nginx-devel July 2014

nginx-devel@nginx.org

30 participants
77 discussions

[PATCH] Mail: send starttls flag value to auth script

by Filipe da Silva

# HG changeset patch # User Filipe da Silva <fdasilvayy(a)gmail.com> # Date 1394099468 -3600 # Thu Mar 06 10:51:08 2014 +0100 # Node ID 51fd90f96449c23af0076a19efbfdb1f88702125 # Parent 24df9fa5868957c1fb9a2d1569271e0958327dad Mail: send starttls flag value to auth script. Allow to do logging (if logging takes place in the auth script) and or force some users to use STARTTLS while others can use unencrypted connection. diff -r 24df9fa58689 -r 51fd90f96449 src/mail/ngx_mail_auth_http_module.c --- a/src/mail/ngx_mail_auth_http_module.c Thu Mar 06 10:51:08 2014 +0100 +++ b/src/mail/ngx_mail_auth_http_module.c Thu Mar 06 10:51:08 2014 +0100 @@ -1165,6 +1165,9 @@ ngx_mail_auth_http_create_request(ngx_ma + sizeof("Auth-Salt: ") - 1 + s->salt.len + sizeof("Auth-Protocol: ") - 1 + cscf->protocol->name.len + sizeof(CRLF) - 1 +#if (NGX_MAIL_SSL) + + sizeof("Auth-STARTTLS: ") - 1 + 1 + sizeof(CRLF) - 1 +#endif + sizeof("Auth-Login-Attempt: ") - 1 + NGX_INT_T_LEN + sizeof(CRLF) - 1 + sizeof("Client-IP: ") - 1 + s->connection->addr_text.len @@ -1219,6 +1222,13 @@ ngx_mail_auth_http_create_request(ngx_ma cscf->protocol->name.len); *b->last++ = CR; *b->last++ = LF; +#if (NGX_MAIL_SSL) + b->last = ngx_cpymem(b->last, "Auth-STARTTLS: ", + sizeof("Auth-STARTTLS: ") - 1); + *b->last++ = s->starttls ? '1' : '0' ; + *b->last++ = CR; *b->last++ = LF; +#endif + b->last = ngx_sprintf(b->last, "Auth-Login-Attempt: %ui" CRLF, s->login_attempt);

7 years, 5 months

handle NGX_AGAIN properly

by Julien Zefi

hi, i understand that NGX_AGAIN is returned when a chain could not be send because more data cannot be buffered on that socket. I need to understand the following: in my case, when i receive a request, i start a timer every 10ms and send out some data, then i create a new timer every10ms until i decide to finish sending out data (video frames). But if in some triggered callback by the timer the ngx_http_output_filter(..) returns NGX_AGAIN *i assume* NginX will send that chain as soon as the socket becomes available again. But after that happens, how can i restore my timer cycle ? thnks. J.Z.

7 years, 7 months

[PATCH] allow to use engine keyform for server private key

by Dmitrii Pichulin

# HG changeset patch # User Dmitrii Pichulin <pdn(a)cryptopro.ru> # Date 1406021876 -14400 # Tue Jul 22 13:37:56 2014 +0400 # Node ID 638389b21e0e1522ed8b8205012f5af562dc50c7 # Parent 63d7d69d0fe48e030ff9fc520c7036dbd1ebc13f allow to use engine keyform for server private key diff -r 63d7d69d0fe4 -r 638389b21e0e src/event/ngx_event_openssl.c --- a/src/event/ngx_event_openssl.c Fri Jun 20 12:55:41 2014 +0400 +++ b/src/event/ngx_event_openssl.c Tue Jul 22 13:37:56 2014 +0400 @@ -257,11 +257,31 @@ ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, - ngx_str_t *key) + ngx_str_t *key, ngx_str_t *keyform, ngx_str_t *engine) { - BIO *bio; - X509 *x509; - u_long n; + BIO *bio; + X509 *x509; + u_long n; + ngx_uint_t ssl_use_engine_keyform = 0; + + if (keyform->len) { + + if (ngx_strcmp(keyform->data, "ENGINE") == 0) { + ssl_use_engine_keyform = 1; + + } else if (ngx_strcmp(keyform->data, "PEM") != 0) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "invalid parameter: %V", keyform); + return NGX_ERROR; + } + } + + if (ssl_use_engine_keyform && engine->len == 0) { + ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, + "no \"ssl_certificate_engine\" is defined " + "while \"ssl_certificate_keyform\" is \"ENGINE\""); + return NGX_ERROR; + } if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) { return NGX_ERROR; @@ -344,17 +364,51 @@ BIO_free(bio); - if (ngx_conf_full_name(cf->cycle, key, 1) != NGX_OK) { - return NGX_ERROR; - } - - if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data, - SSL_FILETYPE_PEM) - == 0) - { - ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, - "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data); - return NGX_ERROR; + if (ssl_use_engine_keyform) { + EVP_PKEY *pkey; + ENGINE *e; + + e = ENGINE_by_id((const char *) engine->data); + + if (e == NULL) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "ENGINE_by_id(\"%s\") failed", engine->data); + return NGX_ERROR; + } + + pkey = ENGINE_load_private_key(e, (const char *)key->data, 0, 0); + + ENGINE_free(e); + + if (!pkey) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "ENGINE_load_private_key(\"%s\") failed", key->data); + return NGX_ERROR; + } + + if (SSL_CTX_use_PrivateKey(ssl->ctx, pkey) == 0) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data); + EVP_PKEY_free(pkey); + return NGX_ERROR; + } + + EVP_PKEY_free(pkey); + + } else { + + if (ngx_conf_full_name(cf->cycle, key, 1) != NGX_OK) { + return NGX_ERROR; + } + + if (SSL_CTX_use_PrivateKey_file(ssl->ctx, + (char *) key->data, SSL_FILETYPE_PEM) + == 0) + { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data); + return NGX_ERROR; + } } return NGX_OK; diff -r 63d7d69d0fe4 -r 638389b21e0e src/event/ngx_event_openssl.h --- a/src/event/ngx_event_openssl.h Fri Jun 20 12:55:41 2014 +0400 +++ b/src/event/ngx_event_openssl.h Tue Jul 22 13:37:56 2014 +0400 @@ -112,7 +112,7 @@ ngx_int_t ngx_ssl_init(ngx_log_t *log); ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data); ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, - ngx_str_t *cert, ngx_str_t *key); + ngx_str_t *cert, ngx_str_t *key, ngx_str_t *keyform, ngx_str_t *engine); ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth); ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, diff -r 63d7d69d0fe4 -r 638389b21e0e src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c Fri Jun 20 12:55:41 2014 +0400 +++ b/src/http/modules/ngx_http_ssl_module.c Tue Jul 22 13:37:56 2014 +0400 @@ -91,6 +91,20 @@ offsetof(ngx_http_ssl_srv_conf_t, certificate_key), NULL }, + { ngx_string("ssl_certificate_keyform"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, certificate_keyform), + NULL }, + + { ngx_string("ssl_certificate_engine"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, certificate_engine), + NULL }, + { ngx_string("ssl_dhparam"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, ngx_conf_set_str_slot, @@ -562,6 +576,10 @@ ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); + ngx_conf_merge_str_value(conf->certificate_keyform, + prev->certificate_keyform, ""); + ngx_conf_merge_str_value(conf->certificate_engine, + prev->certificate_engine, ""); ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); @@ -652,7 +670,8 @@ cln->data = &conf->ssl; if (ngx_ssl_certificate(cf, &conf->ssl, &conf->certificate, - &conf->certificate_key) + &conf->certificate_key, &conf->certificate_keyform, + &conf->certificate_engine) != NGX_OK) { return NGX_CONF_ERROR; diff -r 63d7d69d0fe4 -r 638389b21e0e src/http/modules/ngx_http_ssl_module.h --- a/src/http/modules/ngx_http_ssl_module.h Fri Jun 20 12:55:41 2014 +0400 +++ b/src/http/modules/ngx_http_ssl_module.h Tue Jul 22 13:37:56 2014 +0400 @@ -34,6 +34,9 @@ ngx_str_t certificate; ngx_str_t certificate_key; + ngx_str_t certificate_keyform; + ngx_str_t certificate_engine; + ngx_str_t dhparam; ngx_str_t ecdh_curve; ngx_str_t client_certificate; diff -r 63d7d69d0fe4 -r 638389b21e0e src/mail/ngx_mail_ssl_module.c --- a/src/mail/ngx_mail_ssl_module.c Fri Jun 20 12:55:41 2014 +0400 +++ b/src/mail/ngx_mail_ssl_module.c Tue Jul 22 13:37:56 2014 +0400 @@ -230,6 +230,10 @@ ngx_conf_merge_str_value(conf->certificate, prev->certificate, ""); ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, ""); + ngx_conf_merge_str_value(conf->certificate_keyform, + prev->certificate_keyform, ""); + ngx_conf_merge_str_value(conf->certificate_engine, + prev->certificate_engine, ""); ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, ""); @@ -302,7 +306,8 @@ cln->data = &conf->ssl; if (ngx_ssl_certificate(cf, &conf->ssl, &conf->certificate, - &conf->certificate_key) + &conf->certificate_key, &conf->certificate_keyform, + &conf->certificate_engine) != NGX_OK) { return NGX_CONF_ERROR; diff -r 63d7d69d0fe4 -r 638389b21e0e src/mail/ngx_mail_ssl_module.h --- a/src/mail/ngx_mail_ssl_module.h Fri Jun 20 12:55:41 2014 +0400 +++ b/src/mail/ngx_mail_ssl_module.h Tue Jul 22 13:37:56 2014 +0400 @@ -34,6 +34,9 @@ ngx_str_t certificate; ngx_str_t certificate_key; + ngx_str_t certificate_keyform; + ngx_str_t certificate_engine; + ngx_str_t dhparam; ngx_str_t ecdh_curve;

7 years, 8 months

[PATCH] Request hang when cache_lock is used in subrequests

by Yichun Zhang (agentzh)

Hello! Akos Gyimesi reported a request hang (downstream connections stuck in the CLOSE_WAIT state forever) regarding use of proxy_cache_lock in subrequests. The issue is that when proxy_cache_lock_timeout is reached, ngx_http_file_cache_lock_wait_handler calls r->connection->write->handler() directly, but r->connection->write->handler is (usually) just ngx_http_request_handler, which simply picks up r->connection->data, which is *not* necessarily the current (sub)request, so the current subrequest may never be continued nor finalized, leading to an infinite request hang. The following patch fixes this issue for me. Comments welcome! Thanks! -agentzh --- nginx-1.4.3/src/http/ngx_http_file_cache.c 2013-10-08 05:07:14.000000000 -0700 +++ nginx-1.4.3-patched/src/http/ngx_http_file_cache.c 2013-10-26 14:47:56.184041728 -0700 @@ -432,6 +432,7 @@ ngx_http_file_cache_lock_wait_handler(ng ngx_uint_t wait; ngx_msec_t timer; ngx_http_cache_t *c; + ngx_connection_t *conn; ngx_http_request_t *r; ngx_http_file_cache_t *cache; @@ -471,7 +472,10 @@ wakeup: c->waiting = 0; r->main->blocked--; - r->connection->write->handler(r->connection->write); + + conn = r->connection; + r->write_event_handler(r); + ngx_http_run_posted_requests(conn); }

7 years, 8 months

[nginx] Entity tags: downgrade strong etags to weak ones as needed.

by Maxim Dounin

details: http://hg.nginx.org/nginx/rev/e491b26fa5a1 branches: changeset: 5733:e491b26fa5a1 user: Maxim Dounin <mdounin(a)mdounin.ru> date: Thu Jun 26 02:21:01 2014 +0400 description: Entity tags: downgrade strong etags to weak ones as needed. See http://mailman.nginx.org/pipermail/nginx-devel/2013-November/004523.html. diffstat: src/http/modules/ngx_http_addition_filter_module.c | 2 +- src/http/modules/ngx_http_gunzip_filter_module.c | 2 +- src/http/modules/ngx_http_gzip_filter_module.c | 2 +- src/http/modules/ngx_http_ssi_filter_module.c | 5 ++- src/http/modules/ngx_http_sub_filter_module.c | 5 ++- src/http/modules/ngx_http_xslt_filter_module.c | 6 ++- src/http/ngx_http_core_module.c | 40 ++++++++++++++++++++++ src/http/ngx_http_core_module.h | 1 + 8 files changed, 56 insertions(+), 7 deletions(-) diffs (153 lines): diff --git a/src/http/modules/ngx_http_addition_filter_module.c b/src/http/modules/ngx_http_addition_filter_module.c --- a/src/http/modules/ngx_http_addition_filter_module.c +++ b/src/http/modules/ngx_http_addition_filter_module.c @@ -121,7 +121,7 @@ ngx_http_addition_header_filter(ngx_http ngx_http_clear_content_length(r); ngx_http_clear_accept_ranges(r); - ngx_http_clear_etag(r); + ngx_http_weak_etag(r); return ngx_http_next_header_filter(r); } diff --git a/src/http/modules/ngx_http_gunzip_filter_module.c b/src/http/modules/ngx_http_gunzip_filter_module.c --- a/src/http/modules/ngx_http_gunzip_filter_module.c +++ b/src/http/modules/ngx_http_gunzip_filter_module.c @@ -165,7 +165,7 @@ ngx_http_gunzip_header_filter(ngx_http_r ngx_http_clear_content_length(r); ngx_http_clear_accept_ranges(r); - ngx_http_clear_etag(r); + ngx_http_weak_etag(r); return ngx_http_next_header_filter(r); } diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c --- a/src/http/modules/ngx_http_gzip_filter_module.c +++ b/src/http/modules/ngx_http_gzip_filter_module.c @@ -306,7 +306,7 @@ ngx_http_gzip_header_filter(ngx_http_req ngx_http_clear_content_length(r); ngx_http_clear_accept_ranges(r); - ngx_http_clear_etag(r); + ngx_http_weak_etag(r); return ngx_http_next_header_filter(r); } diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c --- a/src/http/modules/ngx_http_ssi_filter_module.c +++ b/src/http/modules/ngx_http_ssi_filter_module.c @@ -369,10 +369,13 @@ ngx_http_ssi_header_filter(ngx_http_requ if (r == r->main) { ngx_http_clear_content_length(r); ngx_http_clear_accept_ranges(r); - ngx_http_clear_etag(r); if (!slcf->last_modified) { ngx_http_clear_last_modified(r); + ngx_http_clear_etag(r); + + } else { + ngx_http_weak_etag(r); } } diff --git a/src/http/modules/ngx_http_sub_filter_module.c b/src/http/modules/ngx_http_sub_filter_module.c --- a/src/http/modules/ngx_http_sub_filter_module.c +++ b/src/http/modules/ngx_http_sub_filter_module.c @@ -175,10 +175,13 @@ ngx_http_sub_header_filter(ngx_http_requ if (r == r->main) { ngx_http_clear_content_length(r); - ngx_http_clear_etag(r); if (!slcf->last_modified) { ngx_http_clear_last_modified(r); + ngx_http_clear_etag(r); + + } else { + ngx_http_weak_etag(r); } } diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -337,12 +337,14 @@ ngx_http_xslt_send(ngx_http_request_t *r r->headers_out.content_length = NULL; } - ngx_http_clear_etag(r); - conf = ngx_http_get_module_loc_conf(r, ngx_http_xslt_filter_module); if (!conf->last_modified) { ngx_http_clear_last_modified(r); + ngx_http_clear_etag(r); + + } else { + ngx_http_weak_etag(r); } } diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -1851,6 +1851,46 @@ ngx_http_set_etag(ngx_http_request_t *r) } +void +ngx_http_weak_etag(ngx_http_request_t *r) +{ + size_t len; + u_char *p; + ngx_table_elt_t *etag; + + etag = r->headers_out.etag; + + if (etag == NULL) { + return; + } + + if (etag->value.len > 2 + && etag->value.data[0] == 'W' + && etag->value.data[1] == '/') + { + return; + } + + if (etag->value.len < 1 || etag->value.data[0] != '"') { + r->headers_out.etag->hash = 0; + r->headers_out.etag = NULL; + return; + } + + p = ngx_pnalloc(r->pool, etag->value.len + 2); + if (p == NULL) { + r->headers_out.etag->hash = 0; + r->headers_out.etag = NULL; + return; + } + + len = ngx_sprintf(p, "W/%V", &etag->value) - p; + + etag->value.data = p; + etag->value.len = len; +} + + ngx_int_t ngx_http_send_response(ngx_http_request_t *r, ngx_uint_t status, ngx_str_t *ct, ngx_http_complex_value_t *cv) diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -501,6 +501,7 @@ void *ngx_http_test_content_type(ngx_htt ngx_int_t ngx_http_set_content_type(ngx_http_request_t *r); void ngx_http_set_exten(ngx_http_request_t *r); ngx_int_t ngx_http_set_etag(ngx_http_request_t *r); +void ngx_http_weak_etag(ngx_http_request_t *r); ngx_int_t ngx_http_send_response(ngx_http_request_t *r, ngx_uint_t status, ngx_str_t *ct, ngx_http_complex_value_t *cv); u_char *ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *name,

8 years

[PATCH] Perl: NULL-terminate argument list

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1403176596 25200 # Thu Jun 19 04:16:36 2014 -0700 # Node ID 290f3fcb9cf552c235b9807cf0af3830b5add5af # Parent 675bda8dcfdbf66e4a17017839f39ed6c8cbb9f5 Perl: NULL-terminate argument list. perl_parse() function expects argv/argc-style argument list, which according to the C standard must be NULL-terminated, that is: argv[argc] == NULL. This change fixes a crash (SIGSEGV) that could happen because of the buffer overrun during perl module initialization. Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r 675bda8dcfdb -r 290f3fcb9cf5 src/http/modules/perl/ngx_http_perl_module.c --- a/src/http/modules/perl/ngx_http_perl_module.c Thu Jun 19 13:55:59 2014 +0400 +++ b/src/http/modules/perl/ngx_http_perl_module.c Thu Jun 19 04:16:36 2014 -0700 @@ -577,7 +577,7 @@ ngx_http_perl_create_interpreter(ngx_con n = (pmcf->modules != NGX_CONF_UNSET_PTR) ? pmcf->modules->nelts * 2 : 0; - embedding = ngx_palloc(cf->pool, (4 + n) * sizeof(char *)); + embedding = ngx_palloc(cf->pool, (5 + n) * sizeof(char *)); if (embedding == NULL) { goto fail; } @@ -595,6 +595,7 @@ ngx_http_perl_create_interpreter(ngx_con embedding[n++] = "-Mnginx"; embedding[n++] = "-e"; embedding[n++] = "0"; + embedding[n] = NULL; n = perl_parse(perl, ngx_http_perl_xs_init, n, embedding, NULL);

8 years

[PATCH] Core: add support for expressing size in gigabytes

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1406803246 25200 # Thu Jul 31 03:40:46 2014 -0700 # Node ID c1aeec0f33fe6a42fde0a1851228a130f5ab12a1 # Parent e0eaf2d92a8cee90abe592d7ac01d3118cb0853a Core: add support for expressing size in gigabytes. Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r e0eaf2d92a8c -r c1aeec0f33fe src/core/ngx_parse.c --- a/src/core/ngx_parse.c Wed Jul 30 04:32:16 2014 -0700 +++ b/src/core/ngx_parse.c Thu Jul 31 03:40:46 2014 -0700 @@ -33,6 +33,12 @@ ngx_parse_size(ngx_str_t *line) scale = 1024 * 1024; break; + case 'G': + case 'g': + len--; + scale = 1024 * 1024 * 1024; + break; + default: scale = 1; }

8 years

[PATCH] Configure: remove outdated and unused patch.zlib.h

by Piotr Sikora

# HG changeset patch # User Piotr Sikora <piotr(a)cloudflare.com> # Date 1406803948 25200 # Thu Jul 31 03:52:28 2014 -0700 # Node ID 5be611309d6f7983879104054d4a68feece64142 # Parent f1e05e533c8b7028121104740f2ab76e49d9212f Configure: remove outdated and unused patch.zlib.h. Signed-off-by: Piotr Sikora <piotr(a)cloudflare.com> diff -r f1e05e533c8b -r 5be611309d6f auto/lib/zlib/patch.zlib.h --- a/auto/lib/zlib/patch.zlib.h Thu Jul 31 13:59:37 2014 +0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,10 +0,0 @@ ---- zlib.h Thu Jul 9 20:06:56 1998 -+++ zlib-1.1.3/zlib.h Tue Mar 22 13:41:04 2005 -@@ -709,7 +709,6 @@ - (0 in case of error). - */ - --ZEXTERN int ZEXPORTVA gzprintf OF((gzFile file, const char *format, ...)); - /* - Converts, formats, and writes the args to the compressed file under - control of the format string, as in fprintf. gzprintf returns the number of

8 years

[PATCH]Dav: ngx_http_map_uri_to_path() errors were not checked.

by flygoast

# HG changeset patch # User FengGu <flygoast(a)126.com> # Date 1406702708 -28800 # Wed Jul 30 14:45:08 2014 +0800 # Node ID 9a9f7c2783b1afe0e5d374450daa5df6acbfd332 # Parent 4d092aa2f4637ce50284d2accd99a8e91aae2b4c Dav: ngx_http_map_uri_to_path() errors were not checked. Once error occured, it could lead to use uninitialized variables to log, even more segmentation fault. diff -r 4d092aa2f463 -r 9a9f7c2783b1 src/http/modules/ngx_http_dav_module.c --- a/src/http/modules/ngx_http_dav_module.cMon Jul 28 12:27:57 2014 -0700 +++ b/src/http/modules/ngx_http_dav_module.cWed Jul 30 14:45:08 2014 +0800 @@ -212,7 +212,10 @@ return; } - ngx_http_map_uri_to_path(r, &path, &root, 0); + if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { + ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); + return; + } path.len--; @@ -320,7 +323,9 @@ ok: - ngx_http_map_uri_to_path(r, &path, &root, 0); + if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { + return NGX_HTTP_INTERNAL_SERVER_ERROR; + } ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http delete filename: \"%s\"", path.data); @@ -488,6 +493,9 @@ } p = ngx_http_map_uri_to_path(r, &path, &root, 0); + if (p == NULL) { + return NGX_HTTP_INTERNAL_SERVER_ERROR; + } *(p - 1) = '\0'; r->uri.len--; @@ -666,7 +674,9 @@ overwrite_done: - ngx_http_map_uri_to_path(r, &path, &root, 0); + if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { + return NGX_HTTP_INTERNAL_SERVER_ERROR; + } ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http copy from: \"%s\"", path.data); @@ -674,7 +684,9 @@ uri = r->uri; r->uri = duri; - ngx_http_map_uri_to_path(r, &copy.path, &root, 0); + if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) { + return NGX_HTTP_INTERNAL_SERVER_ERROR; + } r->uri = uri;

8 years

[PATCH] Config: enhancing nginx default config file with added security options

by Kristian Erik Hermansen

# HG changeset patch # User Kristian Erik Hermansen <kristian.hermansen(a)gmail.com> # Date 1406803911 25200 # Thu Jul 31 03:51:51 2014 -0700 # Node ID 8966ff589f5de5e9155335373247de4485451304 # Parent e0eaf2d92a8cee90abe592d7ac01d3118cb0853a Config: enhancing nginx default config file with added security options. diff -r e0eaf2d92a8c -r 8966ff589f5d conf/nginx.conf --- a/conf/nginx.conf Wed Jul 30 04:32:16 2014 -0700 +++ b/conf/nginx.conf Thu Jul 31 03:51:51 2014 -0700 @@ -105,9 +105,34 @@ # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; + # recommended protocols that provide better security and compatibility + # + # ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; + # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; + # security headers recommended by OWASP to block common attacks + # + # add_header X-Frame-Options 'DENY'; + # add_header X-Content-Type-Options 'nosniff'; + # add_header X-XSS-Protection '1; mode=block'; + # add_header Cache-Control 'no-cache, no-store, must-revalidate'; + # add_header Pragma 'no-cache'; + # add_header Expires '-1'; + # + # security headers that require additional configuration + # + # #add_header X-Permitted-Cross-Domain-Policies 'master-only'; + # #add_header Content-Security-Policy-Report-Only "default-src 'self'; report-uri /csp_report_parser"; + # #add_header Content-Security-Policy "default-src 'self'; report-uri /csp_report_parser"; + # + # security header required to attain an 'A+' rating via Qualys SSL Labs + # + # #add_header Strict-Transport-Security 'max-age=31536000'; + + # charset utf-8; + # location / { # root html; # index index.html index.htm; -- Regards, Kristian Erik Hermansen https://www.linkedin.com/in/kristianhermansen https://google.com/+KristianHermansen

8 years

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

nginx-devel July 2014