nginx-devel November 2013

nginx-devel@nginx.org

29 participants
51 discussions

by Julien Zefi

hi, i understand that NGX_AGAIN is returned when a chain could not be send because more data cannot be buffered on that socket. I need to understand the following: in my case, when i receive a request, i start a timer every 10ms and send out some data, then i create a new timer every10ms until i decide to finish sending out data (video frames). But if in some triggered callback by the timer the ngx_http_output_filter(..) returns NGX_AGAIN *i assume* NginX will send that chain as soon as the socket becomes available again. But after that happens, how can i restore my timer cycle ? thnks. J.Z.

7 years, 11 months

[PATCH] Request hang when cache_lock is used in subrequests

by Yichun Zhang (agentzh)

Hello! Akos Gyimesi reported a request hang (downstream connections stuck in the CLOSE_WAIT state forever) regarding use of proxy_cache_lock in subrequests. The issue is that when proxy_cache_lock_timeout is reached, ngx_http_file_cache_lock_wait_handler calls r->connection->write->handler() directly, but r->connection->write->handler is (usually) just ngx_http_request_handler, which simply picks up r->connection->data, which is *not* necessarily the current (sub)request, so the current subrequest may never be continued nor finalized, leading to an infinite request hang. The following patch fixes this issue for me. Comments welcome! Thanks! -agentzh --- nginx-1.4.3/src/http/ngx_http_file_cache.c 2013-10-08 05:07:14.000000000 -0700 +++ nginx-1.4.3-patched/src/http/ngx_http_file_cache.c 2013-10-26 14:47:56.184041728 -0700 @@ -432,6 +432,7 @@ ngx_http_file_cache_lock_wait_handler(ng ngx_uint_t wait; ngx_msec_t timer; ngx_http_cache_t *c; + ngx_connection_t *conn; ngx_http_request_t *r; ngx_http_file_cache_t *cache; @@ -471,7 +472,10 @@ wakeup: c->waiting = 0; r->main->blocked--; - r->connection->write->handler(r->connection->write); + + conn = r->connection; + r->write_event_handler(r); + ngx_http_run_posted_requests(conn); }

7 years, 12 months

Help with shared memory usage

by Wandenberg Peixoto

Hi, I'm trying to understand how the shared memory pool works inside the Nginx. To do that, I made a very small module which create a shared memory zone with 2097152 bytes, and allocating and freeing blocks of memory, starting from 0 and increasing by 1kb until the allocation fails. The strange parts to me were: - the maximum block I could allocate was 128000 bytes - each time the allocation fails, I started again from 0, but the maximum allocated block changed with the following profile 128000 87040 70656 62464 58368 54272 50176 46080 41984 37888 33792 29696 This is the expected behavior? Can anyone help me explaining how shared memory works? I have another module which do an intensive shared memory usage, and understanding this can help me improve it solving some "no memory" messages. I put the code in attach. Thanks, Wandenberg

8 years, 6 months

[PATCH] SSL: support automatic selection of ECDH temporary key parameters

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1375735677 25200 # Mon Aug 05 13:47:57 2013 -0700 # Node ID bff5a43ea1596c1b0d2bb0b2fe698c7c79d8348a # Parent 997b00c5c7f377a6c18874311fe39f22655616f6 SSL: support automatic selection of ECDH temporary key parameters. Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r 997b00c5c7f3 -r bff5a43ea159 src/event/ngx_event_openssl.c --- a/src/event/ngx_event_openssl.c Mon Aug 05 13:43:03 2013 -0700 +++ b/src/event/ngx_event_openssl.c Mon Aug 05 13:47:57 2013 -0700 @@ -630,6 +630,19 @@ ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_s * maximum interoperability. */ + if (ngx_strcmp(name->data, "auto") == 0) { +#ifdef SSL_CTRL_SET_ECDH_AUTO + SSL_CTX_set_ecdh_auto(ssl->ctx, 1); + return NGX_OK; +#else + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "nginx was built without OpenSSL support for " + "automatic selection of ECDH temporary key " + "parameters"); + return NGX_ERROR; +#endif + } + nid = OBJ_sn2nid((const char *) name->data); if (nid == 0) { ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,

8 years, 7 months

[PATCH] SSL: support ALPN (IETF's successor to NPN)

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1375735383 25200 # Mon Aug 05 13:43:03 2013 -0700 # Node ID 997b00c5c7f377a6c18874311fe39f22655616f6 # Parent 31932b5464f0230d5039fafed94c33f495da35f6 SSL: support ALPN (IETF's successor to NPN). Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r 31932b5464f0 -r 997b00c5c7f3 src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c Mon Aug 05 14:30:03 2013 +0400 +++ b/src/http/modules/ngx_http_ssl_module.c Mon Aug 05 13:43:03 2013 -0700 @@ -17,6 +17,17 @@ typedef ngx_int_t (*ngx_ssl_variable_han #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" #define NGX_DEFAULT_ECDH_CURVE "prime256v1" +#if (defined TLSEXT_TYPE_application_layer_protocol_negotiation \ + || defined TLSEXT_TYPE_next_proto_neg) +#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +#endif + + +#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation +static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, + const unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, void *arg); +#endif #ifdef TLSEXT_TYPE_next_proto_neg static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, @@ -267,10 +278,64 @@ static ngx_http_variable_t ngx_http_ssl static ngx_str_t ngx_http_ssl_sess_id_ctx = ngx_string("HTTP"); +#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + +static int +ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, const unsigned char **out, + unsigned char *outlen, const unsigned char *in, unsigned int inlen, + void *arg) +{ + unsigned int srvlen; + unsigned char *srv; +#if (NGX_DEBUG) + unsigned int i; +#endif +#if (NGX_HTTP_SPDY || NGX_DEBUG) + ngx_connection_t *c; + + c = ngx_ssl_get_connection(ssl_conn); +#endif +#if (NGX_DEBUG) + for (i = 0; i < inlen; i += in[i] + 1) { + ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, + "SSL ALPN supported by client: %*s", in[i], &in[i + 1]); + } +#endif + +#if (NGX_HTTP_SPDY) + ngx_http_connection_t *hc; + + hc = c->data; + + if (hc->addr_conf->spdy) { + srv = (unsigned char *) NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE; + srvlen = sizeof(NGX_SPDY_NPN_ADVERTISE NGX_HTTP_NPN_ADVERTISE) - 1; + + } else +#endif + { + srv = (unsigned char *) NGX_HTTP_NPN_ADVERTISE; + srvlen = sizeof(NGX_HTTP_NPN_ADVERTISE) - 1; + } + + if (SSL_select_next_proto((unsigned char **) out, outlen, srv, srvlen, + in, inlen) + != OPENSSL_NPN_NEGOTIATED) + { + return SSL_TLSEXT_ERR_NOACK; + } + + ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, + "SSL ALPN selected: %*s", *outlen, *out); + + return SSL_TLSEXT_ERR_OK; +} + +#endif + + #ifdef TLSEXT_TYPE_next_proto_neg -#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" - static int ngx_http_ssl_npn_advertised(ngx_ssl_conn_t *ssl_conn, const unsigned char **out, unsigned int *outlen, void *arg) @@ -534,6 +599,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * #endif +#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_http_ssl_alpn_select, NULL); +#endif + #ifdef TLSEXT_TYPE_next_proto_neg SSL_CTX_set_next_protos_advertised_cb(conf->ssl.ctx, ngx_http_ssl_npn_advertised, NULL); diff -r 31932b5464f0 -r 997b00c5c7f3 src/http/ngx_http.c --- a/src/http/ngx_http.c Mon Aug 05 14:30:03 2013 +0400 +++ b/src/http/ngx_http.c Mon Aug 05 13:43:03 2013 -0700 @@ -1346,11 +1346,12 @@ ngx_http_add_address(ngx_conf_t *cf, ngx } } -#if (NGX_HTTP_SPDY && NGX_HTTP_SSL && !defined TLSEXT_TYPE_next_proto_neg) +#if (NGX_HTTP_SPDY && NGX_HTTP_SSL && !defined TLSEXT_TYPE_next_proto_neg \ + && !defined TLSEXT_TYPE_application_layer_protocol_negotiation) if (lsopt->spdy && lsopt->ssl) { ngx_conf_log_error(NGX_LOG_WARN, cf, 0, - "nginx was built without OpenSSL NPN support, " - "SPDY is not enabled for %s", lsopt->addr); + "nginx was built without OpenSSL ALPN and NPN " + "support, SPDY is not enabled for %s", lsopt->addr); } #endif diff -r 31932b5464f0 -r 997b00c5c7f3 src/http/ngx_http_request.c --- a/src/http/ngx_http_request.c Mon Aug 05 14:30:03 2013 +0400 +++ b/src/http/ngx_http_request.c Mon Aug 05 13:43:03 2013 -0700 @@ -727,18 +727,31 @@ ngx_http_ssl_handshake_handler(ngx_conne c->ssl->no_wait_shutdown = 1; -#if (NGX_HTTP_SPDY && defined TLSEXT_TYPE_next_proto_neg) +#if (NGX_HTTP_SPDY \ + && (defined TLSEXT_TYPE_application_layer_protocol_negotiation \ + || defined TLSEXT_TYPE_next_proto_neg)) { unsigned int len; const unsigned char *data; static const ngx_str_t spdy = ngx_string(NGX_SPDY_NPN_NEGOTIATED); - SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len); +#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + SSL_get0_alpn_selected(c->ssl->connection, &data, &len); if (len == spdy.len && ngx_strncmp(data, spdy.data, spdy.len) == 0) { ngx_http_spdy_init(c->read); return; } +#endif + +#ifdef TLSEXT_TYPE_next_proto_neg + SSL_get0_next_proto_negotiated(c->ssl->connection, &data, &len); + + if (len == spdy.len && ngx_strncmp(data, spdy.data, spdy.len) == 0) { + ngx_http_spdy_init(c->read); + return; + } +#endif } #endif diff -r 31932b5464f0 -r 997b00c5c7f3 src/http/ngx_http_spdy.h --- a/src/http/ngx_http_spdy.h Mon Aug 05 14:30:03 2013 +0400 +++ b/src/http/ngx_http_spdy.h Mon Aug 05 13:43:03 2013 -0700 @@ -17,7 +17,8 @@ #define NGX_SPDY_VERSION 2 -#ifdef TLSEXT_TYPE_next_proto_neg +#if (defined TLSEXT_TYPE_application_layer_protocol_negotiation \ + || defined TLSEXT_TYPE_next_proto_neg) #define NGX_SPDY_NPN_ADVERTISE "\x06spdy/2" #define NGX_SPDY_NPN_NEGOTIATED "spdy/2" #endif

8 years, 10 months

[PATCH] SSL: added support for TLS Session Tickets (RFC5077).

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1380361691 25200 # Sat Sep 28 02:48:11 2013 -0700 # Node ID 6d3710969a18e2d0d817e297c2e17f941a58cd40 # Parent a720f0b0e08345ebb01353250f4031bb6e141385 SSL: added support for TLS Session Tickets (RFC5077). Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r a720f0b0e083 -r 6d3710969a18 src/event/ngx_event_openssl.c --- a/src/event/ngx_event_openssl.c Fri Sep 27 19:39:33 2013 +0400 +++ b/src/event/ngx_event_openssl.c Sat Sep 28 02:48:11 2013 -0700 @@ -38,6 +38,12 @@ static void ngx_ssl_expire_sessions(ngx_ static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp, ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel); +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB +static int ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn, + unsigned char *name, unsigned char *iv, EVP_CIPHER_CTX *ectx, + HMAC_CTX *hctx, int enc); +#endif + static void *ngx_openssl_create_conf(ngx_cycle_t *cycle); static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); static void ngx_openssl_exit(ngx_cycle_t *cycle); @@ -84,6 +90,9 @@ int ngx_ssl_server_conf_index; int ngx_ssl_session_cache_index; int ngx_ssl_certificate_index; int ngx_ssl_stapling_index; +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB +int ngx_ssl_session_ticket_keys_index; +#endif ngx_int_t @@ -155,6 +164,18 @@ ngx_ssl_init(ngx_log_t *log) return NGX_ERROR; } +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + + ngx_ssl_session_ticket_keys_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, + NULL, NULL); + if (ngx_ssl_session_ticket_keys_index == -1) { + ngx_ssl_error(NGX_LOG_ALERT, log, 0, + "SSL_CTX_get_ex_new_index() failed"); + return NGX_ERROR; + } + +#endif + return NGX_OK; } @@ -2240,6 +2261,122 @@ ngx_ssl_session_rbtree_insert_value(ngx_ } +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + +ngx_int_t +ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_ssl_session_ticket_keys_t *keys, time_t timeout) +{ + if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_ticket_keys_index, keys) + == 0) + { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "SSL_CTX_set_ex_data() failed"); + return NGX_ERROR; + } + + SSL_CTX_set_timeout(ssl->ctx, (long) timeout); + + if (SSL_CTX_set_tlsext_ticket_key_cb(ssl->ctx, + ngx_ssl_session_ticket_key_callback) + == 0) + { + ngx_log_error(NGX_LOG_WARN, cf->log, 0, + "nginx was built with Session Tickets support, however, " + "now it is linked dynamically to an OpenSSL library " + "which has no tlsext support, therefore Session Tickets " + "are not available"); + } + + return NGX_OK; +} + + +static int +ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn, + unsigned char *name, unsigned char *iv, EVP_CIPHER_CTX *ectx, + HMAC_CTX *hctx, int enc) +{ + int rc; + SSL_CTX *ssl_ctx; + ngx_uint_t i; + ngx_ssl_session_ticket_key_t *key; + ngx_ssl_session_ticket_keys_t *keys; +#if (NGX_DEBUG) + ngx_connection_t *c; +#endif + + ssl_ctx = SSL_get_SSL_CTX(ssl_conn); + + keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_ticket_keys_index); + if (keys == NULL) { + return -1; + } + +#if (NGX_DEBUG) + c = ngx_ssl_get_connection(ssl_conn); +#endif + + if (enc == 1) { + /* encrypt session ticket */ + + key = keys->default_key; + + ngx_log_debug3(NGX_LOG_DEBUG_HTTP, c->log, 0, + "ssl session ticket encrypt, key: \"%*s\" (%s session)", + key->name_len, key->name, + SSL_session_reused(ssl_conn) ? "reused" : "new"); + + RAND_pseudo_bytes(iv, 16); + EVP_EncryptInit_ex(ectx, EVP_aes_128_cbc(), NULL, key->aes_key, iv); + HMAC_Init_ex(hctx, key->hmac_key, 16, ngx_ssl_session_ticket_md(), + NULL); + memcpy(name, key->name, 16); + + return 0; + + } else { + /* decrypt session ticket */ + + if (ngx_strncmp(name, keys->default_key->name, 16)) { + + key = keys->keys.elts; + for (i = 0; i < keys->keys.nelts; i++) { + if (ngx_strncmp(name, key[i].name, 16) == 0) { + break; + } + } + + if (i == keys->keys.nelts) { + ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, + "ssl session ticket decrypt, key: \"%*s\" " + "not found", 16, name); + return 0; + } + + key = &key[i]; + rc = 2; /* success, renew */ + + } else { + key = keys->default_key; + rc = 1; /* success */ + } + + ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, + "ssl session ticket decrypt, key: \"%*s\"", + key->name_len, key->name); + + HMAC_Init_ex(hctx, key->hmac_key, 16, ngx_ssl_session_ticket_md(), + NULL); + EVP_DecryptInit_ex(ectx, EVP_aes_128_cbc(), NULL, key->aes_key, iv); + + return rc; + } +} + +#endif + + void ngx_ssl_cleanup_ctx(void *data) { diff -r a720f0b0e083 -r 6d3710969a18 src/event/ngx_event_openssl.h --- a/src/event/ngx_event_openssl.h Fri Sep 27 19:39:33 2013 +0400 +++ b/src/event/ngx_event_openssl.h Sat Sep 28 02:48:11 2013 -0700 @@ -83,6 +83,24 @@ typedef struct { } ngx_ssl_session_cache_t; +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + +typedef struct { + size_t name_len; + u_char name[16]; + + u_char aes_key[16]; + u_char hmac_key[16]; +} ngx_ssl_session_ticket_key_t; + + +typedef struct { + ngx_ssl_session_ticket_key_t *default_key; + ngx_array_t keys; +} ngx_ssl_session_ticket_keys_t; + +#endif + #define NGX_SSL_SSLv2 0x0002 #define NGX_SSL_SSLv3 0x0004 @@ -136,6 +154,16 @@ ngx_int_t ngx_ssl_set_session(ngx_connec || n == X509_V_ERR_CERT_UNTRUSTED \ || n == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB +ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_ssl_session_ticket_keys_t *keys, time_t timeout); + +#ifdef OPENSSL_NO_SHA256 +#define ngx_ssl_session_ticket_md EVP_sha1 +#else +#define ngx_ssl_session_ticket_md EVP_sha256 +#endif +#endif ngx_int_t ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); @@ -175,6 +203,9 @@ extern int ngx_ssl_server_conf_index; extern int ngx_ssl_session_cache_index; extern int ngx_ssl_certificate_index; extern int ngx_ssl_stapling_index; +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB +extern int ngx_ssl_session_ticket_keys_index; +#endif #endif /* _NGX_EVENT_OPENSSL_H_INCLUDED_ */ diff -r a720f0b0e083 -r 6d3710969a18 src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c Fri Sep 27 19:39:33 2013 +0400 +++ b/src/http/modules/ngx_http_ssl_module.c Sat Sep 28 02:48:11 2013 -0700 @@ -38,6 +38,11 @@ static char *ngx_http_ssl_enable(ngx_con static char *ngx_http_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB +static char *ngx_http_ssl_session_ticket_key(ngx_conf_t *cf, ngx_command_t *cmd, + void *conf); +#endif + static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); @@ -153,6 +158,17 @@ static ngx_command_t ngx_http_ssl_comma 0, NULL }, +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + + { ngx_string("ssl_session_ticket_key"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE23, + ngx_http_ssl_session_ticket_key, + NGX_HTTP_SRV_CONF_OFFSET, + 0, + NULL }, + +#endif + { ngx_string("ssl_session_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, ngx_conf_set_sec_slot, @@ -413,6 +429,7 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t * sscf->shm_zone = NULL; * sscf->stapling_file = { 0, NULL }; * sscf->stapling_responder = { 0, NULL }; + * sscf->session_ticket_keys = NULL; */ sscf->enable = NGX_CONF_UNSET; @@ -634,6 +651,30 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * } +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + + if (conf->session_ticket_keys == NULL) { + conf->session_ticket_keys = prev->session_ticket_keys; + } + + if (conf->session_ticket_keys) { + if (conf->session_ticket_keys->default_key == NULL) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "default \"ssl_session_ticket_key\" is not defined"); + return NGX_CONF_ERROR; + } + + if (ngx_ssl_session_ticket_keys(cf, &conf->ssl, + conf->session_ticket_keys, + conf->session_timeout) + != NGX_OK) + { + return NGX_CONF_ERROR; + } + } + +#endif + return NGX_CONF_OK; } @@ -769,6 +810,146 @@ invalid: return NGX_CONF_ERROR; } +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + +static char * +ngx_http_ssl_session_ticket_key(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) +{ + ngx_http_ssl_srv_conf_t *sscf = conf; + + char *rc; + u_char buf[32]; + ssize_t n; + ngx_str_t *value; + ngx_file_t file; + ngx_uint_t i; + ngx_file_info_t fi; + ngx_ssl_session_ticket_key_t *key, *k; + + if (sscf->session_ticket_keys == NULL) { + sscf->session_ticket_keys = ngx_pcalloc(cf->pool, + sizeof(ngx_ssl_session_ticket_keys_t)); + if (sscf->session_ticket_keys == NULL) { + return NGX_CONF_ERROR; + } + + if (ngx_array_init(&sscf->session_ticket_keys->keys, cf->pool, 4, + sizeof(ngx_ssl_session_ticket_key_t)) + != NGX_OK) + { + return NGX_CONF_ERROR; + } + } + + key = ngx_array_push(&sscf->session_ticket_keys->keys); + if (key == NULL) { + return NGX_CONF_ERROR; + } + + value = cf->args->elts; + + if (value[1].len > 16) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "\"ssl_session_ticket_key\" name \"%V\" too long, " + "it cannot exceed 16 characters", &value[1]); + return NGX_CONF_ERROR; + } + + if (cf->args->nelts == 4) { + + if (ngx_strcmp(value[3].data, "default")) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "invalid parameter \"%V\"", &value[3]); + return NGX_CONF_ERROR; + } + + if (sscf->session_ticket_keys->default_key) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "default \"ssl_session_ticket_key\" is already " + "defined"); + return NGX_CONF_ERROR; + } + + sscf->session_ticket_keys->default_key = key; + } + + ngx_memzero(key->name, 16); + key->name_len = ngx_cpymem(key->name, value[1].data, value[1].len) + - key->name; + + k = sscf->session_ticket_keys->keys.elts; + for (i = 0; i < sscf->session_ticket_keys->keys.nelts - 1; i++) { + if (ngx_strncmp(key->name, k[i].name, 16) == 0) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "\"ssl_session_ticket_key\" named \"%V\" " + "is already defined", &value[1]); + return NGX_CONF_ERROR; + } + } + + if (ngx_conf_full_name(cf->cycle, &value[2], 1) != NGX_OK) { + return NGX_CONF_ERROR; + } + + ngx_memzero(&file, sizeof(ngx_file_t)); + file.name = value[2]; + file.log = cf->log; + + file.fd = ngx_open_file(file.name.data, NGX_FILE_RDONLY, 0, 0); + if (file.fd == NGX_INVALID_FILE) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno, + ngx_open_file_n " \"%V\" failed", &file.name); + + return NGX_CONF_ERROR; + } + + rc = NGX_CONF_ERROR; + + if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) { + ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, + ngx_fd_info_n " \"%V\" failed", &file.name); + goto failed; + } + + if (ngx_file_size(&fi) != 32) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "\"%V\" must be 32 bytes", &file.name); + goto failed; + } + + n = ngx_read_file(&file, buf, 32, 0); + + if (n == NGX_ERROR) { + ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, + ngx_read_file_n " \"%V\" failed", &file.name); + goto failed; + } + + if (n != 32) { + ngx_conf_log_error(NGX_LOG_CRIT, cf, 0, + ngx_read_file_n " \"%V\" returned only %z bytes " + "instead of 32", &file.name, n); + goto failed; + } + + ngx_memcpy(key->aes_key, buf, 16); + ngx_memcpy(key->hmac_key, buf + 16, 16); + + rc = NGX_CONF_OK; + +failed: + + if (file.fd != NGX_INVALID_FILE) { + if (ngx_close_file(file.fd) == NGX_FILE_ERROR) { + ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno, + ngx_close_file_n " \"%V\" failed", &file.name); + } + } + + return rc; +} + +#endif static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf) diff -r a720f0b0e083 -r 6d3710969a18 src/http/modules/ngx_http_ssl_module.h --- a/src/http/modules/ngx_http_ssl_module.h Fri Sep 27 19:39:33 2013 +0400 +++ b/src/http/modules/ngx_http_ssl_module.h Sat Sep 28 02:48:11 2013 -0700 @@ -49,6 +49,10 @@ typedef struct { u_char *file; ngx_uint_t line; + +#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB + ngx_ssl_session_ticket_keys_t *session_ticket_keys; +#endif } ngx_http_ssl_srv_conf_t;

8 years, 11 months

IPv6 support in resolver

by ToSHiC

Hello, We needed this feature in our company, I found that it is in milestones of version 1.5 but doesn't exist yet. So I've implemented it based in 1.3 code and merged in current 1.5 code. When I wrote this code I mostly cared about minimum intrusion into other parts of nginx. IPv6 fallback logic is not a straightforward implementation of suggested by RFC. RFC states that IPv6 resolving have priority over IPv4, and it's not very good for Internet we have currently. With this patch you can specify priority, and in upstream and mail modules I've set IPv4 as preferred address family. Patch is pretty big and I hope it'll not break mailing list or mail clients. >From b98c8cd3bd0bca9df88a8d6d660015a502b9727c Mon Sep 17 00:00:00 2001 From: Anton Kortunov <toshic.toshic(a)gmail.com> Date: Fri, 14 Jun 2013 20:38:41 +0400 Subject: [PATCH] IPv6 resolver --- src/core/ngx_inet.h | 10 + src/core/ngx_resolver.c | 436 +++++++++++++++++++++++++----- src/core/ngx_resolver.h | 23 ++- src/http/ngx_http_upstream.c | 16 +- src/http/ngx_http_upstream.h | 2 +- src/http/ngx_http_upstream_round_robin.c | 49 +++- src/mail/ngx_mail_smtp_handler.c | 95 ++++++-- 7 files changed, 524 insertions(+), 107 deletions(-) diff --git a/src/core/ngx_inet.h b/src/core/ngx_inet.h index 6a5a368..077ed34 100644 --- a/src/core/ngx_inet.h +++ b/src/core/ngx_inet.h @@ -68,6 +68,16 @@ typedef struct { typedef struct { + ngx_uint_t family; + union { + in_addr_t v4; +#if (NGX_HAVE_INET6) + struct in6_addr v6; +#endif + } u; +} ngx_ipaddr_t; + +typedef struct { struct sockaddr *sockaddr; socklen_t socklen; ngx_str_t name; diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c index d59d0c4..5953b9c 100644 --- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c @@ -71,12 +71,12 @@ static void ngx_resolver_process_response(ngx_resolver_t *r, u_char *buf, size_t n); static void ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n, ngx_uint_t ident, ngx_uint_t code, ngx_uint_t nan, ngx_uint_t ans); -static void ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, +void ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, ngx_uint_t ident, ngx_uint_t code, ngx_uint_t nan); static ngx_resolver_node_t *ngx_resolver_lookup_name(ngx_resolver_t *r, ngx_str_t *name, uint32_t hash); static ngx_resolver_node_t *ngx_resolver_lookup_addr(ngx_resolver_t *r, - in_addr_t addr); + ngx_ipaddr_t addr, uint32_t hash); static void ngx_resolver_rbtree_insert_value(ngx_rbtree_node_t *temp, ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel); static ngx_int_t ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, @@ -88,7 +88,7 @@ static void *ngx_resolver_calloc(ngx_resolver_t *r, size_t size); static void ngx_resolver_free(ngx_resolver_t *r, void *p); static void ngx_resolver_free_locked(ngx_resolver_t *r, void *p); static void *ngx_resolver_dup(ngx_resolver_t *r, void *src, size_t size); -static in_addr_t *ngx_resolver_rotate(ngx_resolver_t *r, in_addr_t *src, +static ngx_ipaddr_t *ngx_resolver_rotate(ngx_resolver_t *r, ngx_ipaddr_t *src, ngx_uint_t n); static u_char *ngx_resolver_log_error(ngx_log_t *log, u_char *buf, size_t len); @@ -270,13 +270,27 @@ ngx_resolver_cleanup_tree(ngx_resolver_t *r, ngx_rbtree_t *tree) ngx_resolver_ctx_t * ngx_resolve_start(ngx_resolver_t *r, ngx_resolver_ctx_t *temp) { - in_addr_t addr; + ngx_ipaddr_t addr; ngx_resolver_ctx_t *ctx; if (temp) { - addr = ngx_inet_addr(temp->name.data, temp->name.len); + addr.family = 0; - if (addr != INADDR_NONE) { + + addr.u.v4 = ngx_inet_addr(temp->name.data, temp->name.len); + + if (addr.u.v4 != INADDR_NONE) { + + addr.family = AF_INET; + +#if (NGX_HAVE_INET6) + } else if (ngx_inet6_addr(temp->name.data, temp->name.len, addr.u.v6.s6_addr) == NGX_OK) { + + addr.family = AF_INET6; +#endif + } + + if (addr.family) { temp->resolver = r; temp->state = NGX_OK; temp->naddrs = 1; @@ -417,7 +431,7 @@ static ngx_int_t ngx_resolve_name_locked(ngx_resolver_t *r, ngx_resolver_ctx_t *ctx) { uint32_t hash; - in_addr_t addr, *addrs; + ngx_ipaddr_t addr, *addrs; ngx_int_t rc; ngx_uint_t naddrs; ngx_resolver_ctx_t *next; @@ -429,7 +443,11 @@ ngx_resolve_name_locked(ngx_resolver_t *r, ngx_resolver_ctx_t *ctx) if (rn) { - if (rn->valid >= ngx_time()) { + if (rn->valid >= ngx_time() +#if (NGX_HAVE_INET6) + && rn->qtype != NGX_RESOLVE_RETRY +#endif + ) { ngx_log_debug0(NGX_LOG_DEBUG_CORE, r->log, 0, "resolve cached"); @@ -446,7 +464,6 @@ ngx_resolve_name_locked(ngx_resolver_t *r, ngx_resolver_ctx_t *ctx) /* NGX_RESOLVE_A answer */ if (naddrs != 1) { - addr = 0; addrs = ngx_resolver_rotate(r, rn->u.addrs, naddrs); if (addrs == NULL) { return NGX_ERROR; @@ -506,6 +523,8 @@ ngx_resolve_name_locked(ngx_resolver_t *r, ngx_resolver_ctx_t *ctx) } while (ctx); return NGX_OK; + } else { + rn->qtype = ctx->type; } if (rn->waiting) { @@ -552,6 +571,7 @@ ngx_resolve_name_locked(ngx_resolver_t *r, ngx_resolver_ctx_t *ctx) rn->node.key = hash; rn->nlen = (u_short) ctx->name.len; rn->query = NULL; + rn->qtype = ctx->type; ngx_rbtree_insert(&r->name_rbtree, &rn->node); } @@ -629,17 +649,40 @@ failed: ngx_int_t ngx_resolve_addr(ngx_resolver_ctx_t *ctx) { + uint32_t hash; u_char *name; ngx_resolver_t *r; ngx_resolver_node_t *rn; r = ctx->resolver; + rn = NULL; + + hash = ctx->addr.family; - ctx->addr = ntohl(ctx->addr); + switch(ctx->addr.family) { + + case AF_INET: + ctx->addr.u.v4 = ntohl(ctx->addr.u.v4); + ngx_crc32_update(&hash, (u_char *)&ctx->addr.u.v4, sizeof(in_addr_t)); +ngx_log_debug3(NGX_LOG_DEBUG_CORE, r->log, 0, + "resolve addr hash: %xd, addr:%xd, family: %d", hash, ctx->addr.u.v4, ctx->addr.family); + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + ngx_crc32_update(&hash, (u_char *)&ctx->addr.u.v6, sizeof(struct in6_addr)); + break; +#endif + + default: + goto failed; + } /* lock addr mutex */ - rn = ngx_resolver_lookup_addr(r, ctx->addr); + rn = ngx_resolver_lookup_addr(r, ctx->addr, hash); + ngx_log_error(r->log_level, r->log, 0, + "resolve: in resolve_addr searching, hash = %xd, rn = %p", hash, rn); if (rn) { @@ -694,8 +737,10 @@ ngx_resolve_addr(ngx_resolver_ctx_t *ctx) goto failed; } - rn->node.key = ctx->addr; + rn->node.key = hash; rn->query = NULL; + rn->qtype = ctx->type; + rn->u.addr = ctx->addr; ngx_rbtree_insert(&r->addr_rbtree, &rn->node); } @@ -768,10 +813,11 @@ failed: void ngx_resolve_addr_done(ngx_resolver_ctx_t *ctx) { - in_addr_t addr; + uint32_t hash; ngx_resolver_t *r; ngx_resolver_ctx_t *w, **p; ngx_resolver_node_t *rn; + char text[NGX_SOCKADDR_STRLEN]; r = ctx->resolver; @@ -786,7 +832,25 @@ ngx_resolve_addr_done(ngx_resolver_ctx_t *ctx) if (ctx->state == NGX_AGAIN || ctx->state == NGX_RESOLVE_TIMEDOUT) { - rn = ngx_resolver_lookup_addr(r, ctx->addr); + hash = ctx->addr.family; + + switch(ctx->addr.family) { + + case AF_INET: + ngx_crc32_update(&hash, (u_char *)&ctx->addr.u.v4, sizeof(in_addr_t)); + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + ngx_crc32_update(&hash, (u_char *)&ctx->addr.u.v6, sizeof(struct in6_addr)); + break; +#endif + + default: + goto failed; + } + + rn = ngx_resolver_lookup_addr(r, ctx->addr, hash); if (rn) { p = &rn->waiting; @@ -804,12 +868,13 @@ ngx_resolve_addr_done(ngx_resolver_ctx_t *ctx) } } - addr = ntohl(ctx->addr); +failed: + + //addr = ntohl(ctx->addr); + inet_ntop(ctx->addr.family, &ctx->addr.u, text, NGX_SOCKADDR_STRLEN); ngx_log_error(NGX_LOG_ALERT, r->log, 0, - "could not cancel %ud.%ud.%ud.%ud resolving", - (addr >> 24) & 0xff, (addr >> 16) & 0xff, - (addr >> 8) & 0xff, addr & 0xff); + "could not cancel %s resolving", text); } done: @@ -1130,6 +1195,9 @@ found: switch (qtype) { case NGX_RESOLVE_A: +#if (NGX_HAVE_INET6) + case NGX_RESOLVE_AAAA: +#endif ngx_resolver_process_a(r, buf, n, ident, code, nan, i + sizeof(ngx_resolver_qs_t)); @@ -1178,7 +1246,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, size_t len; int32_t ttl; uint32_t hash; - in_addr_t addr, *addrs; + ngx_ipaddr_t addr, *addrs; ngx_str_t name; ngx_uint_t qtype, qident, naddrs, a, i, n, start; ngx_resolver_an_t *an; @@ -1212,12 +1280,55 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, goto failed; } - ngx_resolver_free(r, name.data); - if (code == 0 && nan == 0) { + +#if (NGX_HAVE_INET6) + // If it was required dual type v4|v6 resolv create one more request + if (rn->qtype == NGX_RESOLVE_A_AAAA + || rn->qtype == NGX_RESOLVE_AAAA_A) { + + ngx_queue_remove(&rn->queue); + + rn->valid = ngx_time() + (r->valid ? r->valid : ttl); + rn->expire = ngx_time() + r->expire; + + ngx_queue_insert_head(&r->name_expire_queue, &rn->queue); + + ctx = rn->waiting; + rn->waiting = NULL; + + if (ctx) { + ctx->name = name; + + switch (rn->qtype) { + + case NGX_RESOLVE_A_AAAA: + ctx->type = NGX_RESOLVE_AAAA; + break; + + case NGX_RESOLVE_AAAA_A: + ctx->type = NGX_RESOLVE_A; + break; + } + + ngx_log_debug2(NGX_LOG_DEBUG_CORE, r->log, 0, + "restarting request for name %V, with type %ud", + &name, ctx->type); + + rn->qtype = NGX_RESOLVE_RETRY; + + (void) ngx_resolve_name_locked(r, ctx); + } + + return; + } +#endif + code = 3; /* NXDOMAIN */ } + ngx_resolver_free(r, name.data); + if (code) { next = rn->waiting; rn->waiting = NULL; @@ -1243,7 +1354,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, i = ans; naddrs = 0; - addr = 0; + addr.family = 0; addrs = NULL; cname = NULL; qtype = 0; @@ -1302,13 +1413,30 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, goto short_response; } - addr = htonl((buf[i] << 24) + (buf[i + 1] << 16) + addr.family = AF_INET; + addr.u.v4 = htonl((buf[i] << 24) + (buf[i + 1] << 16) + (buf[i + 2] << 8) + (buf[i + 3])); naddrs++; i += len; +#if (NGX_HAVE_INET6) + } else if (qtype == NGX_RESOLVE_AAAA) { + + i += sizeof(ngx_resolver_an_t); + + if (i + len > last) { + goto short_response; + } + + addr.family = AF_INET6; + ngx_memcpy(&addr.u.v6.s6_addr, &buf[i], 16); + + naddrs++; + + i += len; +#endif } else if (qtype == NGX_RESOLVE_CNAME) { cname = &buf[i] + sizeof(ngx_resolver_an_t); i += sizeof(ngx_resolver_an_t) + len; @@ -1333,7 +1461,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, } else { - addrs = ngx_resolver_alloc(r, naddrs * sizeof(in_addr_t)); + addrs = ngx_resolver_alloc(r, naddrs * sizeof(ngx_ipaddr_t)); if (addrs == NULL) { return; } @@ -1369,12 +1497,23 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, if (qtype == NGX_RESOLVE_A) { - addrs[n++] = htonl((buf[i] << 24) + (buf[i + 1] << 16) + addrs[n].family = AF_INET; + addrs[n++].u.v4 = htonl((buf[i] << 24) + (buf[i + 1] << 16) + (buf[i + 2] << 8) + (buf[i + 3])); if (n == naddrs) { break; } +#if (NGX_HAVE_INET6) + } else if (qtype == NGX_RESOLVE_AAAA) { + + addrs[n].family = AF_INET6; + ngx_memcpy(&addrs[n++].u.v6.s6_addr, &buf[i], 16); + + if (n == naddrs) { + break; + } +#endif } i += len; @@ -1383,7 +1522,7 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last, rn->u.addrs = addrs; addrs = ngx_resolver_dup(r, rn->u.addrs, - naddrs * sizeof(in_addr_t)); + naddrs * sizeof(ngx_ipaddr_t)); if (addrs == NULL) { return; } @@ -1486,13 +1625,14 @@ failed: } -static void +void ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, ngx_uint_t ident, ngx_uint_t code, ngx_uint_t nan) { - char *err; + char *err = NULL; + uint32_t hash = 0; size_t len; - in_addr_t addr; + ngx_ipaddr_t addr; int32_t ttl; ngx_int_t digit; ngx_str_t name; @@ -1500,12 +1640,16 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, ngx_resolver_an_t *an; ngx_resolver_ctx_t *ctx, *next; ngx_resolver_node_t *rn; + char text[NGX_SOCKADDR_STRLEN]; if (ngx_resolver_copy(r, NULL, buf, &buf[12], &buf[n]) != NGX_OK) { goto invalid_in_addr_arpa; } - addr = 0; + ngx_memzero(&addr, sizeof(ngx_ipaddr_t)); + + /* Try to parse request as in-addr.arpa */ + addr.family = AF_INET; i = 12; for (mask = 0; mask < 32; mask += 8) { @@ -1516,7 +1660,7 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, goto invalid_in_addr_arpa; } - addr += digit << mask; + addr.u.v4 += digit << mask; i += len; } @@ -1524,15 +1668,79 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, goto invalid_in_addr_arpa; } + i += sizeof("\7in-addr\4arpa") + sizeof(ngx_resolver_qs_t); + + goto found; + +invalid_in_addr_arpa: + +#if (NGX_HAVE_INET6) + /* Try to parse request as ip6.arpa */ + addr.family = AF_INET6; + i = 12; + + for (len = 15; len < 16; len--) { + if (buf[i++] != 1) + goto invalid_arpa; + + digit = ngx_hextoi(&buf[i++], 1); + if (digit == NGX_ERROR || digit > 16) { + goto invalid_arpa; + } + + addr.u.v6.s6_addr[len] = digit; + + if (buf[i++] != 1) + goto invalid_arpa; + + + digit = ngx_hextoi(&buf[i++], 1); + if (digit == NGX_ERROR || digit > 16) { + goto invalid_arpa; + } + + addr.u.v6.s6_addr[len] += digit << 4; + } + + if (ngx_strcmp(&buf[i], "\3ip6\4arpa") != 0) { + goto invalid_arpa; + } + + i += sizeof("\3ip6\4arpa") + sizeof(ngx_resolver_qs_t); + +#else /* NGX_HAVE_INET6 */ + goto invalid_arpa; +#endif + +found: + /* lock addr mutex */ - rn = ngx_resolver_lookup_addr(r, addr); + hash = addr.family; + + switch(addr.family) { + + case AF_INET: + ngx_crc32_update(&hash, (u_char *)&addr.u.v4, sizeof(in_addr_t)); + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + ngx_crc32_update(&hash, (u_char *)&addr.u.v6, sizeof(struct in6_addr)); + break; +#endif + + default: + goto invalid; + } + + rn = ngx_resolver_lookup_addr(r, addr, hash); + + inet_ntop(addr.family, &addr.u, text, NGX_SOCKADDR_STRLEN); if (rn == NULL || rn->query == NULL) { ngx_log_error(r->log_level, r->log, 0, - "unexpected response for %ud.%ud.%ud.%ud", - (addr >> 24) & 0xff, (addr >> 16) & 0xff, - (addr >> 8) & 0xff, addr & 0xff); + "unexpected response for %s", text); goto failed; } @@ -1540,12 +1748,15 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, if (ident != qident) { ngx_log_error(r->log_level, r->log, 0, - "wrong ident %ui response for %ud.%ud.%ud.%ud, expect %ui", - ident, (addr >> 24) & 0xff, (addr >> 16) & 0xff, - (addr >> 8) & 0xff, addr & 0xff, qident); + "wrong ident %ui response for %s, expect %ui", + ident, text, qident); goto failed; } + ngx_log_error(r->log_level, r->log, 0, + "code: %d, nan: %d", + code, nan); + if (code == 0 && nan == 0) { code = 3; /* NXDOMAIN */ } @@ -1573,8 +1784,6 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, return; } - i += sizeof("\7in-addr\4arpa") + sizeof(ngx_resolver_qs_t); - if (i + 2 + sizeof(ngx_resolver_an_t) > (ngx_uint_t) n) { goto short_response; } @@ -1654,10 +1863,10 @@ ngx_resolver_process_ptr(ngx_resolver_t *r, u_char *buf, size_t n, return; -invalid_in_addr_arpa: +invalid_arpa: ngx_log_error(r->log_level, r->log, 0, - "invalid in-addr.arpa name in DNS response"); + "invalid in-addr.arpa or ip6.arpa name in DNS response"); return; short_response: @@ -1722,28 +1931,54 @@ ngx_resolver_lookup_name(ngx_resolver_t *r, ngx_str_t *name, uint32_t hash) static ngx_resolver_node_t * -ngx_resolver_lookup_addr(ngx_resolver_t *r, in_addr_t addr) +ngx_resolver_lookup_addr(ngx_resolver_t *r, ngx_ipaddr_t addr, uint32_t hash) { + ngx_int_t rc; ngx_rbtree_node_t *node, *sentinel; + ngx_resolver_node_t *rn; node = r->addr_rbtree.root; sentinel = r->addr_rbtree.sentinel; while (node != sentinel) { - if (addr < node->key) { + if (hash < node->key) { node = node->left; continue; } - if (addr > node->key) { + if (hash > node->key) { node = node->right; continue; } - /* addr == node->key */ + /* hash == node->key */ + + rn = (ngx_resolver_node_t *) node; + + rc = addr.family - rn->u.addr.family; + + if (rc == 0) { + + switch (addr.family) { + case AF_INET: + rc = ngx_memn2cmp((u_char *)&addr.u.v4, (u_char *)&rn->u.addr.u.v4, sizeof(in_addr_t), sizeof(in_addr_t)); + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + rc = ngx_memn2cmp((u_char *)&addr.u.v6, (u_char *)&rn->u.addr.u.v6, sizeof(struct in6_addr), sizeof(struct in6_addr)); + break; +#endif + } + + if (rc == 0) { + return rn; + } + + } - return (ngx_resolver_node_t *) node; + node = (rc < 0) ? node->left : node->right; } /* not found */ @@ -1758,6 +1993,7 @@ ngx_resolver_rbtree_insert_value(ngx_rbtree_node_t *temp, { ngx_rbtree_node_t **p; ngx_resolver_node_t *rn, *rn_temp; + ngx_int_t rc; for ( ;; ) { @@ -1774,8 +2010,29 @@ ngx_resolver_rbtree_insert_value(ngx_rbtree_node_t *temp, rn = (ngx_resolver_node_t *) node; rn_temp = (ngx_resolver_node_t *) temp; - p = (ngx_memn2cmp(rn->name, rn_temp->name, rn->nlen, rn_temp->nlen) - < 0) ? &temp->left : &temp->right; + if (rn->qtype == NGX_RESOLVE_PTR) { + rc = rn->u.addr.family - rn_temp->u.addr.family; + + if (rc == 0) { + + switch (rn->u.addr.family) { + case AF_INET: + rc = ngx_memn2cmp((u_char *)&rn->u.addr.u.v4, (u_char *)&rn_temp->u.addr.u.v4, sizeof(in_addr_t), sizeof(in_addr_t)); + break; + + #if (NGX_HAVE_INET6) + case AF_INET6: + rc = ngx_memn2cmp((u_char *)&rn->u.addr.u.v6, (u_char *)&rn_temp->u.addr.u.v6, sizeof(struct in6_addr), sizeof(struct in6_addr)); + break; + #endif + } + } + + } else { + rc = ngx_memn2cmp(rn->name, rn_temp->name, rn->nlen, rn_temp->nlen); + } + + p = (rc < 0) ? &temp->left : &temp->right; } if (*p == sentinel) { @@ -1838,7 +2095,20 @@ ngx_resolver_create_name_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) qs = (ngx_resolver_qs_t *) p; /* query type */ - qs->type_hi = 0; qs->type_lo = (u_char) ctx->type; + qs->type_hi = 0; qs->type_lo = (u_char) rn->qtype; + +#if (NGX_HAVE_INET6) + switch (rn->qtype) { + + case NGX_RESOLVE_A_AAAA: + qs->type_lo = NGX_RESOLVE_A; + break; + + case NGX_RESOLVE_AAAA_A: + qs->type_lo = NGX_RESOLVE_AAAA; + break; + } +#endif /* IP query class */ qs->class_hi = 0; qs->class_lo = 1; @@ -1880,8 +2150,6 @@ ngx_resolver_create_name_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) } -/* AF_INET only */ - static ngx_int_t ngx_resolver_create_addr_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) { @@ -1892,7 +2160,7 @@ ngx_resolver_create_addr_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) ngx_resolver_query_t *query; len = sizeof(ngx_resolver_query_t) - + sizeof(".255.255.255.255.in-addr.arpa.") - 1 + + NGX_PTR_QUERY_LEN + sizeof(ngx_resolver_qs_t); p = ngx_resolver_alloc(ctx->resolver, len); @@ -1919,18 +2187,50 @@ ngx_resolver_create_addr_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) p += sizeof(ngx_resolver_query_t); - for (n = 0; n < 32; n += 8) { - d = ngx_sprintf(&p[1], "%ud", (ctx->addr >> n) & 0xff); - *p = (u_char) (d - &p[1]); - p = d; + switch (ctx->addr.family) { + + case AF_INET: + for (n = 0; n < 32; n += 8) { + d = ngx_sprintf(&p[1], "%ud", (ctx->addr.u.v4 >> n) & 0xff); + *p = (u_char) (d - &p[1]); + p = d; + } + + /* query type "PTR", IP query class */ + ngx_memcpy(p, "\7in-addr\4arpa\0\0\14\0\1", 18); + + rn->qlen = (u_short) + (p + sizeof("\7in-addr\4arpa") + sizeof(ngx_resolver_qs_t) + - rn->query); + + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + for (n = 15; n >= 0; n--) { + p = ngx_sprintf(p, "\1%xd\1%xd", + (ctx->addr.u.v6.s6_addr[n]) & 0xf, + (ctx->addr.u.v6.s6_addr[n] >> 4) & 0xf); + + } + + /* query type "PTR", IP query class */ + ngx_memcpy(p, "\3ip6\4arpa\0\0\14\0\1", 18); + + rn->qlen = (u_short) + (p + sizeof("\3ip6\4arpa") + sizeof(ngx_resolver_qs_t) + - rn->query); + + break; +#endif + + default: + return NGX_ERROR; } - /* query type "PTR", IP query class */ - ngx_memcpy(p, "\7in-addr\4arpa\0\0\14\0\1", 18); +ngx_log_debug2(NGX_LOG_DEBUG_CORE, ctx->resolver->log, 0, + "resolve: query %s, ident %i", (rn->query+12), ident & 0xffff); - rn->qlen = (u_short) - (p + sizeof("\7in-addr\4arpa") + sizeof(ngx_resolver_qs_t) - - rn->query); return NGX_OK; } @@ -2136,13 +2436,13 @@ ngx_resolver_dup(ngx_resolver_t *r, void *src, size_t size) } -static in_addr_t * -ngx_resolver_rotate(ngx_resolver_t *r, in_addr_t *src, ngx_uint_t n) +static ngx_ipaddr_t * +ngx_resolver_rotate(ngx_resolver_t *r, ngx_ipaddr_t *src, ngx_uint_t n) { void *dst, *p; ngx_uint_t j; - dst = ngx_resolver_alloc(r, n * sizeof(in_addr_t)); + dst = ngx_resolver_alloc(r, n * sizeof(ngx_ipaddr_t)); if (dst == NULL) { return dst; @@ -2151,12 +2451,12 @@ ngx_resolver_rotate(ngx_resolver_t *r, in_addr_t *src, ngx_uint_t n) j = ngx_random() % n; if (j == 0) { - ngx_memcpy(dst, src, n * sizeof(in_addr_t)); + ngx_memcpy(dst, src, n * sizeof(ngx_ipaddr_t)); return dst; } - p = ngx_cpymem(dst, &src[j], (n - j) * sizeof(in_addr_t)); - ngx_memcpy(p, src, j * sizeof(in_addr_t)); + p = ngx_cpymem(dst, &src[j], (n - j) * sizeof(ngx_ipaddr_t)); + ngx_memcpy(p, src, j * sizeof(ngx_ipaddr_t)); return dst; } diff --git a/src/core/ngx_resolver.h b/src/core/ngx_resolver.h index ae34ca5..a45b244 100644 --- a/src/core/ngx_resolver.h +++ b/src/core/ngx_resolver.h @@ -20,6 +20,15 @@ #define NGX_RESOLVE_TXT 16 #define NGX_RESOLVE_DNAME 39 +#if (NGX_HAVE_INET6) + +#define NGX_RESOLVE_AAAA 28 +#define NGX_RESOLVE_A_AAAA 1000 +#define NGX_RESOLVE_AAAA_A 1001 +#define NGX_RESOLVE_RETRY 1002 + +#endif + #define NGX_RESOLVE_FORMERR 1 #define NGX_RESOLVE_SERVFAIL 2 #define NGX_RESOLVE_NXDOMAIN 3 @@ -32,6 +41,11 @@ #define NGX_RESOLVER_MAX_RECURSION 50 +#if (NGX_HAVE_INET6) +#define NGX_PTR_QUERY_LEN (sizeof(".f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.ip6.arpa.") - 1) +#else +#define NGX_PTR_QUERY_LEN (sizeof(".255.255.255.255.in-addr.arpa.") - 1) +#endif typedef struct { ngx_connection_t *connection; @@ -58,10 +72,11 @@ typedef struct { u_short qlen; u_char *query; + ngx_int_t qtype; union { - in_addr_t addr; - in_addr_t *addrs; + ngx_ipaddr_t addr; + ngx_ipaddr_t *addrs; u_char *cname; } u; @@ -121,8 +136,8 @@ struct ngx_resolver_ctx_s { ngx_str_t name; ngx_uint_t naddrs; - in_addr_t *addrs; - in_addr_t addr; + ngx_ipaddr_t *addrs; + ngx_ipaddr_t addr; ngx_resolver_handler_pt handler; void *data; diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c index 16e6602..7a8035c 100644 --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c @@ -638,7 +638,11 @@ ngx_http_upstream_init_request(ngx_http_request_t *r) } ctx->name = *host; +#if (NGX_HAVE_INET6) + ctx->type = NGX_RESOLVE_A_AAAA; +#else ctx->type = NGX_RESOLVE_A; +#endif ctx->handler = ngx_http_upstream_resolve_handler; ctx->data = r; ctx->timeout = clcf->resolver_timeout; @@ -912,16 +916,14 @@ ngx_http_upstream_resolve_handler(ngx_resolver_ctx_t *ctx) #if (NGX_DEBUG) { - in_addr_t addr; + char text[NGX_SOCKADDR_STRLEN]; ngx_uint_t i; - for (i = 0; i < ctx->naddrs; i++) { - addr = ntohl(ur->addrs[i]); + for (i = 0; i < ur->naddrs; i++) { + inet_ntop(ur->addrs[i].family, &ur->addrs[i].u, text, NGX_SOCKADDR_STRLEN); - ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "name was resolved to %ud.%ud.%ud.%ud", - (addr >> 24) & 0xff, (addr >> 16) & 0xff, - (addr >> 8) & 0xff, addr & 0xff); + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "name was resolved to %s", text); } } #endif diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h index fd4e36b..9e88a9a 100644 --- a/src/http/ngx_http_upstream.h +++ b/src/http/ngx_http_upstream.h @@ -254,7 +254,7 @@ typedef struct { ngx_uint_t no_port; /* unsigned no_port:1 */ ngx_uint_t naddrs; - in_addr_t *addrs; + ngx_ipaddr_t *addrs; struct sockaddr *sockaddr; socklen_t socklen; diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c index e0c6c58..92fa825 100644 --- a/src/http/ngx_http_upstream_round_robin.c +++ b/src/http/ngx_http_upstream_round_robin.c @@ -268,6 +268,9 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r, size_t len; ngx_uint_t i, n; struct sockaddr_in *sin; +#if (NGX_HAVE_INET6) + struct sockaddr_in6 *sin6; +#endif ngx_http_upstream_rr_peers_t *peers; ngx_http_upstream_rr_peer_data_t *rrp; @@ -306,27 +309,52 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r, for (i = 0; i < ur->naddrs; i++) { - len = NGX_INET_ADDRSTRLEN + sizeof(":65536") - 1; + len = NGX_SOCKADDR_STRLEN; p = ngx_pnalloc(r->pool, len); if (p == NULL) { return NGX_ERROR; } - len = ngx_inet_ntop(AF_INET, &ur->addrs[i], p, NGX_INET_ADDRSTRLEN); + len = ngx_inet_ntop(ur->addrs[i].family, &ur->addrs[i].u, p, NGX_SOCKADDR_STRLEN - sizeof(":65535") + 1); len = ngx_sprintf(&p[len], ":%d", ur->port) - p; - sin = ngx_pcalloc(r->pool, sizeof(struct sockaddr_in)); - if (sin == NULL) { + switch (ur->addrs[i].family) { + + case AF_INET: + sin = ngx_pcalloc(r->pool, sizeof(struct sockaddr_in)); + if (sin == NULL) { + return NGX_ERROR; + } + + sin->sin_family = AF_INET; + sin->sin_port = htons(ur->port); + sin->sin_addr.s_addr = ur->addrs[i].u.v4; + + peers->peer[i].sockaddr = (struct sockaddr *) sin; + peers->peer[i].socklen = sizeof(struct sockaddr_in); + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + sin6 = ngx_pcalloc(r->pool, sizeof(struct sockaddr_in6)); + if (sin6 == NULL) { + return NGX_ERROR; + } + + sin6->sin6_family = AF_INET6; + sin6->sin6_port = htons(ur->port); + sin6->sin6_addr = ur->addrs[i].u.v6; + + peers->peer[i].sockaddr = (struct sockaddr *) sin6; + peers->peer[i].socklen = sizeof(struct sockaddr_in6); + break; +#endif + + default: return NGX_ERROR; } - sin->sin_family = AF_INET; - sin->sin_port = htons(ur->port); - sin->sin_addr.s_addr = ur->addrs[i]; - - peers->peer[i].sockaddr = (struct sockaddr *) sin; - peers->peer[i].socklen = sizeof(struct sockaddr_in); peers->peer[i].name.len = len; peers->peer[i].name.data = p; peers->peer[i].weight = 1; @@ -334,6 +362,7 @@ ngx_http_upstream_create_round_robin_peer(ngx_http_request_t *r, peers->peer[i].current_weight = 0; peers->peer[i].max_fails = 1; peers->peer[i].fail_timeout = 10; + } } diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c index 2171423..668424e 100644 --- a/src/mail/ngx_mail_smtp_handler.c +++ b/src/mail/ngx_mail_smtp_handler.c @@ -56,6 +56,9 @@ void ngx_mail_smtp_init_session(ngx_mail_session_t *s, ngx_connection_t *c) { struct sockaddr_in *sin; +#if (NGX_HAVE_INET6) + struct sockaddr_in6 *sin6; +#endif ngx_resolver_ctx_t *ctx; ngx_mail_core_srv_conf_t *cscf; @@ -67,7 +70,11 @@ ngx_mail_smtp_init_session(ngx_mail_session_t *s, ngx_connection_t *c) return; } - if (c->sockaddr->sa_family != AF_INET) { + if (c->sockaddr->sa_family != AF_INET +#if (NGX_HAVE_INET6) + && c->sockaddr->sa_family != AF_INET6 +#endif + ) { s->host = smtp_tempunavail; ngx_mail_smtp_greeting(s, c); return; @@ -81,11 +88,23 @@ ngx_mail_smtp_init_session(ngx_mail_session_t *s, ngx_connection_t *c) return; } - /* AF_INET only */ + ctx->addr.family = c->sockaddr->sa_family; - sin = (struct sockaddr_in *) c->sockaddr; + switch (c->sockaddr->sa_family) { + + case AF_INET: + sin = (struct sockaddr_in *) c->sockaddr; + ctx->addr.u.v4 = sin->sin_addr.s_addr; + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + sin6 = (struct sockaddr_in6 *) c->sockaddr; + ctx->addr.u.v6 = sin6->sin6_addr; + break; +#endif + } - ctx->addr = sin->sin_addr.s_addr; ctx->handler = ngx_mail_smtp_resolve_addr_handler; ctx->data = s; ctx->timeout = cscf->resolver_timeout; @@ -167,11 +186,23 @@ ngx_mail_smtp_resolve_name(ngx_event_t *rev) } ctx->name = s->host; - ctx->type = NGX_RESOLVE_A; ctx->handler = ngx_mail_smtp_resolve_name_handler; ctx->data = s; ctx->timeout = cscf->resolver_timeout; + switch (c->sockaddr->sa_family) { + + case AF_INET: + ctx->type = NGX_RESOLVE_A; + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + ctx->type = NGX_RESOLVE_AAAA_A; + break; +#endif + } + if (ngx_resolve_name(ctx) != NGX_OK) { ngx_mail_close_connection(c); } @@ -181,11 +212,15 @@ ngx_mail_smtp_resolve_name(ngx_event_t *rev) static void ngx_mail_smtp_resolve_name_handler(ngx_resolver_ctx_t *ctx) { - in_addr_t addr; + ngx_ipaddr_t addr; ngx_uint_t i; ngx_connection_t *c; struct sockaddr_in *sin; +#if (NGX_HAVE_INET6) + struct sockaddr_in6 *sin6; +#endif ngx_mail_session_t *s; + char text[NGX_SOCKADDR_STRLEN]; s = ctx->data; c = s->connection; @@ -205,23 +240,49 @@ ngx_mail_smtp_resolve_name_handler(ngx_resolver_ctx_t *ctx) } else { - /* AF_INET only */ + addr.family = c->sockaddr->sa_family; - sin = (struct sockaddr_in *) c->sockaddr; + switch (c->sockaddr->sa_family) { + + case AF_INET: + sin = (struct sockaddr_in *) c->sockaddr; + addr.u.v4 = sin->sin_addr.s_addr; + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + sin6 = (struct sockaddr_in6 *) c->sockaddr; + addr.u.v6 = sin6->sin6_addr; + break; +#endif + } for (i = 0; i < ctx->naddrs; i++) { - addr = ctx->addrs[i]; + inet_ntop(ctx->addrs[i].family, &ctx->addrs[i].u, text, NGX_SOCKADDR_STRLEN); - ngx_log_debug4(NGX_LOG_DEBUG_MAIL, c->log, 0, - "name was resolved to %ud.%ud.%ud.%ud", - (ntohl(addr) >> 24) & 0xff, - (ntohl(addr) >> 16) & 0xff, - (ntohl(addr) >> 8) & 0xff, - ntohl(addr) & 0xff); + ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, + "name was resolved to %s", text); - if (addr == sin->sin_addr.s_addr) { - goto found; + if (addr.family != ctx->addrs[i].family) { + continue; + } + + switch (addr.family) { + + case AF_INET: + if (addr.u.v4 == ctx->addrs[i].u.v4) { + goto found; + } + break; + +#if (NGX_HAVE_INET6) + case AF_INET6: + if (!ngx_memcmp(&addr.u.v6, &ctx->addrs[i].u.v6, sizeof(addr.u.v6))) { + goto found; + } + break; +#endif } } -- 1.7.0.4

8 years, 11 months

Modules developing

by Deymon

Good day, all nginx’s developers. There are task module development for nginx. Upon receipt of the request, permitting it, we forward the request to the backend (e.g. other web-server) using the modified module (ngx_http_proxy_module). Upon receipt the response from the server, we need to modify the response (buffers chunks) and send it to frontend (e.g. browser). We have tried to connect to the stream via: - u->pipe->input_filter; - r->upstream->pipe->input_filter. But but did not get the desired result. How to solve this problem? How to we need to connect to the processing chain: as a module-handler, filter-module? We look forward to any help. Thanks in advance. Best regards, Edelkin Dmitry, the developer (Department of Applied Systems, ext. tel. 1624) Russian Federation, Republic of Tatarstan, Kazan city, group of companies «CENTER» telephone number: +7 (843) 533 88 00 e-mail: edelkin(a)cg.ru skype: edelkin.dmitr y

8 years, 11 months

Nginx Logging to Zeromq Module - Sparkngin

by Steve Morin

Does anyone have experience integrating zeromq with Nginx. I am looking for some pointers, to see what concerns I should look out for. I am trying to contribute this code to a open source project. -Steve

8 years, 11 months

IPv6 & IPv4 backend with proxy_bind

by SplitIce

Looking at the documentation it seems there is no way to specify a proxy bind address for both IPv4 and IPv6. You can specify one or the other, but never both. This is a particular issue when a configuration is setup to allow for a failure in IPv6 transit / routing. Is it possible to get a proxy_bind_v6 directive? Regards, Mathew

8 years, 11 months

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

nginx-devel November 2013