From djonas at vitalwerks.com Mon Apr 2 00:50:01 2012 From: djonas at vitalwerks.com (David Jonas) Date: Sun, 01 Apr 2012 17:50:01 -0700 Subject: [PATCH] pass smtp authentication upstream Message-ID: <4F78F7B9.8040204@vitalwerks.com> Hello! When using nginx as an smtp proxy, we needed to be able to pass smtp authentication through to the upstream. So I worked up this patch. Hopefully someone else will find it useful. Any fixes or problems are more than welcome. Patch was written against nginx-1.0.14. It adds a boolean configuration directive, smtp_auth_upstream that enables the functionality. xclient still works and is performed after authentication, if enabled. David Jonas ========================================= diff -r 720380947aef src/mail/ngx_mail.h --- a/src/mail/ngx_mail.h Wed Mar 28 16:08:26 2012 -0700 +++ b/src/mail/ngx_mail.h Sun Apr 01 17:45:45 2012 -0700 @@ -164,10 +164,15 @@ ngx_smtp_auth_cram_md5, ngx_smtp_helo, ngx_smtp_helo_xclient, + ngx_smtp_helo_login, ngx_smtp_helo_from, ngx_smtp_xclient, ngx_smtp_xclient_from, ngx_smtp_xclient_helo, + ngx_smtp_login, + ngx_smtp_user, + ngx_smtp_passwd_xclient, + ngx_smtp_passwd_helo, ngx_smtp_from, ngx_smtp_to } ngx_smtp_state_e; diff -r 720380947aef src/mail/ngx_mail_proxy_module.c --- a/src/mail/ngx_mail_proxy_module.c Wed Mar 28 16:08:26 2012 -0700 +++ b/src/mail/ngx_mail_proxy_module.c Sun Apr 01 17:45:45 2012 -0700 @@ -16,6 +16,7 @@ ngx_flag_t enable; ngx_flag_t pass_error_message; ngx_flag_t xclient; + ngx_flag_t smtp_auth_upstream; size_t buffer_size; ngx_msec_t timeout; } ngx_mail_proxy_conf_t; @@ -74,6 +75,13 @@ offsetof(ngx_mail_proxy_conf_t, xclient), NULL }, + { ngx_string("smtp_auth_upstream"), + NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_MAIL_SRV_CONF_OFFSET, + offsetof(ngx_mail_proxy_conf_t, smtp_auth_upstream), + NULL }, + ngx_null_command }; @@ -520,7 +528,10 @@ p = ngx_cpymem(p, cscf->server_name.data, cscf->server_name.len); *p++ = CR; *p = LF; - if (pcf->xclient) { + if(s->auth_method != NGX_MAIL_AUTH_NONE && pcf->smtp_auth_upstream) { + s->mail_state = ngx_smtp_helo_login; + + } else if (pcf->xclient) { s->mail_state = ngx_smtp_helo_xclient; } else if (s->auth_method == NGX_MAIL_AUTH_NONE) { @@ -532,7 +543,76 @@ break; + case ngx_smtp_helo_login: + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0, + "mail proxy send login"); + + s->connection->log->action = "sending LOGIN command to upstream"; + + line.len = sizeof("AUTH LOGIN " CRLF) - 1; + line.data = ngx_pnalloc(c->pool, line.len); + if (line.data == NULL) { + ngx_mail_proxy_internal_server_error(s); + return; + } + + p = ngx_cpymem(line.data, "AUTH LOGIN ", sizeof("AUTH LOGIN ") - 1); + *p++ = CR; *p = LF; + + s->mail_state = ngx_smtp_login; + break; + + case ngx_smtp_login: + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0, "mail proxy send user"); + + s->connection->log->action = "sending user name to upstream"; + + line.len = ngx_base64_encoded_length(s->login.len) + 2; + p = ngx_pnalloc(c->pool, line.len); + if (p == NULL) { + ngx_mail_proxy_internal_server_error(s); + return; + } + + line.data = p; + ngx_encode_base64(&line, &s->login); + p += line.len; + *p++ = CR; *p = LF; + line.len += 2; + + s->mail_state = ngx_smtp_user; + break; + + case ngx_smtp_user: + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0, + "mail proxy send passwd"); + + s->connection->log->action = "sending password to upstream"; + + line.len = ngx_base64_encoded_length(s->passwd.len) + 2; + p = ngx_pnalloc(c->pool, line.len); + if (p == NULL) { + ngx_mail_proxy_internal_server_error(s); + return; + } + + line.data = p; + ngx_encode_base64(&line, &s->passwd); + p += line.len; + *p++ = CR; *p = LF; + line.len += 2; + + pcf = ngx_mail_get_module_srv_conf(s, ngx_mail_proxy_module); + + if (pcf->xclient) { + s->mail_state = ngx_smtp_passwd_xclient; + } else { + s->mail_state = ngx_smtp_passwd_helo; + } + break; + case ngx_smtp_helo_xclient: + case ngx_smtp_passwd_xclient: ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0, "mail proxy send xclient"); @@ -633,6 +713,7 @@ case ngx_smtp_helo: case ngx_smtp_xclient: + case ngx_smtp_passwd_helo: case ngx_smtp_to: b = s->proxy->buffer; @@ -789,6 +870,7 @@ case ngx_smtp_helo: case ngx_smtp_xclient: + case ngx_smtp_passwd_helo: case ngx_smtp_to: b = s->proxy->buffer; @@ -789,6 +870,7 @@ case ngx_smtp_helo: case ngx_smtp_helo_xclient: + case ngx_smtp_helo_login: case ngx_smtp_helo_from: case ngx_smtp_from: if (p[0] == '2' && p[1] == '5' && p[2] == '0') { @@ -804,6 +886,20 @@ } break; + case ngx_smtp_login: + case ngx_smtp_user: + if(p[0] == '3' && p[1] == '3' && p[2] == '4') { + return NGX_OK; + } + break; + + case ngx_smtp_passwd_xclient: + case ngx_smtp_passwd_helo: + if(p[0] == '2' && p[1] == '3' && p[2] == '5') { + return NGX_OK; + } + break; + case ngx_smtp_to: return NGX_OK; } @@ -1065,6 +1161,7 @@ pcf->enable = NGX_CONF_UNSET; pcf->pass_error_message = NGX_CONF_UNSET; pcf->xclient = NGX_CONF_UNSET; + pcf->smtp_auth_upstream = NGX_CONF_UNSET; pcf->buffer_size = NGX_CONF_UNSET_SIZE; pcf->timeout = NGX_CONF_UNSET_MSEC; @@ -1081,6 +1178,7 @@ ngx_conf_merge_value(conf->enable, prev->enable, 0); ngx_conf_merge_value(conf->pass_error_message, prev->pass_error_message, 0); ngx_conf_merge_value(conf->xclient, prev->xclient, 1); + ngx_conf_merge_value(conf->smtp_auth_upstream, prev->smtp_auth_upstream, 0); ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, (size_t) ngx_pagesize); ngx_conf_merge_msec_value(conf->timeout, prev->timeout, 24 * 60 * 60000); From mdounin at mdounin.ru Mon Apr 2 21:28:32 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 2 Apr 2012 21:28:32 +0000 Subject: [nginx] svn commit: r4569 - in trunk/src: core http/modules/perl Message-ID: <20120402212832.5F90B3FA0C9@mail.nginx.com> Author: mdounin Date: 2012-04-02 21:28:31 +0000 (Mon, 02 Apr 2012) New Revision: 4569 URL: http://trac.nginx.org/nginx/changeset/4569/nginx Log: Version bump. Modified: trunk/src/core/nginx.h trunk/src/http/modules/perl/nginx.pm Modified: trunk/src/core/nginx.h =================================================================== --- trunk/src/core/nginx.h 2012-03-29 19:47:27 UTC (rev 4568) +++ trunk/src/core/nginx.h 2012-04-02 21:28:31 UTC (rev 4569) @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1001018 -#define NGINX_VERSION "1.1.18" +#define nginx_version 1001019 +#define NGINX_VERSION "1.1.19" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "NGINX" Modified: trunk/src/http/modules/perl/nginx.pm =================================================================== --- trunk/src/http/modules/perl/nginx.pm 2012-03-29 19:47:27 UTC (rev 4568) +++ trunk/src/http/modules/perl/nginx.pm 2012-04-02 21:28:31 UTC (rev 4569) @@ -50,7 +50,7 @@ HTTP_INSUFFICIENT_STORAGE ); -our $VERSION = '1.1.18'; +our $VERSION = '1.1.19'; require XSLoader; XSLoader::load('nginx', $VERSION); From mdounin at mdounin.ru Mon Apr 2 21:29:35 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 2 Apr 2012 21:29:35 +0000 Subject: [nginx] svn commit: r4570 - trunk/src/http Message-ID: <20120402212935.64D493FA5BC@mail.nginx.com> Author: mdounin Date: 2012-04-02 21:29:35 +0000 (Mon, 02 Apr 2012) New Revision: 4570 URL: http://trac.nginx.org/nginx/changeset/4570/nginx Log: Upstream: reject upstreams without normal servers. Such upstreams cause CPU hog later in the code as number of peers isn't expected to be 0. Currently this may happen either if there are only backup servers defined in an upstream block, or if server with ipv6 address used in an upstream block. Modified: trunk/src/http/ngx_http_upstream_round_robin.c Modified: trunk/src/http/ngx_http_upstream_round_robin.c =================================================================== --- trunk/src/http/ngx_http_upstream_round_robin.c 2012-04-02 21:28:31 UTC (rev 4569) +++ trunk/src/http/ngx_http_upstream_round_robin.c 2012-04-02 21:29:35 UTC (rev 4570) @@ -49,6 +49,13 @@ n += server[i].naddrs; } + if (n == 0) { + ngx_log_error(NGX_LOG_EMERG, cf->log, 0, + "no servers in upstream \"%V\" in %s:%ui", + &us->host, us->file_name, us->line); + return NGX_ERROR; + } + peers = ngx_pcalloc(cf->pool, sizeof(ngx_http_upstream_rr_peers_t) + sizeof(ngx_http_upstream_rr_peer_t) * (n - 1)); if (peers == NULL) { From mdounin at mdounin.ru Mon Apr 2 21:30:58 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 2 Apr 2012 21:30:58 +0000 Subject: [nginx] svn commit: r4571 - trunk/src/os/win32 Message-ID: <20120402213058.BF9333FA5BC@mail.nginx.com> Author: mdounin Date: 2012-04-02 21:30:58 +0000 (Mon, 02 Apr 2012) New Revision: 4571 URL: http://trac.nginx.org/nginx/changeset/4571/nginx Log: Win32: fixed memory allocation for shmem name (ticket #134). Modified: trunk/src/os/win32/ngx_shmem.c Modified: trunk/src/os/win32/ngx_shmem.c =================================================================== --- trunk/src/os/win32/ngx_shmem.c 2012-04-02 21:29:35 UTC (rev 4570) +++ trunk/src/os/win32/ngx_shmem.c 2012-04-02 21:30:58 UTC (rev 4571) @@ -15,7 +15,7 @@ u_char *name; uint64_t size; - name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN), shm->log); + name = ngx_alloc(shm->name.len + 2 + NGX_INT32_LEN, shm->log); if (name == NULL) { return NGX_ERROR; } From mdounin at mdounin.ru Mon Apr 2 21:31:45 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 2 Apr 2012 21:31:45 +0000 Subject: [nginx] svn commit: r4572 - trunk/src/os/win32 Message-ID: <20120402213145.EABF23FA5BC@mail.nginx.com> Author: mdounin Date: 2012-04-02 21:31:45 +0000 (Mon, 02 Apr 2012) New Revision: 4572 URL: http://trac.nginx.org/nginx/changeset/4572/nginx Log: Win32: improved ngx_mutex_init() stub (ticket #138). This allows to run nginx with "master_process off" under Windows. Modified: trunk/src/os/win32/ngx_thread.c Modified: trunk/src/os/win32/ngx_thread.c =================================================================== --- trunk/src/os/win32/ngx_thread.c 2012-04-02 21:30:58 UTC (rev 4571) +++ trunk/src/os/win32/ngx_thread.c 2012-04-02 21:31:45 UTC (rev 4572) @@ -72,7 +72,18 @@ ngx_mutex_t * ngx_mutex_init(ngx_log_t *log, ngx_uint_t flags) { - return (ngx_mutex_t *) 1; + ngx_mutex_t *m; + + m = ngx_alloc(sizeof(ngx_mutex_t), log); + if (m == NULL) { + return NULL; + } + + m->log = log; + + /* STUB */ + + return m; } From ru at nginx.com Tue Apr 3 07:37:33 2012 From: ru at nginx.com (ru at nginx.com) Date: Tue, 3 Apr 2012 07:37:33 +0000 Subject: [nginx] svn commit: r4573 - in trunk/src: core event event/modules http http/modules os/unix os/win32 Message-ID: <20120403073733.94E733FA491@mail.nginx.com> Author: ru Date: 2012-04-03 07:37:31 +0000 (Tue, 03 Apr 2012) New Revision: 4573 URL: http://trac.nginx.org/nginx/changeset/4573/nginx Log: Fixed spelling in multiline C comments. Modified: trunk/src/core/ngx_conf_file.h trunk/src/core/ngx_connection.c trunk/src/core/ngx_file.c trunk/src/core/ngx_inet.c trunk/src/core/ngx_times.c trunk/src/event/modules/ngx_epoll_module.c trunk/src/event/modules/ngx_eventport_module.c trunk/src/event/modules/ngx_kqueue_module.c trunk/src/event/ngx_event_openssl.c trunk/src/http/modules/ngx_http_degradation_module.c trunk/src/http/ngx_http.c trunk/src/http/ngx_http_parse.c trunk/src/http/ngx_http_upstream.c trunk/src/http/ngx_http_variables.c trunk/src/os/unix/ngx_freebsd_rfork_thread.c trunk/src/os/unix/ngx_freebsd_sendfile_chain.c trunk/src/os/unix/ngx_gcc_atomic_sparc64.h trunk/src/os/unix/ngx_setproctitle.c trunk/src/os/win32/ngx_win32_config.h Modified: trunk/src/core/ngx_conf_file.h =================================================================== --- trunk/src/core/ngx_conf_file.h 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/core/ngx_conf_file.h 2012-04-03 07:37:31 UTC (rev 4573) @@ -14,7 +14,7 @@ /* - * AAAA number of agruments + * AAAA number of arguments * FF command flags * TT command type, i.e. HTTP "location" or "server" command */ Modified: trunk/src/core/ngx_connection.c =================================================================== --- trunk/src/core/ngx_connection.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/core/ngx_connection.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -708,7 +708,7 @@ /* * it seems that Linux-2.6.x OpenVZ sends events * for closed shared listening sockets unless - * the events was explicity deleted + * the events was explicitly deleted */ ngx_del_event(c->read, NGX_READ_EVENT, 0); Modified: trunk/src/core/ngx_file.c =================================================================== --- trunk/src/core/ngx_file.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/core/ngx_file.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -808,7 +808,7 @@ * reallocated if ctx->alloc is nonzero * * ctx->alloc - a size of data structure that is allocated at every level - * and is initilialized by ctx->init_handler() + * and is initialized by ctx->init_handler() * * ctx->log - a log * Modified: trunk/src/core/ngx_inet.c =================================================================== --- trunk/src/core/ngx_inet.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/core/ngx_inet.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -459,7 +459,7 @@ struct sockaddr_in6 *sin6; /* - * prevent MSVC8 waring: + * prevent MSVC8 warning: * potentially uninitialized local variable 'inaddr6' used */ ngx_memzero(inaddr6.s6_addr, sizeof(struct in6_addr)); Modified: trunk/src/core/ngx_times.c =================================================================== --- trunk/src/core/ngx_times.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/core/ngx_times.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -33,7 +33,7 @@ #if !(NGX_WIN32) /* - * locatime() and localtime_r() are not Async-Signal-Safe functions, therefore, + * localtime() and localtime_r() are not Async-Signal-Safe functions, therefore, * they must not be called by a signal handler, so we use the cached * GMT offset value. Fortunately the value is changed only two times a year. */ @@ -308,7 +308,7 @@ /* * The "days" should be adjusted to 1 only, however, some March 1st's go * to previous year, so we adjust them to 2. This causes also shift of the - * last Feburary days to next year, but we catch the case when "yday" + * last February days to next year, but we catch the case when "yday" * becomes negative. */ Modified: trunk/src/event/modules/ngx_epoll_module.c =================================================================== --- trunk/src/event/modules/ngx_epoll_module.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/event/modules/ngx_epoll_module.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -445,7 +445,7 @@ /* * when the file descriptor is closed, the epoll automatically deletes - * it from its queue, so we do not need to delete explicity the event + * it from its queue, so we do not need to delete explicitly the event * before the closing the file descriptor */ @@ -524,7 +524,7 @@ /* * when the file descriptor is closed the epoll automatically deletes - * it from its queue so we do not need to delete explicity the event + * it from its queue so we do not need to delete explicitly the event * before the closing the file descriptor */ Modified: trunk/src/event/modules/ngx_eventport_module.c =================================================================== --- trunk/src/event/modules/ngx_eventport_module.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/event/modules/ngx_eventport_module.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -322,7 +322,7 @@ /* * when the file descriptor is closed, the event port automatically - * dissociates it from the port, so we do not need to dissociate explicity + * dissociates it from the port, so we do not need to dissociate explicitly * the event before the closing the file descriptor */ Modified: trunk/src/event/modules/ngx_kqueue_module.c =================================================================== --- trunk/src/event/modules/ngx_kqueue_module.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/event/modules/ngx_kqueue_module.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -377,7 +377,7 @@ /* * when the file descriptor is closed the kqueue automatically deletes - * its filters so we do not need to delete explicity the event + * its filters so we do not need to delete explicitly the event * before the closing the file descriptor. */ Modified: trunk/src/event/ngx_event_openssl.c =================================================================== --- trunk/src/event/ngx_event_openssl.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/event/ngx_event_openssl.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -489,7 +489,7 @@ /* * Elliptic-Curve Diffie-Hellman parameters are either "named curves" - * from RFC 4492 section 5.1.1, or explicitely described curves over + * from RFC 4492 section 5.1.1, or explicitly described curves over * binary fields. OpenSSL only supports the "named curves", which provide * maximum interoperability. */ Modified: trunk/src/http/modules/ngx_http_degradation_module.c =================================================================== --- trunk/src/http/modules/ngx_http_degradation_module.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/http/modules/ngx_http_degradation_module.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -126,7 +126,7 @@ * ELF/i386 is loaded at 0x08000000, 128M * ELF/amd64 is loaded at 0x00400000, 4M * - * use a function address to substract the loading address + * use a function address to subtract the loading address */ sbrk_size = (size_t) sbrk(0) - ((uintptr_t) ngx_palloc & ~0x3FFFFF); Modified: trunk/src/http/ngx_http.c =================================================================== --- trunk/src/http/ngx_http.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/http/ngx_http.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -1417,7 +1417,7 @@ /* * check whether all name-based servers have the same - * configuraiton as a default server for given address:port + * configuration as a default server for given address:port */ addr = port[p].addrs.elts; Modified: trunk/src/http/ngx_http_parse.c =================================================================== --- trunk/src/http/ngx_http_parse.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/http/ngx_http_parse.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -1097,7 +1097,7 @@ /* * we use "ch = *p++" inside the cycle, but this operation is safe, - * because after the URI there is always at least one charcter: + * because after the URI there is always at least one character: * the line feed */ Modified: trunk/src/http/ngx_http_upstream.c =================================================================== --- trunk/src/http/ngx_http_upstream.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/http/ngx_http_upstream.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -1196,7 +1196,7 @@ { /* * the r->request_body->buf can be reused for one request only, - * the subrequests should allocate their own temporay bufs + * the subrequests should allocate their own temporary bufs */ u->output.free = ngx_alloc_chain_link(r->pool); Modified: trunk/src/http/ngx_http_variables.c =================================================================== --- trunk/src/http/ngx_http_variables.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/http/ngx_http_variables.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -112,7 +112,7 @@ /* * the $http_host, $http_user_agent, $http_referer, $http_via, * and $http_x_forwarded_for variables may be handled by generic - * ngx_http_variable_unknown_header_in(), but for perfomance reasons + * ngx_http_variable_unknown_header_in(), but for performance reasons * they are handled using dedicated entries */ Modified: trunk/src/os/unix/ngx_freebsd_rfork_thread.c =================================================================== --- trunk/src/os/unix/ngx_freebsd_rfork_thread.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/os/unix/ngx_freebsd_rfork_thread.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -11,14 +11,14 @@ /* * The threads implementation uses the rfork(RFPROC|RFTHREAD|RFMEM) syscall * to create threads. All threads use the stacks of the same size mmap()ed - * below the main stack. Thus the current thread id is determinated via + * below the main stack. Thus the current thread id is determined via * the stack pointer value. * * The mutex implementation uses the ngx_atomic_cmp_set() operation * to acquire a mutex and the SysV semaphore to wait on a mutex and to wake up * the waiting threads. The light mutex does not use semaphore, so after * spinning in the lock the thread calls sched_yield(). However the light - * mutecies are intended to be used with the "trylock" operation only. + * mutexes are intended to be used with the "trylock" operation only. * The SysV semop() is a cheap syscall, particularly if it has little sembuf's * and does not use SEM_UNDO. * Modified: trunk/src/os/unix/ngx_freebsd_sendfile_chain.c =================================================================== --- trunk/src/os/unix/ngx_freebsd_sendfile_chain.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/os/unix/ngx_freebsd_sendfile_chain.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -18,7 +18,7 @@ * as the 11 full 1460-bytes packets, then one incomplete 324-bytes packet, * and then again the 11 full 1460-bytes packets. * - * Threfore we use the TCP_NOPUSH option (similar to Linux's TCP_CORK) + * Therefore we use the TCP_NOPUSH option (similar to Linux's TCP_CORK) * to postpone the sending - it not only sends a header and the first part of * the file in one packet, but also sends the file pages in the full packets. * Modified: trunk/src/os/unix/ngx_gcc_atomic_sparc64.h =================================================================== --- trunk/src/os/unix/ngx_gcc_atomic_sparc64.h 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/os/unix/ngx_gcc_atomic_sparc64.h 2012-04-03 07:37:31 UTC (rev 4573) @@ -15,7 +15,7 @@ * r0 = [r1]; * } * - * so "r0 == r2" means that the operation was successfull. + * so "r0 == r2" means that the operation was successful. * * * The "r" means the general register. Modified: trunk/src/os/unix/ngx_setproctitle.c =================================================================== --- trunk/src/os/unix/ngx_setproctitle.c 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/os/unix/ngx_setproctitle.c 2012-04-03 07:37:31 UTC (rev 4573) @@ -21,7 +21,7 @@ * from argv[0] for our process title. * * The Solaris's standard /bin/ps does not show the changed process title. - * You have to use "/usr/ucb/ps -w" instead. Besides, the UCB ps dos not + * You have to use "/usr/ucb/ps -w" instead. Besides, the UCB ps does not * show a new title if its length less than the origin command line length. * To avoid it we append to a new title the origin command line in the * parenthesis. Modified: trunk/src/os/win32/ngx_win32_config.h =================================================================== --- trunk/src/os/win32/ngx_win32_config.h 2012-04-02 21:31:45 UTC (rev 4572) +++ trunk/src/os/win32/ngx_win32_config.h 2012-04-03 07:37:31 UTC (rev 4573) @@ -20,7 +20,7 @@ #define _CRT_SECURE_NO_WARNINGS /* - * we need to include explicity before because + * we need to include explicitly before because * the warning 4201 is enabled in */ #include From ru at nginx.com Tue Apr 3 08:22:00 2012 From: ru at nginx.com (ru at nginx.com) Date: Tue, 3 Apr 2012 08:22:00 +0000 Subject: [nginx] svn commit: r4574 - trunk/src/core Message-ID: <20120403082200.E53043FA2A0@mail.nginx.com> Author: ru Date: 2012-04-03 08:22:00 +0000 (Tue, 03 Apr 2012) New Revision: 4574 URL: http://trac.nginx.org/nginx/changeset/4574/nginx Log: In ngx_ptocidr(), check that the supplied prefix length is within the allowed range. Modified: trunk/src/core/ngx_inet.c Modified: trunk/src/core/ngx_inet.c =================================================================== --- trunk/src/core/ngx_inet.c 2012-04-03 07:37:31 UTC (rev 4573) +++ trunk/src/core/ngx_inet.c 2012-04-03 08:22:00 UTC (rev 4574) @@ -407,6 +407,10 @@ #if (NGX_HAVE_INET6) case AF_INET6: + if (shift > 128) { + return NGX_ERROR; + } + addr = cidr->u.in6.addr.s6_addr; mask = cidr->u.in6.mask.s6_addr; rc = NGX_OK; @@ -428,6 +432,9 @@ #endif default: /* AF_INET */ + if (shift > 32) { + return NGX_ERROR; + } if (shift) { cidr->u.in.mask = htonl((ngx_uint_t) (0 - (1 << (32 - shift)))); From maxim at nginx.com Thu Apr 5 15:32:44 2012 From: maxim at nginx.com (maxim at nginx.com) Date: Thu, 5 Apr 2012 15:32:44 +0000 Subject: [nginx] svn commit: r4575 - trunk/src/os/unix Message-ID: <20120405153244.DD8903FA790@mail.nginx.com> Author: maxim Date: 2012-04-05 15:32:43 +0000 (Thu, 05 Apr 2012) New Revision: 4575 URL: http://trac.nginx.org/nginx/changeset/4575/nginx Log: Style: the function type should be on a line by itself preceding the function. No functional changes. Modified: trunk/src/os/unix/ngx_daemon.c Modified: trunk/src/os/unix/ngx_daemon.c =================================================================== --- trunk/src/os/unix/ngx_daemon.c 2012-04-03 08:22:00 UTC (rev 4574) +++ trunk/src/os/unix/ngx_daemon.c 2012-04-05 15:32:43 UTC (rev 4575) @@ -9,7 +9,8 @@ #include -ngx_int_t ngx_daemon(ngx_log_t *log) +ngx_int_t +ngx_daemon(ngx_log_t *log) { int fd; From defan at nginx.com Thu Apr 5 19:49:34 2012 From: defan at nginx.com (defan at nginx.com) Date: Thu, 5 Apr 2012 19:49:34 +0000 Subject: [nginx] svn commit: r4576 - trunk/src/core Message-ID: <20120405194934.74A6C3FA5D4@mail.nginx.com> Author: defan Date: 2012-04-05 19:49:34 +0000 (Thu, 05 Apr 2012) New Revision: 4576 URL: http://trac.nginx.org/nginx/changeset/4576/nginx Log: Comment fixed. Modified: trunk/src/core/ngx_murmurhash.h Modified: trunk/src/core/ngx_murmurhash.h =================================================================== --- trunk/src/core/ngx_murmurhash.h 2012-04-05 15:32:43 UTC (rev 4575) +++ trunk/src/core/ngx_murmurhash.h 2012-04-05 19:49:34 UTC (rev 4576) @@ -16,4 +16,4 @@ uint32_t ngx_murmur_hash2(u_char *data, size_t len); -#endif /* _NGX_CRC_H_INCLUDED_ */ +#endif /* _NGX_MURMURHASH_H_INCLUDED_ */ From goelvivek2011 at gmail.com Fri Apr 6 07:25:55 2012 From: goelvivek2011 at gmail.com (vivek goel) Date: Fri, 6 Apr 2012 12:55:55 +0530 Subject: ngx_http_send_response is not sending big buffer Message-ID: I am writing my own module. I am getting error with function ngx_http_send_response it is not sending complete buffer if buffer is big. I have following code ngx_http_complex_value_t cv; ngx_int_t rc = ProcessNginxRequest(r, &cv); ngx_http_finalize_request(r, NGX_HTTP_OK); return rc; Sudo Code for ProccessNginxRequest is like this ngx_str_set(&cv->value,"A BIG STRING OF LENGTH 401481") But response coming from the server is truncated. How to fix this problem ? regards Vivek Goel -------------- next part -------------- An HTML attachment was scrubbed... URL: From goelvivek2011 at gmail.com Fri Apr 6 07:26:56 2012 From: goelvivek2011 at gmail.com (vivek goel) Date: Fri, 6 Apr 2012 12:56:56 +0530 Subject: ngx_http_send_response is not sending big buffer In-Reply-To: References: Message-ID: I forgot to mention line ngx_http_send_response Sudo Code for ProccessNginxRequest is like this ngx_str_set(&cv->value,"A BIG STRING OF LENGTH 401481") ngx_http_send_response(r, NGX_HTTP_OK, &ngx_http_json_type, cv); regards Vivek Goel On Fri, Apr 6, 2012 at 12:55 PM, vivek goel wrote: > I am writing my own module. > I am getting error with function ngx_http_send_response it is not sending > complete buffer if buffer is big. > > I have following code > > ngx_http_complex_value_t cv; > ngx_int_t rc = ProcessNginxRequest(r, &cv); > ngx_http_finalize_request(r, NGX_HTTP_OK); > return rc; > > Sudo Code for ProccessNginxRequest is like this > ngx_str_set(&cv->value,"A BIG STRING OF LENGTH 401481") > > But response coming from the server is truncated. > How to fix this problem ? > > > > > > > regards > Vivek Goel > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From mdounin at mdounin.ru Fri Apr 6 09:09:12 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 6 Apr 2012 13:09:12 +0400 Subject: ngx_http_send_response is not sending big buffer In-Reply-To: References: Message-ID: <20120406090912.GI13466@mdounin.ru> Hello! On Fri, Apr 06, 2012 at 12:56:56PM +0530, vivek goel wrote: > I forgot to mention line ngx_http_send_response > Sudo Code for ProccessNginxRequest is like this > ngx_str_set(&cv->value,"A BIG STRING OF LENGTH 401481") > ngx_http_send_response(r, NGX_HTTP_OK, &ngx_http_json_type, cv); > > regards > Vivek Goel > > > > On Fri, Apr 6, 2012 at 12:55 PM, vivek goel wrote: > > > I am writing my own module. > > I am getting error with function ngx_http_send_response it is not sending > > complete buffer if buffer is big. > > > > I have following code > > > > ngx_http_complex_value_t cv; > > ngx_int_t rc = ProcessNginxRequest(r, &cv); > > ngx_http_finalize_request(r, NGX_HTTP_OK); > > return rc; > > > > Sudo Code for ProccessNginxRequest is like this > > ngx_str_set(&cv->value,"A BIG STRING OF LENGTH 401481") > > > > But response coming from the server is truncated. > > How to fix this problem ? Parts of code you've provided suggests you do 2 extra request finalizations. Correct usage of ngx_http_send_response() in a handler function is: return ngx_http_send_response(r, NGX_HTTP_OK, &ngx_http_json_type, &cv); Maxim Dounin From mdounin at mdounin.ru Fri Apr 6 23:46:09 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Fri, 6 Apr 2012 23:46:09 +0000 Subject: [nginx] svn commit: r4577 - in trunk/src: core event Message-ID: <20120406234609.D7BB73FA64F@mail.nginx.com> Author: mdounin Date: 2012-04-06 23:46:09 +0000 (Fri, 06 Apr 2012) New Revision: 4577 URL: http://trac.nginx.org/nginx/changeset/4577/nginx Log: Fixed signed integer overflows in timer code (ticket #145). Integer overflow is undefined behaviour in C and this indeed caused problems on Solaris/SPARC (at least in some cases). Fix is to subtract unsigned integers instead, and then cast result to a signed one, which is implementation-defined behaviour and used to work. Strictly speaking, we should compare (unsigned) result with the maximum value of the corresponding signed integer type instead, this will be defined behaviour. This will require much more changes though, and considered to be overkill for now. Modified: trunk/src/core/ngx_rbtree.c trunk/src/event/ngx_event_timer.c Modified: trunk/src/core/ngx_rbtree.c =================================================================== --- trunk/src/core/ngx_rbtree.c 2012-04-05 19:49:34 UTC (rev 4576) +++ trunk/src/core/ngx_rbtree.c 2012-04-06 23:46:09 UTC (rev 4577) @@ -136,8 +136,7 @@ /* node->key < temp->key */ - p = ((ngx_rbtree_key_int_t) node->key - (ngx_rbtree_key_int_t) temp->key - < 0) + p = ((ngx_rbtree_key_int_t) (node->key - temp->key) < 0) ? &temp->left : &temp->right; if (*p == sentinel) { Modified: trunk/src/event/ngx_event_timer.c =================================================================== --- trunk/src/event/ngx_event_timer.c 2012-04-05 19:49:34 UTC (rev 4576) +++ trunk/src/event/ngx_event_timer.c 2012-04-06 23:46:09 UTC (rev 4577) @@ -67,7 +67,7 @@ ngx_mutex_unlock(ngx_event_timer_mutex); - timer = (ngx_msec_int_t) node->key - (ngx_msec_int_t) ngx_current_msec; + timer = (ngx_msec_int_t) (node->key - ngx_current_msec); return (ngx_msec_t) (timer > 0 ? timer : 0); } @@ -95,8 +95,7 @@ /* node->key <= ngx_current_time */ - if ((ngx_msec_int_t) node->key - (ngx_msec_int_t) ngx_current_msec <= 0) - { + if ((ngx_msec_int_t) (node->key - ngx_current_msec) <= 0) { ev = (ngx_event_t *) ((char *) node - offsetof(ngx_event_t, timer)); #if (NGX_THREADS) From igor at sysoev.ru Tue Apr 10 11:27:43 2012 From: igor at sysoev.ru (igor at sysoev.ru) Date: Tue, 10 Apr 2012 11:27:43 +0000 Subject: [nginx] svn commit: r4579 - trunk/src/http/modules Message-ID: Author: is Date: 2012-04-10 11:27:43 +0000 (Tue, 10 Apr 2012) New Revision: 4579 URL: http://trac.nginx.org/nginx/changeset/4579/nginx Log: Fixed previous commit. Modified: trunk/src/http/modules/ngx_http_mp4_module.c Modified: trunk/src/http/modules/ngx_http_mp4_module.c =================================================================== --- trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-10 11:21:47 UTC (rev 4578) +++ trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-10 11:27:43 UTC (rev 4579) @@ -1910,7 +1910,7 @@ if (start_time < (uint64_t) count * duration) { start_sample += (ngx_uint_t) (start_time / duration); - count -= start_time; + count -= (uint32_t) (start_time / duration); ngx_mp4_set_32value(entry->count, count); goto found; } From igor at sysoev.ru Tue Apr 10 11:28:59 2012 From: igor at sysoev.ru (igor at sysoev.ru) Date: Tue, 10 Apr 2012 11:28:59 +0000 Subject: [nginx] svn commit: r4580 - trunk/src/http/modules Message-ID: Author: is Date: 2012-04-10 11:28:59 +0000 (Tue, 10 Apr 2012) New Revision: 4580 URL: http://trac.nginx.org/nginx/changeset/4580/nginx Log: Fixed debug logging. Modified: trunk/src/http/modules/ngx_http_mp4_module.c Modified: trunk/src/http/modules/ngx_http_mp4_module.c =================================================================== --- trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-10 11:27:43 UTC (rev 4579) +++ trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-10 11:28:59 UTC (rev 4580) @@ -752,7 +752,7 @@ - start_offset; ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, - "mp4 adjustment:%D", adjustment); + "mp4 adjustment:%O", adjustment); for (i = 0; i < mp4->trak.nelts; i++) { if (trak[i].out[NGX_HTTP_MP4_CO64_DATA].buf) { From mdounin at mdounin.ru Tue Apr 10 13:25:53 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Tue, 10 Apr 2012 13:25:53 +0000 Subject: [nginx] svn commit: r4581 - trunk/src/http/modules Message-ID: <20120410132553.62F483F9E49@mail.nginx.com> Author: mdounin Date: 2012-04-10 13:25:53 +0000 (Tue, 10 Apr 2012) New Revision: 4581 URL: http://trac.nginx.org/nginx/changeset/4581/nginx Log: Access module: fixed inheritance of allow/deny ipv6 rules. Previous (incorrect) behaviour was to inherit ipv6 rules separately from ipv4 ones. Now all rules are either inherited (if there are no rules defined at current level) or not (if there are any rules defined). Modified: trunk/src/http/modules/ngx_http_access_module.c Modified: trunk/src/http/modules/ngx_http_access_module.c =================================================================== --- trunk/src/http/modules/ngx_http_access_module.c 2012-04-10 11:28:59 UTC (rev 4580) +++ trunk/src/http/modules/ngx_http_access_module.c 2012-04-10 13:25:53 UTC (rev 4581) @@ -351,14 +351,19 @@ ngx_http_access_loc_conf_t *prev = parent; ngx_http_access_loc_conf_t *conf = child; +#if (NGX_HAVE_INET6) + + if (conf->rules == NULL && conf->rules6 == NULL) { + conf->rules = prev->rules; + conf->rules6 = prev->rules6; + } + +#else + if (conf->rules == NULL) { conf->rules = prev->rules; } -#if (NGX_HAVE_INET6) - if (conf->rules6 == NULL) { - conf->rules6 = prev->rules6; - } #endif return NGX_CONF_OK; From mikegagnon at gmail.com Tue Apr 10 14:12:07 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Tue, 10 Apr 2012 07:12:07 -0700 Subject: ngx_snprintf question Message-ID: I am getting unexpected results from?ngx_snprintf in the following statement: ngx_snprintf((u_char *) buf, sizeof(buf), "%s\n", peer->peer_config->name.data); with peer->peer_config->name.data == "127.0.0.1:9000\0". I expect ngx_snprintf to yield buf == "127.0.0.1:9000\n\0", but instead it yields buf == "127.0.0.1:9000\n\bf\0" (I was not expecting that '\bf' character to be inserted there.) When I change ngx_snprintf to just snprintf, it works as expected. Any thoughts? Mike Gagnon From piotr.sikora at frickle.com Tue Apr 10 14:54:04 2012 From: piotr.sikora at frickle.com (Piotr Sikora) Date: Tue, 10 Apr 2012 16:54:04 +0200 Subject: ngx_snprintf question In-Reply-To: References: Message-ID: Hi, > I am getting unexpected results from ngx_snprintf in the following > statement: > > ngx_snprintf((u_char *) buf, sizeof(buf), "%s\n", > peer->peer_config->name.data); > > with peer->peer_config->name.data == "127.0.0.1:9000\0". > > I expect ngx_snprintf to yield buf == "127.0.0.1:9000\n\0", but > instead it yields buf == "127.0.0.1:9000\n\bf\0" (I was not expecting > that '\bf' character to be inserted there.) > > When I change ngx_snprintf to just snprintf, it works as expected. ngx_snprintf isn't snprintf-equivalent (I was burned by this once myself), it doesn't add trailing '\0' and the "\bf\0" you're seeing is just the data that was in the buffer before. You should either add "%Z" ('\0') to the format string or explicitly set '\0' yourself after ngx_snprintf() call. Best regards, Piotr Sikora < piotr.sikora at frickle.com > From mikegagnon at gmail.com Tue Apr 10 15:00:39 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Tue, 10 Apr 2012 08:00:39 -0700 Subject: ngx_snprintf question In-Reply-To: References: Message-ID: Good to know; thanks! Mike Gagnon On Apr 10, 2012 7:54 AM, "Piotr Sikora" wrote: > Hi, > > I am getting unexpected results from ngx_snprintf in the following >> statement: >> >> ngx_snprintf((u_char *) buf, sizeof(buf), "%s\n", >> peer->peer_config->name.data); >> >> with peer->peer_config->name.data == "127.0.0.1:9000\0". >> >> I expect ngx_snprintf to yield buf == "127.0.0.1:9000\n\0", but >> instead it yields buf == "127.0.0.1:9000\n\bf\0" (I was not expecting >> that '\bf' character to be inserted there.) >> >> When I change ngx_snprintf to just snprintf, it works as expected. >> > > ngx_snprintf isn't snprintf-equivalent (I was burned by this once myself), > it doesn't add trailing '\0' and the "\bf\0" you're seeing is just the data > that was in the buffer before. > > You should either add "%Z" ('\0') to the format string or explicitly set > '\0' yourself after ngx_snprintf() call. > > Best regards, > Piotr Sikora < piotr.sikora at frickle.com > > > ______________________________**_________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/**mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From mikegagnon at gmail.com Wed Apr 11 02:50:43 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Tue, 10 Apr 2012 19:50:43 -0700 Subject: Question about multiple upstream->peer.free calls Message-ID: Hello, I am developing a load-balancing module for nginx. I have noticed that when a peer fails (say because the connection was reset by the peer) the r->upstream->peer.free function is called multiple times on the same peer connection: the first time with state == NGX_PEER_FAILED set, and the second time with state == 0. What is the purpose of calling peer.free multiple times? Is there a recommended way to tell if a call to peer.free is the first call (for that peer connection)? Or to tell if it is the last call (for that peer connection)? This issue is important for the correctness of my code. Thanks! Mike Gagnon From mdounin at mdounin.ru Wed Apr 11 09:41:15 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Wed, 11 Apr 2012 13:41:15 +0400 Subject: Question about multiple upstream->peer.free calls In-Reply-To: References: Message-ID: <20120411094115.GE13466@mdounin.ru> Hello! On Tue, Apr 10, 2012 at 07:50:43PM -0700, Mike Gagnon wrote: > Hello, > > I am developing a load-balancing module for nginx. I have noticed that > when a peer fails (say because the connection was reset by the peer) > the r->upstream->peer.free function is called multiple times on the > same peer connection: the first time with state == NGX_PEER_FAILED > set, and the second time with state == 0. > > What is the purpose of calling peer.free multiple times? There is no real reason, it's more or less bug. It's not yet fixed as it doesn't cause any problems with vanilla balancer modules (well, actually there is a workaround in upstream keepalive, though it's mostly result of the fact it was developed as a separate module). We'll likely fix this somewhere in 1.3.x. > Is there a > recommended way to tell if a call to peer.free is the first call (for > that peer connection)? Or to tell if it is the last call (for that > peer connection)? > > This issue is important for the correctness of my code. For now I would recommend doing similar thing as upstream keepalive does: remember 1st free() call in an internal data and ignore subsequent calls. Maxim Dounin From ru at nginx.com Wed Apr 11 09:56:30 2012 From: ru at nginx.com (ru at nginx.com) Date: Wed, 11 Apr 2012 09:56:30 +0000 Subject: [nginx] svn commit: r4582 - trunk/src/http/modules Message-ID: <20120411095630.8631F3FA729@mail.nginx.com> Author: ru Date: 2012-04-11 09:56:30 +0000 (Wed, 11 Apr 2012) New Revision: 4582 URL: http://trac.nginx.org/nginx/changeset/4582/nginx Log: Fixed directives inheritance. Modified: trunk/src/http/modules/ngx_http_browser_module.c Modified: trunk/src/http/modules/ngx_http_browser_module.c =================================================================== --- trunk/src/http/modules/ngx_http_browser_module.c 2012-04-10 13:25:53 UTC (rev 4581) +++ trunk/src/http/modules/ngx_http_browser_module.c 2012-04-11 09:56:30 UTC (rev 4582) @@ -458,10 +458,11 @@ * with a real skip value. The zero value means Opera. */ - if (conf->modern_browsers == NULL) { + if (conf->modern_browsers == NULL && conf->modern_unlisted_browsers == 0) { conf->modern_browsers = prev->modern_browsers; + conf->modern_unlisted_browsers = prev->modern_unlisted_browsers; - } else { + } else if (conf->modern_browsers != NULL) { browsers = conf->modern_browsers->elts; for (i = 0; i < conf->modern_browsers->nelts; i++) { @@ -501,8 +502,9 @@ } } - if (conf->ancient_browsers == NULL) { + if (conf->ancient_browsers == NULL && conf->netscape4 == 0) { conf->ancient_browsers = prev->ancient_browsers; + conf->netscape4 = prev->netscape4; } if (conf->modern_browser_value == NULL) { From mikegagnon at gmail.com Wed Apr 11 15:14:55 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Wed, 11 Apr 2012 08:14:55 -0700 Subject: Question about multiple upstream->peer.free calls In-Reply-To: <20120411094115.GE13466@mdounin.ru> References: <20120411094115.GE13466@mdounin.ru> Message-ID: Thanks for the feedback! Everything works smoothly now. Mike Gagnon On Apr 11, 2012 2:41 AM, "Maxim Dounin" wrote: > Hello! > > On Tue, Apr 10, 2012 at 07:50:43PM -0700, Mike Gagnon wrote: > > > Hello, > > > > I am developing a load-balancing module for nginx. I have noticed that > > when a peer fails (say because the connection was reset by the peer) > > the r->upstream->peer.free function is called multiple times on the > > same peer connection: the first time with state == NGX_PEER_FAILED > > set, and the second time with state == 0. > > > > What is the purpose of calling peer.free multiple times? > > There is no real reason, it's more or less bug. It's not yet > fixed as it doesn't cause any problems with vanilla balancer > modules (well, actually there is a workaround in upstream > keepalive, though it's mostly result of the fact it was developed > as a separate module). We'll likely fix this somewhere in > 1.3.x. > > > Is there a > > recommended way to tell if a call to peer.free is the first call (for > > that peer connection)? Or to tell if it is the last call (for that > > peer connection)? > > > > This issue is important for the correctness of my code. > > For now I would recommend doing similar thing as upstream > keepalive does: remember 1st free() call in an internal data and > ignore subsequent calls. > > Maxim Dounin > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From ru at nginx.com Wed Apr 11 17:18:15 2012 From: ru at nginx.com (ru at nginx.com) Date: Wed, 11 Apr 2012 17:18:15 +0000 Subject: [nginx] svn commit: r4583 - trunk/src/core Message-ID: <20120411171815.7645A3FA72D@mail.nginx.com> Author: ru Date: 2012-04-11 17:18:15 +0000 (Wed, 11 Apr 2012) New Revision: 4583 URL: http://trac.nginx.org/nginx/changeset/4583/nginx Log: Improved readability of the code that produces bitmask from prefix. In collaboration with Maxim Dounin. Modified: trunk/src/core/ngx_inet.c Modified: trunk/src/core/ngx_inet.c =================================================================== --- trunk/src/core/ngx_inet.c 2012-04-11 09:56:30 UTC (rev 4582) +++ trunk/src/core/ngx_inet.c 2012-04-11 17:18:15 UTC (rev 4583) @@ -420,7 +420,7 @@ s = (shift > 8) ? 8 : shift; shift -= s; - mask[i] = (u_char) (0 - (1 << (8 - s))); + mask[i] = (u_char) (0xffu << (8 - s)); if (addr[i] != (addr[i] & mask[i])) { rc = NGX_DONE; @@ -437,7 +437,7 @@ } if (shift) { - cidr->u.in.mask = htonl((ngx_uint_t) (0 - (1 << (32 - shift)))); + cidr->u.in.mask = htonl((uint32_t) (0xffffffffu << (32 - shift))); } else { /* x86 compilers use a shl instruction that shifts by modulo 32 */ From ru at nginx.com Thu Apr 12 09:19:15 2012 From: ru at nginx.com (ru at nginx.com) Date: Thu, 12 Apr 2012 09:19:15 +0000 Subject: [nginx] svn commit: r4584 - trunk/src/http Message-ID: <20120412091915.7F8F83FA7D9@mail.nginx.com> Author: ru Date: 2012-04-12 09:19:14 +0000 (Thu, 12 Apr 2012) New Revision: 4584 URL: http://trac.nginx.org/nginx/changeset/4584/nginx Log: Fixed buffer overflow when long URI is processed by "try_files" in regex location with "alias" (fixes ticket #135). Modified: trunk/src/http/ngx_http_core_module.c Modified: trunk/src/http/ngx_http_core_module.c =================================================================== --- trunk/src/http/ngx_http_core_module.c 2012-04-11 17:18:15 UTC (rev 4583) +++ trunk/src/http/ngx_http_core_module.c 2012-04-12 09:19:14 UTC (rev 4584) @@ -1228,20 +1228,29 @@ len = tf->name.len; } - /* 16 bytes are preallocation */ - reserve = ngx_abs((ssize_t) (len - r->uri.len)) + alias + 16; + if (!alias) { + reserve = len > r->uri.len ? len - r->uri.len : 0; +#if (NGX_PCRE) + } else if (clcf->regex) { + reserve = len; +#endif + + } else { + reserve = len > r->uri.len - alias ? len - (r->uri.len - alias) : 0; + } + if (reserve > allocated) { - /* we just need to allocate path and to copy a root */ + /* 16 bytes are preallocation */ + allocated = reserve + 16; - if (ngx_http_map_uri_to_path(r, &path, &root, reserve) == NULL) { + if (ngx_http_map_uri_to_path(r, &path, &root, allocated) == NULL) { ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); return NGX_OK; } name = path.data + root; - allocated = path.len - root - (r->uri.len - alias); } if (tf->values == NULL) { From ru at nginx.com Thu Apr 12 10:20:33 2012 From: ru at nginx.com (ru at nginx.com) Date: Thu, 12 Apr 2012 10:20:33 +0000 Subject: [nginx] svn commit: r4585 - trunk/src/core Message-ID: <20120412102033.841CF3FA591@mail.nginx.com> Author: ru Date: 2012-04-12 10:20:33 +0000 (Thu, 12 Apr 2012) New Revision: 4585 URL: http://trac.nginx.org/nginx/changeset/4585/nginx Log: Reduced the number of lines of code in ngx_inet_addr(). Modified: trunk/src/core/ngx_inet.c Modified: trunk/src/core/ngx_inet.c =================================================================== --- trunk/src/core/ngx_inet.c 2012-04-12 09:19:14 UTC (rev 4584) +++ trunk/src/core/ngx_inet.c 2012-04-12 10:20:33 UTC (rev 4585) @@ -44,11 +44,7 @@ return INADDR_NONE; } - if (n != 3) { - return INADDR_NONE; - } - - if (octet < 256) { + if (n == 3 && octet < 256) { addr = (addr << 8) + octet; return htonl(addr); } From mdounin at mdounin.ru Thu Apr 12 12:18:14 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 12:18:14 +0000 Subject: [nginx] svn commit: r4586 - trunk/src/http/modules Message-ID: <20120412121814.EABB13F9F0F@mail.nginx.com> Author: mdounin Date: 2012-04-12 12:18:14 +0000 (Thu, 12 Apr 2012) New Revision: 4586 URL: http://trac.nginx.org/nginx/changeset/4586/nginx Log: Mp4: sanity checks cleanup. Modified: trunk/src/http/modules/ngx_http_mp4_module.c Modified: trunk/src/http/modules/ngx_http_mp4_module.c =================================================================== --- trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-12 10:20:33 UTC (rev 4585) +++ trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-12 12:18:14 UTC (rev 4586) @@ -156,6 +156,7 @@ #define ngx_mp4_atom_header(mp4) (mp4->buffer_pos - 8) #define ngx_mp4_atom_data(mp4) mp4->buffer_pos +#define ngx_mp4_atom_data_size(t) (uint64_t) (sizeof(t) - 8) #define ngx_mp4_atom_next(mp4, n) mp4->buffer_pos += n; mp4->offset += n @@ -204,7 +205,7 @@ static ngx_int_t ngx_http_mp4_process(ngx_http_mp4_file_t *mp4); static ngx_int_t ngx_http_mp4_read_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_atom_handler_t *atom, uint64_t atom_data_size); -static ngx_int_t ngx_http_mp4_read(ngx_http_mp4_file_t *mp4); +static ngx_int_t ngx_http_mp4_read(ngx_http_mp4_file_t *mp4, size_t size); static ngx_int_t ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); static ngx_int_t ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, @@ -265,7 +266,7 @@ ngx_http_mp4_trak_t *trak); static ngx_int_t ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); -static void ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, +static ngx_int_t ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_trak_t *trak); static ngx_int_t ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); @@ -701,7 +702,9 @@ return NGX_ERROR; } - ngx_http_mp4_update_stsz_atom(mp4, &trak[i]); + if (ngx_http_mp4_update_stsz_atom(mp4, &trak[i]) != NGX_OK) { + return NGX_ERROR; + } if (trak[i].out[NGX_HTTP_MP4_CO64_DATA].buf) { if (ngx_http_mp4_update_co64_atom(mp4, &trak[i]) != NGX_OK) { @@ -793,10 +796,8 @@ while (mp4->offset < end) { - if (mp4->buffer_pos + sizeof(uint32_t) > mp4->buffer_end) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } + if (ngx_http_mp4_read(mp4, sizeof(uint32_t)) != NGX_OK) { + return NGX_ERROR; } atom_header = mp4->buffer_pos; @@ -813,17 +814,14 @@ if (atom_size == 1) { - if (mp4->buffer_pos + sizeof(ngx_mp4_atom_header64_t) - > mp4->buffer_end) + if (ngx_http_mp4_read(mp4, sizeof(ngx_mp4_atom_header64_t)) + != NGX_OK) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } - - atom_header = mp4->buffer_pos; + return NGX_ERROR; } /* 64-bit atom size */ + atom_header = mp4->buffer_pos; atom_size = ngx_mp4_get_64value(atom_header + 8); atom_header_size = sizeof(ngx_mp4_atom_header64_t); @@ -835,20 +833,26 @@ } } - if (mp4->buffer_pos + sizeof(ngx_mp4_atom_header_t) > mp4->buffer_end) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } - - atom_header = mp4->buffer_pos; + if (ngx_http_mp4_read(mp4, sizeof(ngx_mp4_atom_header_t)) != NGX_OK) { + return NGX_ERROR; } + atom_header = mp4->buffer_pos; atom_name = atom_header + sizeof(uint32_t); ngx_log_debug4(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 atom: %*s @%O:%uL", 4, atom_name, mp4->offset, atom_size); + if (atom_size > (uint64_t) (NGX_MAX_OFF_T_VALUE - mp4->offset) + || mp4->offset + (off_t) atom_size > end) + { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 atom too large:%uL", + mp4->file.name.data, atom_size); + return NGX_ERROR; + } + for (n = 0; atom[n].name; n++) { if (ngx_strncmp(atom_name, atom[n].name, 4) == 0) { @@ -875,14 +879,24 @@ static ngx_int_t -ngx_http_mp4_read(ngx_http_mp4_file_t *mp4) +ngx_http_mp4_read(ngx_http_mp4_file_t *mp4, size_t size) { - ngx_int_t n; + ssize_t n; + if (mp4->buffer_pos + size <= mp4->buffer_end) { + return NGX_OK; + } + if (mp4->offset + (off_t) mp4->buffer_size > mp4->end) { mp4->buffer_size = (size_t) (mp4->end - mp4->offset); } + if (mp4->buffer_size < size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 file truncated", mp4->file.name.data); + return NGX_ERROR; + } + if (mp4->buffer == NULL) { mp4->buffer = ngx_palloc(mp4->request->pool, mp4->buffer_size); if (mp4->buffer == NULL) { @@ -890,7 +904,6 @@ } mp4->buffer_start = mp4->buffer; - mp4->buffer_end = mp4->buffer + mp4->buffer_size; } n = ngx_read_file(&mp4->file, mp4->buffer_start, mp4->buffer_size, @@ -900,11 +913,15 @@ return NGX_ERROR; } - if (n == 0) { - return NGX_OK; + if ((size_t) n != mp4->buffer_size) { + ngx_log_error(NGX_LOG_CRIT, mp4->file.log, 0, + ngx_read_file_n " read only %z of %z from \"%s\"", + n, mp4->buffer_size, mp4->file.name.data); + return NGX_ERROR; } mp4->buffer_pos = mp4->buffer_start; + mp4->buffer_end = mp4->buffer_start + mp4->buffer_size; return NGX_OK; } @@ -919,7 +936,9 @@ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 ftyp atom"); - if (atom_data_size > 1024) { + if (atom_data_size > 1024 + || ngx_mp4_atom_data(mp4) + atom_data_size > mp4->buffer_end) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, "\"%s\" mp4 ftyp atom is too large:%uL", mp4->file.name.data, atom_data_size); @@ -1168,6 +1187,12 @@ mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(atom_header, 'm', 'v', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_mvhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mvhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (mvhd_atom->version[0] == 0) { /* version 0: 32-bit duration */ timescale = ngx_mp4_get_32value(mvhd_atom->timescale); @@ -1175,6 +1200,14 @@ } else { /* version 1: 64-bit duration */ + + if (ngx_mp4_atom_data_size(ngx_mp4_mvhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mvhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + timescale = ngx_mp4_get_32value(mvhd64_atom->timescale); duration = ngx_mp4_get_64value(mvhd64_atom->duration); } @@ -1345,12 +1378,26 @@ tkhd64_atom = (ngx_mp4_tkhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(tkhd_atom, 't', 'k', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_tkhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 tkhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (tkhd_atom->version[0] == 0) { /* version 0: 32-bit duration */ duration = ngx_mp4_get_32value(tkhd_atom->duration); } else { /* version 1: 64-bit duration */ + + if (ngx_mp4_atom_data_size(ngx_mp4_tkhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 tkhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + duration = ngx_mp4_get_64value(tkhd64_atom->duration); } @@ -1474,6 +1521,12 @@ mdhd64_atom = (ngx_mp4_mdhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(mdhd_atom, 'm', 'd', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_mdhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mdhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (mdhd_atom->version[0] == 0) { /* version 0: everything is 32-bit */ timescale = ngx_mp4_get_32value(mdhd_atom->timescale); @@ -1481,6 +1534,14 @@ } else { /* version 1: 64-bit duration and 32-bit timescale */ + + if (ngx_mp4_atom_data_size(ngx_mp4_mdhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mdhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + timescale = ngx_mp4_get_32value(mdhd64_atom->timescale); duration = ngx_mp4_get_64value(mdhd64_atom->duration); } @@ -1756,12 +1817,9 @@ ngx_mp4_set_32value(stsd_atom->size, atom_size); ngx_mp4_set_atom_name(stsd_atom, 's', 't', 's', 'd'); - if ((uint64_t) (sizeof(ngx_mp4_stsd_atom_t) - sizeof(ngx_mp4_atom_header_t)) - > atom_data_size) - { + if (ngx_mp4_atom_data_size(ngx_mp4_stsd_atom_t) > atom_data_size) { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsd atom too large", - mp4->file.name.data); + "\"%s\" mp4 stsd atom too small", mp4->file.name.data); return NGX_ERROR; } @@ -1825,21 +1883,28 @@ stts_atom = (ngx_mp4_stts_atom_t *) atom_header; ngx_mp4_set_atom_name(stts_atom, 's', 't', 't', 's'); + if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stts atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stts_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 time-to-sample entries:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stts_atom_t); - atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); - - if ((uint64_t) (atom_end - stts_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t) + + entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stts atom too large", - mp4->file.name.data); + "\"%s\" mp4 stts atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stts_atom_t); + atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); + trak = ngx_mp4_last_trak(mp4); trak->time_to_sample_entries = entries; @@ -1973,6 +2038,12 @@ stss_atom = (ngx_http_mp4_stss_atom_t *) atom_header; ngx_mp4_set_atom_name(stss_atom, 's', 't', 's', 's'); + if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stss atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stss_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, @@ -1988,14 +2059,16 @@ atom->pos = atom_header; atom->last = atom_table; - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stss_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stss atom too large", mp4->file.name.data); + "\"%s\" mp4 stss atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(uint32_t); + data = &trak->stss_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2118,6 +2191,12 @@ ctts_atom = (ngx_mp4_ctts_atom_t *) atom_header; ngx_mp4_set_atom_name(ctts_atom, 'c', 't', 't', 's'); + if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 ctts atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(ctts_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, @@ -2133,14 +2212,16 @@ atom->pos = atom_header; atom->last = atom_table; - atom_end = atom_table + entries * sizeof(ngx_mp4_ctts_entry_t); - - if ((uint64_t) (atom_end - ctts_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t) + + entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 ctts atom too large", mp4->file.name.data); + "\"%s\" mp4 ctts atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(ngx_mp4_ctts_entry_t); + data = &trak->ctts_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2251,21 +2332,28 @@ stsc_atom = (ngx_mp4_stsc_atom_t *) atom_header; ngx_mp4_set_atom_name(stsc_atom, 's', 't', 's', 'c'); + if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stsc atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stsc_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "sample-to-chunk entries:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stsc_atom_t); - atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); - - if ((uint64_t) (atom_end - stsc_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t) + + entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsc atom too large", - mp4->file.name.data); + "\"%s\" mp4 stsc atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stsc_atom_t); + atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); + trak = ngx_mp4_last_trak(mp4); trak->sample_to_chunk_entries = entries; @@ -2317,6 +2405,13 @@ return NGX_ERROR; } + if (trak->sample_to_chunk_entries == 0) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "zero number of entries in stsc atom in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + start_sample = (uint32_t) trak->start_sample; entries = trak->sample_to_chunk_entries - 1; @@ -2458,6 +2553,12 @@ stsz_atom = (ngx_mp4_stsz_atom_t *) atom_header; ngx_mp4_set_atom_name(stsz_atom, 's', 't', 's', 'z'); + if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stsz atom too small", mp4->file.name.data); + return NGX_ERROR; + } + size = ngx_mp4_get_32value(stsz_atom->uniform_size); entries = ngx_mp4_get_32value(stsz_atom->entries); @@ -2477,15 +2578,17 @@ trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf = atom; if (size == 0) { - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stsz_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsz atom too large", + "\"%s\" mp4 stsz atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(uint32_t); + data = &trak->stsz_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2507,7 +2610,7 @@ } -static void +static ngx_int_t ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_trak_t *trak) { @@ -2528,6 +2631,13 @@ data = trak->out[NGX_HTTP_MP4_STSZ_DATA].buf; if (data) { + if (trak->start_sample > trak->sample_sizes_entries) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 stsz samples in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_sample * sizeof(uint32_t); end = (uint32_t *) data->pos; @@ -2548,6 +2658,8 @@ ngx_mp4_set_32value(stsz_atom->entries, trak->sample_sizes_entries - trak->start_sample); } + + return NGX_OK; } @@ -2577,19 +2689,27 @@ stco_atom = (ngx_mp4_stco_atom_t *) atom_header; ngx_mp4_set_atom_name(stco_atom, 's', 't', 'c', 'o'); + if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stco atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stco_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stco_atom_t); - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stco_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stco atom too large", mp4->file.name.data); + "\"%s\" mp4 stco atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stco_atom_t); + atom_end = atom_table + entries * sizeof(uint32_t); + trak = ngx_mp4_last_trak(mp4); trak->chunks = entries; @@ -2638,6 +2758,13 @@ return NGX_ERROR; } + if (trak->start_chunk > trak->chunks) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 stco chunks in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_chunk * sizeof(uint32_t); atom_size = sizeof(ngx_mp4_stco_atom_t) + (data->last - data->pos); trak->size += atom_size; @@ -2713,19 +2840,27 @@ co64_atom = (ngx_mp4_co64_atom_t *) atom_header; ngx_mp4_set_atom_name(co64_atom, 'c', 'o', '6', '4'); + if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 co64 atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(co64_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_co64_atom_t); - atom_end = atom_table + entries * sizeof(uint64_t); - - if ((uint64_t) (atom_end - co64_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t) + + entries * sizeof(uint64_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 co64 atom too large", mp4->file.name.data); + "\"%s\" mp4 co64 atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_co64_atom_t); + atom_end = atom_table + entries * sizeof(uint64_t); + trak = ngx_mp4_last_trak(mp4); trak->chunks = entries; @@ -2774,6 +2909,13 @@ return NGX_ERROR; } + if (trak->start_chunk > trak->chunks) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 co64 chunks in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_chunk * sizeof(uint64_t); atom_size = sizeof(ngx_mp4_co64_atom_t) + (data->last - data->pos); trak->size += atom_size; From mdounin at mdounin.ru Thu Apr 12 12:42:47 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 12:42:47 +0000 Subject: [nginx] svn commit: r4587 - trunk/docs/xml/nginx Message-ID: <20120412124247.59C233F9F0F@mail.nginx.com> Author: mdounin Date: 2012-04-12 12:42:46 +0000 (Thu, 12 Apr 2012) New Revision: 4587 URL: http://trac.nginx.org/nginx/changeset/4587/nginx Log: nginx-1.1.19-RELEASE Modified: trunk/docs/xml/nginx/changes.xml Modified: trunk/docs/xml/nginx/changes.xml =================================================================== --- trunk/docs/xml/nginx/changes.xml 2012-04-12 12:18:14 UTC (rev 4586) +++ trunk/docs/xml/nginx/changes.xml 2012-04-12 12:42:46 UTC (rev 4587) @@ -9,6 +9,88 @@ nginx changelog + + + + +??? ????????? ?????????? ?????????? mp4 ????? ??????? ngx_http_mp4_module +????? ???????????????? ??????? ?????? ???????? ????????, ??? ????? +????????? ? ?????????? ????????????? ???? (CVE-2012-2089).
+??????? Matthew Daley. + + +specially crafted mp4 file might allow to overwrite +memory locations in a worker process +if the ngx_http_mp4_module was used, +potentially resulting in arbitrary code execution (CVE-2012-2089).
+Thanks to Matthew Daley. + + + + + +nginx/Windows ??? ??????????? ????????.
+??????? Vincent Lee. + + +nginx/Windows might be terminated abnormally.
+Thanks to Vincent Lee. + + + + + +nginx ???????? ?????????, ???? ??? ??????? ? upstream'? ???? ???????? +?????? backup. + + +nginx hogged CPU if all servers in an upstream were marked as "backup". + + + + + +????????? allow ? deny ????? ????????????? ???????????, +???? ? ??? ?????????????? IPv6 ??????. + + +the "allow" and "deny" directives might be inherited incorrectly +if they were used with IPv6 addresses. + + + + + +????????? modern_browser ? ancient_browser +????? ????????????? ???????????. + + +the "modern_browser" and "ancient_browser" directives +might be inherited incorrectly. + + + + + +???????? ????? ???????? ??????????? ?? Solaris/SPARC. + + +timeouts might be handled incorrectly on Solaris/SPARC. + + + + + +? ?????? ngx_http_mp4_module. + + +in the ngx_http_mp4_module. + + + + + + From mdounin at mdounin.ru Thu Apr 12 12:43:31 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 12:43:31 +0000 Subject: [nginx] svn commit: r4588 - tags Message-ID: <20120412124332.029A83FA0C9@mail.nginx.com> Author: mdounin Date: 2012-04-12 12:43:31 +0000 (Thu, 12 Apr 2012) New Revision: 4588 URL: http://trac.nginx.org/nginx/changeset/4588/nginx Log: release-1.1.19 tag Added: tags/release-1.1.19/ From mdounin at mdounin.ru Thu Apr 12 12:47:36 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 12:47:36 +0000 Subject: [nginx] svn commit: r4589 - in branches/stable-1.0/src: core http/modules/perl Message-ID: <20120412124736.E80C13F9F0F@mail.nginx.com> Author: mdounin Date: 2012-04-12 12:47:36 +0000 (Thu, 12 Apr 2012) New Revision: 4589 URL: http://trac.nginx.org/nginx/changeset/4589/nginx Log: Version bump. Modified: branches/stable-1.0/src/core/nginx.h branches/stable-1.0/src/http/modules/perl/nginx.pm Modified: branches/stable-1.0/src/core/nginx.h =================================================================== --- branches/stable-1.0/src/core/nginx.h 2012-04-12 12:43:31 UTC (rev 4588) +++ branches/stable-1.0/src/core/nginx.h 2012-04-12 12:47:36 UTC (rev 4589) @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1000014 -#define NGINX_VERSION "1.0.14" +#define nginx_version 1000015 +#define NGINX_VERSION "1.0.15" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "NGINX" Modified: branches/stable-1.0/src/http/modules/perl/nginx.pm =================================================================== --- branches/stable-1.0/src/http/modules/perl/nginx.pm 2012-04-12 12:43:31 UTC (rev 4588) +++ branches/stable-1.0/src/http/modules/perl/nginx.pm 2012-04-12 12:47:36 UTC (rev 4589) @@ -50,7 +50,7 @@ HTTP_INSUFFICIENT_STORAGE ); -our $VERSION = '1.0.14'; +our $VERSION = '1.0.15'; require XSLoader; XSLoader::load('nginx', $VERSION); From mdounin at mdounin.ru Thu Apr 12 12:55:43 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 12:55:43 +0000 Subject: [nginx] svn commit: r4590 - in branches/stable-1.0: . src/http/modules Message-ID: <20120412125543.876683FA726@mail.nginx.com> Author: mdounin Date: 2012-04-12 12:55:43 +0000 (Thu, 12 Apr 2012) New Revision: 4590 URL: http://trac.nginx.org/nginx/changeset/4590/nginx Log: Merge of r4578, r4579, r4580, r4586: mp4 fixes. Modified: branches/stable-1.0/ branches/stable-1.0/src/http/modules/ngx_http_mp4_module.c Property changes on: branches/stable-1.0 ___________________________________________________________________ Modified: svn:mergeinfo - /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500,4530-4531 + /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500,4530-4531,4578-4580,4586 Modified: branches/stable-1.0/src/http/modules/ngx_http_mp4_module.c =================================================================== --- branches/stable-1.0/src/http/modules/ngx_http_mp4_module.c 2012-04-12 12:47:36 UTC (rev 4589) +++ branches/stable-1.0/src/http/modules/ngx_http_mp4_module.c 2012-04-12 12:55:43 UTC (rev 4590) @@ -156,6 +156,7 @@ #define ngx_mp4_atom_header(mp4) (mp4->buffer_pos - 8) #define ngx_mp4_atom_data(mp4) mp4->buffer_pos +#define ngx_mp4_atom_data_size(t) (uint64_t) (sizeof(t) - 8) #define ngx_mp4_atom_next(mp4, n) mp4->buffer_pos += n; mp4->offset += n @@ -204,7 +205,7 @@ static ngx_int_t ngx_http_mp4_process(ngx_http_mp4_file_t *mp4); static ngx_int_t ngx_http_mp4_read_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_atom_handler_t *atom, uint64_t atom_data_size); -static ngx_int_t ngx_http_mp4_read(ngx_http_mp4_file_t *mp4); +static ngx_int_t ngx_http_mp4_read(ngx_http_mp4_file_t *mp4, size_t size); static ngx_int_t ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); static ngx_int_t ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, @@ -265,7 +266,7 @@ ngx_http_mp4_trak_t *trak); static ngx_int_t ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); -static void ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, +static ngx_int_t ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_trak_t *trak); static ngx_int_t ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size); @@ -693,7 +694,9 @@ return NGX_ERROR; } - ngx_http_mp4_update_stsz_atom(mp4, &trak[i]); + if (ngx_http_mp4_update_stsz_atom(mp4, &trak[i]) != NGX_OK) { + return NGX_ERROR; + } if (trak[i].out[NGX_HTTP_MP4_CO64_DATA].buf) { if (ngx_http_mp4_update_co64_atom(mp4, &trak[i]) != NGX_OK) { @@ -744,7 +747,7 @@ - start_offset; ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, - "mp4 adjustment:%D", adjustment); + "mp4 adjustment:%O", adjustment); for (i = 0; i < mp4->trak.nelts; i++) { if (trak[i].out[NGX_HTTP_MP4_CO64_DATA].buf) { @@ -785,10 +788,8 @@ while (mp4->offset < end) { - if (mp4->buffer_pos + sizeof(uint32_t) > mp4->buffer_end) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } + if (ngx_http_mp4_read(mp4, sizeof(uint32_t)) != NGX_OK) { + return NGX_ERROR; } atom_header = mp4->buffer_pos; @@ -805,17 +806,14 @@ if (atom_size == 1) { - if (mp4->buffer_pos + sizeof(ngx_mp4_atom_header64_t) - > mp4->buffer_end) + if (ngx_http_mp4_read(mp4, sizeof(ngx_mp4_atom_header64_t)) + != NGX_OK) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } - - atom_header = mp4->buffer_pos; + return NGX_ERROR; } /* 64-bit atom size */ + atom_header = mp4->buffer_pos; atom_size = ngx_mp4_get_64value(atom_header + 8); atom_header_size = sizeof(ngx_mp4_atom_header64_t); @@ -827,20 +825,26 @@ } } - if (mp4->buffer_pos + sizeof(ngx_mp4_atom_header_t) > mp4->buffer_end) { - if (ngx_http_mp4_read(mp4) != NGX_OK) { - return NGX_ERROR; - } - - atom_header = mp4->buffer_pos; + if (ngx_http_mp4_read(mp4, sizeof(ngx_mp4_atom_header_t)) != NGX_OK) { + return NGX_ERROR; } + atom_header = mp4->buffer_pos; atom_name = atom_header + sizeof(uint32_t); ngx_log_debug4(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 atom: %*s @%O:%uL", 4, atom_name, mp4->offset, atom_size); + if (atom_size > (uint64_t) (NGX_MAX_OFF_T_VALUE - mp4->offset) + || mp4->offset + (off_t) atom_size > end) + { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 atom too large:%uL", + mp4->file.name.data, atom_size); + return NGX_ERROR; + } + for (n = 0; atom[n].name; n++) { if (ngx_strncmp(atom_name, atom[n].name, 4) == 0) { @@ -867,14 +871,24 @@ static ngx_int_t -ngx_http_mp4_read(ngx_http_mp4_file_t *mp4) +ngx_http_mp4_read(ngx_http_mp4_file_t *mp4, size_t size) { - ngx_int_t n; + ssize_t n; + if (mp4->buffer_pos + size <= mp4->buffer_end) { + return NGX_OK; + } + if (mp4->offset + (off_t) mp4->buffer_size > mp4->end) { mp4->buffer_size = (size_t) (mp4->end - mp4->offset); } + if (mp4->buffer_size < size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 file truncated", mp4->file.name.data); + return NGX_ERROR; + } + if (mp4->buffer == NULL) { mp4->buffer = ngx_palloc(mp4->request->pool, mp4->buffer_size); if (mp4->buffer == NULL) { @@ -882,7 +896,6 @@ } mp4->buffer_start = mp4->buffer; - mp4->buffer_end = mp4->buffer + mp4->buffer_size; } n = ngx_read_file(&mp4->file, mp4->buffer_start, mp4->buffer_size, @@ -892,11 +905,15 @@ return NGX_ERROR; } - if (n == 0) { - return NGX_OK; + if ((size_t) n != mp4->buffer_size) { + ngx_log_error(NGX_LOG_CRIT, mp4->file.log, 0, + ngx_read_file_n " read only %z of %z from \"%s\"", + n, mp4->buffer_size, mp4->file.name.data); + return NGX_ERROR; } mp4->buffer_pos = mp4->buffer_start; + mp4->buffer_end = mp4->buffer_start + mp4->buffer_size; return NGX_OK; } @@ -911,7 +928,9 @@ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 ftyp atom"); - if (atom_data_size > 1024) { + if (atom_data_size > 1024 + || ngx_mp4_atom_data(mp4) + atom_data_size > mp4->buffer_end) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, "\"%s\" mp4 ftyp atom is too large:%uL", mp4->file.name.data, atom_data_size); @@ -1160,6 +1179,12 @@ mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(atom_header, 'm', 'v', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_mvhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mvhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (mvhd_atom->version[0] == 0) { /* version 0: 32-bit duration */ timescale = ngx_mp4_get_32value(mvhd_atom->timescale); @@ -1167,6 +1192,14 @@ } else { /* version 1: 64-bit duration */ + + if (ngx_mp4_atom_data_size(ngx_mp4_mvhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mvhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + timescale = ngx_mp4_get_32value(mvhd64_atom->timescale); duration = ngx_mp4_get_64value(mvhd64_atom->duration); } @@ -1337,12 +1370,26 @@ tkhd64_atom = (ngx_mp4_tkhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(tkhd_atom, 't', 'k', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_tkhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 tkhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (tkhd_atom->version[0] == 0) { /* version 0: 32-bit duration */ duration = ngx_mp4_get_32value(tkhd_atom->duration); } else { /* version 1: 64-bit duration */ + + if (ngx_mp4_atom_data_size(ngx_mp4_tkhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 tkhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + duration = ngx_mp4_get_64value(tkhd64_atom->duration); } @@ -1466,6 +1513,12 @@ mdhd64_atom = (ngx_mp4_mdhd64_atom_t *) atom_header; ngx_mp4_set_atom_name(mdhd_atom, 'm', 'd', 'h', 'd'); + if (ngx_mp4_atom_data_size(ngx_mp4_mdhd_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mdhd atom too small", mp4->file.name.data); + return NGX_ERROR; + } + if (mdhd_atom->version[0] == 0) { /* version 0: everything is 32-bit */ timescale = ngx_mp4_get_32value(mdhd_atom->timescale); @@ -1473,6 +1526,14 @@ } else { /* version 1: 64-bit duration and 32-bit timescale */ + + if (ngx_mp4_atom_data_size(ngx_mp4_mdhd64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 mdhd atom too small", + mp4->file.name.data); + return NGX_ERROR; + } + timescale = ngx_mp4_get_32value(mdhd64_atom->timescale); duration = ngx_mp4_get_64value(mdhd64_atom->duration); } @@ -1748,12 +1809,9 @@ ngx_mp4_set_32value(stsd_atom->size, atom_size); ngx_mp4_set_atom_name(stsd_atom, 's', 't', 's', 'd'); - if ((uint64_t) (sizeof(ngx_mp4_stsd_atom_t) - sizeof(ngx_mp4_atom_header_t)) - > atom_data_size) - { + if (ngx_mp4_atom_data_size(ngx_mp4_stsd_atom_t) > atom_data_size) { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsd atom too large", - mp4->file.name.data); + "\"%s\" mp4 stsd atom too small", mp4->file.name.data); return NGX_ERROR; } @@ -1817,21 +1875,28 @@ stts_atom = (ngx_mp4_stts_atom_t *) atom_header; ngx_mp4_set_atom_name(stts_atom, 's', 't', 't', 's'); + if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stts atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stts_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 time-to-sample entries:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stts_atom_t); - atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); - - if ((uint64_t) (atom_end - stts_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t) + + entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stts atom too large", - mp4->file.name.data); + "\"%s\" mp4 stts atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stts_atom_t); + atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t); + trak = ngx_mp4_last_trak(mp4); trak->time_to_sample_entries = entries; @@ -1902,7 +1967,7 @@ if (start_time < (uint64_t) count * duration) { start_sample += (ngx_uint_t) (start_time / duration); - count -= start_sample; + count -= (uint32_t) (start_time / duration); ngx_mp4_set_32value(entry->count, count); goto found; } @@ -1965,6 +2030,12 @@ stss_atom = (ngx_http_mp4_stss_atom_t *) atom_header; ngx_mp4_set_atom_name(stss_atom, 's', 't', 's', 's'); + if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stss atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stss_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, @@ -1980,14 +2051,16 @@ atom->pos = atom_header; atom->last = atom_table; - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stss_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stss atom too large", mp4->file.name.data); + "\"%s\" mp4 stss atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(uint32_t); + data = &trak->stss_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2110,6 +2183,12 @@ ctts_atom = (ngx_mp4_ctts_atom_t *) atom_header; ngx_mp4_set_atom_name(ctts_atom, 'c', 't', 't', 's'); + if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 ctts atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(ctts_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, @@ -2125,14 +2204,16 @@ atom->pos = atom_header; atom->last = atom_table; - atom_end = atom_table + entries * sizeof(ngx_mp4_ctts_entry_t); - - if ((uint64_t) (atom_end - ctts_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t) + + entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 ctts atom too large", mp4->file.name.data); + "\"%s\" mp4 ctts atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(ngx_mp4_ctts_entry_t); + data = &trak->ctts_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2243,21 +2324,28 @@ stsc_atom = (ngx_mp4_stsc_atom_t *) atom_header; ngx_mp4_set_atom_name(stsc_atom, 's', 't', 's', 'c'); + if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stsc atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stsc_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "sample-to-chunk entries:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stsc_atom_t); - atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); - - if ((uint64_t) (atom_end - stsc_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t) + + entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsc atom too large", - mp4->file.name.data); + "\"%s\" mp4 stsc atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stsc_atom_t); + atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t); + trak = ngx_mp4_last_trak(mp4); trak->sample_to_chunk_entries = entries; @@ -2309,6 +2397,13 @@ return NGX_ERROR; } + if (trak->sample_to_chunk_entries == 0) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "zero number of entries in stsc atom in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + start_sample = (uint32_t) trak->start_sample; entries = trak->sample_to_chunk_entries - 1; @@ -2450,6 +2545,12 @@ stsz_atom = (ngx_mp4_stsz_atom_t *) atom_header; ngx_mp4_set_atom_name(stsz_atom, 's', 't', 's', 'z'); + if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stsz atom too small", mp4->file.name.data); + return NGX_ERROR; + } + size = ngx_mp4_get_32value(stsz_atom->uniform_size); entries = ngx_mp4_get_32value(stsz_atom->entries); @@ -2469,15 +2570,17 @@ trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf = atom; if (size == 0) { - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stsz_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stsz atom too large", + "\"%s\" mp4 stsz atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_end = atom_table + entries * sizeof(uint32_t); + data = &trak->stsz_data_buf; data->temporary = 1; data->pos = atom_table; @@ -2499,7 +2602,7 @@ } -static void +static ngx_int_t ngx_http_mp4_update_stsz_atom(ngx_http_mp4_file_t *mp4, ngx_http_mp4_trak_t *trak) { @@ -2520,6 +2623,13 @@ data = trak->out[NGX_HTTP_MP4_STSZ_DATA].buf; if (data) { + if (trak->start_sample > trak->sample_sizes_entries) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 stsz samples in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_sample * sizeof(uint32_t); end = (uint32_t *) data->pos; @@ -2540,6 +2650,8 @@ ngx_mp4_set_32value(stsz_atom->entries, trak->sample_sizes_entries - trak->start_sample); } + + return NGX_OK; } @@ -2569,19 +2681,27 @@ stco_atom = (ngx_mp4_stco_atom_t *) atom_header; ngx_mp4_set_atom_name(stco_atom, 's', 't', 'c', 'o'); + if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 stco atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(stco_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_stco_atom_t); - atom_end = atom_table + entries * sizeof(uint32_t); - - if ((uint64_t) (atom_end - stco_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t) + + entries * sizeof(uint32_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 stco atom too large", mp4->file.name.data); + "\"%s\" mp4 stco atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_stco_atom_t); + atom_end = atom_table + entries * sizeof(uint32_t); + trak = ngx_mp4_last_trak(mp4); trak->chunks = entries; @@ -2630,6 +2750,13 @@ return NGX_ERROR; } + if (trak->start_chunk > trak->chunks) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 stco chunks in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_chunk * sizeof(uint32_t); atom_size = sizeof(ngx_mp4_stco_atom_t) + (data->last - data->pos); trak->size += atom_size; @@ -2705,19 +2832,27 @@ co64_atom = (ngx_mp4_co64_atom_t *) atom_header; ngx_mp4_set_atom_name(co64_atom, 'c', 'o', '6', '4'); + if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t) > atom_data_size) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "\"%s\" mp4 co64 atom too small", mp4->file.name.data); + return NGX_ERROR; + } + entries = ngx_mp4_get_32value(co64_atom->entries); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries); - atom_table = atom_header + sizeof(ngx_mp4_co64_atom_t); - atom_end = atom_table + entries * sizeof(uint64_t); - - if ((uint64_t) (atom_end - co64_atom->version) > atom_data_size) { + if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t) + + entries * sizeof(uint64_t) > atom_data_size) + { ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, - "\"%s\" mp4 co64 atom too large", mp4->file.name.data); + "\"%s\" mp4 co64 atom too small", mp4->file.name.data); return NGX_ERROR; } + atom_table = atom_header + sizeof(ngx_mp4_co64_atom_t); + atom_end = atom_table + entries * sizeof(uint64_t); + trak = ngx_mp4_last_trak(mp4); trak->chunks = entries; @@ -2766,6 +2901,13 @@ return NGX_ERROR; } + if (trak->start_chunk > trak->chunks) { + ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, + "start time is out mp4 co64 chunks in \"%s\"", + mp4->file.name.data); + return NGX_ERROR; + } + data->pos += trak->start_chunk * sizeof(uint64_t); atom_size = sizeof(ngx_mp4_co64_atom_t) + (data->last - data->pos); trak->size += atom_size; From mdounin at mdounin.ru Thu Apr 12 13:00:53 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 13:00:53 +0000 Subject: [nginx] svn commit: r4591 - branches/stable-1.0/docs/xml/nginx Message-ID: <20120412130053.F3F5B3FA77A@mail.nginx.com> Author: mdounin Date: 2012-04-12 13:00:53 +0000 (Thu, 12 Apr 2012) New Revision: 4591 URL: http://trac.nginx.org/nginx/changeset/4591/nginx Log: nginx-1.0.15-RELEASE Modified: branches/stable-1.0/docs/xml/nginx/changes.xml Modified: branches/stable-1.0/docs/xml/nginx/changes.xml =================================================================== --- branches/stable-1.0/docs/xml/nginx/changes.xml 2012-04-12 12:55:43 UTC (rev 4590) +++ branches/stable-1.0/docs/xml/nginx/changes.xml 2012-04-12 13:00:53 UTC (rev 4591) @@ -9,6 +9,36 @@ nginx changelog + + + + +??? ????????? ?????????? ?????????? mp4 ????? ??????? ngx_http_mp4_module +????? ???????????????? ??????? ?????? ???????? ????????, ??? ????? +????????? ? ?????????? ????????????? ???? (CVE-2012-2089).
+??????? Matthew Daley. + + +specially crafted mp4 file might allow to overwrite +memory locations in a worker process +if the ngx_http_mp4_module was used, +potentially resulting in arbitrary code execution (CVE-2012-2089).
+Thanks to Matthew Daley. + + + + + +? ?????? ngx_http_mp4_module. + + +in the ngx_http_mp4_module. + + + + + + From mdounin at mdounin.ru Thu Apr 12 13:01:18 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 13:01:18 +0000 Subject: [nginx] svn commit: r4592 - in tags: . release-1.0.15 Message-ID: <20120412130118.447423FA77F@mail.nginx.com> Author: mdounin Date: 2012-04-12 13:01:17 +0000 (Thu, 12 Apr 2012) New Revision: 4592 URL: http://trac.nginx.org/nginx/changeset/4592/nginx Log: release-1.0.15 tag Added: tags/release-1.0.15/ Property changes on: tags/release-1.0.15 ___________________________________________________________________ Added: svn:ignore + access.log client_body_temp fastcgi_temp proxy_temp GNUmakefile Makefile makefile nginx nginx.conf nginx-*.tar.gz objs* tmp Added: svn:mergeinfo + /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500,4530-4531,4578-4580,4586 From mdounin at mdounin.ru Thu Apr 12 16:35:00 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 12 Apr 2012 16:35:00 +0000 Subject: [nginx] svn commit: r4593 - in trunk/src: core http/modules/perl Message-ID: <20120412163500.6E0D23F9F8E@mail.nginx.com> Author: mdounin Date: 2012-04-12 16:34:59 +0000 (Thu, 12 Apr 2012) New Revision: 4593 URL: http://trac.nginx.org/nginx/changeset/4593/nginx Log: Version bump. Modified: trunk/src/core/nginx.h trunk/src/http/modules/perl/nginx.pm Modified: trunk/src/core/nginx.h =================================================================== --- trunk/src/core/nginx.h 2012-04-12 13:01:17 UTC (rev 4592) +++ trunk/src/core/nginx.h 2012-04-12 16:34:59 UTC (rev 4593) @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1001019 -#define NGINX_VERSION "1.1.19" +#define nginx_version 1001020 +#define NGINX_VERSION "1.1.20" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "NGINX" Modified: trunk/src/http/modules/perl/nginx.pm =================================================================== --- trunk/src/http/modules/perl/nginx.pm 2012-04-12 13:01:17 UTC (rev 4592) +++ trunk/src/http/modules/perl/nginx.pm 2012-04-12 16:34:59 UTC (rev 4593) @@ -50,7 +50,7 @@ HTTP_INSUFFICIENT_STORAGE ); -our $VERSION = '1.1.19'; +our $VERSION = '1.1.20'; require XSLoader; XSLoader::load('nginx', $VERSION); From ru at nginx.com Thu Apr 12 19:35:41 2012 From: ru at nginx.com (ru at nginx.com) Date: Thu, 12 Apr 2012 19:35:41 +0000 Subject: [nginx] svn commit: r4594 - in trunk/src: core event http http/modules Message-ID: <20120412193541.F08D33F9E89@mail.nginx.com> Author: ru Date: 2012-04-12 19:35:41 +0000 (Thu, 12 Apr 2012) New Revision: 4594 URL: http://trac.nginx.org/nginx/changeset/4594/nginx Log: Fixed grammar in error messages. Modified: trunk/src/core/nginx.c trunk/src/core/ngx_conf_file.c trunk/src/event/ngx_event.c trunk/src/http/modules/ngx_http_fastcgi_module.c trunk/src/http/modules/ngx_http_geo_module.c trunk/src/http/modules/ngx_http_proxy_module.c trunk/src/http/modules/ngx_http_scgi_module.c trunk/src/http/modules/ngx_http_split_clients_module.c trunk/src/http/modules/ngx_http_ssi_filter_module.c trunk/src/http/modules/ngx_http_uwsgi_module.c trunk/src/http/ngx_http_request.c trunk/src/http/ngx_http_request_body.c Modified: trunk/src/core/nginx.c =================================================================== --- trunk/src/core/nginx.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/core/nginx.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -649,7 +649,7 @@ if (ngx_rename_file(ccf->oldpid.data, ccf->pid.data) != NGX_OK) { ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno, ngx_rename_file_n " %s back to %s failed after " - "the try to execute the new binary process \"%s\"", + "an attempt to execute new binary process \"%s\"", ccf->oldpid.data, ccf->pid.data, argv[0]); } } Modified: trunk/src/core/ngx_conf_file.c =================================================================== --- trunk/src/core/ngx_conf_file.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/core/ngx_conf_file.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -1481,7 +1481,8 @@ } ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "value must be equal or more than %i", bounds->low); + "value must be equal to or greater than %i", + bounds->low); return NGX_CONF_ERROR; } Modified: trunk/src/event/ngx_event.c =================================================================== --- trunk/src/event/ngx_event.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/event/ngx_event.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -471,7 +471,7 @@ (ngx_int_t) rlmt.rlim_cur : ccf->rlimit_nofile; ngx_log_error(NGX_LOG_WARN, cycle->log, 0, - "%ui worker_connections are more than " + "%ui worker_connections exceed " "open file resource limit: %i", ecf->connections, limit); } @@ -489,7 +489,7 @@ } - /* cl should be equal or bigger than cache line size */ + /* cl should be equal to or greater than cache line size */ cl = 128; Modified: trunk/src/http/modules/ngx_http_fastcgi_module.c =================================================================== --- trunk/src/http/modules/ngx_http_fastcgi_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_fastcgi_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -1254,7 +1254,7 @@ if (f->type == NGX_HTTP_FASTCGI_STDOUT && f->length == 0) { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "upstream closed prematurely FastCGI stdout"); + "upstream prematurely closed FastCGI stdout"); return NGX_HTTP_UPSTREAM_INVALID_HEADER; } @@ -2198,8 +2198,8 @@ if (conf->upstream.busy_buffers_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"fastcgi_busy_buffers_size\" must be equal or bigger than " - "maximum of the value of \"fastcgi_buffer_size\" and " + "\"fastcgi_busy_buffers_size\" must be equal to or greater than " + "the maximum of the value of \"fastcgi_buffer_size\" and " "one of the \"fastcgi_buffers\""); return NGX_CONF_ERROR; @@ -2229,8 +2229,8 @@ if (conf->upstream.temp_file_write_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"fastcgi_temp_file_write_size\" must be equal or bigger than " - "maximum of the value of \"fastcgi_buffer_size\" and " + "\"fastcgi_temp_file_write_size\" must be equal to or greater " + "than the maximum of the value of \"fastcgi_buffer_size\" and " "one of the \"fastcgi_buffers\""); return NGX_CONF_ERROR; @@ -2253,8 +2253,8 @@ { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "\"fastcgi_max_temp_file_size\" must be equal to zero to disable " - "the temporary files usage or must be equal or bigger than " - "maximum of the value of \"fastcgi_buffer_size\" and " + "temporary files usage or must be equal to or greater than " + "the maximum of the value of \"fastcgi_buffer_size\" and " "one of the \"fastcgi_buffers\""); return NGX_CONF_ERROR; Modified: trunk/src/http/modules/ngx_http_geo_module.c =================================================================== --- trunk/src/http/modules/ngx_http_geo_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_geo_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -566,7 +566,7 @@ if (ctx->binary_include) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "binary geo range base \"%s\" may not be mixed with usual entries", + "binary geo range base \"%s\" cannot be mixed with usual entries", ctx->include_name.data); return NGX_CONF_ERROR; } @@ -1195,7 +1195,7 @@ if (ctx->outside_entries) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "binary geo range base \"%s\" may not be mixed with usual entries", + "binary geo range base \"%s\" cannot be mixed with usual entries", name->data); rc = NGX_ERROR; goto done; @@ -1203,7 +1203,7 @@ if (ctx->binary_include) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "second binary geo range base \"%s\" may not be mixed with \"%s\"", + "second binary geo range base \"%s\" cannot be mixed with \"%s\"", name->data, ctx->include_name.data); rc = NGX_ERROR; goto done; Modified: trunk/src/http/modules/ngx_http_proxy_module.c =================================================================== --- trunk/src/http/modules/ngx_http_proxy_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_proxy_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -2734,8 +2734,8 @@ if (conf->upstream.busy_buffers_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"proxy_busy_buffers_size\" must be equal or bigger than " - "maximum of the value of \"proxy_buffer_size\" and " + "\"proxy_busy_buffers_size\" must be equal to or greater than " + "the maximum of the value of \"proxy_buffer_size\" and " "one of the \"proxy_buffers\""); return NGX_CONF_ERROR; @@ -2765,8 +2765,8 @@ if (conf->upstream.temp_file_write_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"proxy_temp_file_write_size\" must be equal or bigger than " - "maximum of the value of \"proxy_buffer_size\" and " + "\"proxy_temp_file_write_size\" must be equal to or greater " + "than the maximum of the value of \"proxy_buffer_size\" and " "one of the \"proxy_buffers\""); return NGX_CONF_ERROR; @@ -2788,8 +2788,8 @@ { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "\"proxy_max_temp_file_size\" must be equal to zero to disable " - "the temporary files usage or must be equal or bigger than " - "maximum of the value of \"proxy_buffer_size\" and " + "temporary files usage or must be equal to or greater than " + "the maximum of the value of \"proxy_buffer_size\" and " "one of the \"proxy_buffers\""); return NGX_CONF_ERROR; @@ -3425,11 +3425,11 @@ { if (plcf->vars.uri.len) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"proxy_pass\" may not have URI part in " + "\"proxy_pass\" cannot have URI part in " "location given by regular expression, " "or inside named location, " - "or inside the \"if\" statement, " - "or inside the \"limit_except\" block"); + "or inside \"if\" statement, " + "or inside \"limit_except\" block"); return NGX_CONF_ERROR; } @@ -3498,14 +3498,14 @@ if (ngx_strcmp(value[1].data, "default") == 0) { if (plcf->proxy_lengths) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"proxy_redirect default\" may not be used " + "\"proxy_redirect default\" cannot be used " "with \"proxy_pass\" directive with variables"); return NGX_CONF_ERROR; } if (plcf->url.data == NULL) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"proxy_redirect default\" must go " + "\"proxy_redirect default\" should be placed " "after the \"proxy_pass\" directive"); return NGX_CONF_ERROR; } Modified: trunk/src/http/modules/ngx_http_scgi_module.c =================================================================== --- trunk/src/http/modules/ngx_http_scgi_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_scgi_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -1173,8 +1173,8 @@ if (conf->upstream.busy_buffers_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"scgi_busy_buffers_size\" must be equal or bigger " - "than maximum of the value of \"scgi_buffer_size\" and " + "\"scgi_busy_buffers_size\" must be equal to or greater " + "than the maximum of the value of \"scgi_buffer_size\" and " "one of the \"scgi_buffers\""); return NGX_CONF_ERROR; @@ -1204,8 +1204,8 @@ if (conf->upstream.temp_file_write_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"scgi_temp_file_write_size\" must be equal or bigger than " - "maximum of the value of \"scgi_buffer_size\" and " + "\"scgi_temp_file_write_size\" must be equal to or greater than " + "the maximum of the value of \"scgi_buffer_size\" and " "one of the \"scgi_buffers\""); return NGX_CONF_ERROR; @@ -1227,8 +1227,8 @@ && conf->upstream.max_temp_file_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "\"scgi_max_temp_file_size\" must be equal to zero to disable " - "the temporary files usage or must be equal or bigger than " - "maximum of the value of \"scgi_buffer_size\" and " + "temporary files usage or must be equal to or greater than " + "the maximum of the value of \"scgi_buffer_size\" and " "one of the \"scgi_buffers\""); return NGX_CONF_ERROR; Modified: trunk/src/http/modules/ngx_http_split_clients_module.c =================================================================== --- trunk/src/http/modules/ngx_http_split_clients_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_split_clients_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -177,7 +177,7 @@ sum = part[i].percent ? sum + part[i].percent : 10000; if (sum > 10000) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "percent sum is more than 100%%"); + "percent total is greater than 100%%"); return NGX_CONF_ERROR; } Modified: trunk/src/http/modules/ngx_http_ssi_filter_module.c =================================================================== --- trunk/src/http/modules/ngx_http_ssi_filter_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_ssi_filter_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -2003,7 +2003,7 @@ if (set && stub) { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "\"set\" and \"stub\" may not be used together " + "\"set\" and \"stub\" cannot be used together " "in \"include\" SSI command"); return NGX_HTTP_SSI_ERROR; } @@ -2011,7 +2011,7 @@ if (wait) { if (uri == NULL) { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "\"wait\" may not be used with file=\"%V\"", file); + "\"wait\" cannot be used with file=\"%V\"", file); return NGX_HTTP_SSI_ERROR; } @@ -2188,7 +2188,7 @@ } else { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "only one subrequest may be waited at the same time"); + "can only wait for one subrequest at a time"); } return NGX_OK; Modified: trunk/src/http/modules/ngx_http_uwsgi_module.c =================================================================== --- trunk/src/http/modules/ngx_http_uwsgi_module.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/modules/ngx_http_uwsgi_module.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -1216,8 +1216,8 @@ if (conf->upstream.busy_buffers_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"uwsgi_busy_buffers_size\" must be equal or bigger " - "than maximum of the value of \"uwsgi_buffer_size\" and " + "\"uwsgi_busy_buffers_size\" must be equal to or greater " + "than the maximum of the value of \"uwsgi_buffer_size\" and " "one of the \"uwsgi_buffers\""); return NGX_CONF_ERROR; @@ -1247,8 +1247,8 @@ if (conf->upstream.temp_file_write_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"uwsgi_temp_file_write_size\" must be equal or bigger than " - "maximum of the value of \"uwsgi_buffer_size\" and " + "\"uwsgi_temp_file_write_size\" must be equal to or greater than " + "the maximum of the value of \"uwsgi_buffer_size\" and " "one of the \"uwsgi_buffers\""); return NGX_CONF_ERROR; @@ -1270,8 +1270,8 @@ && conf->upstream.max_temp_file_size < size) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "\"uwsgi_max_temp_file_size\" must be equal to zero to disable " - "the temporary files usage or must be equal or bigger than " - "maximum of the value of \"uwsgi_buffer_size\" and " + "temporary files usage or must be equal to or greater than " + "the maximum of the value of \"uwsgi_buffer_size\" and " "one of the \"uwsgi_buffers\""); return NGX_CONF_ERROR; Modified: trunk/src/http/ngx_http_request.c =================================================================== --- trunk/src/http/ngx_http_request.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/ngx_http_request.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -1175,7 +1175,7 @@ if (n == 0) { ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client closed prematurely connection"); + "client prematurely closed connection"); } if (n == 0 || n == NGX_ERROR) { @@ -2426,7 +2426,7 @@ } ngx_log_error(NGX_LOG_INFO, c->log, err, - "client closed prematurely connection"); + "client prematurely closed connection"); ngx_http_finalize_request(r, 0); } Modified: trunk/src/http/ngx_http_request_body.c =================================================================== --- trunk/src/http/ngx_http_request_body.c 2012-04-12 16:34:59 UTC (rev 4593) +++ trunk/src/http/ngx_http_request_body.c 2012-04-12 19:35:41 UTC (rev 4594) @@ -303,7 +303,7 @@ if (n == 0) { ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client closed prematurely connection"); + "client prematurely closed connection"); } if (n == 0 || n == NGX_ERROR) { From mdounin at mdounin.ru Mon Apr 16 13:05:21 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 16 Apr 2012 13:05:21 +0000 Subject: [nginx] svn commit: r4595 - trunk/src/http Message-ID: <20120416130521.8A6AC3F9C1F@mail.nginx.com> Author: mdounin Date: 2012-04-16 13:05:20 +0000 (Mon, 16 Apr 2012) New Revision: 4595 URL: http://trac.nginx.org/nginx/changeset/4595/nginx Log: Fixed log->action after ssl handshake. Modified: trunk/src/http/ngx_http_request.c Modified: trunk/src/http/ngx_http_request.c =================================================================== --- trunk/src/http/ngx_http_request.c 2012-04-12 19:35:41 UTC (rev 4594) +++ trunk/src/http/ngx_http_request.c 2012-04-16 13:05:20 UTC (rev 4595) @@ -612,6 +612,8 @@ c->ssl->no_wait_shutdown = 1; + c->log->action = "reading client request line"; + c->read->handler = ngx_http_process_request_line; /* STUB: epoll edge */ c->write->handler = ngx_http_empty_handler; From mdounin at mdounin.ru Tue Apr 17 09:10:50 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Tue, 17 Apr 2012 09:10:50 +0000 Subject: [nginx] svn commit: r4596 - trunk/src/os/unix Message-ID: <20120417091051.12A623F9D48@mail.nginx.com> Author: mdounin Date: 2012-04-17 09:10:50 +0000 (Tue, 17 Apr 2012) New Revision: 4596 URL: http://trac.nginx.org/nginx/changeset/4596/nginx Log: Fixed loop in ngx_writev_chain() and ngx_solaris_sendfilev_chain(). The "complete" flag wasn't cleared on loop iteration start, resulting in broken behaviour if there were more than IOV_MAX buffers and first iteration was fully completed (and hence the "complete" flag was set to 1). Modified: trunk/src/os/unix/ngx_solaris_sendfilev_chain.c trunk/src/os/unix/ngx_writev_chain.c Modified: trunk/src/os/unix/ngx_solaris_sendfilev_chain.c =================================================================== --- trunk/src/os/unix/ngx_solaris_sendfilev_chain.c 2012-04-16 13:05:20 UTC (rev 4595) +++ trunk/src/os/unix/ngx_solaris_sendfilev_chain.c 2012-04-17 09:10:50 UTC (rev 4596) @@ -74,7 +74,6 @@ send = 0; - complete = 0; vec.elts = sfvs; vec.size = sizeof(sendfilevec_t); @@ -87,6 +86,7 @@ fprev = 0; sfv = NULL; eintr = 0; + complete = 0; sent = 0; prev_send = send; Modified: trunk/src/os/unix/ngx_writev_chain.c =================================================================== --- trunk/src/os/unix/ngx_writev_chain.c 2012-04-16 13:05:20 UTC (rev 4595) +++ trunk/src/os/unix/ngx_writev_chain.c 2012-04-17 09:10:50 UTC (rev 4596) @@ -54,7 +54,6 @@ } send = 0; - complete = 0; vec.elts = iovs; vec.size = sizeof(struct iovec); @@ -65,6 +64,7 @@ prev = NULL; iov = NULL; eintr = 0; + complete = 0; prev_send = send; vec.nelts = 0; From mdounin at mdounin.ru Tue Apr 17 09:13:15 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Tue, 17 Apr 2012 09:13:15 +0000 Subject: [nginx] svn commit: r4597 - trunk/src/os/unix Message-ID: <20120417091316.ED0DA3F9CFB@mail.nginx.com> Author: mdounin Date: 2012-04-17 09:13:15 +0000 (Tue, 17 Apr 2012) New Revision: 4597 URL: http://trac.nginx.org/nginx/changeset/4597/nginx Log: IOV_MAX handling microoptimization. We now stop on IOV_MAX iovec entries only if we are going to add new one, i.e. next buffer can't be coalesced into last iovec. This also fixes incorrect checks for trailer creation on FreeBSD and Mac OS X, header.nelts was checked instead of trailer.nelts. Modified: trunk/src/os/unix/ngx_darwin_sendfile_chain.c trunk/src/os/unix/ngx_freebsd_sendfile_chain.c trunk/src/os/unix/ngx_linux_sendfile_chain.c trunk/src/os/unix/ngx_solaris_sendfilev_chain.c trunk/src/os/unix/ngx_writev_chain.c Modified: trunk/src/os/unix/ngx_darwin_sendfile_chain.c =================================================================== --- trunk/src/os/unix/ngx_darwin_sendfile_chain.c 2012-04-17 09:10:50 UTC (rev 4596) +++ trunk/src/os/unix/ngx_darwin_sendfile_chain.c 2012-04-17 09:13:15 UTC (rev 4597) @@ -103,10 +103,8 @@ prev = NULL; iov = NULL; - for (cl = in; - cl && header.nelts < IOV_MAX && send < limit; - cl = cl->next) - { + for (cl = in; cl && send < limit; cl = cl->next) { + if (ngx_buf_special(cl->buf)) { continue; } @@ -125,6 +123,10 @@ iov->iov_len += (size_t) size; } else { + if (header.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&header); if (iov == NULL) { return NGX_CHAIN_ERROR; @@ -178,7 +180,7 @@ prev = NULL; iov = NULL; - while (cl && header.nelts < IOV_MAX && send < limit) { + while (cl && send < limit) { if (ngx_buf_special(cl->buf)) { cl = cl->next; @@ -199,6 +201,10 @@ iov->iov_len += (size_t) size; } else { + if (trailer.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&trailer); if (iov == NULL) { return NGX_CHAIN_ERROR; Modified: trunk/src/os/unix/ngx_freebsd_sendfile_chain.c =================================================================== --- trunk/src/os/unix/ngx_freebsd_sendfile_chain.c 2012-04-17 09:10:50 UTC (rev 4596) +++ trunk/src/os/unix/ngx_freebsd_sendfile_chain.c 2012-04-17 09:13:15 UTC (rev 4597) @@ -107,10 +107,8 @@ prev = NULL; iov = NULL; - for (cl = in; - cl && header.nelts < IOV_MAX && send < limit; - cl = cl->next) - { + for (cl = in; cl && send < limit; cl = cl->next) { + if (ngx_buf_special(cl->buf)) { continue; } @@ -129,6 +127,10 @@ iov->iov_len += (size_t) size; } else { + if (header.nelts >= IOV_MAX){ + break; + } + iov = ngx_array_push(&header); if (iov == NULL) { return NGX_CHAIN_ERROR; @@ -183,7 +185,7 @@ prev = NULL; iov = NULL; - while (cl && header.nelts < IOV_MAX && send < limit) { + while (cl && send < limit) { if (ngx_buf_special(cl->buf)) { cl = cl->next; @@ -204,6 +206,10 @@ iov->iov_len += (size_t) size; } else { + if (trailer.nelts >= IOV_MAX){ + break; + } + iov = ngx_array_push(&trailer); if (iov == NULL) { return NGX_CHAIN_ERROR; Modified: trunk/src/os/unix/ngx_linux_sendfile_chain.c =================================================================== --- trunk/src/os/unix/ngx_linux_sendfile_chain.c 2012-04-17 09:10:50 UTC (rev 4596) +++ trunk/src/os/unix/ngx_linux_sendfile_chain.c 2012-04-17 09:13:15 UTC (rev 4597) @@ -89,10 +89,8 @@ /* create the iovec and coalesce the neighbouring bufs */ - for (cl = in; - cl && header.nelts < IOV_MAX && send < limit; - cl = cl->next) - { + for (cl = in; cl && send < limit; cl = cl->next) { + if (ngx_buf_special(cl->buf)) { continue; } @@ -132,6 +130,10 @@ iov->iov_len += (size_t) size; } else { + if (header.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&header); if (iov == NULL) { return NGX_CHAIN_ERROR; Modified: trunk/src/os/unix/ngx_solaris_sendfilev_chain.c =================================================================== --- trunk/src/os/unix/ngx_solaris_sendfilev_chain.c 2012-04-17 09:10:50 UTC (rev 4596) +++ trunk/src/os/unix/ngx_solaris_sendfilev_chain.c 2012-04-17 09:13:15 UTC (rev 4597) @@ -94,8 +94,8 @@ /* create the sendfilevec and coalesce the neighbouring bufs */ - for (cl = in; cl && vec.nelts < IOV_MAX && send < limit; cl = cl->next) - { + for (cl = in; cl && send < limit; cl = cl->next) { + if (ngx_buf_special(cl->buf)) { continue; } @@ -113,6 +113,10 @@ sfv->sfv_len += (size_t) size; } else { + if (vec.nelts >= IOV_MAX) { + break; + } + sfv = ngx_array_push(&vec); if (sfv == NULL) { return NGX_CHAIN_ERROR; @@ -147,6 +151,10 @@ sfv->sfv_len += (size_t) size; } else { + if (vec.nelts >= IOV_MAX) { + break; + } + sfv = ngx_array_push(&vec); if (sfv == NULL) { return NGX_CHAIN_ERROR; Modified: trunk/src/os/unix/ngx_writev_chain.c =================================================================== --- trunk/src/os/unix/ngx_writev_chain.c 2012-04-17 09:10:50 UTC (rev 4596) +++ trunk/src/os/unix/ngx_writev_chain.c 2012-04-17 09:13:15 UTC (rev 4597) @@ -71,8 +71,8 @@ /* create the iovec and coalesce the neighbouring bufs */ - for (cl = in; cl && vec.nelts < IOV_MAX && send < limit; cl = cl->next) - { + for (cl = in; cl && send < limit; cl = cl->next) { + if (ngx_buf_special(cl->buf)) { continue; } @@ -93,6 +93,10 @@ iov->iov_len += size; } else { + if (vec.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&vec); if (iov == NULL) { return NGX_CHAIN_ERROR; From mdounin at mdounin.ru Tue Apr 17 09:13:58 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Tue, 17 Apr 2012 09:13:58 +0000 Subject: [nginx] svn commit: r4598 - trunk/src/os/unix Message-ID: <20120417091359.1FED83F9D48@mail.nginx.com> Author: mdounin Date: 2012-04-17 09:13:58 +0000 (Tue, 17 Apr 2012) New Revision: 4598 URL: http://trac.nginx.org/nginx/changeset/4598/nginx Log: Fixed ngx_readv_chain() to honor IOV_MAX (ticket #14). Not using full chain passed is ok as consumers are expected to check event's ready flag to determine if another call is needed, not the returned size. Modified: trunk/src/os/unix/ngx_readv_chain.c Modified: trunk/src/os/unix/ngx_readv_chain.c =================================================================== --- trunk/src/os/unix/ngx_readv_chain.c 2012-04-17 09:13:15 UTC (rev 4597) +++ trunk/src/os/unix/ngx_readv_chain.c 2012-04-17 09:13:58 UTC (rev 4598) @@ -71,6 +71,10 @@ iov->iov_len += chain->buf->end - chain->buf->last; } else { + if (vec.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&vec); if (iov == NULL) { return NGX_ERROR; @@ -195,6 +199,10 @@ iov->iov_len += chain->buf->end - chain->buf->last; } else { + if (vec.nelts >= IOV_MAX) { + break; + } + iov = ngx_array_push(&vec); if (iov == NULL) { return NGX_ERROR; From goelvivek2011 at gmail.com Wed Apr 18 10:16:24 2012 From: goelvivek2011 at gmail.com (vivek goel) Date: Wed, 18 Apr 2012 15:46:24 +0530 Subject: Time-out for worker process Message-ID: Is there any way I can specify a time-out for my http modue? So If my module is not finishing it's task in N second nginx can abort that request ? regards Vivek Goel -------------- next part -------------- An HTML attachment was scrubbed... URL: From ru at nginx.com Wed Apr 18 13:30:44 2012 From: ru at nginx.com (ru at nginx.com) Date: Wed, 18 Apr 2012 13:30:44 +0000 Subject: [nginx] svn commit: r4599 - trunk/src/core Message-ID: <20120418133044.C42173F9E4A@mail.nginx.com> Author: ru Date: 2012-04-18 13:30:43 +0000 (Wed, 18 Apr 2012) New Revision: 4599 URL: http://trac.nginx.org/nginx/changeset/4599/nginx Log: Don't silently ignore the last line of configuration file that consists solely of one unterminated token (inspired by #150). Modified: trunk/src/core/ngx_conf_file.c Modified: trunk/src/core/ngx_conf_file.c =================================================================== --- trunk/src/core/ngx_conf_file.c 2012-04-17 09:13:58 UTC (rev 4598) +++ trunk/src/core/ngx_conf_file.c 2012-04-18 13:30:43 UTC (rev 4599) @@ -465,7 +465,7 @@ if (cf->conf_file->file.offset >= file_size) { - if (cf->args->nelts > 0) { + if (cf->args->nelts > 0 || !last_space) { if (cf->conf_file->file.fd == NGX_INVALID_FILE) { ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, From mdounin at mdounin.ru Wed Apr 18 14:28:17 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Wed, 18 Apr 2012 18:28:17 +0400 Subject: Time-out for worker process In-Reply-To: References: Message-ID: <20120418142816.GJ13466@mdounin.ru> Hello! On Wed, Apr 18, 2012 at 03:46:24PM +0530, vivek goel wrote: > Is there any way I can specify a time-out for my http modue? > So If my module is not finishing it's task in N second nginx can abort that > request ? No, you have to handle timeouts in your module. Maxim Dounin From mdounin at mdounin.ru Wed Apr 18 14:47:10 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Wed, 18 Apr 2012 14:47:10 +0000 Subject: [nginx] svn commit: r4600 - trunk/src/event Message-ID: <20120418144710.E88823F9D98@mail.nginx.com> Author: mdounin Date: 2012-04-18 14:47:10 +0000 (Wed, 18 Apr 2012) New Revision: 4600 URL: http://trac.nginx.org/nginx/changeset/4600/nginx Log: Fixed master exit if there is no events section (ticket #150). Instead of checking if there is events{} section present in configuration in init_module handler we now do the same in init_conf handler. This allows master process to detect incorrect configuration early and reject it. Modified: trunk/src/event/ngx_event.c Modified: trunk/src/event/ngx_event.c =================================================================== --- trunk/src/event/ngx_event.c 2012-04-18 13:30:43 UTC (rev 4599) +++ trunk/src/event/ngx_event.c 2012-04-18 14:47:10 UTC (rev 4600) @@ -21,6 +21,7 @@ extern ngx_module_t ngx_select_module; +static char *ngx_event_init_conf(ngx_cycle_t *cycle, void *conf); static ngx_int_t ngx_event_module_init(ngx_cycle_t *cycle); static ngx_int_t ngx_event_process_init(ngx_cycle_t *cycle); static char *ngx_events_block(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); @@ -31,8 +32,8 @@ static char *ngx_event_debug_connection(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); -static void *ngx_event_create_conf(ngx_cycle_t *cycle); -static char *ngx_event_init_conf(ngx_cycle_t *cycle, void *conf); +static void *ngx_event_core_create_conf(ngx_cycle_t *cycle); +static char *ngx_event_core_init_conf(ngx_cycle_t *cycle, void *conf); static ngx_uint_t ngx_timer_resolution; @@ -93,7 +94,7 @@ static ngx_core_module_t ngx_events_module_ctx = { ngx_string("events"), NULL, - NULL + ngx_event_init_conf }; @@ -173,8 +174,8 @@ ngx_event_module_t ngx_event_core_module_ctx = { &event_core_name, - ngx_event_create_conf, /* create configuration */ - ngx_event_init_conf, /* init configuration */ + ngx_event_core_create_conf, /* create configuration */ + ngx_event_core_init_conf, /* init configuration */ { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL } }; @@ -423,6 +424,19 @@ } +static char * +ngx_event_init_conf(ngx_cycle_t *cycle, void *conf) +{ + if (ngx_get_conf(cycle->conf_ctx, ngx_events_module) == NULL) { + ngx_log_error(NGX_LOG_EMERG, cycle->log, 0, + "no \"events\" section in configuration"); + return NGX_CONF_ERROR; + } + + return NGX_CONF_OK; +} + + static ngx_int_t ngx_event_module_init(ngx_cycle_t *cycle) { @@ -435,13 +449,6 @@ ngx_event_conf_t *ecf; cf = ngx_get_conf(cycle->conf_ctx, ngx_events_module); - - if (cf == NULL) { - ngx_log_error(NGX_LOG_EMERG, cycle->log, 0, - "no \"events\" section in configuration"); - return NGX_ERROR; - } - ecf = (*cf)[ngx_event_core_module.ctx_index]; if (!ngx_test_config && ngx_process <= NGX_PROCESS_MASTER) { @@ -1116,7 +1123,7 @@ static void * -ngx_event_create_conf(ngx_cycle_t *cycle) +ngx_event_core_create_conf(ngx_cycle_t *cycle) { ngx_event_conf_t *ecf; @@ -1147,7 +1154,7 @@ static char * -ngx_event_init_conf(ngx_cycle_t *cycle, void *conf) +ngx_event_core_init_conf(ngx_cycle_t *cycle, void *conf) { ngx_event_conf_t *ecf = conf; From ja.nginx at mailnull.com Wed Apr 18 20:46:09 2012 From: ja.nginx at mailnull.com (SamB) Date: Wed, 18 Apr 2012 22:46:09 +0200 Subject: [PATCH 1 of 2] postpone xslt files parsing to location merge Message-ID: Hi, this is initial patch that allows xslt files to be placed relatively to defined xslt root. Its variation of similar patch I've sent before ( http://mailman.nginx.org/pipermail/nginx-devel/2012-January/001669.html). First patch only reorganizes processing of xslt_stylesheet and xslt_entities directives, to make relative files use possible. Instead of parsing them directly, they are processed in location merge function. DTD parsing has been slightly modified to work in the same way as stylesheet parsing (and use ngx_conf_full_name). Sam -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: nginx-1.1.18-xslt-postpone-parse.patch Type: application/octet-stream Size: 7800 bytes Desc: not available URL: From ja.nginx at mailnull.com Wed Apr 18 20:46:16 2012 From: ja.nginx at mailnull.com (SamB) Date: Wed, 18 Apr 2012 22:46:16 +0200 Subject: [PATCH 2 of 2] add xslt_root directive Message-ID: Hi, this patch adds xslt_root directive and prefixes files defined with xslt_stylesheet or xslt_entities directives (if file not specified with absolute path) . Note: while stealing code from ngx_conf_full_name() for ngx_http_xslt_filter_full_name() I noticed that there is no ngx_pfree() done on original name characted array (name->data) when replaced by newly allocated memory (ngx_conf_file.c:843). Question is: is there a memory leak or I should not do it in my code ?-) Thanks Sam -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: nginx-1.1.18-xslt_root.patch Type: application/octet-stream Size: 3217 bytes Desc: not available URL: From manlio.perillo at gmail.com Wed Apr 18 20:58:37 2012 From: manlio.perillo at gmail.com (Manlio Perillo) Date: Wed, 18 Apr 2012 22:58:37 +0200 Subject: [PATCH] new prefix HTTP variable Message-ID: <4F8F2AFD.3070108@gmail.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi. Attached is a patch that adds a new "prefix" http variable, that returns the Nginx prefix path. Thanks Manlio Perillo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+PKv0ACgkQscQJ24LbaUSnPgCffd44rKqz/5umcxGAWLTcRLfU ZOcAniEgFwnGw/etPbjS8Z4dGvTH47gk =8Gy4 -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: http_variable_prefix.patch Type: text/x-diff Size: 1191 bytes Desc: not available URL: From mdounin at mdounin.ru Thu Apr 19 09:00:38 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 19 Apr 2012 13:00:38 +0400 Subject: [PATCH] new prefix HTTP variable In-Reply-To: <4F8F2AFD.3070108@gmail.com> References: <4F8F2AFD.3070108@gmail.com> Message-ID: <20120419090038.GL13466@mdounin.ru> Hello! On Wed, Apr 18, 2012 at 10:58:37PM +0200, Manlio Perillo wrote: > Attached is a patch that adds a new "prefix" http variable, that returns > the Nginx prefix path. Could you please elaborate a bitmore on expected use cases? Maxim Dounin From manlio.perillo at gmail.com Thu Apr 19 09:26:03 2012 From: manlio.perillo at gmail.com (Manlio Perillo) Date: Thu, 19 Apr 2012 11:26:03 +0200 Subject: [PATCH] new prefix HTTP variable In-Reply-To: <20120419090038.GL13466@mdounin.ru> References: <4F8F2AFD.3070108@gmail.com> <20120419090038.GL13466@mdounin.ru> Message-ID: <4F8FDA2B.2080900@gmail.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Il 19/04/2012 11:00, Maxim Dounin ha scritto: > Hello! > > On Wed, Apr 18, 2012 at 10:58:37PM +0200, Manlio Perillo wrote: > >> Attached is a patch that adds a new "prefix" http variable, that returns >> the Nginx prefix path. > > Could you please elaborate a bitmore on expected use cases? > I have some Python applications running under my ngx_http_wsgi_module. For these application, I set the Nginx prefix command line option to the application working directory. - From Nginx configuration I use the wsgi_var directive to set the path to application configuration file, and currently I have to do something like: set $app_path /path/to/application ... wsgi_var app_conf_path $app_path/settings.yml With the prefix variable, I can avoid having to define an additional variable: wsgi_var app_conf_path $prefix/settings.yml I don't know if there are some other possible use cases. Usually in Nginx there is no need for the "prefix" variable, since most of the paths in directives are resolved against the prefix path. Manlio Perillo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+P2isACgkQscQJ24LbaURdTQCfVfXXi+MPJjx4F5jJ7nyCQVjK 9oUAn0TO8jpg4Y6Ims/so9YNzBRO4NCR =wAI1 -----END PGP SIGNATURE----- From mdounin at mdounin.ru Thu Apr 19 15:48:03 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 19 Apr 2012 15:48:03 +0000 Subject: [nginx] svn commit: r4601 - trunk/src/http Message-ID: <20120419154803.C09CC3F9D5B@mail.nginx.com> Author: mdounin Date: 2012-04-19 15:48:03 +0000 (Thu, 19 Apr 2012) New Revision: 4601 URL: http://trac.nginx.org/nginx/changeset/4601/nginx Log: Fixed segfault with try_files (ticket #152). The problem occured if first uri in try_files was shorter than request uri, resulting in reserve being 0 and hence allocation skipped. The bug was introduced in r4584 (1.1.19). Modified: trunk/src/http/ngx_http_core_module.c Modified: trunk/src/http/ngx_http_core_module.c =================================================================== --- trunk/src/http/ngx_http_core_module.c 2012-04-18 14:47:10 UTC (rev 4600) +++ trunk/src/http/ngx_http_core_module.c 2012-04-19 15:48:03 UTC (rev 4601) @@ -1240,7 +1240,7 @@ reserve = len > r->uri.len - alias ? len - (r->uri.len - alias) : 0; } - if (reserve > allocated) { + if (reserve > allocated || !allocated) { /* 16 bytes are preallocation */ allocated = reserve + 16; From b at codemonkey.ru Thu Apr 19 17:29:07 2012 From: b at codemonkey.ru (Maxim Bublis) Date: Thu, 19 Apr 2012 21:29:07 +0400 Subject: [patch] ngx_http_image_filter_module incorrectly calculates size Message-ID: Hi. There is a bug in ngx_http_image_resize function from ngx_http_image_filter_module with incorrect calculation of new image sizes after resizing with crop in case of original image is capable to resize with preservation of original proportions (i.e. crop is not required). For example, resizing image with original sizes of 360x203 to 304x171 with crop, will surprisingly give us resized and cropped image with sizes of 303x171, though resizing the same image without crop will give us correct image with sizes of 304x171. Attached image_filter_crop.patch fixes this undesired behavior. In the same time i've found that algorithm for calculation of new image sizes in both resize and crop cases could be generalized. Attached image_filter.patch uses this idea and reduces number of duplicated source lines (also includes bugfix from image_filter_crop.patch). -- Maxim Bublis -------------- next part -------------- A non-text attachment was scrubbed... Name: image_filter_crop.patch Type: application/octet-stream Size: 565 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image_filter.patch Type: application/octet-stream Size: 2127 bytes Desc: not available URL: From mdounin at mdounin.ru Fri Apr 20 09:33:51 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 20 Apr 2012 13:33:51 +0400 Subject: [patch] ngx_http_image_filter_module incorrectly calculates size In-Reply-To: References: Message-ID: <20120420093351.GE13466@mdounin.ru> Hello! On Thu, Apr 19, 2012 at 09:29:07PM +0400, Maxim Bublis wrote: > Hi. > > There is a bug in ngx_http_image_resize function from > ngx_http_image_filter_module with incorrect calculation of new image > sizes after resizing with crop in case of original image is capable to > resize with preservation of original proportions (i.e. crop is not > required). For example, resizing image with original sizes of 360x203 > to 304x171 with crop, will surprisingly give us resized and cropped > image with sizes of 303x171, though resizing the same image without > crop will give us correct image with sizes of 304x171. > Attached image_filter_crop.patch fixes this undesired behavior. You patch just moves processing from one code path to another in a case where nginx (due to use of fixed-point calculations) doesn't see the difference between original image aspect ratio (~ 1.773) and desired resulting image aspect ratio (~ 1.778). Normally both code paths should result in identical images matching desired sizes, but in the case in question this doesn't happen due to rounding effects. With your patch the problem goes away for a particular image, but will instead appear in other cases. Something like this should be correct solution to eliminate the problem: --- a/src/http/modules/ngx_http_image_filter_module.c +++ b/src/http/modules/ngx_http_image_filter_module.c @@ -817,9 +817,7 @@ transparent: resize = 0; - if ((ngx_uint_t) (dx * 100 / dy) - < ctx->max_width * 100 / ctx->max_height) - { + if (dx * ctx->max_height < dy * ctx->max_width) { if ((ngx_uint_t) dx > ctx->max_width) { dy = dy * ctx->max_width / dx; dy = dy ? dy : 1; > In the same time i've found that algorithm for calculation of new > image sizes in both resize and crop cases could be generalized. > Attached image_filter.patch uses this idea and reduces number of > duplicated source lines (also includes bugfix from > image_filter_crop.patch). No, thanks. We generally prefer code readability over generalization. Maxim Dounin From b at codemonkey.ru Fri Apr 20 11:25:07 2012 From: b at codemonkey.ru (Maxim Bublis) Date: Fri, 20 Apr 2012 15:25:07 +0400 Subject: [patch] ngx_http_image_filter_module incorrectly calculates size In-Reply-To: <20120420093351.GE13466@mdounin.ru> References: <20120420093351.GE13466@mdounin.ru> Message-ID: Hi! > > You patch just moves processing from one code path to another in a > case where nginx (due to use of fixed-point calculations) doesn't > see the difference between original image aspect ratio (~ 1.773) > and desired resulting image aspect ratio (~ 1.778). Normally both > code paths should result in identical images matching desired > sizes, but in the case in question this doesn't happen due to > rounding effects. ?With your patch the problem goes away for a > particular image, but will instead appear in other cases. My original patch fixes problem for resizing image with crop from 360x203 to 304x171 but in the same time breaks calculations for image with original dimensions with 203x360 and resizing it with crop to 171x304 (i.e. height of original image is greater that it's width). Thanks for pointing to that. > > Something like this should be correct solution to eliminate the > problem: > > --- a/src/http/modules/ngx_http_image_filter_module.c > +++ b/src/http/modules/ngx_http_image_filter_module.c > @@ -817,9 +817,7 @@ transparent: > > ? ? ? ? resize = 0; > > - ? ? ? ?if ((ngx_uint_t) (dx * 100 / dy) > - ? ? ? ? ? ?< ctx->max_width * 100 / ctx->max_height) > - ? ? ? ?{ > + ? ? ? ?if (dx * ctx->max_height < dy * ctx->max_width) { > ? ? ? ? ? ? if ((ngx_uint_t) dx > ctx->max_width) { > ? ? ? ? ? ? ? ? dy = dy * ctx->max_width / dx; > ? ? ? ? ? ? ? ? dy = dy ? dy : 1; I think it should be correct solution if multiplication of either dx and ctx->max_height or dy and ctx->max_width would not result in integer overflow in case when both dx and ctx->max_height or dy and ctx->max_height are rather large integers. -- Maxim Bublis From mdounin at mdounin.ru Fri Apr 20 12:48:51 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 20 Apr 2012 16:48:51 +0400 Subject: [patch] ngx_http_image_filter_module incorrectly calculates size In-Reply-To: References: <20120420093351.GE13466@mdounin.ru> Message-ID: <20120420124851.GG13466@mdounin.ru> Hello! On Fri, Apr 20, 2012 at 03:25:07PM +0400, Maxim Bublis wrote: [...] > > Something like this should be correct solution to eliminate the > > problem: > > > > --- a/src/http/modules/ngx_http_image_filter_module.c > > +++ b/src/http/modules/ngx_http_image_filter_module.c > > @@ -817,9 +817,7 @@ transparent: > > > > ? ? ? ? resize = 0; > > > > - ? ? ? ?if ((ngx_uint_t) (dx * 100 / dy) > > - ? ? ? ? ? ?< ctx->max_width * 100 / ctx->max_height) > > - ? ? ? ?{ > > + ? ? ? ?if (dx * ctx->max_height < dy * ctx->max_width) { > > ? ? ? ? ? ? if ((ngx_uint_t) dx > ctx->max_width) { > > ? ? ? ? ? ? ? ? dy = dy * ctx->max_width / dx; > > ? ? ? ? ? ? ? ? dy = dy ? dy : 1; > > I think it should be correct solution if multiplication of either dx > and ctx->max_height or dy and ctx->max_width would not result in > integer overflow in case when both dx and ctx->max_height or dy and > ctx->max_height are rather large integers. While real-world image sizes shouldn't be the problem (and if they will, we'll notice this in other places as these multiplications are done anyway), but I missed the special case of '-' in config, which will result in max_width / max_height being set to maximum possible value. The following patch should be better: --- a/src/http/modules/ngx_http_image_filter_module.c +++ b/src/http/modules/ngx_http_image_filter_module.c @@ -817,9 +817,7 @@ transparent: resize = 0; - if ((ngx_uint_t) (dx * 100 / dy) - < ctx->max_width * 100 / ctx->max_height) - { + if ((double) dx / dy < (double) ctx->max_width / ctx->max_height) { if ((ngx_uint_t) dx > ctx->max_width) { dy = dy * ctx->max_width / dx; dy = dy ? dy : 1; Maxim Dounin From b at codemonkey.ru Fri Apr 20 13:32:11 2012 From: b at codemonkey.ru (Maxim Bublis) Date: Fri, 20 Apr 2012 17:32:11 +0400 Subject: [patch] ngx_http_image_filter_module incorrectly calculates size In-Reply-To: <20120420124851.GG13466@mdounin.ru> References: <20120420093351.GE13466@mdounin.ru> <20120420124851.GG13466@mdounin.ru> Message-ID: Hi. >> I think it should be correct solution if multiplication of either dx >> and ctx->max_height or dy and ctx->max_width would not result in >> integer overflow in case when both dx and ctx->max_height or dy and >> ctx->max_height are rather large integers. > > While real-world image sizes shouldn't be the problem (and if they > will, we'll notice this in other places as these multiplications > are done anyway), but I missed the special case of '-' in config, > which will result in max_width / max_height being set to maximum > possible value. > > The following patch should be better: > > --- a/src/http/modules/ngx_http_image_filter_module.c > +++ b/src/http/modules/ngx_http_image_filter_module.c > @@ -817,9 +817,7 @@ transparent: > > ? ? ? ? resize = 0; > > - ? ? ? ?if ((ngx_uint_t) (dx * 100 / dy) > - ? ? ? ? ? ?< ctx->max_width * 100 / ctx->max_height) > - ? ? ? ?{ > + ? ? ? ?if ((double) dx / dy < (double) ctx->max_width / ctx->max_height) { > ? ? ? ? ? ? if ((ngx_uint_t) dx > ctx->max_width) { > ? ? ? ? ? ? ? ? dy = dy * ctx->max_width / dx; > ? ? ? ? ? ? ? ? dy = dy ? dy : 1; It seems like everything is fine now. Should it be expected that bugfix to be applied upstream? -- Maxim Bublis From mdounin at mdounin.ru Sat Apr 21 19:02:22 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Sat, 21 Apr 2012 19:02:22 +0000 Subject: [nginx] svn commit: r4602 - trunk/src/http/modules Message-ID: <20120421190223.262993F9ECE@mail.nginx.com> Author: mdounin Date: 2012-04-21 19:02:21 +0000 (Sat, 21 Apr 2012) New Revision: 4602 URL: http://trac.nginx.org/nginx/changeset/4602/nginx Log: Image filter: compare aspect ratio more accurately during crop. Previously used fixed-point calculation caused wrong code path selection in some cases, resulting in incorrect image size. See here for report: http://mailman.nginx.org/pipermail/nginx-devel/2012-April/002123.html Modified: trunk/src/http/modules/ngx_http_image_filter_module.c Modified: trunk/src/http/modules/ngx_http_image_filter_module.c =================================================================== --- trunk/src/http/modules/ngx_http_image_filter_module.c 2012-04-19 15:48:03 UTC (rev 4601) +++ trunk/src/http/modules/ngx_http_image_filter_module.c 2012-04-21 19:02:21 UTC (rev 4602) @@ -817,9 +817,7 @@ resize = 0; - if ((ngx_uint_t) (dx * 100 / dy) - < ctx->max_width * 100 / ctx->max_height) - { + if ((double) dx / dy < (double) ctx->max_width / ctx->max_height) { if ((ngx_uint_t) dx > ctx->max_width) { dy = dy * ctx->max_width / dx; dy = dy ? dy : 1; From mdounin at mdounin.ru Mon Apr 23 10:40:02 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 23 Apr 2012 10:40:02 +0000 Subject: [nginx] svn commit: r4603 - trunk/src/http/modules Message-ID: <20120423104003.4C0163F9C5F@mail.nginx.com> Author: mdounin Date: 2012-04-23 10:40:01 +0000 (Mon, 23 Apr 2012) New Revision: 4603 URL: http://trac.nginx.org/nginx/changeset/4603/nginx Log: Proxy: added ctx checking to input filters. The proxy module context may be NULL in case of filter finalization (e.g. by image_filter) followed by an internal redirect. This needs some better handling, but for now just check if ctx is still here. Modified: trunk/src/http/modules/ngx_http_proxy_module.c Modified: trunk/src/http/modules/ngx_http_proxy_module.c =================================================================== --- trunk/src/http/modules/ngx_http_proxy_module.c 2012-04-21 19:02:21 UTC (rev 4602) +++ trunk/src/http/modules/ngx_http_proxy_module.c 2012-04-23 10:40:01 UTC (rev 4603) @@ -1497,6 +1497,10 @@ u = r->upstream; ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module); + if (ctx == NULL) { + return NGX_ERROR; + } + ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http proxy filter init s:%d h:%d c:%d l:%O", u->headers_in.status_n, ctx->head, u->headers_in.chunked, @@ -1636,6 +1640,11 @@ } state; ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module); + + if (ctx == NULL) { + return NGX_ERROR; + } + state = ctx->state; if (state == sw_chunk_data && ctx->size == 0) { @@ -1883,6 +1892,10 @@ r = p->input_ctx; ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module); + if (ctx == NULL) { + return NGX_ERROR; + } + b = NULL; prev = &buf->shadow; @@ -2064,6 +2077,11 @@ ngx_http_proxy_ctx_t *ctx; ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module); + + if (ctx == NULL) { + return NGX_ERROR; + } + u = r->upstream; buf = &u->buffer; From mdounin at mdounin.ru Mon Apr 23 11:05:22 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 23 Apr 2012 11:05:22 +0000 Subject: [nginx] svn commit: r4604 - trunk/misc Message-ID: <20120423110522.3E1883F9E2E@mail.nginx.com> Author: mdounin Date: 2012-04-23 11:05:21 +0000 (Mon, 23 Apr 2012) New Revision: 4604 URL: http://trac.nginx.org/nginx/changeset/4604/nginx Log: Update openssl used for win32 builds. Modified: trunk/misc/GNUmakefile Modified: trunk/misc/GNUmakefile =================================================================== --- trunk/misc/GNUmakefile 2012-04-23 10:40:01 UTC (rev 4603) +++ trunk/misc/GNUmakefile 2012-04-23 11:05:21 UTC (rev 4604) @@ -6,7 +6,7 @@ REPO = $(shell svn info | sed -n 's/^Repository Root: //p') OBJS = objs.msvc8 -OPENSSL = openssl-1.0.0h +OPENSSL = openssl-1.0.0i ZLIB = zlib-1.2.5 PCRE = pcre-8.30 From igor at sysoev.ru Mon Apr 23 11:11:32 2012 From: igor at sysoev.ru (igor at sysoev.ru) Date: Mon, 23 Apr 2012 11:11:32 +0000 Subject: [nginx] svn commit: r4605 - trunk/src/core Message-ID: <20120423111132.74EFC3F9E85@mail.nginx.com> Author: is Date: 2012-04-23 11:11:32 +0000 (Mon, 23 Apr 2012) New Revision: 4605 URL: http://trac.nginx.org/nginx/changeset/4605/nginx Log: Fix of "%f" format handling. ngx_sprintf("%.2f", 0.999) incorrectly resulted in "0.100" instead of "1.00". Modified: trunk/src/core/ngx_string.c Modified: trunk/src/core/ngx_string.c =================================================================== --- trunk/src/core/ngx_string.c 2012-04-23 11:05:21 UTC (rev 4604) +++ trunk/src/core/ngx_string.c 2012-04-23 11:11:32 UTC (rev 4605) @@ -146,12 +146,12 @@ { u_char *p, zero; int d; - double f, scale; + double f; size_t len, slen; int64_t i64; - uint64_t ui64; + uint64_t ui64, frac; ngx_msec_t ms; - ngx_uint_t width, sign, hex, max_width, frac_width, n; + ngx_uint_t width, sign, hex, max_width, frac_width, scale, n; ngx_str_t *v; ngx_variable_value_t *vv; @@ -365,28 +365,31 @@ } ui64 = (int64_t) f; + frac = 0; - buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width); - if (frac_width) { - if (buf < last) { - *buf++ = '.'; + scale = 1; + for (n = frac_width; n; n--) { + scale *= 10; } - scale = 1.0; + frac = (uint64_t) ((f - (double) ui64) * scale + 0.5); - for (n = frac_width; n; n--) { - scale *= 10.0; + if (frac == scale) { + ui64++; + frac = 0; } + } - /* - * (int64_t) cast is required for msvc6: - * it cannot convert uint64_t to double - */ - ui64 = (uint64_t) ((f - (int64_t) ui64) * scale + 0.5); + buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width); - buf = ngx_sprintf_num(buf, last, ui64, '0', 0, frac_width); + if (frac_width) { + if (buf < last) { + *buf++ = '.'; + } + + buf = ngx_sprintf_num(buf, last, frac, '0', 0, frac_width); } fmt++; From mdounin at mdounin.ru Mon Apr 23 12:54:15 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 23 Apr 2012 12:54:15 +0000 Subject: [nginx] svn commit: r4606 - in trunk/src: core http/modules/perl Message-ID: <20120423125415.4BE943F9E7B@mail.nginx.com> Author: mdounin Date: 2012-04-23 12:54:14 +0000 (Mon, 23 Apr 2012) New Revision: 4606 URL: http://trac.nginx.org/nginx/changeset/4606/nginx Log: Version bump. Modified: trunk/src/core/nginx.h trunk/src/http/modules/perl/nginx.pm Modified: trunk/src/core/nginx.h =================================================================== --- trunk/src/core/nginx.h 2012-04-23 11:11:32 UTC (rev 4605) +++ trunk/src/core/nginx.h 2012-04-23 12:54:14 UTC (rev 4606) @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1001020 -#define NGINX_VERSION "1.1.20" +#define nginx_version 1002000 +#define NGINX_VERSION "1.2.0" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "NGINX" Modified: trunk/src/http/modules/perl/nginx.pm =================================================================== --- trunk/src/http/modules/perl/nginx.pm 2012-04-23 11:11:32 UTC (rev 4605) +++ trunk/src/http/modules/perl/nginx.pm 2012-04-23 12:54:14 UTC (rev 4606) @@ -50,7 +50,7 @@ HTTP_INSUFFICIENT_STORAGE ); -our $VERSION = '1.1.20'; +our $VERSION = '1.2.0'; require XSLoader; XSLoader::load('nginx', $VERSION); From mdounin at mdounin.ru Mon Apr 23 13:06:47 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 23 Apr 2012 13:06:47 +0000 Subject: [nginx] svn commit: r4607 - trunk/docs/xml/nginx Message-ID: <20120423130647.E8B983F9C1F@mail.nginx.com> Author: mdounin Date: 2012-04-23 13:06:47 +0000 (Mon, 23 Apr 2012) New Revision: 4607 URL: http://trac.nginx.org/nginx/changeset/4607/nginx Log: nginx-1.2.0-RELEASE Modified: trunk/docs/xml/nginx/changes.xml Modified: trunk/docs/xml/nginx/changes.xml =================================================================== --- trunk/docs/xml/nginx/changes.xml 2012-04-23 12:54:14 UTC (rev 4606) +++ trunk/docs/xml/nginx/changes.xml 2012-04-23 13:06:47 UTC (rev 4607) @@ -9,6 +9,46 @@ nginx changelog + + + + +? ??????? ???????? ??? ????????? segmentation fault, +???? ?????????????? ????????? try_files; +?????? ????????? ? 1.1.19. + + +a segmentation fault might occur in a worker process +if the "try_files" directive was used; +the bug had appeared in 1.1.19. + + + + + +????? ??? ???? ??????? ?? ?????????, +???? ?????????????? ?????? IOV_MAX ???????. + + +response might be truncated +if there were more than IOV_MAX buffers used. + + + + + +? ?????? ????????? crop ????????? image_filter.
+??????? Maxim Bublis. + + +in the "crop" parameter of the "image_filter" directive.
+Thanks to Maxim Bublis. + + + + + + From mdounin at mdounin.ru Mon Apr 23 13:07:07 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Mon, 23 Apr 2012 13:07:07 +0000 Subject: [nginx] svn commit: r4608 - tags Message-ID: <20120423130707.CAF8C3F9FA7@mail.nginx.com> Author: mdounin Date: 2012-04-23 13:07:07 +0000 (Mon, 23 Apr 2012) New Revision: 4608 URL: http://trac.nginx.org/nginx/changeset/4608/nginx Log: release-1.2.0 tag Added: tags/release-1.2.0/ From doubleukay at doubleukay.com Mon Apr 23 16:11:01 2012 From: doubleukay at doubleukay.com (Woon Wai Keen) Date: Tue, 24 Apr 2012 00:11:01 +0800 Subject: Proxy cache and proxy_ignore_client_abort Message-ID: <4F957F15.7050903@doubleukay.com> In svn r2758, proxy_ignore_client_abort is ignored when case where proxy_cache or proxy_store is enabled. What was the reason for this, compared to letting it be controlled using proxy_ignore_client_abort? I reverted the patch and proxy_cache appears to work as expected with proxy_ignore_client_abort set to on and off, but I'm curious to know if there are other side effects. Author: is Date: Mon Apr 27 11:20:55 2009 +0000 get a full response if the response is cacheable or storable even a client has closed connection prematurely From faskiri.devel at gmail.com Tue Apr 24 11:52:39 2012 From: faskiri.devel at gmail.com (Fasih) Date: Tue, 24 Apr 2012 17:22:39 +0530 Subject: Query about keepalive Message-ID: Hi All, Few days back I was trying to evaluate the performance of upstream keepalive feature for a website when I noticed a rather unexpected behaviour. It would be help me understand what's going on in the test. Here's what I did: 1. Setup httperf to run a session load. This basically means that a text file with different urls is supplied to httperf. httperf sends all the requests in bursts spaced by a sec towards nginx. 2. Tcpdump is run on the machine 3. Before the tests begin, cache is cleared and nginx restarted 4. Test is repeated with httperf "replaying" the requests 1 time first, and re-run with repeat count 4 to account for setup of connections/cache priming etc 5. All the steps are repeated once without keepalive and with keepalive 512; Results: SessionKeep aliveConns upstreamConn TimeUnique upstream hostsReqs upstreamAvg time to 1st byteMax upstream conn reuseClient conns (1)Client reqs (1)Client replies (1)Testdur (1)Client connsClient reqsClient repliesTestdurmy-site148 8.30858191920.15262331213013031.219852052078.064my-site019220.716919192 0.1679461213013025.680852052071.781 Analysis: * First row with keepalive, second row without keepalive. * With keepalive, number of connections upstream (as seen in tcpdump) is 48. Note that my-site has multiple (19 - unique upstream hosts) subdomains, each of which is individually configured. Without keepalive 192 connections are made * Total time spent establishing connections is 8.3 vs 20.7 * Latency is ~0.15secs All these are as expected, test duration however goes from 78 -> 71 secs. An *increase* in the time for test to complete. As the number of unique upstream increases, the time increases further. This wasnt something that I could explain. Please help me understand, is it a bug in the system? Configuration: nginx version: nginx/1.1.18 built by gcc 4.4.5 (Ubuntu/Linaro 4.4.4-14ubuntu5) TLS SNI support enabled configure arguments: --without-http_ssi_module --without-http_geo_module --without-http_uwsgi_module --without-http_scgi_module --without-http_memcached_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --with-http_ssl_module --with-debug --without-http_rewrite_module --prefix=/home/faskiri/Downloads/nginx-1.1.18/install Cache config: proxy_cache_path /tmp/cache levels=1:2 keys_zone=my-cache:8m max_size=1000m inactive=600m; Highly appreciate any help on this. Regards +Fasih -------------- next part -------------- An HTML attachment was scrubbed... URL: From mdounin at mdounin.ru Tue Apr 24 14:53:48 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 24 Apr 2012 18:53:48 +0400 Subject: Query about keepalive In-Reply-To: References: Message-ID: <20120424145348.GE31671@mdounin.ru> Hello! On Tue, Apr 24, 2012 at 05:22:39PM +0530, Fasih wrote: > Hi All, > > Few days back I was trying to evaluate the performance of upstream > keepalive feature for a website when I noticed a rather unexpected > behaviour. It would be help me understand what's going on in the test. > > Here's what I did: > 1. Setup httperf to run a session load. This basically means that a text > file with different urls is supplied to httperf. httperf sends all the > requests in bursts spaced by a sec towards nginx. > > 2. Tcpdump is run on the machine > > 3. Before the tests begin, cache is cleared and nginx restarted > > 4. Test is repeated with httperf "replaying" the requests 1 time first, and > re-run with repeat count 4 to account for setup of connections/cache > priming etc > > 5. All the steps are repeated once without keepalive and with keepalive 512; Just a side note: you may want to avoid setting keepalive bigger than your backend is able to handle, keeping in mind that it's not a hard limit on connections established, but rather size of connection cache kept by each worker. > Results: > SessionKeep aliveConns upstreamConn TimeUnique upstream hostsReqs upstreamAvg > time to 1st byteMax upstream conn reuseClient conns (1)Client reqs (1)Client > replies (1)Testdur (1)Client connsClient reqsClient repliesTestdurmy-site148 > 8.30858191920.15262331213013031.219852052078.064my-site019220.716919192 > 0.1679461213013025.680852052071.781 Just a side note: please do not use html to post here. We'll won't see it anyway, and plain text of your message is somewhat unreadable. > Analysis: > * First row with keepalive, second row without keepalive. > * With keepalive, number of connections upstream (as seen in tcpdump) is > 48. Note that my-site has multiple (19 - unique upstream hosts) subdomains, > each of which is individually configured. Without keepalive 192 connections > are made > * Total time spent establishing connections is 8.3 vs 20.7 > * Latency is ~0.15secs > All these are as expected, test duration however goes from 78 -> 71 secs. > An *increase* in the time for test to complete. > > As the number of unique upstream increases, the time increases further. > This wasnt something that I could explain. Please help me understand, is it > a bug in the system? How many times did you run the test? From numbers it looks like you are measuring your network and/or upstream server performance, and I suspect this might fluctuate widely. You might want to do the test at least 3 times in each configuration to be able to see the difference between two configurations. If the difference will still be there, you may want to share more details about your setup (provide nginx configs, network details, description of the upstream servers involved, probably debug log for a deeper investigation). It is possible that keepalive connections to upstreams will lead to worse overall performance than no keepalives (notably due to various network effects and upstream servers behaviour), but I wouldn't expect it to be slower in general. Maxim Dounin From faskiri.devel at gmail.com Tue Apr 24 15:13:03 2012 From: faskiri.devel at gmail.com (Fasih) Date: Tue, 24 Apr 2012 20:43:03 +0530 Subject: Query about keepalive In-Reply-To: <20120424145348.GE31671@mdounin.ru> References: <20120424145348.GE31671@mdounin.ru> Message-ID: Thanks a lot for the response. > Just a side note: you may want to avoid setting keepalive bigger > than your backend is able to handle, keeping in mind that it's > not a hard limit on connections established, but rather size of > connection cache kept by each worker. I didnt realize that. I did run the test with keepalive 16 but the results are similiar. > Just a side note: please do not use html to post here. ?We'll > won't see it anyway, and plain text of your message is somewhat > unreadable. Sorry about that. Wiki format: ?|| Session || Keepalive || Conns upstream || Conn Time || Unique upstream hosts || Reqs upstream || Avg time to 1st byte || Max upstream conn reuse || Client conns(1) || Client reqs(1) || Client replies(1) || Testdur(1) || Client conns || Client reqs || Client replies || Testdur || | site | 1 | 48 | 8.30858 | 19 | 192 | 0.152623 | 31 | 2 | 130 | 130 | 31.219 | 8 | 520 | 520 | 78.064 | | site | 0 | 192 | 20.7169 | 19 | 192 | 0.167946 | 1 | 2 | 130 | 130 | 25.680 | 8 | 520 | 520 | 71.781 | > How many times did you run the test? ?From numbers it looks like > you are measuring your network and/or upstream server performance, > and I suspect this might fluctuate widely. ?You might want to do > the test at least 3 times in each configuration to be able to see > the difference between two configurations. > I repeated this for quite a number of times, the trend is, the increased number of upstreams (ie. I configure a.mysite, images.mysites... etc) the slower it gets. > > If the difference will still be there, you may want to share more > details about your setup (provide nginx configs, network details, > description of the upstream servers involved, probably debug log > for a deeper investigation). configuration consists of some 20s of these(0-20): server { server_name 0.my-site.com; listen 10010; location / { proxy_pass http://0.my-site.com; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_cache my-cache; } } And other than these I dont think I modified any setting server_names_hash_max_size 1024; proxy_cache_path /tmp/cache levels=1:2 keys_zone=my-cache:8m max_size=1000m inactive=600m; > > It is possible that keepalive connections to upstreams will lead > to worse overall performance than no keepalives (notably due to > various network effects and upstream servers behaviour), but I > wouldn't expect it to be slower in general. If you can give pointers as to what to look for, I could investigate more. The logs generated are huge for a moderate load, not sure if attaching is a good idea. I can grep out keepalive|upstream if you want Thanks again for your patience and time From mdounin at mdounin.ru Tue Apr 24 17:38:10 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 24 Apr 2012 21:38:10 +0400 Subject: Query about keepalive In-Reply-To: References: <20120424145348.GE31671@mdounin.ru> Message-ID: <20120424173810.GG31671@mdounin.ru> Hello! On Tue, Apr 24, 2012 at 08:43:03PM +0530, Fasih wrote: > Thanks a lot for the response. > > > > Just a side note: you may want to avoid setting keepalive bigger > > than your backend is able to handle, keeping in mind that it's > > not a hard limit on connections established, but rather size of > > connection cache kept by each worker. > > I didnt realize that. I did run the test with keepalive 16 but the > results are similiar. > > > > Just a side note: please do not use html to post here. ?We'll > > won't see it anyway, and plain text of your message is somewhat > > unreadable. > > > Sorry about that. Wiki format: > ?|| Session || Keepalive || Conns upstream || Conn Time || Unique > upstream hosts || Reqs upstream || Avg time to 1st byte || Max > upstream conn reuse || Client conns(1) || Client reqs(1) || Client > replies(1) || Testdur(1) || Client conns || Client reqs || Client > replies || Testdur || > | site | 1 | 48 | 8.30858 | 19 | 192 | 0.152623 | 31 | 2 | 130 | 130 | > 31.219 | 8 | 520 | 520 | 78.064 | > | site | 0 | 192 | 20.7169 | 19 | 192 | 0.167946 | 1 | 2 | 130 | 130 | > 25.680 | 8 | 520 | 520 | 71.781 | > > > How many times did you run the test? ?From numbers it looks like > > you are measuring your network and/or upstream server performance, > > and I suspect this might fluctuate widely. ?You might want to do > > the test at least 3 times in each configuration to be able to see > > the difference between two configurations. > > > I repeated this for quite a number of times, the trend is, the > increased number of upstreams (ie. I configure a.mysite, > images.mysites... etc) the slower it gets. There shouldn't be any difference from number of upstreams from nginx side (despite the fact that it lowers chance to get cached connection). Do these upstreams map to the same host? If yes - is it able to cope with the number of connections opened? > > If the difference will still be there, you may want to share more > > details about your setup (provide nginx configs, network details, > > description of the upstream servers involved, probably debug log > > for a deeper investigation). > > configuration consists of some 20s of these(0-20): > server { > server_name 0.my-site.com; > listen 10010; > location / { > proxy_pass http://0.my-site.com; > proxy_http_version 1.1; > proxy_set_header Connection ""; > proxy_cache my-cache; > } > } What's configured in upstream blocks? How configuration looks like with keepalive disabled? Most notably: do you remove/comment out proxy_http_version and proxy_set_header? If yes, please try with these lines in place (but without "keepalive" in upstream block) to rule out protocol differences. What about details about the upstream servers used (software used, network connectivity details, how many connections they are able to handle)? > And other than these I dont think I modified any setting > server_names_hash_max_size 1024; > proxy_cache_path /tmp/cache levels=1:2 keys_zone=my-cache:8m > max_size=1000m inactive=600m; > > > > > It is possible that keepalive connections to upstreams will lead > > to worse overall performance than no keepalives (notably due to > > various network effects and upstream servers behaviour), but I > > wouldn't expect it to be slower in general. > > If you can give pointers as to what to look for, I could investigate more. > The logs generated are huge for a moderate load, not sure if attaching > is a good idea. I can grep out keepalive|upstream if you want First of all check if there are any "info" or more severe level messages which you don't expect and/or understand. If there are any, post them here for a review. If there are none - please compress logs and make them available for download (you may email me privately if there are any private data). Maxim Dounin From mikegagnon at gmail.com Wed Apr 25 01:13:42 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Tue, 24 Apr 2012 18:13:42 -0700 Subject: Do http headers need to fit in a single FastCGI record? Message-ID: Hello, I have noticed that http requests with large headers leads to 500 errors (more than 64k). From a previous discussion on the mailing list (2007), Igor said that the entire FastCGI request (except body) must fit into a single record. Is that limitation still true today? http://mailman.nginx.org/pipermail/nginx/2007-August/001602.html Thanks! Mike Gagnon -------------- next part -------------- An HTML attachment was scrubbed... URL: From wandenberg at gmail.com Wed Apr 25 04:15:31 2012 From: wandenberg at gmail.com (Wandenberg Peixoto) Date: Wed, 25 Apr 2012 01:15:31 -0300 Subject: Setting cache control and expires inside a module Message-ID: Hi, I need to add response to OPTIONS method to a module to allow cross domain access, but I want to set cache control and expires headers, only for this method, to browsers does not ask this method frequently. How is the best way to do that? I have to add these headers to headers_out or has a function to do that for me? Regards, Wandenberg -------------- next part -------------- An HTML attachment was scrubbed... URL: From zls.sogou at gmail.com Wed Apr 25 07:48:47 2012 From: zls.sogou at gmail.com (lanshun zhou) Date: Wed, 25 Apr 2012 15:48:47 +0800 Subject: [BUG] zero-length cname response not handled Message-ID: We found a zero-length cname response in dns reply for the domain "www.czcsgl.com", and this will cause core dump. We have no idea where this domain comes from and why this kind of setting .. Not sure whether it's always safe to print the rn->name in the patch attached. -------------- next part -------------- A non-text attachment was scrubbed... Name: resolver.patch Type: application/octet-stream Size: 680 bytes Desc: not available URL: From mdounin at mdounin.ru Wed Apr 25 09:07:23 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Wed, 25 Apr 2012 13:07:23 +0400 Subject: Do http headers need to fit in a single FastCGI record? In-Reply-To: References: Message-ID: <20120425090723.GJ31671@mdounin.ru> Hello! On Tue, Apr 24, 2012 at 06:13:42PM -0700, Mike Gagnon wrote: > Hello, > > I have noticed that http requests with large headers leads to 500 errors > (more than 64k). From a previous discussion on the mailing list (2007), > Igor said that the entire FastCGI request (except body) must fit into a > single record. Is that limitation still true today? > > http://mailman.nginx.org/pipermail/nginx/2007-August/001602.html It's still true. You should get "[alert] ... fastcgi request record is too big: ..." in logs when you hit the limit. Maxim Dounin From mikegagnon at gmail.com Wed Apr 25 14:58:28 2012 From: mikegagnon at gmail.com (Mike Gagnon) Date: Wed, 25 Apr 2012 07:58:28 -0700 Subject: Do http headers need to fit in a single FastCGI record? In-Reply-To: <20120425090723.GJ31671@mdounin.ru> References: <20120425090723.GJ31671@mdounin.ru> Message-ID: Thank you! I do indeed see that error in the debug log. Cheers, Mike Gagnon On Wed, Apr 25, 2012 at 2:07 AM, Maxim Dounin wrote: > Hello! > > On Tue, Apr 24, 2012 at 06:13:42PM -0700, Mike Gagnon wrote: > > > Hello, > > > > I have noticed that http requests with large headers leads to 500 errors > > (more than 64k). From a previous discussion on the mailing list (2007), > > Igor said that the entire FastCGI request (except body) must fit into a > > single record. Is that limitation still true today? > > > > http://mailman.nginx.org/pipermail/nginx/2007-August/001602.html > > It's still true. You should get "[alert] ... fastcgi request > record is too big: ..." in logs when you hit the limit. > > Maxim Dounin > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From kindy61 at gmail.com Thu Apr 26 02:11:48 2012 From: kindy61 at gmail.com (kindy) Date: Thu, 26 Apr 2012 10:11:48 +0800 Subject: the $upstream_addr variable is empty when enable keepalive Message-ID: hi, from nginx 1.1.13 to 1.2.0. the conf: upstream a { server 127.0.0.1:8083; keepalive 10 single; } server { listen 8083; keepalive_timeout 10; location = /a { } location = /b { proxy_http_version 1.1; proxy_set_header Connection keep-alive; add_header upname "abc[$upstream_addr]dd"; proxy_pass http://a/a; } } - - - - - - - - - $ touch html/a $ curl -i localhost:8083/b HTTP/1.1 200 OK Server: nginx/1.2.0 Date: Thu, 26 Apr 2012 02:07:12 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive Last-Modified: Thu, 26 Apr 2012 02:01:02 GMT Accept-Ranges: bytes upname: abc[127.0.0.1:8083]dd $ curl -i localhost:8083/b HTTP/1.1 200 OK Server: nginx/1.2.0 Date: Thu, 26 Apr 2012 02:07:12 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive Last-Modified: Thu, 26 Apr 2012 02:01:02 GMT Accept-Ranges: bytes upname: abc[]dd -- ??(Kindy Lin) -------------- next part -------------- An HTML attachment was scrubbed... URL: From mdounin at mdounin.ru Thu Apr 26 11:18:22 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 26 Apr 2012 11:18:22 +0000 Subject: [nginx] svn commit: r4609 - branches Message-ID: <20120426111822.EB7353F9DAE@mail.nginx.com> Author: mdounin Date: 2012-04-26 11:18:21 +0000 (Thu, 26 Apr 2012) New Revision: 4609 URL: http://trac.nginx.org/nginx/changeset/4609/nginx Log: stable-1.2 branch Added: branches/stable-1.2/ From brian at akins.org Thu Apr 26 11:19:28 2012 From: brian at akins.org (Brian Akins) Date: Thu, 26 Apr 2012 07:19:28 -0400 Subject: Setting cache control and expires inside a module In-Reply-To: References: Message-ID: On Apr 25, 2012, at 12:15 AM, Wandenberg Peixoto wrote: > I need to add response to OPTIONS method to a module to allow cross domain access, > but I want to set cache control and expires headers, only for this method, to browsers does not ask this method frequently. I did this in a simple Lua script. Could do the same with perl. From mdounin at mdounin.ru Thu Apr 26 11:20:30 2012 From: mdounin at mdounin.ru (mdounin at mdounin.ru) Date: Thu, 26 Apr 2012 11:20:30 +0000 Subject: [nginx] svn commit: r4610 - in trunk/src: core http/modules/perl Message-ID: <20120426112030.2973F3F9E81@mail.nginx.com> Author: mdounin Date: 2012-04-26 11:20:29 +0000 (Thu, 26 Apr 2012) New Revision: 4610 URL: http://trac.nginx.org/nginx/changeset/4610/nginx Log: Version bump. Modified: trunk/src/core/nginx.h trunk/src/http/modules/perl/nginx.pm Modified: trunk/src/core/nginx.h =================================================================== --- trunk/src/core/nginx.h 2012-04-26 11:18:21 UTC (rev 4609) +++ trunk/src/core/nginx.h 2012-04-26 11:20:29 UTC (rev 4610) @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1002000 -#define NGINX_VERSION "1.2.0" +#define nginx_version 1003000 +#define NGINX_VERSION "1.3.0" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "NGINX" Modified: trunk/src/http/modules/perl/nginx.pm =================================================================== --- trunk/src/http/modules/perl/nginx.pm 2012-04-26 11:18:21 UTC (rev 4609) +++ trunk/src/http/modules/perl/nginx.pm 2012-04-26 11:20:29 UTC (rev 4610) @@ -50,7 +50,7 @@ HTTP_INSUFFICIENT_STORAGE ); -our $VERSION = '1.2.0'; +our $VERSION = '1.3.0'; require XSLoader; XSLoader::load('nginx', $VERSION); From mdounin at mdounin.ru Thu Apr 26 12:35:39 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 26 Apr 2012 16:35:39 +0400 Subject: the $upstream_addr variable is empty when enable keepalive In-Reply-To: References: Message-ID: <20120426123539.GV31671@mdounin.ru> Hello! On Thu, Apr 26, 2012 at 10:11:48AM +0800, kindy wrote: > hi, > > from nginx 1.1.13 to 1.2.0. > the conf: > > upstream a { > server 127.0.0.1:8083; > keepalive 10 single; Don't use "single", it's intentionally left undocumented in official nginx docs (http://nginx.org/r/keepalive) as it might cause various problems. It will likely be deprecated and removed. Maxim Dounin From ru at nginx.com Thu Apr 26 12:58:43 2012 From: ru at nginx.com (ru at nginx.com) Date: Thu, 26 Apr 2012 12:58:43 +0000 Subject: [nginx] svn commit: r4611 - trunk/src/core Message-ID: <20120426125843.2B2BB3F9D92@mail.nginx.com> Author: ru Date: 2012-04-26 12:58:42 +0000 (Thu, 26 Apr 2012) New Revision: 4611 URL: http://trac.nginx.org/nginx/changeset/4611/nginx Log: Fixed segmentation fault in ngx_resolver_create_name_query(). If name passed for resolution was { 0, NULL } (e.g. as a result of name server returning CNAME pointing to ".") pointer wrapped to (void *) -1 resulting in segmentation fault on an attempt to dereference it. Reported by Lanshun Zhou. Modified: trunk/src/core/ngx_resolver.c Modified: trunk/src/core/ngx_resolver.c =================================================================== --- trunk/src/core/ngx_resolver.c 2012-04-26 11:20:29 UTC (rev 4610) +++ trunk/src/core/ngx_resolver.c 2012-04-26 12:58:42 UTC (rev 4611) @@ -1834,6 +1834,10 @@ p--; *p-- = '\0'; + if (ctx->name.len == 0) { + return NGX_DECLINED; + } + for (s = ctx->name.data + ctx->name.len - 1; s >= ctx->name.data; s--) { if (*s != '.') { *p = *s; From ru at nginx.com Thu Apr 26 13:02:28 2012 From: ru at nginx.com (Ruslan Ermilov) Date: Thu, 26 Apr 2012 17:02:28 +0400 Subject: [BUG] zero-length cname response not handled In-Reply-To: References: Message-ID: <20120426130228.GC14350@lo0.su> On Wed, Apr 25, 2012 at 03:48:47PM +0800, lanshun zhou wrote: > We found a zero-length cname response in dns reply for the > domain "www.czcsgl.com", and this will cause core dump. Thanks for the report. A fix has just been committed: http://trac.nginx.org/nginx/changeset/4611/nginx From wandenberg at gmail.com Thu Apr 26 13:04:29 2012 From: wandenberg at gmail.com (Wandenberg Peixoto) Date: Thu, 26 Apr 2012 10:04:29 -0300 Subject: Setting cache control and expires inside a module In-Reply-To: References: Message-ID: Hi Brian, I need to this inside my module, it already exists. Actually it responds to GET method and I need to add response to OPTIONS methods to support cross domain access, but want to send the response with cache headers, only for OPTIONS. This is the reason I need to do that by code. Regards, Wandenberg On Thu, Apr 26, 2012 at 8:19 AM, Brian Akins wrote: > > On Apr 25, 2012, at 12:15 AM, Wandenberg Peixoto wrote: > > I need to add response to OPTIONS method to a module to allow cross > domain access, > > but I want to set cache control and expires headers, only for this > method, to browsers does not ask this method frequently. > > I did this in a simple Lua script. Could do the same with perl. > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From defan at nginx.com Thu Apr 26 13:06:28 2012 From: defan at nginx.com (defan at nginx.com) Date: Thu, 26 Apr 2012 13:06:28 +0000 Subject: [nginx] svn commit: r4612 - trunk/src/http/modules Message-ID: <20120426130628.490E33F9E40@mail.nginx.com> Author: defan Date: 2012-04-26 13:06:27 +0000 (Thu, 26 Apr 2012) New Revision: 4612 URL: http://trac.nginx.org/nginx/changeset/4612/nginx Log: Allows particular modules to handle subrequests properly. Modified: trunk/src/http/modules/ngx_http_flv_module.c trunk/src/http/modules/ngx_http_gzip_static_module.c trunk/src/http/modules/ngx_http_mp4_module.c trunk/src/http/modules/ngx_http_stub_status_module.c Modified: trunk/src/http/modules/ngx_http_flv_module.c =================================================================== --- trunk/src/http/modules/ngx_http_flv_module.c 2012-04-26 12:58:42 UTC (rev 4611) +++ trunk/src/http/modules/ngx_http_flv_module.c 2012-04-26 13:06:27 UTC (rev 4612) @@ -235,7 +235,7 @@ b->file_last = of.size; b->in_file = b->file_last ? 1: 0; - b->last_buf = 1; + b->last_buf = (r == r->main) ? 1 : 0; b->last_in_chain = 1; b->file->fd = of.fd; Modified: trunk/src/http/modules/ngx_http_gzip_static_module.c =================================================================== --- trunk/src/http/modules/ngx_http_gzip_static_module.c 2012-04-26 12:58:42 UTC (rev 4611) +++ trunk/src/http/modules/ngx_http_gzip_static_module.c 2012-04-26 13:06:27 UTC (rev 4612) @@ -245,7 +245,7 @@ b->file_last = of.size; b->in_file = b->file_last ? 1 : 0; - b->last_buf = 1; + b->last_buf = (r == r->main) ? 1 : 0; b->last_in_chain = 1; b->file->fd = of.fd; Modified: trunk/src/http/modules/ngx_http_mp4_module.c =================================================================== --- trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-26 12:58:42 UTC (rev 4611) +++ trunk/src/http/modules/ngx_http_mp4_module.c 2012-04-26 13:06:27 UTC (rev 4612) @@ -616,7 +616,7 @@ b->file_last = of.size; b->in_file = b->file_last ? 1 : 0; - b->last_buf = 1; + b->last_buf = (r == r->main) ? 1 : 0; b->last_in_chain = 1; b->file->fd = of.fd; Modified: trunk/src/http/modules/ngx_http_stub_status_module.c =================================================================== --- trunk/src/http/modules/ngx_http_stub_status_module.c 2012-04-26 12:58:42 UTC (rev 4611) +++ trunk/src/http/modules/ngx_http_stub_status_module.c 2012-04-26 13:06:27 UTC (rev 4612) @@ -121,7 +121,7 @@ r->headers_out.status = NGX_HTTP_OK; r->headers_out.content_length_n = b->last - b->pos; - b->last_buf = 1; + b->last_buf = (r == r->main) ? 1 : 0; rc = ngx_http_send_header(r); From mdounin at mdounin.ru Thu Apr 26 14:33:35 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 26 Apr 2012 18:33:35 +0400 Subject: Setting cache control and expires inside a module In-Reply-To: References: Message-ID: <20120426143335.GB31671@mdounin.ru> Hello! On Thu, Apr 26, 2012 at 10:04:29AM -0300, Wandenberg Peixoto wrote: > Hi Brian, > > I need to this inside my module, it already exists. > Actually it responds to GET method and I need to add response to OPTIONS > methods to support cross domain access, > but want to send the response with cache headers, only for OPTIONS. > This is the reason I need to do that by code. I really wonder why you ever asked, I'm pretty sure you'll be able to write correct code yourself. See ngx_http_set_expires() in ngx_http_headers_module.c for an example. Maxim Dounin > > Regards, > Wandenberg > > On Thu, Apr 26, 2012 at 8:19 AM, Brian Akins wrote: > > > > > On Apr 25, 2012, at 12:15 AM, Wandenberg Peixoto wrote: > > > I need to add response to OPTIONS method to a module to allow cross > > domain access, > > > but I want to set cache control and expires headers, only for this > > method, to browsers does not ask this method frequently. > > > > I did this in a simple Lua script. Could do the same with perl. > > > > _______________________________________________ > > nginx-devel mailing list > > nginx-devel at nginx.org > > http://mailman.nginx.org/mailman/listinfo/nginx-devel > > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel From wandenberg at gmail.com Fri Apr 27 00:53:55 2012 From: wandenberg at gmail.com (Wandenberg Peixoto) Date: Thu, 26 Apr 2012 21:53:55 -0300 Subject: Setting cache control and expires inside a module In-Reply-To: <20120426143335.GB31671@mdounin.ru> References: <20120426143335.GB31671@mdounin.ru> Message-ID: Hi Maxim, thanks for your response. I was hoping it had a specific function in the nginx core for that. I looked the ngx_http_set_expires function before ask to the list, but don't want to copy the code, if was possible to just call some function will be better. If don't have any other way, I will implement based on that code. Regards, Wandenberg On Thu, Apr 26, 2012 at 11:33 AM, Maxim Dounin wrote: > Hello! > > On Thu, Apr 26, 2012 at 10:04:29AM -0300, Wandenberg Peixoto wrote: > > > Hi Brian, > > > > I need to this inside my module, it already exists. > > Actually it responds to GET method and I need to add response to OPTIONS > > methods to support cross domain access, > > but want to send the response with cache headers, only for OPTIONS. > > This is the reason I need to do that by code. > > I really wonder why you ever asked, I'm pretty sure you'll be able > to write correct code yourself. See ngx_http_set_expires() in > ngx_http_headers_module.c for an example. > > Maxim Dounin > > > > > Regards, > > Wandenberg > > > > On Thu, Apr 26, 2012 at 8:19 AM, Brian Akins wrote: > > > > > > > > On Apr 25, 2012, at 12:15 AM, Wandenberg Peixoto wrote: > > > > I need to add response to OPTIONS method to a module to allow cross > > > domain access, > > > > but I want to set cache control and expires headers, only for this > > > method, to browsers does not ask this method frequently. > > > > > > I did this in a simple Lua script. Could do the same with perl. > > > > > > _______________________________________________ > > > nginx-devel mailing list > > > nginx-devel at nginx.org > > > http://mailman.nginx.org/mailman/listinfo/nginx-devel > > > > > > _______________________________________________ > > nginx-devel mailing list > > nginx-devel at nginx.org > > http://mailman.nginx.org/mailman/listinfo/nginx-devel > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel > -------------- next part -------------- An HTML attachment was scrubbed... URL: From b at codemonkey.ru Fri Apr 27 10:13:08 2012 From: b at codemonkey.ru (Maxim Bublis) Date: Fri, 27 Apr 2012 14:13:08 +0400 Subject: [patch] ngx_http_image_filter_module crop offset Message-ID: Hello. I assume it is a very common (but not solved yet) problem to tell image_filter's crop about it's alignment. In case we want to resize portrait images with crop (for example from 480x640 to 200x200) it is really usefull to align it on top of image instead of aligning it in the middle and cutting out part of face (current behavior). There is a proposal to add image_filter_crop_offset setting with two variables - axis x percentage offset and axis y percentage offset (maybe it should be better called "percentage ratio" or something else). image_filter_crop_offset ; The default and backward compatible values for both crop_x_offset and crop_y_offset are 50. Valid values for both variables should be between 0 and 100. To solve problem with cropping portrait images we could simply do the following setting - image_filter_crop_offset 50 10. It should tell image_filter to crop 10% upside and 90% from downside. Attached patch implements this proposal and adds support for crop offset. Unfortunately, I have not found the way to checkout nginx_org repository, but i'm ready to provide patch for Russian and English documentation too. -- Maxim Bublis -------------- next part -------------- A non-text attachment was scrubbed... Name: image_filter_crop_offset.patch Type: application/octet-stream Size: 6733 bytes Desc: not available URL: From maxim at nginx.com Fri Apr 27 10:16:19 2012 From: maxim at nginx.com (Maxim Konovalov) Date: Fri, 27 Apr 2012 14:16:19 +0400 Subject: how to check out nginx.org from svn (was Re: [patch] ngx_http_image_filter_module crop offset) In-Reply-To: References: Message-ID: <4F9A71F3.2050003@nginx.com> [...] > Unfortunately, I have not found the way to checkout nginx_org > repository, but i'm ready to provide patch for Russian and English > documentation too. > As simple as svn co svn://svn.nginx.org/nginx.org nginx.org -- Maxim Konovalov +7 (910) 4293178 http://nginx.com/ From b at codemonkey.ru Fri Apr 27 10:27:10 2012 From: b at codemonkey.ru (Maxim Bublis) Date: Fri, 27 Apr 2012 14:27:10 +0400 Subject: how to check out nginx.org from svn (was Re: [patch] ngx_http_image_filter_module crop offset) In-Reply-To: <4F9A71F3.2050003@nginx.com> References: <4F9A71F3.2050003@nginx.com> Message-ID: > As simple as > > svn co svn://svn.nginx.org/nginx.org nginx.org I've tried "svn co svn://svn.nginx.org/nginx_org". Trac Browser repository (http://trac.nginx.org/nginx/browser) misleaded me to incorrect repository name. Thanks. -- Maxim Bublis From vbart at nginx.com Fri Apr 27 10:48:43 2012 From: vbart at nginx.com (vbart at nginx.com) Date: Fri, 27 Apr 2012 10:48:43 +0000 Subject: [nginx] svn commit: r4613 - trunk/src/http Message-ID: <20120427104843.A3AFB3F9E40@mail.nginx.com> Author: vbart Date: 2012-04-27 10:48:42 +0000 (Fri, 27 Apr 2012) New Revision: 4613 URL: http://trac.nginx.org/nginx/changeset/4613/nginx Log: Removed surplus condition. Modified: trunk/src/http/ngx_http_request.c Modified: trunk/src/http/ngx_http_request.c =================================================================== --- trunk/src/http/ngx_http_request.c 2012-04-26 13:06:27 UTC (rev 4612) +++ trunk/src/http/ngx_http_request.c 2012-04-27 10:48:42 UTC (rev 4613) @@ -2001,14 +2001,6 @@ return; } -#if (NGX_DEBUG) - if (r != c->data) { - ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, - "http finalize non-active request: \"%V?%V\"", - &r->uri, &r->args); - } -#endif - pr = r->parent; if (r == c->data) { @@ -2042,6 +2034,10 @@ } else { + ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0, + "http finalize non-active request: \"%V?%V\"", + &r->uri, &r->args); + r->write_event_handler = ngx_http_request_finalizer; if (r->waited) { From adrian.kotelba at barbasyn.org Sat Apr 28 08:48:02 2012 From: adrian.kotelba at barbasyn.org (Adrian Kotelba) Date: Sat, 28 Apr 2012 11:48:02 +0300 Subject: [PATCH] Nginx secure link module with HMAC construction Message-ID: Hello, Attached is the proposed patch to http_secure_link module. With the patch, the security and functionality of the module is extended. First of all, the secure token is created using much more secure HMAC construction with an arbitrary hash algorithm supported by OpenSSL, e.g., md5, sha1, sha256, sha512. Secure token is created in the standard way as in RFC2104, that is, H(secret_key XOR opad, H(secret_key XOR ipad, message)) instead of a simple MD5(secret_key, message, expire). Message to be hashed is defined by secure_link_hmac_message, secret_key is given by secure_link_hmac_secret, and hashing algorithm H is defined by secure_link_hmac_algorithm. The expiration timestamp can be either appended to secret key, or message to be hashed, or both. Configuration example below. location ^~ /files/ { secure_link $arg_st,$arg_e; secure_link_hmac_secret my_secret_key$arg_e; secure_link_hmac_message $uri; secure_link_hmac_algorithm sha256; if ($secure_link = "") { return 403; } if ($secure_link = "0") { return 410; } rewrite ^/files/(.$)$ /files/$1 break; } Application side can use a standard hash_hmac function to generate hash, which then needs to be base64 encoded. Example in PHP $expire = time() + 3600; $secret = "my_secret_key" . $expire; $algo = "sha256"; $path = "/files/top_secret.pdf"; $hashmac = base64_encode(hash_hmac($algo,$path,$secret,true)); $hashmac = strtr($hashmac,"+/","-_")); $hashmac = str_replace("=","",$hashmac); $host = $_SERVER['HTTP_HOST']; $loc = "https://" . $host . "/files/top_secret.pdf" . "?st=" . $hashmac . "&e=" . $expire; Patch below. --- ngx_http_secure_link_module.c 2012-01-18 17:07:43.000000000 +0200 +++ ngx_http_hmac_secure_link_module.c 2012-04-28 10:19:00.000000000 +0300 @@ -9,12 +9,17 @@ #include #include #include +#include +#include typedef struct { ngx_http_complex_value_t *variable; ngx_http_complex_value_t *md5; + ngx_http_complex_value_t *hmac_message; + ngx_http_complex_value_t *hmac_secret; ngx_str_t secret; + ngx_str_t hmac_algorithm; } ngx_http_secure_link_conf_t; @@ -26,6 +31,9 @@ static ngx_int_t ngx_http_secure_link_old_variable(ngx_http_request_t *r, ngx_http_secure_link_conf_t *conf, ngx_http_variable_value_t *v, uintptr_t data); +static ngx_int_t ngx_http_secure_link_hmac_variable(ngx_http_request_t *r, + ngx_http_secure_link_conf_t *conf, ngx_http_variable_value_t *v, + uintptr_t data); static ngx_int_t ngx_http_secure_link_expires_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data); static void *ngx_http_secure_link_create_conf(ngx_conf_t *cf); @@ -57,6 +65,27 @@ offsetof(ngx_http_secure_link_conf_t, secret), NULL }, + { ngx_string("secure_link_hmac_message"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, + ngx_http_set_complex_value_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_secure_link_conf_t, hmac_message), + NULL }, + + { ngx_string("secure_link_hmac_secret"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, + ngx_http_set_complex_value_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_secure_link_conf_t, hmac_secret), + NULL }, + + { ngx_string("secure_link_hmac_algorithm"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, + ngx_conf_set_str_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_secure_link_conf_t, hmac_algorithm), + NULL }, + ngx_null_command }; @@ -115,6 +144,10 @@ return ngx_http_secure_link_old_variable(r, conf, v, data); } + if (conf->hmac_algorithm.len) { + return ngx_http_secure_link_hmac_variable(r, conf, v, data); + } + if (conf->variable == NULL || conf->md5 == NULL) { goto not_found; } @@ -266,6 +299,107 @@ return NGX_OK; } +static ngx_int_t +ngx_http_secure_link_hmac_variable(ngx_http_request_t *r, + ngx_http_secure_link_conf_t *conf, ngx_http_variable_value_t *v, + uintptr_t data) +{ + u_char *p, *last; + ngx_str_t val, hash, key; + time_t expires; + ngx_http_secure_link_ctx_t *ctx; + u_char hash_buf[EVP_MAX_MD_SIZE], hmac_buf[EVP_MAX_MD_SIZE]; + const EVP_MD *evp_md; + u_int hmac_len, hash_base64_len; + + if (conf->variable == NULL || conf->hmac_message == NULL || conf->hmac_secret == NULL) { + goto not_found; + } + + if (ngx_http_complex_value(r, conf->variable, &val) != NGX_OK) { + return NGX_ERROR; + } + + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "secure link: \"%V\"", &val); + + last = val.data + val.len; + + p = ngx_strlchr(val.data, last, ','); + expires = 0; + + if (p) { + val.len = p++ - val.data; + + expires = ngx_atotm(p, last - p); + if (expires <= 0) { + goto not_found; + } + + ctx = ngx_pcalloc(r->pool, sizeof(ngx_http_secure_link_ctx_t)); + if (ctx == NULL) { + return NGX_ERROR; + } + + ngx_http_set_ctx(r, ctx, ngx_http_secure_link_module); + + ctx->expires.len = last - p; + ctx->expires.data = p; + } + + evp_md = EVP_get_digestbyname((const char*) conf->hmac_algorithm.data); + if (evp_md == NULL) { + return NGX_ERROR; + } + + hash.len = (u_int) EVP_MD_size(evp_md); + hash.data = hash_buf; + + hash_base64_len = (4*hash.len+2)/3; + if (val.len > hash_base64_len+2) { + goto not_found; + } + + if (ngx_decode_base64url(&hash, &val) != NGX_OK) { + goto not_found; + } + + if (hash.len != (u_int) EVP_MD_size(evp_md)) { + goto not_found; + } + + if (ngx_http_complex_value(r, conf->hmac_message, &val) != NGX_OK) { + return NGX_ERROR; + } + + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "secure link message: \"%V\"", &val); + + if (ngx_http_complex_value(r, conf->hmac_secret, &key) != NGX_OK) { + return NGX_ERROR; + } + + HMAC(evp_md, key.data, key.len, val.data, val.len, hmac_buf, &hmac_len); + + if (ngx_memcmp(hash_buf, hmac_buf, EVP_MD_size(evp_md)) != 0) { + goto not_found; + } + + v->data = (u_char *) ((expires && expires < ngx_time()) ? "0" : "1"); + v->len = 1; + v->valid = 1; + v->no_cacheable = 0; + v->not_found = 0; + + return NGX_OK; + +not_found: + + v->not_found = 1; + + return NGX_OK; +} + static ngx_int_t ngx_http_secure_link_expires_variable(ngx_http_request_t *r, @@ -306,6 +440,9 @@ * conf->variable = NULL; * conf->md5 = NULL; * conf->secret = { 0, NULL }; + * conf->hmac_message = NULL; + * conf->hmac_secret = NULL; + * conf->hmac_algorithm = {0,NULL}; */ return conf; @@ -319,6 +456,7 @@ ngx_http_secure_link_conf_t *conf = child; ngx_conf_merge_str_value(conf->secret, prev->secret, ""); + ngx_conf_merge_str_value(conf->hmac_algorithm, prev->hmac_algorithm, ""); if (conf->variable == NULL) { conf->variable = prev->variable; @@ -328,6 +466,14 @@ conf->md5 = prev->md5; } + if (conf->hmac_message == NULL) { + conf->hmac_message = prev->hmac_message; + } + + if (conf->hmac_message == NULL) { + conf->hmac_message = prev->hmac_secret; + } + return NGX_CONF_OK; } From mdounin at mdounin.ru Sat Apr 28 11:15:55 2012 From: mdounin at mdounin.ru (Maxim Dounin) Date: Sat, 28 Apr 2012 15:15:55 +0400 Subject: [PATCH] Nginx secure link module with HMAC construction In-Reply-To: References: Message-ID: <20120428111554.GZ31671@mdounin.ru> Hello! On Sat, Apr 28, 2012 at 11:48:02AM +0300, Adrian Kotelba wrote: > Hello, > > Attached is the proposed patch to http_secure_link module. With the > patch, the security and functionality of the module is extended. First > of all, the secure token is created using much more secure HMAC > construction with an arbitrary hash algorithm supported by OpenSSL, > e.g., md5, sha1, sha256, sha512. Secure token is created in the The ngx_http_secure_link module must be usable without OpenSSL. Maxim Dounin From adrian.kotelba at barbasyn.org Sat Apr 28 17:52:45 2012 From: adrian.kotelba at barbasyn.org (Adrian Kotelba) Date: Sat, 28 Apr 2012 20:52:45 +0300 Subject: [PATCH] Nginx secure link module with HMAC construction In-Reply-To: <20120428111554.GZ31671@mdounin.ru> References: <20120428111554.GZ31671@mdounin.ru> Message-ID: Hello, Oops. So it must work without OpenSSL. This requirement makes all things more complicated and inflexible. All hashing algorithms of practical importance (sha1, sha256) should be implemented in the module. It is a lot of work :) Well, maybe someone finds the patch useful. 2012/4/28 Maxim Dounin : > Hello! > > On Sat, Apr 28, 2012 at 11:48:02AM +0300, Adrian Kotelba wrote: > >> Hello, >> >> Attached is the proposed patch to http_secure_link module. With the >> patch, the security and functionality of the module is extended. First >> of all, the secure token is created using much more secure HMAC >> construction with an arbitrary hash algorithm supported by OpenSSL, >> e.g., md5, sha1, sha256, sha512. Secure token is created in the > > The ngx_http_secure_link module must be usable without OpenSSL. > > Maxim Dounin > > _______________________________________________ > nginx-devel mailing list > nginx-devel at nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx-devel From agentzh at gmail.com Sun Apr 29 04:43:31 2012 From: agentzh at gmail.com (agentzh) Date: Sun, 29 Apr 2012 12:43:31 +0800 Subject: [ANN] Test::Nginx 0.19 released! In-Reply-To: References: Message-ID: Hi, folks! After almost three months' active development, I just uploaded Test::Nginx 0.19 to CPAN: ? ?http://search.cpan.org/perldoc?Test::Nginx It will appear on the CPAN mirror near you in the next few hours or so. Special thanks go to all of our contributors and users :) Here's the complete change log for this release (compared to the last CPAN release, 0.18): * feature: added new section "--- error_code_like". * bugfix: tests could hang on slow machines after maximal number of connecting attempts (as well as other exceptions). Now we eliminate dying directly from within the test scaffold. Instead, we always use Test::More::BAIL_OUT. Also, we always politely clean up all the forked child processes before we quit. Finally, we add timeout protection to the connect operation. * bugfix: prevented blocking indefinitely on ForkManager's wait_all_children call. also made timeout an API provided by Test::Nginx::Util. feature: now we preserve environment "MOCKEAGAIN" as well. * bugfix: the timestamps for the "--- user_files" directive should be GMT rather than localtime. * feature: now section "no_error_log" also supports multi-line values to mean multiple literal patterns (per line). * feature: the "--- user_files" sections now support absolute file paths and creating arbitrarily nested directories in the file path. thanks @penjin2012 for suggesting it. * feature: the "--- error_log" section now supports multiple lines to mean multiple literal patterns. * bugfix: fixed places that crash for bad responses. * bugfix: fixed another crash when no response object is constructed. This Perl module provides a test scaffold based on IO::Socket (or LWP) for automated testing in Nginx C module development. This class inherits from Test::Base, thus bringing all its declarative power to the Nginx C module testing practices. Please check out the full documentation on CPAN: ? http://search.cpan.org/perldoc?Test::Nginx::Socket All of our Nginx modules (as well as our lua-resty-* libraries) are using Test::Nginx to drive their test suites. Please note that this module is completely different from the Test::Nginx module created by Maxim Dounin. Enjoy! -agentzh From konstantin at symbi.org Sun Apr 29 13:01:50 2012 From: konstantin at symbi.org (Konstantin Baryshnikov) Date: Sun, 29 Apr 2012 17:01:50 +0400 Subject: [PATCH] Nginx secure link module with HMAC construction In-Reply-To: References: <20120428111554.GZ31671@mdounin.ru> Message-ID: <0401A57A-810C-4A94-A24A-5D81FCCF929E@symbi.org> On Apr 28, 2012, at 9:52 PM, Adrian Kotelba wrote: > Oops. So it must work without OpenSSL. This requirement makes all > things more complicated and inflexible. All hashing algorithms of > practical importance (sha1, sha256) should be implemented in the > module. It is a lot of work :) You may consider converting it to a 3rd-party module, and put a link on the wiki . I think many people will find it useful. -------------- next part -------------- An HTML attachment was scrubbed... URL: From ru at nginx.com Sun Apr 29 22:02:19 2012 From: ru at nginx.com (ru at nginx.com) Date: Sun, 29 Apr 2012 22:02:19 +0000 Subject: [nginx] svn commit: r4614 - trunk/src/event Message-ID: <20120429220219.56CA73F9ED9@mail.nginx.com> Author: ru Date: 2012-04-29 22:02:18 +0000 (Sun, 29 Apr 2012) New Revision: 4614 URL: http://trac.nginx.org/nginx/changeset/4614/nginx Log: debug_connection: added the IPv6 and UNIX-domain socket support. Modified: trunk/src/event/ngx_event.c trunk/src/event/ngx_event.h trunk/src/event/ngx_event_accept.c Modified: trunk/src/event/ngx_event.c =================================================================== --- trunk/src/event/ngx_event.c 2012-04-27 10:48:42 UTC (rev 4613) +++ trunk/src/event/ngx_event.c 2012-04-29 22:02:18 UTC (rev 4614) @@ -1064,38 +1064,34 @@ ngx_int_t rc; ngx_str_t *value; - ngx_event_debug_t *dc; struct hostent *h; - ngx_cidr_t cidr; + ngx_cidr_t *cidr; value = cf->args->elts; - dc = ngx_array_push(&ecf->debug_connection); - if (dc == NULL) { + cidr = ngx_array_push(&ecf->debug_connection); + if (cidr == NULL) { return NGX_CONF_ERROR; } - rc = ngx_ptocidr(&value[1], &cidr); +#if (NGX_HAVE_UNIX_DOMAIN) + if (ngx_strcmp(value[1].data, "unix:") == 0) { + cidr->family = AF_UNIX; + return NGX_CONF_OK; + } + +#endif + + rc = ngx_ptocidr(&value[1], cidr); + if (rc == NGX_DONE) { ngx_conf_log_error(NGX_LOG_WARN, cf, 0, "low address bits of %V are meaningless", &value[1]); - rc = NGX_OK; + return NGX_CONF_OK; } if (rc == NGX_OK) { - - /* AF_INET only */ - - if (cidr.family != AF_INET) { - ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, - "\"debug_connection\" supports IPv4 only"); - return NGX_CONF_ERROR; - } - - dc->mask = cidr.u.in.mask; - dc->addr = cidr.u.in.addr; - return NGX_CONF_OK; } @@ -1107,8 +1103,9 @@ return NGX_CONF_ERROR; } - dc->mask = 0xffffffff; - dc->addr = *(in_addr_t *)(h->h_addr_list[0]); + cidr->family = AF_INET; + cidr->u.in.mask = 0xffffffff; + cidr->u.in.addr = *(in_addr_t *)(h->h_addr_list[0]); #else @@ -1142,7 +1139,7 @@ #if (NGX_DEBUG) if (ngx_array_init(&ecf->debug_connection, cycle->pool, 4, - sizeof(ngx_event_debug_t)) == NGX_ERROR) + sizeof(ngx_cidr_t)) == NGX_ERROR) { return NULL; } Modified: trunk/src/event/ngx_event.h =================================================================== --- trunk/src/event/ngx_event.h 2012-04-27 10:48:42 UTC (rev 4613) +++ trunk/src/event/ngx_event.h 2012-04-29 22:02:18 UTC (rev 4614) @@ -222,12 +222,6 @@ typedef struct { - in_addr_t mask; - in_addr_t addr; -} ngx_event_debug_t; - - -typedef struct { ngx_int_t (*add)(ngx_event_t *ev, ngx_int_t event, ngx_uint_t flags); ngx_int_t (*del)(ngx_event_t *ev, ngx_int_t event, ngx_uint_t flags); Modified: trunk/src/event/ngx_event_accept.c =================================================================== --- trunk/src/event/ngx_event_accept.c 2012-04-27 10:48:42 UTC (rev 4613) +++ trunk/src/event/ngx_event_accept.c 2012-04-29 22:02:18 UTC (rev 4614) @@ -252,17 +252,56 @@ #if (NGX_DEBUG) { - in_addr_t i; - ngx_event_debug_t *dc; - struct sockaddr_in *sin; + struct sockaddr_in *sin; + ngx_cidr_t *cidr; + ngx_uint_t i; +#if (NGX_HAVE_INET6) + struct sockaddr_in6 *sin6; + ngx_uint_t n; +#endif - sin = (struct sockaddr_in *) sa; - dc = ecf->debug_connection.elts; + cidr = ecf->debug_connection.elts; for (i = 0; i < ecf->debug_connection.nelts; i++) { - if ((sin->sin_addr.s_addr & dc[i].mask) == dc[i].addr) { - log->log_level = NGX_LOG_DEBUG_CONNECTION|NGX_LOG_DEBUG_ALL; + if (cidr[i].family != c->sockaddr->sa_family) { + goto next; + } + + switch (cidr[i].family) { + +#if (NGX_HAVE_INET6) + case AF_INET6: + sin6 = (struct sockaddr_in6 *) c->sockaddr; + for (n = 0; n < 16; n++) { + if ((sin6->sin6_addr.s6_addr[n] + & cidr[i].u.in6.mask.s6_addr[n]) + != cidr[i].u.in6.addr.s6_addr[n]) + { + goto next; + } + } break; +#endif + +#if (NGX_HAVE_UNIX_DOMAIN) + case AF_UNIX: + break; +#endif + + default: /* AF_INET */ + sin = (struct sockaddr_in *) c->sockaddr; + if ((sin->sin_addr.s_addr & cidr[i].u.in.mask) + != cidr[i].u.in.addr) + { + goto next; + } + break; } + + log->log_level = NGX_LOG_DEBUG_CONNECTION|NGX_LOG_DEBUG_ALL; + break; + + next: + continue; } }