a
   variable that is evaluated only once (first time is required or when nginx
   is started/reloaded). It's clear that it should not be related to
   request/response but this approach would improve performance by avoiding
   executing same thing for each request. It would be similar to importing a
   javascript module (it's only imported once and global vars and requirements
   are satisfied only once).
   - I would like to include javascript modules. I'm using a directive:
   "include /etc/nginx/js/*.js;" but this .js files need to include the js_set
   $xxx "..." which makes the file to be invalid javascript (and you may miss
   some features from your javascript IDE).
   - It would be nice to access a cookie by name (it wouldn't be necessary
   if I could access to a nginx var like $v.cookie_XXX).
   - Logging function would be nice to help debugging.

Hope it can be helpful
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160622/56fabf9a/attachment.html>

From nginx-forum at forum.nginx.org  Wed Jun 22 18:50:27 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Wed, 22 Jun 2016 14:50:27 -0400
Subject: nginx core dump explodes
In-Reply-To: <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>
References: <3370618.uXC7DQAANu@vbart-workstation>
 <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <4e81b8184ccd00565ab21027df8c1164.NginxMailingListEnglish@forum.nginx.org>

Here you go: https://tempfile.me/dl/ES9tWLqjnFozdx/

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267783#msg-267783


From r1ch+nginx at teamliquid.net  Wed Jun 22 18:59:25 2016
From: r1ch+nginx at teamliquid.net (Richard Stanway)
Date: Wed, 22 Jun 2016 20:59:25 +0200
Subject: HTTP2 site does not loads on firefox
In-Reply-To: <CACTshoTm_5iRRf-KfHK1S4mu+7a1-j+5KFNBO3kBBSWwPCPkQg@mail.gmail.com>
References: <CACTshoTm_5iRRf-KfHK1S4mu+7a1-j+5KFNBO3kBBSWwPCPkQg@mail.gmail.com>
Message-ID: <CAKWQeygZrNpBvBBTGE7N=r6qQ_i8JybpF2Z08cStzKMn3wUbJQ@mail.gmail.com>

You need to provide more information such as Firefox error messages, nginx
config, server hostname, etc. You may find
https://developer.mozilla.org/en-US/docs/Tools/Network_Monitor useful.

I did notice your cipher suites include blacklisted ciphers, but this
shouldn't be an issue for outright failure.
https://http2.github.io/http2-spec/#BadCipherSuites

On Wed, Jun 22, 2016 at 7:50 AM, Rajnesh Kumar Siwal <
rajnesh.siwal at gmail.com> wrote:

> Hi,
> We have recently deployed a site on http2 (with ALPN support) using nginx.
> The site does not open in Firefox 47.
> The site supports following ciphers :
>
> *Protocols* TLS 1.2 Yes TLS 1.1 Yes TLS 1.0 Yes SSL 3 No SSL 2 No
>
>
> *Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and
> SSL 2 suites at the end)* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
>   ECDH secp256r1 (eq. 3072 bits RSA)   FS 256
> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072
> bits RSA)   FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH
> secp256r1 (eq. 3072 bits RSA)   FS 256 TLS_RSA_WITH_AES_256_GCM_SHA384 (
> 0x9d) 256 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256
> TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
> (0x84) 256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH
> secp256r1 (eq. 3072 bits RSA)   FS 128
> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH secp256r1 (eq. 3072
> bits RSA)   FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH
> secp256r1 (eq. 3072 bits RSA)   FS 128 TLS_RSA_WITH_AES_128_GCM_SHA256 (
> 0x9c) 128 TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128
> TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
> (0x41) 128 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)   ECDH secp256r1
> (eq. 3072 bits RSA)   FS 112 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112
>
> --
> Regards,
> Rajnesh Kumar Siwal
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160622/709b7ab7/attachment.html>

From envek at envek.name  Wed Jun 22 19:30:49 2016
From: envek at envek.name (Andrey Novikov)
Date: Wed, 22 Jun 2016 22:30:49 +0300
Subject: SSL handshake failed with mutual TLS
In-Reply-To: <5769CC6F.6030003@greengecko.co.nz>
References: <CAD7KOZKwhtW4ONhJR_1=xCfk97iph4hLRQWparypSXDbCU7zVA@mail.gmail.com>
 <20160619090939.GJ2852@daoine.org>
 <CA+p3EyzHa87DUpLYJWKz0pgcAjjVCUUYHSOa9A6QWruf=Qfiag@mail.gmail.com>
 <5769CC6F.6030003@greengecko.co.nz>
Message-ID: <CAD7KOZL8ErfupJruLehdjFvt40j9kS5iBV0G_T8iWzqMqd+95w@mail.gmail.com>

Thank everyone for advices.

I have server certificate (first) and Intermediate CA certificate
(second) in bundle file specified in `ssl_certificate` directive.
I have Intermediate CA certificate (first) and Root CA certificate
(second) in bundle file specified in `ssl_client_certificate`.

Both server and client certificate are issued by this intermediate CA
certificate, command

    openssl verify -verbose -CAfile ca.bundle.crt client.crt

returns

    client.crt: OK

I can successfully connect to my server with curl (using server's
certificate itself as client cert) and browser. One system can access
it with own client certificate (issued by the same intermediate), and
problematic one can't.

I will ask for problematic client's logs, not sure that it can help.

Unfortunately my Nginx is located in private network and neither
accessible from Internet nor have access to Internet. So I can't use
Qualys SSL Test. Any tests I can do with preinstalled in RHEL 7 curl
and openssl?


From vbart at nginx.com  Wed Jun 22 19:46:44 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Wed, 22 Jun 2016 22:46:44 +0300
Subject: nginx core dump explodes
In-Reply-To: <4e81b8184ccd00565ab21027df8c1164.NginxMailingListEnglish@forum.nginx.org>
References: <3370618.uXC7DQAANu@vbart-workstation>
 <9c7ae2483360cdc78a793b88c5e2aa96.NginxMailingListEnglish@forum.nginx.org>
 <4e81b8184ccd00565ab21027df8c1164.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1959667.cdTZgnWc5o@vbart-workstation>

On Wednesday 22 June 2016 14:50:27 martinproinity wrote:
> Here you go: https://tempfile.me/dl/ES9tWLqjnFozdx/
> 
> Thanks!
> 

Please try the patch:
http://pp.nginx.com/vbart/patches/http2_fix.txt

  wbr, Valentin V. Bartenev


From lists.md at gmail.com  Wed Jun 22 21:32:47 2016
From: lists.md at gmail.com (Marcelo MD)
Date: Wed, 22 Jun 2016 18:32:47 -0300
Subject: Enable HTTP2 in one of several name-based servers
Message-ID: <CAJzGbDdLpjLQ0DR0yq37f=70Jad3Ln=mtJfFuUYDK8rTOp5L-A@mail.gmail.com>

Hi,

Is it possible to enable http2 in only one of several name-based servers?

I have the following scenario:

server {
    listen          443 ssl;
    server_name     www.example.com;
    ssl_certificate www.example.com.crt;
    ...
}

server {
    listen          443 ssl http2;
    server_name     www.example.org;
    ssl_certificate www.example.org.crt;
    ...
}

Enabling http2 in the second server makes the first respond http2 as well.

In my use case I have a few servers using modules that are not
http2-compatible yet.

Is there anything I'm missing?

Thanks!


-- 
Marcelo Mallmann Dias
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160622/002e1b18/attachment.html>

From vbart at nginx.com  Wed Jun 22 21:36:27 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Thu, 23 Jun 2016 00:36:27 +0300
Subject: Enable HTTP2 in one of several name-based servers
In-Reply-To: <CAJzGbDdLpjLQ0DR0yq37f=70Jad3Ln=mtJfFuUYDK8rTOp5L-A@mail.gmail.com>
References: <CAJzGbDdLpjLQ0DR0yq37f=70Jad3Ln=mtJfFuUYDK8rTOp5L-A@mail.gmail.com>
Message-ID: <3535522.UbbDQvD4IY@vbart-laptop>

On Wednesday 22 June 2016 18:32:47 Marcelo MD wrote:
> Hi,
> 
> Is it possible to enable http2 in only one of several name-based servers?
> 
[..]

No, it's not possible.

  wbr, Valentin V. Bartenev


From chencw1982 at gmail.com  Thu Jun 23 07:33:30 2016
From: chencw1982 at gmail.com (Chuanwen Chen)
Date: Thu, 23 Jun 2016 15:33:30 +0800
Subject: limit_conn is not limiting the number of connections in my use
 case
In-Reply-To: <1681118.fU8EJV4dmk@vbart-laptop>
References: <06a0d7628a55f19b70979bb04dceafd2.NginxMailingListEnglish@forum.nginx.org>
 <1681118.fU8EJV4dmk@vbart-laptop>
Message-ID: <CAKPCrs3g8K9S-3dTFUAVS6DkHFbf=+Syt+fT5Jz7rikBXBFBAQ@mail.gmail.com>

try this one plz

https://github.com/cfsego/nginx-limit-upstream

On Sun, Jun 19, 2016 at 6:41 AM, Valentin V. Bartenev <vbart at nginx.com>
wrote:

> On Saturday 18 June 2016 11:49:16 matt_l wrote:
> > Hello,
> >
> > I have a hard time understanding limit_conn
> >
> > My NGINX has the configuration below. I would expect to see 16
> connections
> > on the backend server 192.168.10.131 defined in the "dynamic" directive.
> >
> > Yet I see ~50-60 connections.
> >
> > QPS:                    3056
> > Active connections:     58
> > QPS:                    3064
> > Active connections:     54
> > QPS:                    3063
> > Active connections:     59
> >
> > Please note the QPS (Query Per Second) limiting works well.
> >
> > I would greatly appreciate any tip as to what is going on with my use of
> the
> > limit_conn.
> [..]
>
> The limit_conn module doesn't limit number of connections to upstream.
> It's all about client connections.
>
> Since you have configured "keepalive 32" each worker process can keep open
> up to 32 connections to your backend even without client requests.
>
>   wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/c34c1554/attachment.html>

From moritz.machner at 42he.com  Thu Jun 23 07:39:35 2016
From: moritz.machner at 42he.com (Moritz Machner)
Date: Thu, 23 Jun 2016 09:39:35 +0200
Subject: Dynamic Cert/Key Lookup
Message-ID: <2B5C8D4D-C4F4-48CA-86E4-61E96F89FB3F@42he.com>

Hello, 

is it possible to dynamical get an cert/key from an database or an script for SNI? 

I want to dynamical add new domains with certs for an web app without changing the config oder restarting nginx:

1. get SNI request for domain example342343.com <http://example342343.com/> 
2. ask mysql for the cert and key for example342343.com <http://example342343.com/> 
3. start encryption 

Is that possible? 

Greets 

Mo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/eb146783/attachment.html>

From nginx-forum at forum.nginx.org  Thu Jun 23 08:35:45 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Thu, 23 Jun 2016 04:35:45 -0400
Subject: Enable HTTP2 in one of several name-based servers
In-Reply-To: <3535522.UbbDQvD4IY@vbart-laptop>
References: <3535522.UbbDQvD4IY@vbart-laptop>
Message-ID: <5a55583b73afa8f28ec7a4aaed6bd7ae.NginxMailingListEnglish@forum.nginx.org>

Valentin V. Bartenev Wrote:
-------------------------------------------------------
> > Is it possible to enable http2 in only one of several name-based
> servers?
> > 
> [..]
> 
> No, it's not possible.

Would it be a big (api) change to add a server block session flag?

ngx_http_v2_init(ngx_event_t *rev)
...
if ( h2scf.no_http2 ) { /* example server block flag */
    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 disabled in server
context");
            ngx_http_close_connection(c);
            return;
        }
...
    c->log->action = "processing HTTP/2 connection";

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267795,267801#msg-267801


From nginx-forum at forum.nginx.org  Thu Jun 23 08:58:23 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Thu, 23 Jun 2016 04:58:23 -0400
Subject: nginx core dump explodes
In-Reply-To: <1959667.cdTZgnWc5o@vbart-workstation>
References: <1959667.cdTZgnWc5o@vbart-workstation>
Message-ID: <905f30f3c622bc656ee9f20267f47fa9.NginxMailingListEnglish@forum.nginx.org>

Wow, that was fast, thanks :) I'm doing tests now with the h2 fix. It looks
promising so far. I will continue to run various test to see if there are
scenarios that trigger an open socket leak.

- At which point in the debug log did you know there is something going
wrong?

- Is there an explanation what went wrong and what the patch is fixing?

- Are there other known cases that can cause open socket leaks?

Thanks Valentin!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267802#msg-267802


From nginx-forum at forum.nginx.org  Thu Jun 23 09:26:21 2016
From: nginx-forum at forum.nginx.org (romkaltu)
Date: Thu, 23 Jun 2016 05:26:21 -0400
Subject: Nginx upstream https not proxing other pages(?)
Message-ID: <a4d2d80ed6656b54b39abd0c80adf57a.NginxMailingListEnglish@forum.nginx.org>

Having odd situation, even don't know how to search in google, how to
describe it...Anyway I'm using Nginx and proxy'ing https traffic to upstream
server. Everything is fine with http (with others domains) but can't get it
to work with https...

Here is my nginx config

upstream umarket { server 192.168.2.11:443; }

# Upstream
server {
    listen 80;
    listen 443 ssl http2;
    server_name  umarket.lt;

    error_log  /var/log/nginx/umarket.lt_error.log;

    add_header Strict-Transport-Security "max-age=31536000";

    ssl on;
    ssl_certificate            
/etc/nginx/ssl/umarket.lt/umarket_lt_chained.crt;
    ssl_certificate_key         /etc/nginx/ssl/umarket.lt/server.key;
    ssl_session_cache           builtin:1000 shared:SSL:10m;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers   on;

    proxy_redirect              off;
    proxy_buffering             off;
    proxy_set_header            Host $host;
    proxy_set_header            X-Real-IP $remote_addr;
    proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header            X-Forwarded-Proto https;
    proxy_next_upstream         error timeout invalid_header http_500
http_502 http_503 http_504;
    proxy_ssl_session_reuse     off;
    proxy_cache_bypass          $http_secret_header;
    proxy_ignore_headers        Set-Cookie;
    proxy_ignore_headers        Cache-Control;

    location = / {

        proxy_pass  $scheme://umarket;

    }

}

Here screenshot whats happening...http://i.stack.imgur.com/3CQc0.png

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267806,267806#msg-267806


From vbart at nginx.com  Thu Jun 23 09:29:19 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Thu, 23 Jun 2016 12:29:19 +0300
Subject: Enable HTTP2 in one of several name-based servers
In-Reply-To: <5a55583b73afa8f28ec7a4aaed6bd7ae.NginxMailingListEnglish@forum.nginx.org>
References: <3535522.UbbDQvD4IY@vbart-laptop>
 <5a55583b73afa8f28ec7a4aaed6bd7ae.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <3501886.qrrSK1J6fN@vbart-laptop>

On Thursday 23 June 2016 04:35:45 itpp2012 wrote:
> Valentin V. Bartenev Wrote:
> -------------------------------------------------------
> > > Is it possible to enable http2 in only one of several name-based
> > servers?
> > > 
> > [..]
> > 
> > No, it's not possible.
> 
> Would it be a big (api) change to add a server block session flag?
> 
> ngx_http_v2_init(ngx_event_t *rev)
> ...
> if ( h2scf.no_http2 ) { /* example server block flag */
>     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 disabled in server
> context");
>             ngx_http_close_connection(c);
>             return;
>         }
> ...
>     c->log->action = "processing HTTP/2 connection";
> 

What effect do you expect?  Since clients are able to request different hosts 
using single HTTP/2 connection, closing the connection in one server block 
will break everything.

  wbr, Valentin V. Bartenev


From nginx-forum at forum.nginx.org  Thu Jun 23 10:06:23 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Thu, 23 Jun 2016 06:06:23 -0400
Subject: Enable HTTP2 in one of several name-based servers
In-Reply-To: <3501886.qrrSK1J6fN@vbart-laptop>
References: <3501886.qrrSK1J6fN@vbart-laptop>
Message-ID: <5aa2c8d7a38f6c6e71198b87e4c00683.NginxMailingListEnglish@forum.nginx.org>

Valentin V. Bartenev Wrote:
> What effect do you expect?  Since clients are able to request
> different hosts 
> using single HTTP/2 connection, closing the connection in one server
> block 
> will break everything.

I'm just venting an (untested) idea, some other way to tell the client to
revert back to pre-http2 connections when hitting a server block, maybe a
simple return would be enough.

connect site.ru (h2)
connect.h2 site2.ru (deny h2, client should revert to http(s))

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267795,267808#msg-267808


From medvedev.yp at gmail.com  Thu Jun 23 10:19:05 2016
From: medvedev.yp at gmail.com (Yuriy Medvedev)
Date: Thu, 23 Jun 2016 13:19:05 +0300
Subject: Nginx upstream https not proxing other pages(?)
In-Reply-To: <a4d2d80ed6656b54b39abd0c80adf57a.NginxMailingListEnglish@forum.nginx.org>
References: <a4d2d80ed6656b54b39abd0c80adf57a.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CABDaVUNF-FhaLA3DjZJAGsFWOK5t-L+gTSSyMe3AcdOdLca1FQ@mail.gmail.com>

My config wotk fine with ssl proxy pass

location / {

      proxy_pass https://backend;

      proxy_redirect          off;

      proxy_next_upstream error timeout invalid_header http_502 http_503
http_504;

      proxy_connect_timeout   120s;

      proxy_set_header Host $host;

      proxy_set_header X-Real-IP $remote_addr;

      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

      proxy_set_header X-Forwarded-Proto $scheme;

    }

2016-06-23 12:26 GMT+03:00 romkaltu <nginx-forum at forum.nginx.org>:

> Having odd situation, even don't know how to search in google, how to
> describe it...Anyway I'm using Nginx and proxy'ing https traffic to
> upstream
> server. Everything is fine with http (with others domains) but can't get it
> to work with https...
>
> Here is my nginx config
>
> upstream umarket { server 192.168.2.11:443; }
>
> # Upstream
> server {
>     listen 80;
>     listen 443 ssl http2;
>     server_name  umarket.lt;
>
>     error_log  /var/log/nginx/umarket.lt_error.log;
>
>     add_header Strict-Transport-Security "max-age=31536000";
>
>     ssl on;
>     ssl_certificate
> /etc/nginx/ssl/umarket.lt/umarket_lt_chained.crt;
>     ssl_certificate_key         /etc/nginx/ssl/umarket.lt/server.key;
>     ssl_session_cache           builtin:1000 shared:SSL:10m;
>     ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
>     ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
>     ssl_prefer_server_ciphers   on;
>
>     proxy_redirect              off;
>     proxy_buffering             off;
>     proxy_set_header            Host $host;
>     proxy_set_header            X-Real-IP $remote_addr;
>     proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
>     proxy_set_header            X-Forwarded-Proto https;
>     proxy_next_upstream         error timeout invalid_header http_500
> http_502 http_503 http_504;
>     proxy_ssl_session_reuse     off;
>     proxy_cache_bypass          $http_secret_header;
>     proxy_ignore_headers        Set-Cookie;
>     proxy_ignore_headers        Cache-Control;
>
>     location = / {
>
>         proxy_pass  $scheme://umarket;
>
>     }
>
> }
>
> Here screenshot whats happening...http://i.stack.imgur.com/3CQc0.png
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,267806,267806#msg-267806
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/f711c347/attachment.html>

From jlorgal at gmail.com  Thu Jun 23 10:58:39 2016
From: jlorgal at gmail.com (Jorge L.)
Date: Thu, 23 Jun 2016 12:58:39 +0200
Subject: nginScript (njs) feedback
In-Reply-To: <CAJ0Nof5RiyxSiDsn-7ZDTgQe_a0rS0UDib6QZK9MR3eHbC=6HA@mail.gmail.com>
References: <CAJ0Nof5RiyxSiDsn-7ZDTgQe_a0rS0UDib6QZK9MR3eHbC=6HA@mail.gmail.com>
Message-ID: <CAJ0Nof7ZXBX=JQWJiyaA4o0O+mPbvHfxOUduHxHMJ=vRY1Lu2w@mail.gmail.com>

I've continued with my attempt to integrate my routing logic as javascript
code.

Regarding my previous feedback, it is possible to iterate the keys of an
object with "for ... in". However, you cannot use "var" keyword to assign
the result of the loop. For example, the following code fails:
  for (var i = 0; i < elements.length; i++) {...}
but the following one works:
  for (i = 0; i < elements.length; i++) {...}

I've found a blocking point. There is a limitation of the size of the
script. It could be solved easily if I could import other nginx vars. My
module currently has 4202 chars (or 123 lines). This is really strange
because I don't consider it to be too big. The error raised is:

2016/06/23 11:48:42 [emerg] 5390#5390: too long parameter, probably missing
terminating """ character in /etc/nginx/js/routing.js:1

Is there any solution for this problem?

On Wed, Jun 22, 2016 at 8:35 PM, Jorge L. <jlorgal at gmail.com> wrote:

> I'm trying to implement a routing logic with nginScript. I haven't been
> successful because I miss important javascript feature.
>
> I would like to give you my feedback just in case it may help to improve
> njs (from more important/blocking to less important):
>
>
>    - There is no way to iterate through the keys of an object. It is not
>    supported none of the following methods:
>       - Object.keys
>       - Object.getOwnPropertyNames()
>       - for ... in
>    - I would like to use/import nginx variables. Something like
>    http://mailman.nginx.org/pipermail/nginx-devel/2016-May/008207.html would
>    be great.
>    - I miss string.split function. Probably map, reduce, and many other
>    methods as well.
>    - It would be nice to have some "singleton" support where I could set
>    a variable that is evaluated only once (first time is required or when
>    nginx is started/reloaded). It's clear that it should not be related to
>    request/response but this approach would improve performance by avoiding
>    executing same thing for each request. It would be similar to importing a
>    javascript module (it's only imported once and global vars and requirements
>    are satisfied only once).
>    - I would like to include javascript modules. I'm using a directive:
>    "include /etc/nginx/js/*.js;" but this .js files need to include the js_set
>    $xxx "..." which makes the file to be invalid javascript (and you may miss
>    some features from your javascript IDE).
>    - It would be nice to access a cookie by name (it wouldn't be
>    necessary if I could access to a nginx var like $v.cookie_XXX).
>    - Logging function would be nice to help debugging.
>
> Hope it can be helpful
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/52e071e1/attachment.html>

From nginx-forum at forum.nginx.org  Thu Jun 23 11:10:19 2016
From: nginx-forum at forum.nginx.org (iivan)
Date: Thu, 23 Jun 2016 07:10:19 -0400
Subject: Full URL parameter in nginx
Message-ID: <5df555e57f7c3a90870f79fd8dbb54f2.NginxMailingListEnglish@forum.nginx.org>

Hi,
I have this nginx rule:

rewrite ^/(.*)?$ /index.cfm?event=saveURL=$1 last;

- Which makes this work:
http://mywebsite.com/http://notherwebsite.com/page.html

- But if I pass a parameter like this:
http://mywebsite.com/http://notherwebsite.com/page.html?id=1 

cuts off ?id=1

How can I fix this? Thank you!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267813,267813#msg-267813


From me at myconan.net  Thu Jun 23 11:21:56 2016
From: me at myconan.net (nanaya)
Date: Thu, 23 Jun 2016 20:21:56 +0900
Subject: Full URL parameter in nginx
In-Reply-To: <5df555e57f7c3a90870f79fd8dbb54f2.NginxMailingListEnglish@forum.nginx.org>
References: <5df555e57f7c3a90870f79fd8dbb54f2.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <a61d31a3-bbea-0ede-86f2-60cd709a818d@myconan.net>

Hi,

On 2016/06/23 20:10, iivan wrote:
> Hi,
> I have this nginx rule:
>
> rewrite ^/(.*)?$ /index.cfm?event=saveURL=$1 last;
>
> - Which makes this work:
> http://mywebsite.com/http://notherwebsite.com/page.html
>
> - But if I pass a parameter like this:
> http://mywebsite.com/http://notherwebsite.com/page.html?id=1
>
> cuts off ?id=1
>
> How can I fix this? Thank you!
>

rewrite doesn't match query string due to its non-positional value (is 
it the correct term? Also it's just my guess).

this should work:

rewrite ^/(.*)?$ /index.cfm?event=saveURL=$1$is_args$args last;

or just:

rewrite ^ /index.cfm?event=saveURL=$uri$is_args$args last;

Or might even be:

location / {
   proxy_pass http://myproxy:port/index.cfm?event=saveURL=$uri$is_args$args;
   proxy_set_header ...;
   ...;
}


* no idea about encoding/escaping.


From nginx-forum at forum.nginx.org  Thu Jun 23 11:29:01 2016
From: nginx-forum at forum.nginx.org (romkaltu)
Date: Thu, 23 Jun 2016 07:29:01 -0400
Subject: Nginx upstream https not proxing other pages(?)
In-Reply-To: <CABDaVUNF-FhaLA3DjZJAGsFWOK5t-L+gTSSyMe3AcdOdLca1FQ@mail.gmail.com>
References: <CABDaVUNF-FhaLA3DjZJAGsFWOK5t-L+gTSSyMe3AcdOdLca1FQ@mail.gmail.com>
Message-ID: <19ad254b3a585493cb3548d36dcd1309.NginxMailingListEnglish@forum.nginx.org>

What is your backend server? Maybe problem can persist in backend? I'm using
Litespeed web server.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267806,267815#msg-267815


From r at roze.lv  Thu Jun 23 11:28:15 2016
From: r at roze.lv (Reinis Rozitis)
Date: Thu, 23 Jun 2016 14:28:15 +0300
Subject: Nginx upstream https not proxing other pages(?)
In-Reply-To: <a4d2d80ed6656b54b39abd0c80adf57a.NginxMailingListEnglish@forum.nginx.org>
References: <a4d2d80ed6656b54b39abd0c80adf57a.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <994AAB3992E9429BAFAB3F3A85412E55@MezhRoze>

> Having odd situation, even don't know how to search in google, how to
> describe it...
>
>   location = / {
>        proxy_pass  $scheme://umarket;
>    }


Change location = / {} to location / {} because the = / means only that 
particular request (just the index page) will be proxied

http://nginx.org/en/docs/http/ngx_http_core_module.html#location


rr 


From daniel at mostertman.org  Thu Jun 23 11:40:07 2016
From: daniel at mostertman.org (=?UTF-8?Q?Dani=c3=abl_Mostertman?=)
Date: Thu, 23 Jun 2016 13:40:07 +0200
Subject: Dynamic Cert/Key Lookup
In-Reply-To: <2B5C8D4D-C4F4-48CA-86E4-61E96F89FB3F@42he.com>
References: <2B5C8D4D-C4F4-48CA-86E4-61E96F89FB3F@42he.com>
Message-ID: <f8e75b8a-fd7f-9522-7803-8b0a5122e843@mostertman.org>

On 2016-06-23 09:39, Moritz Machner wrote:
> Hello,
>
> is it possible to dynamical get an cert/key from an database or an 
> script for SNI?
>
> I want to dynamical add new domains with certs for an web app without 
> changing the config oder restarting nginx:
>
> 1. get SNI request for domain example342343.com 
> <http://example342343.com>
> 2. ask mysql for the cert and key for example342343.com 
> <http://example342343.com>
> 3. start encryption
>
> Is that possible?

Yes, though you would need a bundle called OpenResty (openresty.org) 
that comes with nginx, LUA and some patches to make it all work smoother.
You will lose some features that standard nginx comes with, like http2.

I'm working on my own project with it. Though I would recommend against 
using MySQL, but consider either a file-based storage with a shared 
dictionary inside nginx as cache, and/or use redis as backend.
There's a few articles on it, I was working on one myself as I'm going, 
and it's in no way perfect (plus I made some changes already):

https://finalx.nl/display/NG/OpenResty

After which I stumbled upon https://github.com/GUI/lua-resty-auto-ssl 
which basically does everything I want, and you perhaps as well .. it 
even uses letsencrypt.sh to generate certificates and keys on-the-fly 
when a request comes in.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/60fbf874/attachment.html>

From nginx-forum at forum.nginx.org  Thu Jun 23 11:48:32 2016
From: nginx-forum at forum.nginx.org (romkaltu)
Date: Thu, 23 Jun 2016 07:48:32 -0400
Subject: Nginx upstream https not proxing other pages(?)
In-Reply-To: <994AAB3992E9429BAFAB3F3A85412E55@MezhRoze>
References: <994AAB3992E9429BAFAB3F3A85412E55@MezhRoze>
Message-ID: <bfa51d3f720cc90dcf15224e075f6e2c.NginxMailingListEnglish@forum.nginx.org>

Yep this is it, just wanted to update status as somebody from serverfault
already told me that :)

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267806,267818#msg-267818


From nginx-forum at forum.nginx.org  Thu Jun 23 12:02:11 2016
From: nginx-forum at forum.nginx.org (ktiniatros)
Date: Thu, 23 Jun 2016 08:02:11 -0400
Subject: (52) Empty reply from server on slow response
Message-ID: <cd0a6e18e0b16068f5aa89f187559060.NginxMailingListEnglish@forum.nginx.org>

Hi,

I have a node.js/express backend with nginx. Everything works fine except
one request which gives back (52) Empty reply from server on slow responses
ONLY (this request aggregates remote data, so in some very specific
scenarios it takes time to complete). By slow, I mean specifically when the
response takes more than 4 minutes (node.js still working since I see its
log but nginx is already closing the request with the above message). 

Anyone has an idea why this is happening ? And what's the proper way to
debug this kind of issues ?

Thank you in advance for your time.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267819,267819#msg-267819


From nginx-forum at forum.nginx.org  Thu Jun 23 12:03:58 2016
From: nginx-forum at forum.nginx.org (romkaltu)
Date: Thu, 23 Jun 2016 08:03:58 -0400
Subject: Nginx upstream https not proxing other pages(?)
In-Reply-To: <CABDaVUNF-FhaLA3DjZJAGsFWOK5t-L+gTSSyMe3AcdOdLca1FQ@mail.gmail.com>
References: <CABDaVUNF-FhaLA3DjZJAGsFWOK5t-L+gTSSyMe3AcdOdLca1FQ@mail.gmail.com>
Message-ID: <529054be6148a89ca046c363a41367dc.NginxMailingListEnglish@forum.nginx.org>

Also:  no need to secure front-end to back-end proxy_pass to backend with
port :80

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267806,267820#msg-267820


From mdounin at mdounin.ru  Thu Jun 23 12:24:43 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Thu, 23 Jun 2016 15:24:43 +0300
Subject: (52) Empty reply from server on slow response
In-Reply-To: <cd0a6e18e0b16068f5aa89f187559060.NginxMailingListEnglish@forum.nginx.org>
References: <cd0a6e18e0b16068f5aa89f187559060.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160623122443.GI30781@mdounin.ru>

Hello!

On Thu, Jun 23, 2016 at 08:02:11AM -0400, ktiniatros wrote:

> I have a node.js/express backend with nginx. Everything works fine except
> one request which gives back (52) Empty reply from server on slow responses
> ONLY (this request aggregates remote data, so in some very specific
> scenarios it takes time to complete). By slow, I mean specifically when the
> response takes more than 4 minutes (node.js still working since I see its
> log but nginx is already closing the request with the above message). 
> 
> Anyone has an idea why this is happening ? And what's the proper way to
> debug this kind of issues ?

First of all, try looking into nginx error log.

-- 
Maxim Dounin
http://nginx.org/


From lists.md at gmail.com  Thu Jun 23 13:35:52 2016
From: lists.md at gmail.com (Marcelo MD)
Date: Thu, 23 Jun 2016 10:35:52 -0300
Subject: Enable HTTP2 in one of several name-based servers
In-Reply-To: <5aa2c8d7a38f6c6e71198b87e4c00683.NginxMailingListEnglish@forum.nginx.org>
References: <3501886.qrrSK1J6fN@vbart-laptop>
 <5aa2c8d7a38f6c6e71198b87e4c00683.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CAJzGbDecoKidj+dw4+sX0je-78k1t2Gja0NzURKzTZ9yajjfWQ@mail.gmail.com>

Ok,

What about the other way around. Is it possible to disable http2 for one
server block, via config or via code?

Other than that, what are the alternatives? One listen on one IP for http2
and on another for http1?

Thanks!

On Thu, Jun 23, 2016 at 7:06 AM, itpp2012 <nginx-forum at forum.nginx.org>
wrote:

> Valentin V. Bartenev Wrote:
> > What effect do you expect?  Since clients are able to request
> > different hosts
> > using single HTTP/2 connection, closing the connection in one server
> > block
> > will break everything.
>
> I'm just venting an (untested) idea, some other way to tell the client to
> revert back to pre-http2 connections when hitting a server block, maybe a
> simple return would be enough.
>
> connect site.ru (h2)
> connect.h2 site2.ru (deny h2, client should revert to http(s))
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,267795,267808#msg-267808
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>



-- 
Marcelo Mallmann Dias
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/fca9627a/attachment.html>

From nginx-forum at forum.nginx.org  Thu Jun 23 13:55:26 2016
From: nginx-forum at forum.nginx.org (clubi64)
Date: Thu, 23 Jun 2016 09:55:26 -0400
Subject: Open () failed (24 too many open files
Message-ID: <08579cb6f94e41d1cfbbaa0e5a3e4106.NginxMailingListEnglish@forum.nginx.org>

I have a lot of below error in error.log.
Open /home/user/... failed (24 too many open files.
So i search in google and config below files.
Limits.conf , sysctl.conf nginx.conf for adjust rlimit nofile.
I set open file limit to 999999 and fs.max to 2000000.

When i am geting error i used command ( lsof | wc -l )  for see total open
file that it show 16000.
 I use command ( cd /proc/nginx pid/limits ) it show max open file 999999.
 Now i am geting above error yet.
So what is problem?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267827,267827#msg-267827


From nginx-forum at forum.nginx.org  Thu Jun 23 14:37:59 2016
From: nginx-forum at forum.nginx.org (iivan)
Date: Thu, 23 Jun 2016 10:37:59 -0400
Subject: Full URL parameter in nginx
In-Reply-To: <a61d31a3-bbea-0ede-86f2-60cd709a818d@myconan.net>
References: <a61d31a3-bbea-0ede-86f2-60cd709a818d@myconan.net>
Message-ID: <d68e717829b96a9e7d04f464bb07737a.NginxMailingListEnglish@forum.nginx.org>

Thanks nanaya,
It is the solution I was looking for!

rewrite ^/(.*)?$ /index.cfm?event=saveURL=$1$is_args$args last;

You are the best :)

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267813,267830#msg-267830


From gfrankliu at gmail.com  Thu Jun 23 15:44:51 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Thu, 23 Jun 2016 08:44:51 -0700
Subject: udp balancing
Message-ID: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>

Hi,

In the default stream/udp/proxy setup, will nginx round robin every packet
or will it remembers client and send all packets from same client to same
upstream?

Thanks
Frank
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/1e404321/attachment.html>

From maxim at nginx.com  Thu Jun 23 15:48:59 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Thu, 23 Jun 2016 18:48:59 +0300
Subject: udp balancing
In-Reply-To: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
References: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
Message-ID: <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>

On 6/23/16 6:44 PM, Frank Liu wrote:
> Hi,
> 
> In the default stream/udp/proxy setup, will nginx round robin every
> packet or will it remembers client and send all packets from same
> client to same upstream?
> 
The default is round-robin, yes.

You can enable persistent-like behaviour though:

https://www.nginx.com/resources/admin-guide/tcp-load-balancing/#hash

-- 
Maxim Konovalov


From gfrankliu at gmail.com  Thu Jun 23 15:57:22 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Thu, 23 Jun 2016 08:57:22 -0700
Subject: udp balancing
In-Reply-To: <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>
References: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
 <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>
Message-ID: <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>

That makes sense for udp (connection less).
What about tcp? I assume when client initiate the connection , nginx will
pick one upstream (rr) to make a connection and send all subsequent packets
to the same upstream using the same connection.

Frank

On Thursday, June 23, 2016, Maxim Konovalov <maxim at nginx.com> wrote:

> On 6/23/16 6:44 PM, Frank Liu wrote:
> > Hi,
> >
> > In the default stream/udp/proxy setup, will nginx round robin every
> > packet or will it remembers client and send all packets from same
> > client to same upstream?
> >
> The default is round-robin, yes.
>
> You can enable persistent-like behaviour though:
>
> https://www.nginx.com/resources/admin-guide/tcp-load-balancing/#hash
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org <javascript:;>
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/899abef2/attachment.html>

From maxim at nginx.com  Thu Jun 23 16:08:43 2016
From: maxim at nginx.com (Maxim Konovalov)
Date: Thu, 23 Jun 2016 19:08:43 +0300
Subject: udp balancing
In-Reply-To: <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>
References: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
 <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>
 <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>
Message-ID: <a2547ac3-de3c-3f22-589b-942905e7c08f@nginx.com>

On 6/23/16 6:57 PM, Frank Liu wrote:
> That makes sense for udp (connection less). 
> What about tcp? I assume when client initiate the connection , nginx
> will pick one upstream (rr) to make a connection and send all
> subsequent packets to the same upstream using the same connection.
> 
Not sure I understand your request.

For tcp nginx balances new connections based on the configured load
balancing discipline (rr by default).

> Frank
> 
> On Thursday, June 23, 2016, Maxim Konovalov <maxim at nginx.com
> <mailto:maxim at nginx.com>> wrote:
> 
>     On 6/23/16 6:44 PM, Frank Liu wrote:
>     > Hi,
>     >
>     > In the default stream/udp/proxy setup, will nginx round robin
>     every
>     > packet or will it remembers client and send all packets from same
>     > client to same upstream?
>     >
>     The default is round-robin, yes.
> 
>     You can enable persistent-like behaviour though:
> 
>     https://www.nginx.com/resources/admin-guide/tcp-load-balancing/#hash
> 
>     --
>     Maxim Konovalov
> 
>     _______________________________________________
>     nginx mailing list
>     nginx at nginx.org <javascript:;>
>     http://mailman.nginx.org/mailman/listinfo/nginx
> 
> 
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
> 


-- 
Maxim Konovalov


From vbart at nginx.com  Thu Jun 23 16:19:53 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Thu, 23 Jun 2016 19:19:53 +0300
Subject: udp balancing
In-Reply-To: <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>
References: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
 <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>
 <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>
Message-ID: <2026435.p1XXEHWnn5@vbart-workstation>

On Thursday 23 June 2016 08:57:22 Frank Liu wrote:
> That makes sense for udp (connection less).
> What about tcp? I assume when client initiate the connection , nginx will
> pick one upstream (rr) to make a connection and send all subsequent packets
> to the same upstream using the same connection.
> 

Right.

  wbr, Valentin V. Bartenev


From zeal at freecharge.com  Thu Jun 23 16:47:43 2016
From: zeal at freecharge.com (Zeal Vora)
Date: Thu, 23 Jun 2016 22:17:43 +0530
Subject: Blocking all the URL except 1
Message-ID: <CANNgueyNJE2_K4difFr-h-y72sQ0gcTAY0Q=KSr9arQ4f47+_A@mail.gmail.com>

Hi

We have a Nginx Box which acts as a reverse proxy to backend applications.

We only want to allow traffic on http://example.com which internally
redirects to specific application. Other then that, every other URI should
be blocked.

For example :-

example.com            Allowed
example.com/test     Blocked
example.com/login    Blocked

How can I achieve this ?

Any help will be appreciated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/702bdf20/attachment.html>

From me at myconan.net  Thu Jun 23 16:49:32 2016
From: me at myconan.net (Edho Arief)
Date: Fri, 24 Jun 2016 01:49:32 +0900
Subject: Blocking all the URL except 1
In-Reply-To: <CANNgueyNJE2_K4difFr-h-y72sQ0gcTAY0Q=KSr9arQ4f47+_A@mail.gmail.com>
References: <CANNgueyNJE2_K4difFr-h-y72sQ0gcTAY0Q=KSr9arQ4f47+_A@mail.gmail.com>
Message-ID: <1466700572.2853460.646559489.785A36A2@webmail.messagingengine.com>

Hi,

On Fri, Jun 24, 2016, at 01:47, Zeal Vora wrote:
> Hi
> 
> We have a Nginx Box which acts as a reverse proxy to backend
> applications.
> 
> We only want to allow traffic on http://example.com which internally
> redirects to specific application. Other then that, every other URI
> should
> be blocked.
> 
> For example :-
> 
> example.com            Allowed
> example.com/test     Blocked
> example.com/login    Blocked
> 
> How can I achieve this ?
> 


does this work?

location = / {
  return 302 https://...
}

location / {
  return 404;
}


From gfrankliu at gmail.com  Thu Jun 23 17:08:17 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Thu, 23 Jun 2016 10:08:17 -0700
Subject: udp balancing
In-Reply-To: <a2547ac3-de3c-3f22-589b-942905e7c08f@nginx.com>
References: <CAOXPdC_w5t=hESMVqGd9Ztv_2UFVmEsNyhR0pG_J0M_TQc1YPg@mail.gmail.com>
 <384964e1-bebb-481b-d3d4-660aa5e7f1c7@nginx.com>
 <CAOXPdC998By8N8TzGtTf9r=tXcyJ3-xtUp3LU8AAdm-5Y33ZOg@mail.gmail.com>
 <a2547ac3-de3c-3f22-589b-942905e7c08f@nginx.com>
Message-ID: <CAOXPdC-Q13bMuMHM6XvG38dJ_1YfmnBX5uGAMAqnbp=uF_CEoA@mail.gmail.com>

To summarize:
TCP balancing decision is on every new connection.
TCP balancing decision is on every packet since it is connectionless.

On Thu, Jun 23, 2016 at 9:08 AM, Maxim Konovalov <maxim at nginx.com> wrote:

> On 6/23/16 6:57 PM, Frank Liu wrote:
> > That makes sense for udp (connection less).
> > What about tcp? I assume when client initiate the connection , nginx
> > will pick one upstream (rr) to make a connection and send all
> > subsequent packets to the same upstream using the same connection.
> >
> Not sure I understand your request.
>
> For tcp nginx balances new connections based on the configured load
> balancing discipline (rr by default).
>
> > Frank
> >
> > On Thursday, June 23, 2016, Maxim Konovalov <maxim at nginx.com
> > <mailto:maxim at nginx.com>> wrote:
> >
> >     On 6/23/16 6:44 PM, Frank Liu wrote:
> >     > Hi,
> >     >
> >     > In the default stream/udp/proxy setup, will nginx round robin
> >     every
> >     > packet or will it remembers client and send all packets from same
> >     > client to same upstream?
> >     >
> >     The default is round-robin, yes.
> >
> >     You can enable persistent-like behaviour though:
> >
> >     https://www.nginx.com/resources/admin-guide/tcp-load-balancing/#hash
> >
> >     --
> >     Maxim Konovalov
> >
> >     _______________________________________________
> >     nginx mailing list
> >     nginx at nginx.org <javascript:;>
> >     http://mailman.nginx.org/mailman/listinfo/nginx
> >
> >
> >
> > _______________________________________________
> > nginx mailing list
> > nginx at nginx.org
> > http://mailman.nginx.org/mailman/listinfo/nginx
> >
>
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/e1ab0321/attachment.html>

From vbart at nginx.com  Thu Jun 23 17:40:46 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Thu, 23 Jun 2016 20:40:46 +0300
Subject: nginx core dump explodes
In-Reply-To: <905f30f3c622bc656ee9f20267f47fa9.NginxMailingListEnglish@forum.nginx.org>
References: <1959667.cdTZgnWc5o@vbart-workstation>
 <905f30f3c622bc656ee9f20267f47fa9.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <8062214.5YOs4xqbZH@vbart-workstation>

On Thursday 23 June 2016 04:58:23 martinproinity wrote:
> Wow, that was fast, thanks :) I'm doing tests now with the h2 fix. It looks
> promising so far. I will continue to run various test to see if there are
> scenarios that trigger an open socket leak.
> 
> - At which point in the debug log did you know there is something going
> wrong?
> 

There was nothing interesting till these lines in the log:

2016/06/19 19:53:11 [debug] 8724#0: *19047 process http2 frame type:3 f:0 l:4 sid:3
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 RST_STREAM frame, sid:3 status:8
2016/06/19 19:53:11 [info] 8724#0: *19047 client canceled stream 3 while connecting to upstream, client: <removed>, server: <removed>, request: "GET <removed> HTTP/2.0", upstream: "http://<removed>:80<removed>", host: "<removed>", referrer: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http run request: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream check client, write event:0, "<removed>"

Here the client had canceled the request that was already sent to usptream.

But because the request was potentially cacheable, nginx in order to cache the
response continued processing it.

[..]
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream request: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http upstream process header
2016/06/19 19:53:11 [debug] 8724#0: *19047 malloc: 00000000355360C0:16384
2016/06/19 19:53:11 [debug] 8724#0: *19047 recv: eof:0, avail:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 recv: fd:63 1443 of 15427
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy status 200 "200 OK"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Server: Apache/2.2.22 (Debian)"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "X-Powered-By: PHP/5.4.45-1~dotdeb+7.1"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "P3P: CP="<removed>""
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Set-Cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Set-Cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Set-Cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Set-Cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Set-Cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Cache-Control: no-cache"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Vary: Accept-Encoding"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Content-Encoding: gzip"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Content-Type: text/html"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Content-Length: 3582"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Accept-Ranges: bytes"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Date: Sun, 19 Jun 2016 17:53:11 GMT"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "X-Varnish: 1052777260"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Age: 0"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Via: 1.1 varnish"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header: "Connection: close"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http proxy header done

Here the response was returned by upstream.

2016/06/19 19:53:11 [debug] 8724#0: *19047 http script var: "MISS"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 header filter
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: ":status: 200"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "server: nginx"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "date: Sun, 19 Jun 2016 17:53:11 GMT"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "content-type: text/html"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "content-length: 3582"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "vary: Accept-Encoding"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "x-powered-by: PHP/5.4.45-1~dotdeb+7.1"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "p3p: CP="<removed>""
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "set-cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "set-cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "set-cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "set-cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "set-cookie: <removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "cache-control: no-cache"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "content-encoding: gzip"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "x-varnish: 1052777260"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "age: 0"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "via: 1.1 varnish"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 output header: "accept-ranges: bytes"
2016/06/19 19:53:11 [debug] 8724#0: *19047 posix_memalign: 000000002FCE5840:4096 @16
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2:3 create HEADERS frame 000000002027CD90: len:641
2016/06/19 19:53:11 [debug] 8724#0: *19047 http cleanup add: 000000002027CE28
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 frame out: 000000002027CD90 sid:3 bl:1 len:641

The first problem was here: nginx created the HEADERS frame with the response
for already canceled stream and passed it to the output queue.

2016/06/19 19:53:11 [debug] 8724#0: *19047 SSL buf copy: 9
2016/06/19 19:53:11 [debug] 8724#0: *19047 SSL buf copy: 641
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2:3 HEADERS frame 000000002027CD90 was sent
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 frame sent: 000000002027CD90 sid:3 bl:1 len:641

And the HEADERS frame was written to SSL buffer.

[..]
2016/06/19 19:53:11 [debug] 8724#0: *19047 http finalize request: 0, "<removed>" a:1, c:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate request count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate cleanup count:1 blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http posted request: "<removed>"
2016/06/19 19:53:11 [debug] 8724#0: *19047 http terminate handler count:1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http request count:1 blk:0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 close stream 3, queued 0, processing 1
2016/06/19 19:53:11 [debug] 8724#0: *19047 http close request
2016/06/19 19:53:11 [debug] 8724#0: *19047 http log handler
2016/06/19 19:53:11 [debug] 8724#0: *19047 run cleanup: 000000002DDEE350
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000355360C0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000202F2600, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001E88A800, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002DDED500, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 00000000207AF4B0, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002027BE40, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000002FCE5840, unused: 1348
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000003DABCC40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D295C40
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 0000000024A93CD0, unused: 0
2016/06/19 19:53:11 [debug] 8724#0: *19047 free: 000000001D2E8D10, unused: 828

Eventually the request was finalized and the stream was closed.

2016/06/19 19:53:11 [debug] 8724#0: *19047 post event 000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 delete posted event 000000000582ABD0
2016/06/19 19:53:11 [debug] 8724#0: *19047 http2 handle connection handler

But the connection was neither closed nor switched to idle state.  That was due
to data left in SSL buffer (there were no SSL_write() calls since the HEADERS
frame was buffered).

2016/06/19 19:54:12 [alert] 8724#0: *19047 open socket #236 left in connection 181

As a result there's a connection left without any timeouts.


> - Is there an explanation what went wrong and what the patch is fixing?
> 
> - Are there other known cases that can cause open socket leaks?

I've seen in the log at least two problems:

 1. The HEADERS frame was produced for already canceled stream (and the
    patch in the previous message fixes this particular problem by adding
    a corresponding check into the relevant place).

 2. A connection can be left without any timeouts set if there's data buffered
    in the SSL buffer.  Since there can be other cases that will lead to such
    situation, it should be fixed by another patch:

    http://pp.nginx.com/vbart/patches/http2_fix2.txt

  wbr, Valentin V. Bartenev


From pratyush at hostindya.com  Thu Jun 23 17:42:34 2016
From: pratyush at hostindya.com (Pratyush Kumar)
Date: Thu, 23 Jun 2016 23:12:34 +0530
Subject: udp balancing
In-Reply-To: <CAOXPdC-Q13bMuMHM6XvG38dJ_1YfmnBX5uGAMAqnbp=uF_CEoA@mail.gmail.com>
Message-ID: <442d06c0-ec8a-4629-8bf2-b9d0e44a9924@email.android.com>

An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/55ef858a/attachment.html>

From nginx-forum at forum.nginx.org  Thu Jun 23 17:58:08 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Thu, 23 Jun 2016 13:58:08 -0400
Subject: nginx core dump explodes
In-Reply-To: <8062214.5YOs4xqbZH@vbart-workstation>
References: <8062214.5YOs4xqbZH@vbart-workstation>
Message-ID: <7840c24e7255c88dd5febbc32d032625.NginxMailingListEnglish@forum.nginx.org>

Thanks a lot for the detailed explanation. The first patch reduced the
socket leaks by >99%. I will run tests with second patch beginning next week
and check if it goes down to 0 leaks.

Are does 2 fixes integrated in the next release 1.11.2?

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267843#msg-267843


From vbart at nginx.com  Thu Jun 23 18:23:49 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Thu, 23 Jun 2016 21:23:49 +0300
Subject: nginx core dump explodes
In-Reply-To: <7840c24e7255c88dd5febbc32d032625.NginxMailingListEnglish@forum.nginx.org>
References: <8062214.5YOs4xqbZH@vbart-workstation>
 <7840c24e7255c88dd5febbc32d032625.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <6408233.bxcWmVSEB0@vbart-workstation>

On Thursday 23 June 2016 13:58:08 martinproinity wrote:
> Thanks a lot for the detailed explanation. The first patch reduced the
> socket leaks by >99%. I will run tests with second patch beginning next week
> and check if it goes down to 0 leaks.
> 
> Are does 2 fixes integrated in the next release 1.11.2?
> 
[..]

Not sure about 1.11.2, since the patches need to pass the review process
first, but I'll do my best to fix it soon.

  wbr, Valentin V. Bartenev


From gfrankliu at gmail.com  Thu Jun 23 18:58:25 2016
From: gfrankliu at gmail.com (Frank Liu)
Date: Thu, 23 Jun 2016 11:58:25 -0700
Subject: udp balancing
In-Reply-To: <442d06c0-ec8a-4629-8bf2-b9d0e44a9924@email.android.com>
References: <CAOXPdC-Q13bMuMHM6XvG38dJ_1YfmnBX5uGAMAqnbp=uF_CEoA@mail.gmail.com>
 <442d06c0-ec8a-4629-8bf2-b9d0e44a9924@email.android.com>
Message-ID: <CAOXPdC8a34oT3NCmhyD=xWoAEKKF2y5RzVPKPU+R+etJ+v1jNw@mail.gmail.com>

Yes, thanks :)


On Thu, Jun 23, 2016 at 10:42 AM, Pratyush Kumar <pratyush at hostindya.com>
wrote:

> "To summarize:
>
> TCP balancing decision is on every new connection.
>
> TCP balancing decision is on every packet since it is connectionless."
>
> I think there is a typo there
> Last line should be
>
> "*UDP* balancing decision is on every packet since it is connectionless"
> On 23-Jun-2016 22:38, Frank Liu <gfrankliu at gmail.com> wrote:
>
> To summarize:
> TCP balancing decision is on every new connection.
> TCP balancing decision is on every packet since it is connectionless.
>
> On Thu, Jun 23, 2016 at 9:08 AM, Maxim Konovalov <maxim at nginx.com> wrote:
>
> On 6/23/16 6:57 PM, Frank Liu wrote:
> > That makes sense for udp (connection less).
> > What about tcp? I assume when client initiate the connection , nginx
> > will pick one upstream (rr) to make a connection and send all
> > subsequent packets to the same upstream using the same connection.
> >
> Not sure I understand your request.
>
> For tcp nginx balances new connections based on the configured load
> balancing discipline (rr by default).
>
> > Frank
> >
> > On Thursday, June 23, 2016, Maxim Konovalov <maxim at nginx.com
> > <mailto:maxim at nginx.com>> wrote:
> >
> >     On 6/23/16 6:44 PM, Frank Liu wrote:
> >     > Hi,
> >     >
> >     > In the default stream/udp/proxy setup, will nginx round robin
> >     every
> >     > packet or will it remembers client and send all packets from same
> >     > client to same upstream?
> >     >
> >     The default is round-robin, yes.
> >
> >     You can enable persistent-like behaviour though:
> >
> >     https://www.nginx.com/resources/admin-guide/tcp-load-balancing/#hash
> >
> >     --
> >     Maxim Konovalov
> >
> >     _______________________________________________
> >     nginx mailing list
> >     nginx at nginx.org <javascript:;>
> >     http://mailman.nginx.org/mailman/listinfo/nginx
> >
> >
> >
> > _______________________________________________
> > nginx mailing list
> > nginx at nginx.org
> > http://mailman.nginx.org/mailman/listinfo/nginx
> >
>
>
> --
> Maxim Konovalov
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160623/b93f55ca/attachment.html>

From nginx-forum at forum.nginx.org  Fri Jun 24 04:45:00 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Fri, 24 Jun 2016 00:45:00 -0400
Subject: Double Redirect
In-Reply-To: <20160619231444.GL2852@daoine.org>
References: <20160619231444.GL2852@daoine.org>
Message-ID: <011e7307a2ff3e13eae5a68c78c884a3.NginxMailingListEnglish@forum.nginx.org>

Thanks for the tip Francis but Nginx -T doesn't give me a clue at all.
Would you know what specifically I can change to fix this?

Thank you so much

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267850#msg-267850


From nginx-forum at forum.nginx.org  Fri Jun 24 07:10:08 2016
From: nginx-forum at forum.nginx.org (charles13)
Date: Fri, 24 Jun 2016 03:10:08 -0400
Subject: Nginx limit_rate based on file extension
Message-ID: <2d0b971ce0a0f2ac18c77e375bb2fb69.NginxMailingListEnglish@forum.nginx.org>

Hello,

I wonder is there any way to limit_rate based on file extension in Nginx,
for example, putting different rate limit rules on flv and mp4?

I've tried this, but somehow returned file not found

location ~* \.(flv|f4v)$ {
limit_rate_after 1m;
limit_rate 80k;
}

location ~* \.(mp4|m4v)$ {
limit_rate_after 3m;
limit_rate 80k;
}

Your help is really appreciate!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267852,267852#msg-267852


From zeal at freecharge.com  Fri Jun 24 07:31:50 2016
From: zeal at freecharge.com (Zeal Vora)
Date: Fri, 24 Jun 2016 13:01:50 +0530
Subject: Blocking all the URL except 1
In-Reply-To: <1466700572.2853460.646559489.785A36A2@webmail.messagingengine.com>
References: <CANNgueyNJE2_K4difFr-h-y72sQ0gcTAY0Q=KSr9arQ4f47+_A@mail.gmail.com>
 <1466700572.2853460.646559489.785A36A2@webmail.messagingengine.com>
Message-ID: <CANNguezCTKVjKM0eK5+-kpO-T14OJU7f2uPARm4bbQjOpGw9OQ@mail.gmail.com>

Thanks. The above lined helped. However one more doubt. I want NGINX to
return 200 whenever some one goes to /nature , so I wrote above
configuration, however when some one goes to /nature , NGINX gives it 404
instead of 200. Here is my configuration :-

server {
  location = /nature {
  return 200;
  }
}

server {
    listen 80;
    server_name  example.com;

    location = / {
         proxy_pass http://app:server;
    }

    location / {
         return 404;
     }
}


On Thu, Jun 23, 2016 at 10:19 PM, Edho Arief <me at myconan.net> wrote:

> Hi,
>
> On Fri, Jun 24, 2016, at 01:47, Zeal Vora wrote:
> > Hi
> >
> > We have a Nginx Box which acts as a reverse proxy to backend
> > applications.
> >
> > We only want to allow traffic on http://example.com which internally
> > redirects to specific application. Other then that, every other URI
> > should
> > be blocked.
> >
> > For example :-
> >
> > example.com            Allowed
> > example.com/test     Blocked
> > example.com/login    Blocked
> >
> > How can I achieve this ?
> >
>
>
> does this work?
>
> location = / {
>   return 302 https://...
> }
>
> location / {
>   return 404;
> }
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160624/8e924197/attachment.html>

From igor at sysoev.ru  Fri Jun 24 08:29:01 2016
From: igor at sysoev.ru (Igor Sysoev)
Date: Fri, 24 Jun 2016 11:29:01 +0300
Subject: nginScript (njs) feedback
In-Reply-To: <CAJ0Nof7ZXBX=JQWJiyaA4o0O+mPbvHfxOUduHxHMJ=vRY1Lu2w@mail.gmail.com>
References: <CAJ0Nof5RiyxSiDsn-7ZDTgQe_a0rS0UDib6QZK9MR3eHbC=6HA@mail.gmail.com>
 <CAJ0Nof7ZXBX=JQWJiyaA4o0O+mPbvHfxOUduHxHMJ=vRY1Lu2w@mail.gmail.com>
Message-ID: <2627EA28-9997-496F-B40D-9C16784C3A36@sysoev.ru>

On 23 Jun 2016, at 13:58, Jorge L. <jlorgal at gmail.com> wrote:

> I've continued with my attempt to integrate my routing logic as javascript code.
> 
> Regarding my previous feedback, it is possible to iterate the keys of an object with "for ... in". However, you cannot use "var" keyword to assign the result of the loop. For example, the following code fails:
>   for (var i = 0; i < elements.length; i++) {...}
> but the following one works:
>   for (i = 0; i < elements.length; i++) {?}

Yes, var declaration inside for is not currently supported, it will be fixed soon.

> I've found a blocking point. There is a limitation of the size of the script. It could be solved easily if I could import other nginx vars. My module currently has 4202 chars (or 123 lines). This is really strange because I don't consider it to be too big. The error raised is:
> 
> 2016/06/23 11:48:42 [emerg] 5390#5390: too long parameter, probably missing terminating """ character in /etc/nginx/js/routing.js:1
> 
> Is there any solution for this problem?

Currently no. The string parameter length is limited by 4K. We are going to support js in files.

> On Wed, Jun 22, 2016 at 8:35 PM, Jorge L. <jlorgal at gmail.com> wrote:
> I'm trying to implement a routing logic with nginScript. I haven't been successful because I miss important javascript feature.
> 
> I would like to give you my feedback just in case it may help to improve njs (from more important/blocking to less important):
> 
> There is no way to iterate through the keys of an object. It is not supported none of the following methods:
> Object.keys
> Object.getOwnPropertyNames()
> for ... in
> I would like to use/import nginx variables. Something like http://mailman.nginx.org/pipermail/nginx-devel/2016-May/008207.html would be great.
We consider another interface: req.variables object.
> I miss string.split function. Probably map, reduce, and many other methods as well.
> It would be nice to have some "singleton" support where I could set a variable that is evaluated only once (first time is required or when nginx is started/reloaded). It's clear that it should not be related to request/response but this approach would improve performance by avoiding executing same thing for each request. It would be similar to importing a javascript module (it's only imported once and global vars and requirements are satisfied only once).
> I would like to include javascript modules. I'm using a directive: "include /etc/nginx/js/*.js;" but this .js files need to include the js_set $xxx "..." which makes the file to be invalid javascript (and you may miss some features from your javascript IDE).
> It would be nice to access a cookie by name (it wouldn't be necessary if I could access to a nginx var like $v.cookie_XXX).
We consider another interface: req.cookies object.
> Logging function would be nice to help debugging.
> Hope it can be helpful


Thank you for your feedback!
The full String object support, global objects, logging, and files are on the way.


-- 
Igor Sysoev
http://nginx.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160624/0e20113e/attachment.html>

From r1ch+nginx at teamliquid.net  Fri Jun 24 13:34:04 2016
From: r1ch+nginx at teamliquid.net (Richard Stanway)
Date: Fri, 24 Jun 2016 15:34:04 +0200
Subject: Blocking all the URL except 1
In-Reply-To: <CANNguezCTKVjKM0eK5+-kpO-T14OJU7f2uPARm4bbQjOpGw9OQ@mail.gmail.com>
References: <CANNgueyNJE2_K4difFr-h-y72sQ0gcTAY0Q=KSr9arQ4f47+_A@mail.gmail.com>
 <1466700572.2853460.646559489.785A36A2@webmail.messagingengine.com>
 <CANNguezCTKVjKM0eK5+-kpO-T14OJU7f2uPARm4bbQjOpGw9OQ@mail.gmail.com>
Message-ID: <CAKWQeygibOH1TFh5++3NYvkwHcdYQOn+Am=z6-ebM0Dto9GQWQ@mail.gmail.com>

Why do you have that in a separate server block?

On Fri, Jun 24, 2016 at 9:31 AM, Zeal Vora <zeal at freecharge.com> wrote:

> Thanks. The above lined helped. However one more doubt. I want NGINX to
> return 200 whenever some one goes to /nature , so I wrote above
> configuration, however when some one goes to /nature , NGINX gives it 404
> instead of 200. Here is my configuration :-
>
> server {
>   location = /nature {
>   return 200;
>   }
> }
>
> server {
>     listen 80;
>     server_name  example.com;
>
>     location = / {
>          proxy_pass http://app:server;
>     }
>
>     location / {
>          return 404;
>      }
> }
>
>
> On Thu, Jun 23, 2016 at 10:19 PM, Edho Arief <me at myconan.net> wrote:
>
>> Hi,
>>
>> On Fri, Jun 24, 2016, at 01:47, Zeal Vora wrote:
>> > Hi
>> >
>> > We have a Nginx Box which acts as a reverse proxy to backend
>> > applications.
>> >
>> > We only want to allow traffic on http://example.com which internally
>> > redirects to specific application. Other then that, every other URI
>> > should
>> > be blocked.
>> >
>> > For example :-
>> >
>> > example.com            Allowed
>> > example.com/test     Blocked
>> > example.com/login    Blocked
>> >
>> > How can I achieve this ?
>> >
>>
>>
>> does this work?
>>
>> location = / {
>>   return 302 https://...
>> }
>>
>> location / {
>>   return 404;
>> }
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160624/db7c289e/attachment.html>

From john at cibolo.com  Fri Jun 24 15:29:03 2016
From: john at cibolo.com (John Griessen)
Date: Fri, 24 Jun 2016 10:29:03 -0500
Subject: problem with mailman behind nginx with TLS certs
Message-ID: <4a0ac934-9db8-1fa3-cf99-427bae9ca3e0@cibolo.com>

mailman version 2.1.22 works fine for my webpages I set up such as
http://cibolo.us/mailman/listinfo/open_electroporator  that URl is rewritten and permenanently directed to below:
https://cibolo.us/mailman/listinfo/open_electroporator

The problem is with the moderation page.  When submitting a change,
a security warning pops up saying info will not be encrypted,
I click continue,

The radio button for discard goes back to Defer, the state it was in before.

All other functions of the admin pages work normally except for this.

Do you think some special rewrite is needed for
https://cibolo.us/mailman/admindb/sandbox
the URl that has this problem?  (All lists on this server have this problem).

Thanks,
John Griessen

=================================================================

I checked and my configuration had:
DEFAULT_URL_HOST   = 'cibolo.us'
DEFAULT_URL_PATTERN = 'http://%s/mailman/'
DEFAULT_EMAIL_HOST = 'cibolo.us'
MTA='Postfix'

nginx was set to serve www.cibolo.us and cibolo.us by redirecting to  https://cibolo.us

the subdirectories are set to be rewritten as in
https://www.nginx.com/resources/wiki/start/topics/recipes/mailman/


location /mailman
location /images/mailman
location /pipermail


After noting these settings, I reran

sudo /usr/sbin/withlist -l -r fix_url sandbox

then cleared the browser cache,
then browsed
https://cibolo.us/mailman/listinfo

where I see an overall lists list

I use those links to navigate to

https://cibolo.us/mailman/listinfo/sandbox
https://cibolo.us/mailman/admin/sandbox
https://cibolo.us/mailman/admindb/sandbox

and when I change action to take to discard
and click submit,

a security warning pops up saying info will not be encrypted,
I click continue,

The radio button for discard goes back to Defer, the state it was in before.

All other functions of the admin pages work normally except for this.

=======================================================
If I change nginx to not redirect, but serve http without TLS certs when asked,
the user interface for moderation works normally.
====================================================


From sca at andreasschulze.de  Fri Jun 24 15:34:37 2016
From: sca at andreasschulze.de (A. Schulze)
Date: Fri, 24 Jun 2016 17:34:37 +0200
Subject: problem with mailman behind nginx with TLS certs
In-Reply-To: <4a0ac934-9db8-1fa3-cf99-427bae9ca3e0@cibolo.com>
Message-ID: <20160624173437.Horde.vWLaR8EHuJHZRBdOgfpcMNX@andreasschulze.de>


John Griessen:

> I checked and my configuration had:
> DEFAULT_URL_PATTERN = 'http://%s/mailman/'

shouldn't that say "httpS:// ..." ?

Andreas


From john at cibolo.com  Fri Jun 24 15:35:30 2016
From: john at cibolo.com (John Griessen)
Date: Fri, 24 Jun 2016 10:35:30 -0500
Subject: problem with mailman behind nginx with TLS certs
In-Reply-To: <4a0ac934-9db8-1fa3-cf99-427bae9ca3e0@cibolo.com>
References: <4a0ac934-9db8-1fa3-cf99-427bae9ca3e0@cibolo.com>
Message-ID: <89fb5f2f-2004-68fc-d897-9e2cde47a1eb@cibolo.com>

On 06/24/2016 10:29 AM, John Griessen wrote:
> The problem is with the moderation page.  When submitting a change,
> a security warning pops up saying info will not be encrypted

I found what this needed from Mark Sapiro:

put

DEFAULT_URL_PATTERN = 'https://%s/mailman/'

in mm,_cfg.py ad then rerun

sudo /usr/sbin/withlist -l -r fix_url sandbox


From john at cibolo.com  Fri Jun 24 15:35:59 2016
From: john at cibolo.com (John Griessen)
Date: Fri, 24 Jun 2016 10:35:59 -0500
Subject: problem with mailman behind nginx with TLS certs
In-Reply-To: <20160624173437.Horde.vWLaR8EHuJHZRBdOgfpcMNX@andreasschulze.de>
References: <20160624173437.Horde.vWLaR8EHuJHZRBdOgfpcMNX@andreasschulze.de>
Message-ID: <c15495a1-f740-984f-0ad6-5da4c39b093a@cibolo.com>

On 06/24/2016 10:34 AM, A. Schulze wrote:
> shouldn't that say "httpS:// ..." ?


Yes,

thanks,


JG


From nginx-forum at forum.nginx.org  Fri Jun 24 16:18:15 2016
From: nginx-forum at forum.nginx.org (clubi64)
Date: Fri, 24 Jun 2016 12:18:15 -0400
Subject: Open () failed (24 too many open files
In-Reply-To: <08579cb6f94e41d1cfbbaa0e5a3e4106.NginxMailingListEnglish@forum.nginx.org>
References: <08579cb6f94e41d1cfbbaa0e5a3e4106.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <6c051a06724cd2f4f8c0c46188523683.NginxMailingListEnglish@forum.nginx.org>

anybody don't know about that ?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267827,267861#msg-267861


From jlorgal at gmail.com  Fri Jun 24 16:47:05 2016
From: jlorgal at gmail.com (Jorge L.)
Date: Fri, 24 Jun 2016 18:47:05 +0200
Subject: nginScript (njs) feedback
In-Reply-To: <2627EA28-9997-496F-B40D-9C16784C3A36@sysoev.ru>
References: <CAJ0Nof5RiyxSiDsn-7ZDTgQe_a0rS0UDib6QZK9MR3eHbC=6HA@mail.gmail.com>
 <CAJ0Nof7ZXBX=JQWJiyaA4o0O+mPbvHfxOUduHxHMJ=vRY1Lu2w@mail.gmail.com>
 <2627EA28-9997-496F-B40D-9C16784C3A36@sysoev.ru>
Message-ID: <CAJ0Nof60-CPsjUHPFi-wo7nVAU-05=fj_qpK8nyR6mtXFZPJKg@mail.gmail.com>

?Thanks for your reply. It sounds great!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160624/d9425574/attachment.html>

From rikske at deds.nl  Fri Jun 24 20:05:00 2016
From: rikske at deds.nl (rikske at deds.nl)
Date: Fri, 24 Jun 2016 22:05:00 +0200
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
Message-ID: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>

Hi,

Does someone have a OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*?

So that it is possible to compile Nginx 1.11.* with the latest OpenSSL
1.1.0 Pre 6 git clone (today).

Want to test some new OpenSSL 1.1.0 features, with the latest Git clone as
OpenSSL version 1.1 seems near final.

"src/event/ngx_event_openssl.c: In function 'ngx_ssl_connection_error':
src/event/ngx_event_openssl.c:2065:21: error: 'SSL_R_NO_CIPHERS_PASSED'
undeclared (first use in this function)
             || n == SSL_R_NO_CIPHERS_PASSED                          /*
182 */
                     ^
src/event/ngx_event_openssl.c:2065:21: note: each undeclared identifier is
reported only once for each function it appears in
make[1]: *** [objs/src/event/ngx_event_openssl.o] Error 1
"

Thanks,

Regards,

Rik Ske


From nginx-forum at forum.nginx.org  Fri Jun 24 20:26:11 2016
From: nginx-forum at forum.nginx.org (iivan)
Date: Fri, 24 Jun 2016 16:26:11 -0400
Subject: Full URL parameter in nginx
In-Reply-To: <5df555e57f7c3a90870f79fd8dbb54f2.NginxMailingListEnglish@forum.nginx.org>
References: <5df555e57f7c3a90870f79fd8dbb54f2.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <76d78875cb0a9ddd879952d0566bc524.NginxMailingListEnglish@forum.nginx.org>

Hi nanaya,
today I run a few tests.

this URL:
http://www.website.com/index.php?lvl=cmspage&pageid=14&id_article=52

Return only: http://www.website.com/index.php?lvl=cmspage

you would know how to fix?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267813,267866#msg-267866


From osa at FreeBSD.org.ru  Fri Jun 24 21:11:45 2016
From: osa at FreeBSD.org.ru (Sergey A. Osokin)
Date: Sat, 25 Jun 2016 00:11:45 +0300
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
In-Reply-To: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
References: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
Message-ID: <20160624211145.GA36699@FreeBSD.org.ru>

Hi,

it already has been discussed, https://trac.nginx.org/nginx/ticket/860#comment:10

On Fri, Jun 24, 2016 at 10:05:00PM +0200, rikske at deds.nl wrote:
> Hi,
> 
> Does someone have a OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*?
> 
> So that it is possible to compile Nginx 1.11.* with the latest OpenSSL
> 1.1.0 Pre 6 git clone (today).
> 
> Want to test some new OpenSSL 1.1.0 features, with the latest Git clone as
> OpenSSL version 1.1 seems near final.
> 
> "src/event/ngx_event_openssl.c: In function 'ngx_ssl_connection_error':
> src/event/ngx_event_openssl.c:2065:21: error: 'SSL_R_NO_CIPHERS_PASSED'
> undeclared (first use in this function)
>              || n == SSL_R_NO_CIPHERS_PASSED                          /*
> 182 */
>                      ^
> src/event/ngx_event_openssl.c:2065:21: note: each undeclared identifier is
> reported only once for each function it appears in
> make[1]: *** [objs/src/event/ngx_event_openssl.o] Error 1
> "

-- 
Sergey A. Osokin


From rikske at deds.nl  Fri Jun 24 23:58:27 2016
From: rikske at deds.nl (rikske at deds.nl)
Date: Sat, 25 Jun 2016 01:58:27 +0200
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
In-Reply-To: <20160624211145.GA36699@FreeBSD.org.ru>
References: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
 <20160624211145.GA36699@FreeBSD.org.ru>
Message-ID: <7794892a75657f47b568f1ba52c2f9db.squirrel@deds.nl>

Hi,

That was not the question.
There could be someone who has a pre-patch for version 6, who is also
testing OpenSSL, just like @Gobelet's patch did before with pre 5.

> Hi,
>
> it already has been discussed,
> https://trac.nginx.org/nginx/ticket/860#comment:10
>
> On Fri, Jun 24, 2016 at 10:05:00PM +0200, rikske at deds.nl wrote:
>> Hi,
>>
>> Does someone have a OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*?
>>
>> So that it is possible to compile Nginx 1.11.* with the latest OpenSSL
>> 1.1.0 Pre 6 git clone (today).
>>
>> Want to test some new OpenSSL 1.1.0 features, with the latest Git clone
>> as
>> OpenSSL version 1.1 seems near final.
>>
>> "src/event/ngx_event_openssl.c: In function 'ngx_ssl_connection_error':
>> src/event/ngx_event_openssl.c:2065:21: error: 'SSL_R_NO_CIPHERS_PASSED'
>> undeclared (first use in this function)
>>              || n == SSL_R_NO_CIPHERS_PASSED                          /*
>> 182 */
>>                      ^
>> src/event/ngx_event_openssl.c:2065:21: note: each undeclared identifier
>> is
>> reported only once for each function it appears in
>> make[1]: *** [objs/src/event/ngx_event_openssl.o] Error 1
>> "
>
> --
> Sergey A. Osokin
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>


From francis at daoine.org  Sat Jun 25 00:30:19 2016
From: francis at daoine.org (Francis Daly)
Date: Sat, 25 Jun 2016 01:30:19 +0100
Subject: Double Redirect
In-Reply-To: <011e7307a2ff3e13eae5a68c78c884a3.NginxMailingListEnglish@forum.nginx.org>
References: <20160619231444.GL2852@daoine.org>
 <011e7307a2ff3e13eae5a68c78c884a3.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160625003019.GA12280@daoine.org>

On Fri, Jun 24, 2016 at 12:45:00AM -0400, Lebod wrote:

Hi there,

> Thanks for the tip Francis but Nginx -T doesn't give me a clue at all.
> Would you know what specifically I can change to fix this?

You have two server{} blocks that have server_name example.com.

That is a problem.

Decide what config you want, and make that happen. Perhaps the fix is
to completely remove the first such block. Perhaps it is something else.

Cheers,

	f
-- 
Francis Daly        francis at daoine.org


From francis at daoine.org  Sat Jun 25 00:38:58 2016
From: francis at daoine.org (Francis Daly)
Date: Sat, 25 Jun 2016 01:38:58 +0100
Subject: Nginx limit_rate based on file extension
In-Reply-To: <2d0b971ce0a0f2ac18c77e375bb2fb69.NginxMailingListEnglish@forum.nginx.org>
References: <2d0b971ce0a0f2ac18c77e375bb2fb69.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160625003858.GB12280@daoine.org>

On Fri, Jun 24, 2016 at 03:10:08AM -0400, charles13 wrote:

Hi there,

> I wonder is there any way to limit_rate based on file extension in Nginx,
> for example, putting different rate limit rules on flv and mp4?

I've not tested it, but it should Just Work.

limit_rate can work in location{}, so put it in the location{} that
handles the urls that you care about.

> I've tried this, but somehow returned file not found
> 
> location ~* \.(flv|f4v)$ {
> limit_rate_after 1m;
> limit_rate 80k;
> }

One request is handled in one location. Only the config in, or inherited
into, that location counts.

What is "root" set to here? What file on your filesystem do you want
nginx to return?

	f
-- 
Francis Daly        francis at daoine.org


From osa at FreeBSD.org.ru  Sat Jun 25 02:53:58 2016
From: osa at FreeBSD.org.ru (Sergey A. Osokin)
Date: Sat, 25 Jun 2016 05:53:58 +0300
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
In-Reply-To: <7794892a75657f47b568f1ba52c2f9db.squirrel@deds.nl>
References: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
 <20160624211145.GA36699@FreeBSD.org.ru>
 <7794892a75657f47b568f1ba52c2f9db.squirrel@deds.nl>
Message-ID: <20160625025358.GB36699@FreeBSD.org.ru>

On Sat, Jun 25, 2016 at 01:58:27AM +0200, rikske at deds.nl wrote:
> 
> There could be someone who has a pre-patch for version 6, who is also
> testing OpenSSL, just like @Gobelet's patch did before with pre 5.

No reason for this until API/ABI will be stable.

--
Sergey A. Osokin


From rikske at deds.nl  Sat Jun 25 03:24:35 2016
From: rikske at deds.nl (rikske at deds.nl)
Date: Sat, 25 Jun 2016 05:24:35 +0200
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
In-Reply-To: <20160625025358.GB36699@FreeBSD.org.ru>
References: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
 <20160624211145.GA36699@FreeBSD.org.ru>
 <7794892a75657f47b568f1ba52c2f9db.squirrel@deds.nl>
 <20160625025358.GB36699@FreeBSD.org.ru>
Message-ID: <5670fcb0bf338630bdaa6a7d17d7ea56.squirrel@deds.nl>

No reason? The API/ABI wasn't stable either with the release of the
previous patches to made it compatible with OpenSSl's pre-release for
example @Gobelet's patch.

If someone made a patch, please let me know.


> On Sat, Jun 25, 2016 at 01:58:27AM +0200, rikske at deds.nl wrote:
>>
>> There could be someone who has a pre-patch for version 6, who is also
>> testing OpenSSL, just like @Gobelet's patch did before with pre 5.
>
> No reason for this until API/ABI will be stable.
>
> --
> Sergey A. Osokin
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>


From kurt at x64architecture.com  Sat Jun 25 04:26:10 2016
From: kurt at x64architecture.com (Kurt Cancemi)
Date: Sat, 25 Jun 2016 00:26:10 -0400
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*
In-Reply-To: <5670fcb0bf338630bdaa6a7d17d7ea56.squirrel@deds.nl>
References: <fce61ccf65fc19a0da0d92b78faddce1.squirrel@deds.nl>
 <20160624211145.GA36699@FreeBSD.org.ru>
 <7794892a75657f47b568f1ba52c2f9db.squirrel@deds.nl>
 <20160625025358.GB36699@FreeBSD.org.ru>
 <5670fcb0bf338630bdaa6a7d17d7ea56.squirrel@deds.nl>
Message-ID: <6279BC09-C804-415D-8B5E-14529FBCC9E3@x64architecture.com>

Hello,

I attached a trivial patch that fixes the build. OpenSSL removed unused error codes and SSL_R_NO_CIPHERS_PASSED was one of them.

Apply with:
 patch -p1 < 0001-Fix-nginx-build.patch

Kurt Cancemi
https://www.x64architecture.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-nginx-build.patch
Type: application/octet-stream
Size: 1198 bytes
Desc: not available
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160625/4cc7dc04/attachment.obj>
-------------- next part --------------


> On Jun 24, 2016, at 23:24, rikske at deds.nl wrote:
> 
> No reason? The API/ABI wasn't stable either with the release of the
> previous patches to made it compatible with OpenSSl's pre-release for
> example @Gobelet's patch.
> 
> If someone made a patch, please let me know.
> 
> 
>> On Sat, Jun 25, 2016 at 01:58:27AM +0200, rikske at deds.nl wrote:
>>> 
>>> There could be someone who has a pre-patch for version 6, who is also
>>> testing OpenSSL, just like @Gobelet's patch did before with pre 5.
>> 
>> No reason for this until API/ABI will be stable.
>> 
>> --
>> Sergey A. Osokin
>> 
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>> 
> 
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx


From nginx-forum at forum.nginx.org  Sat Jun 25 05:42:51 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Sat, 25 Jun 2016 01:42:51 -0400
Subject: Double Redirect
In-Reply-To: <20160625003019.GA12280@daoine.org>
References: <20160625003019.GA12280@daoine.org>
Message-ID: <859a5ad7386e8728d593dcf2d50a1d7c.NginxMailingListEnglish@forum.nginx.org>

Thank you for the reply Francis,

I have only 1 server {} with "example.com".

I have one server block that listens on ports 80 and 443 to example.com and
redirects to https://www.example.com like this: 

server { 
listen 80; 
listen 443 ssl; 
server_name example.com ***IP Address***; 
return 301 https://www.example.com$request_uri; 
} 

Is that not correct?

Thank you v much

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267874#msg-267874


From me at myconan.net  Sat Jun 25 05:50:06 2016
From: me at myconan.net (Edho Arief)
Date: Sat, 25 Jun 2016 14:50:06 +0900
Subject: Double Redirect
In-Reply-To: <859a5ad7386e8728d593dcf2d50a1d7c.NginxMailingListEnglish@forum.nginx.org>
References: <20160625003019.GA12280@daoine.org>
 <859a5ad7386e8728d593dcf2d50a1d7c.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1466833806.1448842.648028561.3E2DD47A@webmail.messagingengine.com>

Hi,

On Sat, Jun 25, 2016, at 14:42, Lebod wrote:
> Thank you for the reply Francis,
> 
> I have only 1 server {} with "example.com".
> 
> I have one server block that listens on ports 80 and 443 to example.com
> and
> redirects to https://www.example.com like this: 
> 
> server { 
> listen 80; 
> listen 443 ssl; 
> server_name example.com ***IP Address***; 
> return 301 https://www.example.com$request_uri; 
> } 
> 
> Is that not correct?
> 


Looking at your previous posts indicated there are more server blocks
than the ones you posted. Posting output of nginx -T may help.


From rikske at deds.nl  Sat Jun 25 14:07:24 2016
From: rikske at deds.nl (rikske at deds.nl)
Date: Sat, 25 Jun 2016 16:07:24 +0200
Subject: OpenSSL 1.1.0 Pre 6 patch for Nginx 1.11.*]
Message-ID: <a813612af1da16bb0c7c3263067d099b.squirrel@deds.nl>

Hi,

Fixed.
Consider it done.
Thanks Sergey A. Osokin for the info and Kurt Cancemi for the patch.

Regards,


Rik Ske

> Hello,
>
> I attached a trivial patch that fixes the build. OpenSSL removed unused
> error codes and SSL_R_NO_CIPHERS_PASSED was one of them.
>
> Apply with:
>  patch -p1 < 0001-Fix-nginx-build.patch
>
> Kurt Cancemi
> https://www.x64architecture.com
>
>
>> On Jun 24, 2016, at 23:24, rikske at deds.nl wrote:
>>
>> No reason? The API/ABI wasn't stable either with the release of the
>> previous patches to made it compatible with OpenSSl's pre-release for
>> example @Gobelet's patch.
>>
>> If someone made a patch, please let me know.
>>
>>
>>> On Sat, Jun 25, 2016 at 01:58:27AM +0200, rikske at deds.nl wrote:
>>>>
>>>> There could be someone who has a pre-patch for version 6, who is also
>>>> testing OpenSSL, just like @Gobelet's patch did before with pre 5.
>>>
>>> No reason for this until API/ABI will be stable.
>>>
>>> --
>>> Sergey A. Osokin
>>>
>>> _______________________________________________
>>> nginx mailing list
>>> nginx at nginx.org
>>> http://mailman.nginx.org/mailman/listinfo/nginx
>>>
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>
>



From nginx-forum at forum.nginx.org  Sat Jun 25 21:09:03 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Sat, 25 Jun 2016 17:09:03 -0400
Subject: Double Redirect
In-Reply-To: <1466833806.1448842.648028561.3E2DD47A@webmail.messagingengine.com>
References: <1466833806.1448842.648028561.3E2DD47A@webmail.messagingengine.com>
Message-ID: <f68a2a0b452089389d9edc97c8ce9ff7.NginxMailingListEnglish@forum.nginx.org>

Echo Arief,

Thanks for the reply.
My complete set up is below. The only difference is the use of "example.com"
instead of the domain for privacy reasons.I was really hoping that a
gracious person would just point out the mistake in the set up if there is
one...

server { 
listen 80; 
listen 443 ssl; 
server_name example.com ***IP Address***; 
return 301 https://www.example.com$request_uri; 
} 

server { 
listen 80; 
server_name www.example.com; 
return 301 https://www.example.com$request_uri; 
} 

server { 
listen 443 ssl http2; 
server_name www.example.com; 
root /home/forge/example.com/public; 

index index.html index.htm index.php; 

charset utf-8; 

# FORGE CONFIG (DOT NOT REMOVE!) 
include forge-conf/example.com/server/*; 

location / { 
try_files $uri $uri/ /index.php?$query_string; 
} 

location = /favicon.ico { access_log off; log_not_found off; } 
location = /robots.txt { access_log off; log_not_found off; } 

access_log off; 
error_log /var/log/nginx/example.com-error.log error; 

error_page 404 /index.php; 

location ~* ^/***A CERTAIN BLOCKED DIRECTORY**** { 
auth_basic "closed website"; 
auth_basic_user_file /etc/nginx/htpasswd; 
allow IP1; 
allow IP2; 
allow IP3; 
allow IP4; 
deny all; 

location ~* .(php) { 
fastcgi_split_path_info ^(.+\.php)(/.+)$; 
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; 
fastcgi_index index.php; 
include fastcgi_params; 
} 
try_files $uri $uri/ /index.php?$query_string; 
} 

location ~ \.php$ { 
fastcgi_split_path_info ^(.+\.php)(/.+)$; 
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; 
fastcgi_index index.php; 
include fastcgi_params; 
} 

# Media: images, icons, video, audio, HTC 
location ~* \.(?:jpg|jpeg|png|gif|ico|css|js|svg|woff)$ { 
expires 1M; 
add_header Cache-Control "public"; 
} 

# CSS and Javascript 
location ~* \.(?:css|js)$ { 
expires 1M; 
access_log off; 
add_header Cache-Control "public"; 
} 

# cache.appcache, your document html and data 
location ~* \.(?:manifest|appcache|html?|xml|json)$ { 
expires -1; 
# access_log logs/static.log; # I don't usually include a static log 
} 

location ~ /\.ht { 
deny all; 
} 

if ($allowed_country = no) { 
return 444; 
} 
}

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267877#msg-267877


From zxcvbn4038 at gmail.com  Sun Jun 26 01:00:37 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Sat, 25 Jun 2016 21:00:37 -0400
Subject: nginx and http/2
Message-ID: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>

I could use some help with this one - I took a big leap with enabling
http/2 support and I got knocked back really quick. There seems to be an
issue with POSTs and it seems to be more pronounced with ios devices (as
much as you can trust user agents) but there were some non-ios devices that
seemed to be having issues also. Unfortunately I had to pull the changes
quickly so I didn't get to capture too much debugging information (plus all
the connections were via tls 1.2 w/ diffie-hellman so even if I had quickly
taken a packet dump I wouldn't have been able to decrypt it).

So I built a version of curl with http/2 support to try and reproduce:

curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1 OpenSSL/1.0.2h
nghttp2/1.11.1
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp
smb smbs smtp smtps telnet tftp
Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets

I did a test POST request with http/1 and I got a 200 response.

I did the same POST request via http/2 and the tls handshake completed but
the connection was closed shortly thereafter. The error I see in the log
file is "client sent stream with data before settings were acknowledged
while processing HTTP/2 connection" I see other references to this error on
POST requests when I googled for it, but I didn't see a solution. This
sounds like an interoperability issue but I'd be shocked if I'm the first
one to find something like that.

This is also different then the errors I was seeing earlier in the week -
in those cases it looked like nginx as receiving the POST requests via
http/2, and forwarding to an HAProxy upstream via http/1.1. From there the
requests were dispatched to servers, also via http/1.1. One set of backend
servers seemed to be getting duplicate requests (but only of requests that
originated as HTTP/2 POSTs) and the other set running a java service seemed
to dislike the content received and they were closing the connections. I'm
still trying to reproduce those transactions in a dev environment w/
diffie-hellman disabled so I can get a packet capture and get a better idea
of what is happening.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160625/e64a4101/attachment.html>

From me at myconan.net  Sun Jun 26 02:48:10 2016
From: me at myconan.net (Edho Arief)
Date: Sun, 26 Jun 2016 11:48:10 +0900
Subject: Double Redirect
In-Reply-To: <f68a2a0b452089389d9edc97c8ce9ff7.NginxMailingListEnglish@forum.nginx.org>
References: <1466833806.1448842.648028561.3E2DD47A@webmail.messagingengine.com>
 <f68a2a0b452089389d9edc97c8ce9ff7.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <1466909290.2459939.648551241.6747E26C@webmail.messagingengine.com>

Hi,

On Sun, Jun 26, 2016, at 06:09, Lebod wrote:
> My complete set up is below. The only difference is the use of
> "example.com"
> instead of the domain for privacy reasons.I was really hoping that a
> gracious person would just point out the mistake in the set up if there
> is
> one...
> 
> server { 
> listen 80; 
> listen 443 ssl; 
> server_name example.com ***IP Address***; 
> return 301 https://www.example.com$request_uri; 
> } 
> 
> server { 
> listen 80; 
> server_name www.example.com; 
> return 301 https://www.example.com$request_uri; 
> } 
> 
> server { 
> listen 443 ssl http2; 
> server_name www.example.com; 
> root /home/forge/example.com/public; 
> 
> index index.html index.htm index.php; 
> 
> charset utf-8; 
> 
> # FORGE CONFIG (DOT NOT REMOVE!) 
> include forge-conf/example.com/server/*; 
> 
> location / { 
> try_files $uri $uri/ /index.php?$query_string; 
> } 
> 
> location = /favicon.ico { access_log off; log_not_found off; } 
> location = /robots.txt { access_log off; log_not_found off; } 
> 
> access_log off; 
> error_log /var/log/nginx/example.com-error.log error; 
> 
> error_page 404 /index.php; 
> 
> location ~* ^/***A CERTAIN BLOCKED DIRECTORY**** { 
> auth_basic "closed website"; 
> auth_basic_user_file /etc/nginx/htpasswd; 
> allow IP1; 
> allow IP2; 
> allow IP3; 
> allow IP4; 
> deny all; 
> 
> location ~* .(php) { 
> fastcgi_split_path_info ^(.+\.php)(/.+)$; 
> fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; 
> fastcgi_index index.php; 
> include fastcgi_params; 
> } 
> try_files $uri $uri/ /index.php?$query_string; 
> } 
> 
> location ~ \.php$ { 
> fastcgi_split_path_info ^(.+\.php)(/.+)$; 
> fastcgi_pass unix:/var/run/php/php7.0-fpm.sock; 
> fastcgi_index index.php; 
> include fastcgi_params; 
> } 
> 
> # Media: images, icons, video, audio, HTC 
> location ~* \.(?:jpg|jpeg|png|gif|ico|css|js|svg|woff)$ { 
> expires 1M; 
> add_header Cache-Control "public"; 
> } 
> 
> # CSS and Javascript 
> location ~* \.(?:css|js)$ { 
> expires 1M; 
> access_log off; 
> add_header Cache-Control "public"; 
> } 
> 
> # cache.appcache, your document html and data 
> location ~* \.(?:manifest|appcache|html?|xml|json)$ { 
> expires -1; 
> # access_log logs/static.log; # I don't usually include a static log 
> } 
> 
> location ~ /\.ht { 
> deny all; 
> } 
> 
> if ($allowed_country = no) { 
> return 444; 
> } 
> }
> 

That doesn't seem to be the output of `nginx -T`.


From vbart at nginx.com  Sun Jun 26 12:55:57 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Sun, 26 Jun 2016 15:55:57 +0300
Subject: nginx and http/2
In-Reply-To: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
Message-ID: <2027629.b02kqZmlSr@vbart-laptop>

On Saturday 25 June 2016 21:00:37 CJ Ess wrote:
> I could use some help with this one - I took a big leap with enabling
> http/2 support and I got knocked back really quick. There seems to be an
> issue with POSTs and it seems to be more pronounced with ios devices (as
> much as you can trust user agents) but there were some non-ios devices that
> seemed to be having issues also. Unfortunately I had to pull the changes
> quickly so I didn't get to capture too much debugging information (plus all
> the connections were via tls 1.2 w/ diffie-hellman so even if I had quickly
> taken a packet dump I wouldn't have been able to decrypt it).
> 
> So I built a version of curl with http/2 support to try and reproduce:
> 
> curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1 OpenSSL/1.0.2h
> nghttp2/1.11.1
> Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp
> smb smbs smtp smtps telnet tftp
> Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets
> 
> I did a test POST request with http/1 and I got a 200 response.
> 
> I did the same POST request via http/2 and the tls handshake completed but
> the connection was closed shortly thereafter. The error I see in the log
> file is "client sent stream with data before settings were acknowledged
> while processing HTTP/2 connection" I see other references to this error on
> POST requests when I googled for it, but I didn't see a solution. This
> sounds like an interoperability issue but I'd be shocked if I'm the first
> one to find something like that.
> 
[..]

You're not the first one, so the problem was resolved by this change:
http://hg.nginx.org/nginx/rev/ce94f07d5082 (nginx 1.11.0)

  wbr, Valentin V. Bartenev


From nginx-forum at forum.nginx.org  Sun Jun 26 16:48:03 2016
From: nginx-forum at forum.nginx.org (Lebod)
Date: Sun, 26 Jun 2016 12:48:03 -0400
Subject: Double Redirect
In-Reply-To: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
References: <8a81027744e570e6a5ce2ad8071859db.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <9ef54065b3a07fa05d7c36020f7a543e.NginxMailingListEnglish@forum.nginx.org>

I've found the problem. Thank you everybody for the tip about nginx -T

The web app that I use "forge" to deploy servers seemed to add another
redirect hidden inside of /etc/nginx/forge-conf/before/ssl_redirect.conf
which was redirecting port 80 example.com to https://example.com

My server block was correct, it was just this file that was adding an
additional redirect.

Thanks again

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267700,267881#msg-267881


From zxcvbn4038 at gmail.com  Mon Jun 27 03:50:43 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Sun, 26 Jun 2016 23:50:43 -0400
Subject: nginx and http/2
In-Reply-To: <2027629.b02kqZmlSr@vbart-laptop>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
 <2027629.b02kqZmlSr@vbart-laptop>
Message-ID: <CA+p3EyycVyAXRgA6XxN5if-BwkNPxsi=cQr4T0_BLJTL1PJ1GQ@mail.gmail.com>

Thank you very much for the pointer to the change, I'm going give that a
shot ASAP.


On Sun, Jun 26, 2016 at 8:55 AM, Valentin V. Bartenev <vbart at nginx.com>
wrote:

> On Saturday 25 June 2016 21:00:37 CJ Ess wrote:
> > I could use some help with this one - I took a big leap with enabling
> > http/2 support and I got knocked back really quick. There seems to be an
> > issue with POSTs and it seems to be more pronounced with ios devices (as
> > much as you can trust user agents) but there were some non-ios devices
> that
> > seemed to be having issues also. Unfortunately I had to pull the changes
> > quickly so I didn't get to capture too much debugging information (plus
> all
> > the connections were via tls 1.2 w/ diffie-hellman so even if I had
> quickly
> > taken a packet dump I wouldn't have been able to decrypt it).
> >
> > So I built a version of curl with http/2 support to try and reproduce:
> >
> > curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1 OpenSSL/1.0.2h
> > nghttp2/1.11.1
> > Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s
> rtsp
> > smb smbs smtp smtps telnet tftp
> > Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets
> >
> > I did a test POST request with http/1 and I got a 200 response.
> >
> > I did the same POST request via http/2 and the tls handshake completed
> but
> > the connection was closed shortly thereafter. The error I see in the log
> > file is "client sent stream with data before settings were acknowledged
> > while processing HTTP/2 connection" I see other references to this error
> on
> > POST requests when I googled for it, but I didn't see a solution. This
> > sounds like an interoperability issue but I'd be shocked if I'm the first
> > one to find something like that.
> >
> [..]
>
> You're not the first one, so the problem was resolved by this change:
> http://hg.nginx.org/nginx/rev/ce94f07d5082 (nginx 1.11.0)
>
>   wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160626/658b8107/attachment.html>

From nginx-forum at forum.nginx.org  Mon Jun 27 05:36:50 2016
From: nginx-forum at forum.nginx.org (bhavik)
Date: Mon, 27 Jun 2016 01:36:50 -0400
Subject: Nginx Can't handeled More Perl CGI concurrent Request
Message-ID: <5f8a5439cb45fa7e1d968ab7713fb42d.NginxMailingListEnglish@forum.nginx.org>

Hello 

We are using Fastcgi module in nginx with perl.

We are trying to send 200 concurrent perl cgi request, but after increase
the 250 concurrent request to specific script, We are getting below error in
nginx log file.

[error] 23526#0: *3291 connect() to unix:/var/run/fcgiwrap.socket failed
(11: Resource temporarily unavailable) while connecting to upstream, client:
::1, server: _, request: "POST /cgi-bin/example/example-xml.cgi HTTP/1.1",
upstream: "fastcgi://unix:/var/run/fcgiwrap.socket:", host: "localhost"

In my nginx file content following configuration.

location /cgi-bin/ {

    gzip off;
    # Set the root to /usr/lib (inside this location this means that we are
    # giving access to the files under /usr/lib/cgi-bin)
    root /usr/lib/;
    # Fastcgi socket
    fastcgi_pass  unix:/var/run/fcgiwrap.socket;
    #       fastcgi_pass 127.0.0.1:8999;
    # Fastcgi parameters, include the standard ones
    include /etc/nginx/fastcgi_params;
    # Adjust non standard parameters (SCRIPT_FILENAME)
    fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
}

The Same things Apache can handle 500+ concurrent request without any extra
configuration.

Can any one suggest me how to achieve this OR Is there any mistake in my
configuration to make it working with more concurrent request ?

If you require more log feel free to ask.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267885,267885#msg-267885


From pankajitbhu at gmail.com  Mon Jun 27 11:37:51 2016
From: pankajitbhu at gmail.com (Pankaj Chaudhary)
Date: Mon, 27 Jun 2016 17:07:51 +0530
Subject: how can i get nginx lib
Message-ID: <CAAePTQr6uFv1OF_SnRiKN65wvQ+UXzrcxpAwuinkacEQ=09rOA@mail.gmail.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160627/cf2d77ed/attachment.html>

From mdounin at mdounin.ru  Mon Jun 27 12:45:22 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 27 Jun 2016 15:45:22 +0300
Subject: Nginx Can't handeled More Perl CGI concurrent Request
In-Reply-To: <5f8a5439cb45fa7e1d968ab7713fb42d.NginxMailingListEnglish@forum.nginx.org>
References: <5f8a5439cb45fa7e1d968ab7713fb42d.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160627124522.GX30781@mdounin.ru>

Hello!

On Mon, Jun 27, 2016 at 01:36:50AM -0400, bhavik wrote:

> We are using Fastcgi module in nginx with perl.
> 
> We are trying to send 200 concurrent perl cgi request, but after increase
> the 250 concurrent request to specific script, We are getting below error in
> nginx log file.
> 
> [error] 23526#0: *3291 connect() to unix:/var/run/fcgiwrap.socket failed
> (11: Resource temporarily unavailable) while connecting to upstream, client:
> ::1, server: _, request: "POST /cgi-bin/example/example-xml.cgi HTTP/1.1",
> upstream: "fastcgi://unix:/var/run/fcgiwrap.socket:", host: "localhost"

The message indicate that listen queue of the backend socket is 
overflowed, your backend can't cope with load.  Make sure to tune 
your backend properly - number of processes and socket liste queue 
are most important things to consider.

Note well that if you are in fact using fcgiwrap as the socket 
name suggests, it's a wrong approach for a loaded server.  
Consider converting your scripts to use FastCGI directly instead.

[...]

-- 
Maxim Dounin
http://nginx.org/


From charles.orth at teamaol.com  Mon Jun 27 15:16:12 2016
From: charles.orth at teamaol.com (Charles Orth)
Date: Mon, 27 Jun 2016 11:16:12 -0400
Subject: configuring multiple nginx workers
Message-ID: <5771433C.8010100@teamaol.com>

Hi Gurus,

I am looking to develop a discovery service feature on top of nginx.
I have read http://www.aosabook.org/en/nginx.html and I have a couple 
questions
based on what I've seen in the code base.

If I have multiple workers configured using a single servers as an endpoint.
I want to leverage the ngx_http_upstream_init_main_conf functions to do 
the connection pooling for my service.

I see there is some mutex locking commented out in the code. What I want 
to confirm is if I have 2 or more workers configured, each worker has 
its own memory allocation for  ngx_http_upstream_main_conf_t  *umcf = 
conf; Thus we don't have to do any mutex locking between the separate 
worker processes. Each worker will have a pooled set of connections to 
the same endpoint.

Is my understanding correct?

Any help is greatly appreciated.

Charles


From zxcvbn4038 at gmail.com  Mon Jun 27 21:33:12 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Mon, 27 Jun 2016 17:33:12 -0400
Subject: nginx and http/2
In-Reply-To: <2027629.b02kqZmlSr@vbart-laptop>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
 <2027629.b02kqZmlSr@vbart-laptop>
Message-ID: <CA+p3Eyy5Y6M+G=T=A6voo5ovMT_sfG1K7vxqJ3Yig8m3uH2oQQ@mail.gmail.com>

I finally had a chance to test this, I applied ce94f07d5082 to the 1.9.15
code -- it applied cleanly and compiled cleanly. However, my test post
request over http2 with curl failed with the same "client sent stream with
data before settings were acknowledged while processing HTTP/2 connection"
error. Are there other changes in 1.11.x that I might need? Do I need to
explicitly enable the preread functionality? It looked to me as-if it was
enabled by default.

The error does seem to be 100% reproducible, the command I am running is:

curl --http2 -k -v -X POST -H "Content-Type: application/json" -d "{}" "
https://test-server_name/"

And my curl is: curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1
OpenSSL/1.0.2h nghttp2/1.11.1


On Sun, Jun 26, 2016 at 8:55 AM, Valentin V. Bartenev <vbart at nginx.com>
wrote:

> On Saturday 25 June 2016 21:00:37 CJ Ess wrote:
> > I could use some help with this one - I took a big leap with enabling
> > http/2 support and I got knocked back really quick. There seems to be an
> > issue with POSTs and it seems to be more pronounced with ios devices (as
> > much as you can trust user agents) but there were some non-ios devices
> that
> > seemed to be having issues also. Unfortunately I had to pull the changes
> > quickly so I didn't get to capture too much debugging information (plus
> all
> > the connections were via tls 1.2 w/ diffie-hellman so even if I had
> quickly
> > taken a packet dump I wouldn't have been able to decrypt it).
> >
> > So I built a version of curl with http/2 support to try and reproduce:
> >
> > curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1 OpenSSL/1.0.2h
> > nghttp2/1.11.1
> > Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s
> rtsp
> > smb smbs smtp smtps telnet tftp
> > Features: IPv6 Largefile NTLM NTLM_WB SSL TLS-SRP HTTP2 UnixSockets
> >
> > I did a test POST request with http/1 and I got a 200 response.
> >
> > I did the same POST request via http/2 and the tls handshake completed
> but
> > the connection was closed shortly thereafter. The error I see in the log
> > file is "client sent stream with data before settings were acknowledged
> > while processing HTTP/2 connection" I see other references to this error
> on
> > POST requests when I googled for it, but I didn't see a solution. This
> > sounds like an interoperability issue but I'd be shocked if I'm the first
> > one to find something like that.
> >
> [..]
>
> You're not the first one, so the problem was resolved by this change:
> http://hg.nginx.org/nginx/rev/ce94f07d5082 (nginx 1.11.0)
>
>   wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160627/ff2ceba6/attachment.html>

From vbart at nginx.com  Mon Jun 27 21:45:42 2016
From: vbart at nginx.com (Valentin V. Bartenev)
Date: Tue, 28 Jun 2016 00:45:42 +0300
Subject: nginx and http/2
In-Reply-To: <CA+p3Eyy5Y6M+G=T=A6voo5ovMT_sfG1K7vxqJ3Yig8m3uH2oQQ@mail.gmail.com>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
 <2027629.b02kqZmlSr@vbart-laptop>
 <CA+p3Eyy5Y6M+G=T=A6voo5ovMT_sfG1K7vxqJ3Yig8m3uH2oQQ@mail.gmail.com>
Message-ID: <9781889.AFBQ533sQA@vbart-laptop>

On Monday 27 June 2016 17:33:12 CJ Ess wrote:
> I finally had a chance to test this, I applied ce94f07d5082 to the 1.9.15
> code -- it applied cleanly and compiled cleanly. However, my test post
> request over http2 with curl failed with the same "client sent stream with
> data before settings were acknowledged while processing HTTP/2 connection"
> error. Are there other changes in 1.11.x that I might need? Do I need to
> explicitly enable the preread functionality? It looked to me as-if it was
> enabled by default.
> 

The answer to both questions no, you don't need.  But it looks like you're 
still running the old binary.


> The error does seem to be 100% reproducible, the command I am running is:
> 
> curl --http2 -k -v -X POST -H "Content-Type: application/json" -d "{}" "
> https://test-server_name/"
> 
> And my curl is: curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1
> OpenSSL/1.0.2h nghttp2/1.11.1
> 
[..]

Why don't you just install nginx 1.11?

  wbr, Valentin V. Bartenev


From zxcvbn4038 at gmail.com  Tue Jun 28 00:38:38 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Mon, 27 Jun 2016 20:38:38 -0400
Subject: nginx and http/2
In-Reply-To: <9781889.AFBQ533sQA@vbart-laptop>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
 <2027629.b02kqZmlSr@vbart-laptop>
 <CA+p3Eyy5Y6M+G=T=A6voo5ovMT_sfG1K7vxqJ3Yig8m3uH2oQQ@mail.gmail.com>
 <9781889.AFBQ533sQA@vbart-laptop>
Message-ID: <CA+p3Eywg0HznV9Y6=rjs=b55suGqtBUu=QkurmtxxUxc=TB0+A@mail.gmail.com>

I'm trying to use http/2 with Nginx 1.9.15 from Openresty - I don't know if
they modify the core or if I can just drop in 1.11.0 as a replacement.

I'll see if I can put a misspelling in that error message so I can be sure
I'm running the new binary.


On Mon, Jun 27, 2016 at 5:45 PM, Valentin V. Bartenev <vbart at nginx.com>
wrote:

> On Monday 27 June 2016 17:33:12 CJ Ess wrote:
> > I finally had a chance to test this, I applied ce94f07d5082 to the 1.9.15
> > code -- it applied cleanly and compiled cleanly. However, my test post
> > request over http2 with curl failed with the same "client sent stream
> with
> > data before settings were acknowledged while processing HTTP/2
> connection"
> > error. Are there other changes in 1.11.x that I might need? Do I need to
> > explicitly enable the preread functionality? It looked to me as-if it was
> > enabled by default.
> >
>
> The answer to both questions no, you don't need.  But it looks like you're
> still running the old binary.
>
>
> > The error does seem to be 100% reproducible, the command I am running is:
> >
> > curl --http2 -k -v -X POST -H "Content-Type: application/json" -d "{}" "
> > https://test-server_name/"
> >
> > And my curl is: curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1
> > OpenSSL/1.0.2h nghttp2/1.11.1
> >
> [..]
>
> Why don't you just install nginx 1.11?
>
>   wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160627/aa410e0c/attachment.html>

From zxcvbn4038 at gmail.com  Tue Jun 28 01:03:53 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Mon, 27 Jun 2016 21:03:53 -0400
Subject: nginx and http/2
In-Reply-To: <CA+p3Eywg0HznV9Y6=rjs=b55suGqtBUu=QkurmtxxUxc=TB0+A@mail.gmail.com>
References: <CA+p3Eyw-zAiNcLXfq=2+SL5=vHqDv9pUmHHYEz=n5fr_2cwWVQ@mail.gmail.com>
 <2027629.b02kqZmlSr@vbart-laptop>
 <CA+p3Eyy5Y6M+G=T=A6voo5ovMT_sfG1K7vxqJ3Yig8m3uH2oQQ@mail.gmail.com>
 <9781889.AFBQ533sQA@vbart-laptop>
 <CA+p3Eywg0HznV9Y6=rjs=b55suGqtBUu=QkurmtxxUxc=TB0+A@mail.gmail.com>
Message-ID: <CA+p3Eyz+py6CgmCqqtMayQXzkhiBqCyUHDrYbnyVU_sf5uuX_Q@mail.gmail.com>

You were correct, there was a typeo in my rpm spec that kept the diff from
applying but didn't kill the build. The curl request is working now! Now I
need to see if those other POST requests are working.


On Mon, Jun 27, 2016 at 8:38 PM, CJ Ess <zxcvbn4038 at gmail.com> wrote:

> I'm trying to use http/2 with Nginx 1.9.15 from Openresty - I don't know
> if they modify the core or if I can just drop in 1.11.0 as a replacement.
>
> I'll see if I can put a misspelling in that error message so I can be sure
> I'm running the new binary.
>
>
> On Mon, Jun 27, 2016 at 5:45 PM, Valentin V. Bartenev <vbart at nginx.com>
> wrote:
>
>> On Monday 27 June 2016 17:33:12 CJ Ess wrote:
>> > I finally had a chance to test this, I applied ce94f07d5082 to the
>> 1.9.15
>> > code -- it applied cleanly and compiled cleanly. However, my test post
>> > request over http2 with curl failed with the same "client sent stream
>> with
>> > data before settings were acknowledged while processing HTTP/2
>> connection"
>> > error. Are there other changes in 1.11.x that I might need? Do I need to
>> > explicitly enable the preread functionality? It looked to me as-if it
>> was
>> > enabled by default.
>> >
>>
>> The answer to both questions no, you don't need.  But it looks like you're
>> still running the old binary.
>>
>>
>> > The error does seem to be 100% reproducible, the command I am running
>> is:
>> >
>> > curl --http2 -k -v -X POST -H "Content-Type: application/json" -d "{}" "
>> > https://test-server_name/"
>> >
>> > And my curl is: curl 7.49.1 (x86_64-pc-linux-gnu) libcurl/7.49.1
>> > OpenSSL/1.0.2h nghttp2/1.11.1
>> >
>> [..]
>>
>> Why don't you just install nginx 1.11?
>>
>>   wbr, Valentin V. Bartenev
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160627/bd45657b/attachment.html>

From vfclists at gmail.com  Tue Jun 28 03:22:40 2016
From: vfclists at gmail.com (vfclists .)
Date: Tue, 28 Jun 2016 04:22:40 +0100
Subject: Is there an original source linking Qualys report codes to codes in
 nginx configuration?
Message-ID: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>

<http://security.stackexchange.com/questions/128513/is-there-an-original-informaton-source-linking-output-of-qualys-ssl-report-to-se#>

The online tool at Qualys for testing webserver SSL configurations,
https://www.ssllabs.com/ssltest/index.html, produces a list of codes like
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
etc.

There are a lot of howtos on the net, but none of them show how to relate
the actual string codes to those in the webservers. It is easy enough to
use them but there is no knowning how they arrive at those settings in
particular.

Is there some kind of table relating the Qualys codes with the actual codes
used in nginx configurations?


-- 
Frank Church

=======================
http://devblog.brahmancreations.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/7eceec6b/attachment.html>

From sven at elite12.de  Tue Jun 28 03:30:32 2016
From: sven at elite12.de (Sven Kirschbaum)
Date: Tue, 28 Jun 2016 05:30:32 +0200
Subject: Is there an original source linking Qualys report codes to codes
 in nginx configuration?
In-Reply-To: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
References: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
Message-ID: <CAPROQKuGr6NdV7VU+aHCEhP56L+3CVMbF5CHH6tdv2gSZZAm-g@mail.gmail.com>

The codes used in the nginx configuration are from openssl. There is a list
to convert the names in the manual available here:
https://www.openssl.org/docs/manmaster/apps/ciphers.html
Am 28.06.2016 05:22 schrieb "vfclists ." <vfclists at gmail.com>:

>
> <http://security.stackexchange.com/questions/128513/is-there-an-original-informaton-source-linking-output-of-qualys-ssl-report-to-se#>
>
> The online tool at Qualys for testing webserver SSL configurations,
> https://www.ssllabs.com/ssltest/index.html, produces a list of codes like
> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
> etc.
>
> There are a lot of howtos on the net, but none of them show how to relate
> the actual string codes to those in the webservers. It is easy enough to
> use them but there is no knowning how they arrive at those settings in
> particular.
>
> Is there some kind of table relating the Qualys codes with the actual
> codes used in nginx configurations?
>
>
> --
> Frank Church
>
> =======================
> http://devblog.brahmancreations.com
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/cd6a23c9/attachment.html>

From nginx-forum at forum.nginx.org  Tue Jun 28 06:30:21 2016
From: nginx-forum at forum.nginx.org (martinproinity)
Date: Tue, 28 Jun 2016 02:30:21 -0400
Subject: nginx core dump explodes
In-Reply-To: <6408233.bxcWmVSEB0@vbart-workstation>
References: <6408233.bxcWmVSEB0@vbart-workstation>
Message-ID: <62b00581d5fd55b04ee52595aa53eae2.NginxMailingListEnglish@forum.nginx.org>

I tested now the second patch as well. There are no more socket leaks with
both fixes.

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267928#msg-267928


From reallfqq-nginx at yahoo.fr  Tue Jun 28 08:57:10 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Tue, 28 Jun 2016 10:57:10 +0200
Subject: Is there an original source linking Qualys report codes to codes
 in nginx configuration?
In-Reply-To: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
References: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
Message-ID: <CALqce=3L=kq_SfHPo1WtJOcAZ8b4OKEdKQCe2sgc2+PuGvasug@mail.gmail.com>

nginx deals with an underlying library to manage TLS-ciphered content. The
webserver merely sends configuration data to it on startup/reload and uses
this library to do the actual (en/de)ciphering job.

The one officially supported is OpenSSL, for which cipher strings and
cipher suites are listed in its 'ciphers' module manual (man ciphers - best
- or https://www.openssl.org/docs/manmaster/apps/ciphers.html - worst).
You should use then to feed the ssl_ciphers
<http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers>
directive. What is accepted ultimately depends on the version of OpenSSL
(or any other TLS library) your version of nginx is linked with.
---
*B. R.*

On Tue, Jun 28, 2016 at 5:22 AM, vfclists . <vfclists at gmail.com> wrote:

>
> <http://security.stackexchange.com/questions/128513/is-there-an-original-informaton-source-linking-output-of-qualys-ssl-report-to-se#>
>
> The online tool at Qualys for testing webserver SSL configurations,
> https://www.ssllabs.com/ssltest/index.html, produces a list of codes like
> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
> etc.
>
> There are a lot of howtos on the net, but none of them show how to relate
> the actual string codes to those in the webservers. It is easy enough to
> use them but there is no knowning how they arrive at those settings in
> particular.
>
> Is there some kind of table relating the Qualys codes with the actual
> codes used in nginx configurations?
>
>
> --
> Frank Church
>
> =======================
> http://devblog.brahmancreations.com
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/87aac554/attachment.html>

From alan.orth at gmail.com  Tue Jun 28 15:44:21 2016
From: alan.orth at gmail.com (Alan Orth)
Date: Tue, 28 Jun 2016 15:44:21 +0000
Subject: Is there an original source linking Qualys report codes to codes
 in nginx configuration?
In-Reply-To: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
References: <CAE3mkNAE8JiLF_TGk3Kh+dVx3f4HUjhmAiJp+3kDh_n1o8wLmg@mail.gmail.com>
Message-ID: <CAKKdN4UM_wT7e_fSV7+a6+QYneEiS-5OA1T4GPrS31Gb+ZESFg@mail.gmail.com>

There is a correspondence table on the Mozilla Server Side TLS wiki:

https://wiki.mozilla.org/Security/Server_Side_TLS#Cipher_names_correspondence_table

Regards,

On Tue, Jun 28, 2016 at 6:22 AM vfclists . <vfclists at gmail.com> wrote:

>
> <http://security.stackexchange.com/questions/128513/is-there-an-original-informaton-source-linking-output-of-qualys-ssl-report-to-se#>
>
> The online tool at Qualys for testing webserver SSL configurations,
> https://www.ssllabs.com/ssltest/index.html, produces a list of codes like
> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
> etc.
>
> There are a lot of howtos on the net, but none of them show how to relate
> the actual string codes to those in the webservers. It is easy enough to
> use them but there is no knowning how they arrive at those settings in
> particular.
>
> Is there some kind of table relating the Qualys codes with the actual
> codes used in nginx configurations?
>
>
> --
> Frank Church
>
> =======================
> http://devblog.brahmancreations.com
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

-- 

Alan Orth
alan.orth at gmail.com
https://englishbulgaria.net
https://alaninkenya.org
https://mjanja.ch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/b71ac703/attachment.html>

From daryn at steelsword.org.uk  Tue Jun 28 16:01:28 2016
From: daryn at steelsword.org.uk (Steve Howe)
Date: Tue, 28 Jun 2016 17:01:28 +0100
Subject: Query re: upstreams and two protocols
Message-ID: <CAK+ojjERGjqVyFay7G7bLyo4p=Va0rh6rTPXizDLZTY44hjdfQ@mail.gmail.com>

Hi all,

First time posting here so apologies for any faux pas etc...

I have an nginx config where I have a server block, a location block and a
proxypass in the location block, pointing to an upstream.

The upstream has, at this point 3 servers in it.

All the 3 servers are in the same vpn. The proxy_pass directive pointing
traffic to that upstream uses the http protocol

I want to add another server into the upstream endpoints, located in a
remote datacentre. I want traffic to this remote datacentre to be encrypted
over https.

The proxy_pass can't handle http and https simultaneously

Any ideas how I can have an upstream containing the 3 servers in the local
datacentre that shouldn't use https, and the 1 server in the remote
datacentre that does need the traffic to be encrypted with https, please?


Someone suggested putting a server definition in the upstream that directs
to a local nginx server definition that's designed to just forward off to
another upstream with an https proxy_pass command, with the second upstream
holding the remote datacentre server definition but it seems a bit kludgy.


Thanks for any advice!

Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/c08e7d01/attachment.html>

From infos at opendoc.net  Tue Jun 28 19:41:34 2016
From: infos at opendoc.net (Alexandre)
Date: Tue, 28 Jun 2016 21:41:34 +0200
Subject: Nginx can not use more than 1024 log?
Message-ID: <dcbdf1ea-6772-eba4-0e56-2dce9c63669f@opendoc.net>

Hello everyone,
I think the open file problem already mentioned.

Here is the error
---
2016/06/28 21:12:41 [emerg] 1539#1539: open() 
"/var/log/nginx/xxx-xxx-xx_error.log" failed (24: Too many open files)
---

I use 531 virtual host, each one of the virtual host uses 2 log files 
(access_log and error_log). Nginx uses 1062 logs.

Here is my system configuration :

/etc/sysctl.conf
---
fs.file-max = 2097152
---

/etc/security/limits.conf (I use net user)
---
net               soft     nofile         800000
net               hard     nofile         1000000
net               soft     locks          unlimited
net               hard     locks          unlimited
net               soft     nproc          unlimited
net               hard     nproc          unlimited
net               soft     core           unlimited
net               hard     core           unlimited
net               soft     data           unlimited
net               hard     data           unlimited
net               soft     cpu            unlimited
net               hard     cpu            unlimited
---

/etc/default/nginx
---
NGINX_ULIMIT="-n 1000000"
---

/etc/nginx/nginx.conf
---
worker_rlimit_nofile 100000;
---

ulimit info for user net
---
ulimit -a
core file size          (blocks, -c) unlimited
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 15793
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 800000
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) unlimited
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited
---


I use an debian 8 with nginx 1.10.1-1~jessie

Here are the compilation options en debian 8
---
nginx -V
nginx version: nginx/1.10.1
built by gcc 4.9.2 (Debian 4.9.2-10)
built with OpenSSL 1.0.1k 8 Jan 2015 (running with OpenSSL 1.0.1t  3 May 
2016)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx 
--modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf 
--error-log-path=/var/log/nginx/error.log 
--http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid 
--lock-path=/var/run/nginx.lock 
--http-client-body-temp-path=/var/cache/nginx/client_temp 
--http-proxy-temp-path=/var/cache/nginx/proxy_temp 
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp 
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp 
--http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx 
--group=nginx --with-http_ssl_module --with-http_realip_module 
--with-http_addition_module --with-http_sub_module 
--with-http_dav_module --with-http_flv_module --with-http_mp4_module 
--with-http_gunzip_module --with-http_gzip_static_module 
--with-http_random_index_module --with-http_secure_link_module 
--with-http_stub_status_module --with-http_auth_request_module 
--with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic 
--with-http_geoip_module=dynamic --with-http_perl_module=dynamic 
--add-dynamic-module=debian/extra/njs-1c50334fbea6/nginx --with-threads 
--with-stream --with-stream_ssl_module --with-http_slice_module 
--with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 
--with-http_v2_module --with-cc-opt='-g -O2 -fstack-protector-strong 
-Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' 
--with-ld-opt='-Wl,-z,relro -Wl,--as-needed'
---

I do not understand why it does not work. The same configuration on a 
debian 7 with the same version of nginx working properly.

Here are the compilation options en debian 7
---
nginx -V
nginx version: nginx/1.10.1
built by gcc 4.7.2 (Debian 4.7.2-5)
built with OpenSSL 1.0.1e 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx 
--modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf 
--error-log-path=/var/log/nginx/error.log 
--http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid 
--lock-path=/var/run/nginx.lock 
--http-client-body-temp-path=/var/cache/nginx/client_temp 
--http-proxy-temp-path=/var/cache/nginx/proxy_temp 
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp 
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp 
--http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx 
--group=nginx --with-http_ssl_module --with-http_realip_module 
--with-http_addition_module --with-http_sub_module 
--with-http_dav_module --with-http_flv_module --with-http_mp4_module 
--with-http_gunzip_module --with-http_gzip_static_module 
--with-http_random_index_module --with-http_secure_link_module 
--with-http_stub_status_module --with-http_auth_request_module 
--with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic 
--with-http_geoip_module=dynamic --with-http_perl_module=dynamic 
--add-dynamic-module=debian/extra/njs-1c50334fbea6/nginx --with-threads 
--with-stream --with-stream_ssl_module --with-http_slice_module 
--with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 
--with-http_v2_module --with-cc-opt='-g -O2 -fstack-protector 
--param=ssp-buffer-size=4 -Wformat -Werror=format-security 
-Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed'
---


Difference between the compiler options :
debian 7
---
built by gcc 4.7.2 (Debian 4.7.2-5)
built with OpenSSL 1.0.1e 11 Feb 2013
--with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 
-Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' 
--with-ld-opt='-Wl,-z,relro -Wl,--as-needed'
---

debian 8
---
built by gcc 4.9.2 (Debian 4.9.2-10)
built with OpenSSL 1.0.1k 8 Jan 2015 (running with OpenSSL 1.0.1t  3 May 
2016)
--with-cc-opt='-g -O2 -fstack-protector-strong -Wformat 
-Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' 
--with-ld-opt='-Wl,-z,relro -Wl,--as-needed'
---

Would you have a solution?

Thank you.

Regards,
Alexandre


From zxcvbn4038 at gmail.com  Wed Jun 29 03:54:10 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Tue, 28 Jun 2016 23:54:10 -0400
Subject: Differing ocsp responses
Message-ID: <CA+p3EywoiKyKf-cA-yxZ0zU2ORg9NQ7NTVn4fhutyOZh6kDxcg@mail.gmail.com>

I think I've got ocsp stapling setup correctly with Nginx (1.9.0). I am
seeing valid OCSP responses however if I keep querying the same server I
also frequently see "No response". The OCSP responses are valid for seven
days. Is each worker doing its own OCSP query independently of the others?
Or is there something else happening?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160628/5ec071b1/attachment.html>

From kurt at x64architecture.com  Wed Jun 29 05:23:08 2016
From: kurt at x64architecture.com (Kurt Cancemi)
Date: Wed, 29 Jun 2016 01:23:08 -0400
Subject: Differing ocsp responses
In-Reply-To: <CA+p3EywoiKyKf-cA-yxZ0zU2ORg9NQ7NTVn4fhutyOZh6kDxcg@mail.gmail.com>
References: <CA+p3EywoiKyKf-cA-yxZ0zU2ORg9NQ7NTVn4fhutyOZh6kDxcg@mail.gmail.com>
Message-ID: <CADujJWWfB2Wf2Fz52vUMOt7gby-9DndO28ZXoQB15nPe9cYgSg@mail.gmail.com>

Hello,

Nginx uses a per worker OCSP cache.

On Tuesday, June 28, 2016, CJ Ess <zxcvbn4038 at gmail.com> wrote:

> I think I've got ocsp stapling setup correctly with Nginx (1.9.0). I am
> seeing valid OCSP responses however if I keep querying the same server I
> also frequently see "No response". The OCSP responses are valid for seven
> days. Is each worker doing its own OCSP query independently of the others?
> Or is there something else happening?
>


-- 
Kurt Cancemi
https://www.x64architecture.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/62ec9757/attachment.html>

From nginx-forum at forum.nginx.org  Wed Jun 29 10:21:08 2016
From: nginx-forum at forum.nginx.org (Sernate)
Date: Wed, 29 Jun 2016 06:21:08 -0400
Subject: Nginx can not use more than 1024 log?
In-Reply-To: <dcbdf1ea-6772-eba4-0e56-2dce9c63669f@opendoc.net>
References: <dcbdf1ea-6772-eba4-0e56-2dce9c63669f@opendoc.net>
Message-ID: <7db9ae0d7875e4aec2ebd8a25c1de38b.NginxMailingListEnglish@forum.nginx.org>

Hi,

What does a 'cat /proc/PID/limits' (replace PID with the NGINX PID number)
show you ?

The limits.conf file does not apply to systemd services.
Edit the file /lib/systemd/system/nginx.service and within the '[Service]'
section the following: LimitNOFILE=65536
After that run: systemctl daemon-reload && systemctl restart nginx

Wesley

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267940,267949#msg-267949


From infos at opendoc.net  Wed Jun 29 11:44:36 2016
From: infos at opendoc.net (Alexandre)
Date: Wed, 29 Jun 2016 13:44:36 +0200
Subject: Nginx can not use more than 1024 log?
In-Reply-To: <7db9ae0d7875e4aec2ebd8a25c1de38b.NginxMailingListEnglish@forum.nginx.org>
References: <dcbdf1ea-6772-eba4-0e56-2dce9c63669f@opendoc.net>
 <7db9ae0d7875e4aec2ebd8a25c1de38b.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <13fea1ef-5943-cc26-14e5-d47b1cfc8698@opendoc.net>

Hi Wesley,

I can not get information because the nginx service does not start.

You're right, actually have to use the file 
/lib/systemd/system/nginx.service. However, the file does not exist. I 
find this file on debian 8 : /run/systemd/generator.late/nginx.service

---
[Unit]
SourcePath=/etc/init.d/nginx
Description=LSB: Stop/start nginx
Before=runlevel2.target runlevel3.target runlevel4.target 
runlevel5.target shutdown.target
After=network-online.target remote-fs.target local-fs.target
Wants=network-online.target
Conflicts=shutdown.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
SysVStartPriority=1
ExecStart=/etc/init.d/nginx start
ExecStop=/etc/init.d/nginx stop
ExecReload=/etc/init.d/nginx reload
---

I followed your instructions :

   * I create the nginx.service in /lib/systemd/system/nginx.service
   * I add "LimitNOFILE=65536"
---
[Unit]
SourcePath=/etc/init.d/nginx
Description=LSB: Stop/start nginx
Before=runlevel2.target runlevel3.target runlevel4.target 
runlevel5.target shutdown.target
After=network-online.target remote-fs.target local-fs.target
Wants=network-online.target
Conflicts=shutdown.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
SysVStartPriority=1
ExecStart=/etc/init.d/nginx start
ExecStop=/etc/init.d/nginx stop
ExecReload=/etc/init.d/nginx reload
LimitNOFILE=65536
---
    * systemctl daemon-reload && systemctl restart nginx

Now it works perfectly !

Thank you very much Wesley.

I have a question, I use the official repository nginx.
---
deb http://nginx.org/packages/debian/ jessie nginx
deb-src http://nginx.org/packages/debian/ jessie nginx
---

Would it be possible to create the nginx.service file during 
installation of nginx?

Thank you the nginx community.

Regards,
Alexandre.


On 29/06/2016 12:21, Sernate wrote:
> Hi,
>
> What does a 'cat /proc/PID/limits' (replace PID with the NGINX PID number)
> show you ?
>
> The limits.conf file does not apply to systemd services.
> Edit the file /lib/systemd/system/nginx.service and within the '[Service]'
> section the following: LimitNOFILE=65536
> After that run: systemctl daemon-reload && systemctl restart nginx
>
> Wesley
>
> Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267940,267949#msg-267949
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>


From zxcvbn4038 at gmail.com  Wed Jun 29 15:17:14 2016
From: zxcvbn4038 at gmail.com (CJ Ess)
Date: Wed, 29 Jun 2016 11:17:14 -0400
Subject: Differing ocsp responses
In-Reply-To: <CADujJWWfB2Wf2Fz52vUMOt7gby-9DndO28ZXoQB15nPe9cYgSg@mail.gmail.com>
References: <CA+p3EywoiKyKf-cA-yxZ0zU2ORg9NQ7NTVn4fhutyOZh6kDxcg@mail.gmail.com>
 <CADujJWWfB2Wf2Fz52vUMOt7gby-9DndO28ZXoQB15nPe9cYgSg@mail.gmail.com>
Message-ID: <CA+p3EyxZQ7BmRA1Nq1Q=CXa1E1Fnvk=xiXi3jx_VBwo4oTwTXQ@mail.gmail.com>

Ok, that explains it then. Does the cache survive reloads? Or does it need
to requery?


On Wed, Jun 29, 2016 at 1:23 AM, Kurt Cancemi <kurt at x64architecture.com>
wrote:

> Hello,
>
> Nginx uses a per worker OCSP cache.
>
> On Tuesday, June 28, 2016, CJ Ess <zxcvbn4038 at gmail.com> wrote:
>
>> I think I've got ocsp stapling setup correctly with Nginx (1.9.0). I am
>> seeing valid OCSP responses however if I keep querying the same server I
>> also frequently see "No response". The OCSP responses are valid for seven
>> days. Is each worker doing its own OCSP query independently of the others?
>> Or is there something else happening?
>>
>
>
> --
> Kurt Cancemi
> https://www.x64architecture.com
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/fdd9f09b/attachment.html>

From nginx-forum at forum.nginx.org  Wed Jun 29 16:26:58 2016
From: nginx-forum at forum.nginx.org (itpp2012)
Date: Wed, 29 Jun 2016 12:26:58 -0400
Subject: Differing ocsp responses
In-Reply-To: <CA+p3EyxZQ7BmRA1Nq1Q=CXa1E1Fnvk=xiXi3jx_VBwo4oTwTXQ@mail.gmail.com>
References: <CA+p3EyxZQ7BmRA1Nq1Q=CXa1E1Fnvk=xiXi3jx_VBwo4oTwTXQ@mail.gmail.com>
Message-ID: <e8bf325ae83e526aaeefd9e5ee32a667.NginxMailingListEnglish@forum.nginx.org>

CJ Ess Wrote:
-------------------------------------------------------
> Ok, that explains it then. Does the cache survive reloads? Or does it
> need
> to requery?

See also https://forum.nginx.org/read.php?2,249249,249249#msg-249249

"When Nginx starts for the first time, and there's no cached OCSP response,
the first client to try an OCSP will fail; I understand that this is by
design, and I've overcome it by simply 'warming' the cached manually by
using OpenSSL's s_client... "

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267945,267953#msg-267953


From reallfqq-nginx at yahoo.fr  Wed Jun 29 17:04:48 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Wed, 29 Jun 2016 19:04:48 +0200
Subject: Master process on reload
Message-ID: <CALqce=2xVFpXV+UyVG3Gizd8m0BjYhVS5GfLNz3z2PK9Fs8qsw@mail.gmail.com>

Hello,

Kind of basic question about nginx behavior here.

On the docs page http://nginx.org/en/docs/control.html, it is said :

> HUP -> changing configuration, keeping up with a changed time zone (only
> for FreeBSD and Linux), starting new worker processes with a new
> configuration, graceful shutdown of old worker processes


This is exact since the HUP signal is used to reload configuration and
spawn new workers with it.

However, a little bit further on the same page, in the on-the-fly upgrade
section, you got:

> Send the HUP signal to the old master process. The old master process will
> start new worker processes without re-reading the configuration. After
> that, all new processes can be shut down gracefully, by sending the QUIT
> signal to the new master process.


Is this behavior due to the USR2 signal previously sent, the old master
knowing it is the old one (and thus knowing it should avoid loading an
improper configuration suitable for another version)?
---
*B. R.*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/83bd9bce/attachment.html>

From reallfqq-nginx at yahoo.fr  Wed Jun 29 17:06:27 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Wed, 29 Jun 2016 19:06:27 +0200
Subject: Differing ocsp responses
In-Reply-To: <e8bf325ae83e526aaeefd9e5ee32a667.NginxMailingListEnglish@forum.nginx.org>
References: <CA+p3EyxZQ7BmRA1Nq1Q=CXa1E1Fnvk=xiXi3jx_VBwo4oTwTXQ@mail.gmail.com>
 <e8bf325ae83e526aaeefd9e5ee32a667.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <CALqce=3D8JS1zhyrm9uhhaORCMufMfjG9POKxoKHewM7qBD1=Q@mail.gmail.com>

nginx workers are recreated on reload (read
http://nginx.org/en/docs/control.html#reconfiguration), nothing can thus
remains from past cache at this level.
---
*B. R.*

On Wed, Jun 29, 2016 at 6:26 PM, itpp2012 <nginx-forum at forum.nginx.org>
wrote:

> CJ Ess Wrote:
> -------------------------------------------------------
> > Ok, that explains it then. Does the cache survive reloads? Or does it
> > need
> > to requery?
>
> See also https://forum.nginx.org/read.php?2,249249,249249#msg-249249
>
> "When Nginx starts for the first time, and there's no cached OCSP response,
> the first client to try an OCSP will fail; I understand that this is by
> design, and I've overcome it by simply 'warming' the cached manually by
> using OpenSSL's s_client... "
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,267945,267953#msg-267953
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/22068d50/attachment.html>

From Jordan.Rakoske at cisecurity.org  Wed Jun 29 17:18:22 2016
From: Jordan.Rakoske at cisecurity.org (Jordan C. Rakoske)
Date: Wed, 29 Jun 2016 17:18:22 +0000
Subject: NGINX Help
Message-ID: <B49440E6F4D74144AECFFAFB67AF74FB011C4DDFF1@CISEXCHANGE2.msisac.org.local>

Hey everyone,   We have started work on the CIS NGINX Benchmark and we are looking for folks to help give security recommendations so that we can add them into the benchmark.  We have a good team of editors now but we are looking for help from all you NGINX users/experts to help provide security recommendations.


If any of you are interested in providing some recommendations, here is how you can join the community.

https://benchmarks.cisecurity.org/community/projects/index.cfm#123

Once joined we have a discussion forum where you can post any items you think are good best practices and good security settings.

Shoot me an email if you sign up and I will approve it ASAP.

Thanks everyone!!!


Jordan C. Rakoske
Technical Product Manager
Center for Internet Security, Inc.
31 Tech Valley Drive
East Greenbush, NY 12061
Jordan.Rakoske at cisecurity.org<mailto:Jordan.Rakoske at cisecurity.org>
www.cisecurity.org<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.cisecurity.org%2f&data=01%7c01%7cjmunck%40exchange.microsoft.com%7c0686cbdfb0af47b0efef08d2f4164827%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=IdM%2fuaejoEij0N5uRIK3C%2bSbWp7IGzKwvo5iJ20roYU%3d>
Follow us on Twitter @CISecurity

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

. . .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/aacecc14/attachment.html>

From mdounin at mdounin.ru  Wed Jun 29 17:38:44 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Wed, 29 Jun 2016 20:38:44 +0300
Subject: Master process on reload
In-Reply-To: <CALqce=2xVFpXV+UyVG3Gizd8m0BjYhVS5GfLNz3z2PK9Fs8qsw@mail.gmail.com>
References: <CALqce=2xVFpXV+UyVG3Gizd8m0BjYhVS5GfLNz3z2PK9Fs8qsw@mail.gmail.com>
Message-ID: <20160629173843.GQ30781@mdounin.ru>

Hello!

On Wed, Jun 29, 2016 at 07:04:48PM +0200, B.R. wrote:

> Kind of basic question about nginx behavior here.
> 
> On the docs page http://nginx.org/en/docs/control.html, it is said :
> 
> > HUP -> changing configuration, keeping up with a changed time zone (only
> > for FreeBSD and Linux), starting new worker processes with a new
> > configuration, graceful shutdown of old worker processes
> 
> This is exact since the HUP signal is used to reload configuration and
> spawn new workers with it.
> 
> However, a little bit further on the same page, in the on-the-fly upgrade
> section, you got:
> 
> > Send the HUP signal to the old master process. The old master process will
> > start new worker processes without re-reading the configuration. After
> > that, all new processes can be shut down gracefully, by sending the QUIT
> > signal to the new master process.
> 
> Is this behavior due to the USR2 signal previously sent, the old master
> knowing it is the old one (and thus knowing it should avoid loading an
> improper configuration suitable for another version)?

Yes.  The old master knows it previously started a new master, 
and on the HUP signal it just starts new workers (if the new 
master is still running).  If/when the old master exits, the old 
master is notified about this, and starts to work normally.

Additional details can be found in 
src/os/unix/ngx_process_cycle.c:

http://hg.nginx.org/nginx/file/tip/src/os/unix/ngx_process_cycle.c#l220

-- 
Maxim Dounin
http://nginx.org/


From reallfqq-nginx at yahoo.fr  Wed Jun 29 19:34:49 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Wed, 29 Jun 2016 21:34:49 +0200
Subject: Master process on reload
In-Reply-To: <20160629173843.GQ30781@mdounin.ru>
References: <CALqce=2xVFpXV+UyVG3Gizd8m0BjYhVS5GfLNz3z2PK9Fs8qsw@mail.gmail.com>
 <20160629173843.GQ30781@mdounin.ru>
Message-ID: <CALqce=3ZgKod521W9b-Kdc4Wftt-CO-+u8qQYW_+4ycySAYK1w@mail.gmail.com>

Thanks Maxim!
Helpful and concise as always. :o)
---
*B. R.*

On Wed, Jun 29, 2016 at 7:38 PM, Maxim Dounin <mdounin at mdounin.ru> wrote:

> Hello!
>
> On Wed, Jun 29, 2016 at 07:04:48PM +0200, B.R. wrote:
>
> > Kind of basic question about nginx behavior here.
> >
> > On the docs page http://nginx.org/en/docs/control.html, it is said :
> >
> > > HUP -> changing configuration, keeping up with a changed time zone
> (only
> > > for FreeBSD and Linux), starting new worker processes with a new
> > > configuration, graceful shutdown of old worker processes
> >
> > This is exact since the HUP signal is used to reload configuration and
> > spawn new workers with it.
> >
> > However, a little bit further on the same page, in the on-the-fly upgrade
> > section, you got:
> >
> > > Send the HUP signal to the old master process. The old master process
> will
> > > start new worker processes without re-reading the configuration. After
> > > that, all new processes can be shut down gracefully, by sending the
> QUIT
> > > signal to the new master process.
> >
> > Is this behavior due to the USR2 signal previously sent, the old master
> > knowing it is the old one (and thus knowing it should avoid loading an
> > improper configuration suitable for another version)?
>
> Yes.  The old master knows it previously started a new master,
> and on the HUP signal it just starts new workers (if the new
> master is still running).  If/when the old master exits, the old
> master is notified about this, and starts to work normally.
>
> Additional details can be found in
> src/os/unix/ngx_process_cycle.c:
>
> http://hg.nginx.org/nginx/file/tip/src/os/unix/ngx_process_cycle.c#l220
>
> --
> Maxim Dounin
> http://nginx.org/
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160629/391255bd/attachment.html>

From dm at whocaresabout.de  Wed Jun 29 22:02:29 2016
From: dm at whocaresabout.de (dm at whocaresabout.de)
Date: Thu, 30 Jun 2016 00:02:29 +0200
Subject: caching issues with nginx as reverse-proxy
Message-ID: <813a81a1dd6bf6b67c10cedbd6ca54da@whocaresabout.de>

Hi community,

currently I am serving files with a size about 1,5G (static without 
dynamic content) using a hand full of nodes and nginx in reverse proxy 
setup.
Caching works, ..but not as expected. During the requests nginx creates 
a lot of temp caching files that grow up to the size of the origin file 
delivered from backend server. It's kinda weird that even if the 
inactive caching time out is not reached, the file is randomly 
downloaded again from backend.

I guess that I just simply got blind by the configure that affects that.

## /etc/nginx/nginx.conf ##
proxy_cache_path /var/tmp/nginx-cache/rproxy levels=1:2 
keys_zone=rproxy:260m max_size=5g inactive=260m use_temp_path=off;
proxy_cache_key "$scheme$request_method$host$request_uri$is_args$args";
proxy_cache_valid 200 302 45m;
proxy_cache_valid 404 1m;

## /etc/nginx/sites-available/domain.tld ##
server {
     listen 80;# default_server;
     listen [::]:80;# default_server;

     server_name domain.tld;

     location / {
     return 301 https://$host$request_uri;
     }

}

     server {

     listen 443 ssl http2; #default_server;
     listen [::]:443 ssl http2; #default_server;

     ssl		on;
     ssl_certificate		/etc/letsencrypt/live/domain.tld/fullchain.pem;
     ssl_certificate_key		/etc/letsencrypt/live/domain.tld/privkey.pem;

     server_name domain.tld;

     location / {
#	proxy_buffering on;
	proxy_cache_revalidate on;
	proxy_cache_lock on;
	proxy_cache rproxy;
	proxy_cache_use_stale error timeout http_500 http_502 http_503 
http_504;
	proxy_pass https://rproxy;
     }

}
####

Nginx 1.11.1 is used. And the frontends got only 1gb ram and 10 gb of 
disk space.

I am looking forward for any advice that could bring me some steps 
forward to the right configuration :-)

Thanks in advance!

Best regards,
Daniel




From nginx-forum at forum.nginx.org  Thu Jun 30 01:00:02 2016
From: nginx-forum at forum.nginx.org (blue.outrigger)
Date: Wed, 29 Jun 2016 21:00:02 -0400
Subject: caching issues with nginx as reverse-proxy
Message-ID: <0d9a7095d1f0f2c19173ae3a7af102f4.NginxMailingListEnglish@forum.nginx.org>

Hi,
I am using nginx as a reverse proxy and using the proxy-cache, I use the
request body as a cache key as shown below.

    location ^~ /mycachepath {
        proxy_pass                http://upstreamservers;
        proxy_buffers             8 32K;
        proxy_buffer_size         64K;
        proxy_cache               proxy-cache;
        proxy_cache_key           "$scheme$host$request_uri|$request_body";
        proxy_cache_valid         200 1m;
        proxy_cache_methods       POST GET;
        proxy_ignore_headers      Cache-Control;
        add_header X-Cache-Status $upstream_cache_status;
    }


However, I observe that smaller request bodies the cache works perfectly but
if the request body gets too big then it will actually *always* return the
cached version. Does anyone have any idea what's going on and if someone
also has come across a similar issue ? There is nothing in the logs except
for this statement - "[warn] 29768#0: *2329 a client request body is
buffered to a temporary file /var/cache/nginx/client_temp/0000000009," for a
given request.
Any help is much appreciated.

Thanks!

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267961,267961#msg-267961


From francis at daoine.org  Thu Jun 30 07:14:00 2016
From: francis at daoine.org (Francis Daly)
Date: Thu, 30 Jun 2016 08:14:00 +0100
Subject: caching issues with nginx as reverse-proxy
In-Reply-To: <0d9a7095d1f0f2c19173ae3a7af102f4.NginxMailingListEnglish@forum.nginx.org>
References: <0d9a7095d1f0f2c19173ae3a7af102f4.NginxMailingListEnglish@forum.nginx.org>
Message-ID: <20160630071400.GC12280@daoine.org>

On Wed, Jun 29, 2016 at 09:00:02PM -0400, blue.outrigger wrote:

Hi there,

> I am using nginx as a reverse proxy and using the proxy-cache, I use the
> request body as a cache key as shown below.

>         proxy_cache_key           "$scheme$host$request_uri|$request_body";

http://nginx.org/r/$request_body

If the request body was not read to a memory buffer, this variable is
presumably empty (and therefore: the same for all requests).

> However, I observe that smaller request bodies the cache works perfectly but
> if the request body gets too big then it will actually *always* return the
> cached version. Does anyone have any idea what's going on and if someone
> also has come across a similar issue ?

Set your client_body_buffer_size big enough that it will hold the entire
request, if you want to cache POSTs this way.

	f
-- 
Francis Daly        francis at daoine.org


From daniel at linux-nerd.de  Thu Jun 30 08:45:31 2016
From: daniel at linux-nerd.de (Daniel Eschner)
Date: Thu, 30 Jun 2016 10:45:31 +0200
Subject: Understanding caching
Message-ID: <85599794-482C-4C04-94B3-1DE3FB21F2BE@linux-nerd.de>

Hi there,

i need to understand the caching options better. So, i have serval Questions ;)

I added some Cacherules like these:

        location  /js {
                add_header        Cache-Control public;
                add_header        Cache-Control must-revalidate;
                expires           7d;
    }


        location  /css {
                add_header        Cache-Control public;
                add_header        Cache-Control must-revalidate;
                expires           7d;
    }

        location  /img {
                add_header        Cache-Control public;
                add_header        Cache-Control must-revalidate;
                expires           7d;
    }

        location  /bundles {
                add_header        Cache-Control public;
                add_header        Cache-Control must-revalidate;
                expires           7d;
    }

        location  /alloyeditor {
                add_header        Cache-Control public;
                add_header        Cache-Control must-revalidate;
                expires           7d;
    }

No when i browser arround Chrome said ?From cache? that works fine for me but when i reload the Website it seems that only *.JPGs comming from the cache.
Is that a Browser issue or a nginx issue? Need to know where i have to search ;)

Closing the browser and start again it dont came from cache - but as i understand i say it will expire in 7 Days - so why nit not comming from local cache?

Cheers

Daniel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160630/74232bc2/attachment.html>

From francis at daoine.org  Thu Jun 30 12:51:03 2016
From: francis at daoine.org (Francis Daly)
Date: Thu, 30 Jun 2016 13:51:03 +0100
Subject: Understanding caching
In-Reply-To: <85599794-482C-4C04-94B3-1DE3FB21F2BE@linux-nerd.de>
References: <85599794-482C-4C04-94B3-1DE3FB21F2BE@linux-nerd.de>
Message-ID: <20160630125103.GD12280@daoine.org>

On Thu, Jun 30, 2016 at 10:45:31AM +0200, Daniel Eschner wrote:

Hi there,

> i need to understand the caching options better. So, i have serval Questions ;)

I think in this mail, you refer to the caching done by your browser.

That is entirely controlled by your browser; but it will probably respect
the suggestions that the server makes.

"A web page" is typically one request for some html, plus multiple
requests for css, js, and image files.

Each of those requests is independent, and each of the responses can be
cached (or not) by your browser, as it sees fit.

>                 add_header        Cache-Control public;
>                 add_header        Cache-Control must-revalidate;
>                 expires           7d;

These lead to http response headers sent to the browser; how the browser
handles them it entirely its business. Essentially the server is
suggesting "do cache this, cache it for 7 days, and then check again".

You can look at the actual http response headers received by your browser,
and you can check its documentation for how it is expected to handle them.

(It is possible that other response headers are sent which say "do not
cache this".)

> No when i browser arround Chrome said ?From cache? that works fine for me but when i reload the Website it seems that only *.JPGs comming from the cache.

"reload" is probably an instruction to your browser to fetch the (first,
html) page again from outside its local cache.

If you follow a link and then use your browser's "back" button, that
can be an instruction to your browser to show the page again, from local
cache if possible.

Usually there is also an instruction available to your browser to invite
it to fetch the page again, from the origin web server (bypassing or
breaking through any intermediate caches).

In any case, the multiple subsequent css, js, image requests may be
handled from the local cache, or may be made to "the web", or may be
made to the origin web server. Your browser decides what requests,
if any, it will make.

> Is that a Browser issue or a nginx issue? Need to know where i have to search ;)

It seems like expected behaviour to me.

It is initially a browser issue.

If you can see a request that you think should not be made; and if you
can see the previous response that you think should have been used instead;
and if you can see a "please do not cache this" in that response; then you
can check where in your nginx that "please do not cache this" came from.

> Closing the browser and start again it dont came from cache - but as i understand i say it will expire in 7 Days - so why nit not comming from local cache?

The server said "please cache this for 7 days".

The browser may or may not have done that. Perhaps it never writes to
disk; or clears the disk cache on startup, or something.

Cheers,

	f
-- 
Francis Daly        francis at daoine.org


From mdounin at mdounin.ru  Thu Jun 30 12:51:15 2016
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Thu, 30 Jun 2016 15:51:15 +0300
Subject: caching issues with nginx as reverse-proxy
In-Reply-To: <813a81a1dd6bf6b67c10cedbd6ca54da@whocaresabout.de>
References: <813a81a1dd6bf6b67c10cedbd6ca54da@whocaresabout.de>
Message-ID: <20160630125115.GU30781@mdounin.ru>

Hello!

On Thu, Jun 30, 2016 at 12:02:29AM +0200, dm at whocaresabout.de wrote:

> currently I am serving files with a size about 1,5G (static without dynamic
> content) using a hand full of nodes and nginx in reverse proxy setup.
> Caching works, ..but not as expected. During the requests nginx creates a
> lot of temp caching files that grow up to the size of the origin file
> delivered from backend server. It's kinda weird that even if the inactive
> caching time out is not reached, the file is randomly downloaded again from
> backend.

Multiple temporary files can be created when the response is not 
yet cached and there are multiple requests to the resource in 
question.  Once the response is cached it will be returned from 
cache to subsequent requests, and no additional temporary files 
will appear.

To mininize parallel caching by multiple simultaneous requests 
there is the "proxy_cache_lock" directive.  Though for 1.5G files 
default timeouts it uses may not be enough, consider tuning 
proxy_cache_lock_age and proxy_cache_lock_timeout:

http://nginx.org/r/proxy_cache_lock_age
http://nginx.org/r/proxy_cache_lock_timeout

Additionally, consider using the slice module.  It was specially 
designed to improve caching of large files, see here:

http://nginx.org/en/docs/http/ngx_http_slice_module.html

[...]

> proxy_cache_path /var/tmp/nginx-cache/rproxy levels=1:2
> keys_zone=rproxy:260m max_size=5g inactive=260m use_temp_path=off;

Note well: with "max_size" set to 5g the cache in question can 
hold about 3 1.5G files.  It may not be what you want for 
effective caching. 

[...]

-- 
Maxim Dounin
http://nginx.org/


From reallfqq-nginx at yahoo.fr  Thu Jun 30 17:17:11 2016
From: reallfqq-nginx at yahoo.fr (B.R.)
Date: Thu, 30 Jun 2016 19:17:11 +0200
Subject: Understanding caching
In-Reply-To: <20160630125103.GD12280@daoine.org>
References: <85599794-482C-4C04-94B3-1DE3FB21F2BE@linux-nerd.de>
 <20160630125103.GD12280@daoine.org>
Message-ID: <CALqce=34FcuuGO0=LGGV760zBHH9d0+L6piO6pgQqawu2+eVQg@mail.gmail.com>

To add to Francis' answer, browsers might not respect server specification
for expiration.

must-revalidate however forces the browser to check the expiration of the
resource before attempting of really load it again from the server.
Read: https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.4
When the browser contacts server with the right version the resource in its
local cache already, the request is replied with a 304, which you might see
in you requests log in you browser console.

The probable scenario you will notice is: the base resource (webpage) will
be downloaded again (200) because there is a user action requesting it.
However, you should see the other included resources, typically small ones
like pictures, stylesheets, are only revalidated and are replied 304.
That is the standard behavior of nginx, though, you should not need special
rules for it.
---
*B. R.*

On Thu, Jun 30, 2016 at 2:51 PM, Francis Daly <francis at daoine.org> wrote:

> On Thu, Jun 30, 2016 at 10:45:31AM +0200, Daniel Eschner wrote:
>
> Hi there,
>
> > i need to understand the caching options better. So, i have serval
> Questions ;)
>
> I think in this mail, you refer to the caching done by your browser.
>
> That is entirely controlled by your browser; but it will probably respect
> the suggestions that the server makes.
>
> "A web page" is typically one request for some html, plus multiple
> requests for css, js, and image files.
>
> Each of those requests is independent, and each of the responses can be
> cached (or not) by your browser, as it sees fit.
>
> >                 add_header        Cache-Control public;
> >                 add_header        Cache-Control must-revalidate;
> >                 expires           7d;
>
> These lead to http response headers sent to the browser; how the browser
> handles them it entirely its business. Essentially the server is
> suggesting "do cache this, cache it for 7 days, and then check again".
>
> You can look at the actual http response headers received by your browser,
> and you can check its documentation for how it is expected to handle them.
>
> (It is possible that other response headers are sent which say "do not
> cache this".)
>
> > No when i browser arround Chrome said ?From cache? that works fine for
> me but when i reload the Website it seems that only *.JPGs comming from the
> cache.
>
> "reload" is probably an instruction to your browser to fetch the (first,
> html) page again from outside its local cache.
>
> If you follow a link and then use your browser's "back" button, that
> can be an instruction to your browser to show the page again, from local
> cache if possible.
>
> Usually there is also an instruction available to your browser to invite
> it to fetch the page again, from the origin web server (bypassing or
> breaking through any intermediate caches).
>
> In any case, the multiple subsequent css, js, image requests may be
> handled from the local cache, or may be made to "the web", or may be
> made to the origin web server. Your browser decides what requests,
> if any, it will make.
>
> > Is that a Browser issue or a nginx issue? Need to know where i have to
> search ;)
>
> It seems like expected behaviour to me.
>
> It is initially a browser issue.
>
> If you can see a request that you think should not be made; and if you
> can see the previous response that you think should have been used instead;
> and if you can see a "please do not cache this" in that response; then you
> can check where in your nginx that "please do not cache this" came from.
>
> > Closing the browser and start again it dont came from cache - but as i
> understand i say it will expire in 7 Days - so why nit not comming from
> local cache?
>
> The server said "please cache this for 7 days".
>
> The browser may or may not have done that. Perhaps it never writes to
> disk; or clears the disk cache on startup, or something.
>
> Cheers,
>
>         f
> --
> Francis Daly        francis at daoine.org
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20160630/cf772302/attachment.html>