Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
Can’t automatically merge.
Don’t worry, you can still create the pull request.
1
contributor
Commits on Apr 26, 2012
Commits on Jun 4, 2012
-
-
Merge of r4611, r4620: resolver fixes.
*) Fixed segmentation fault in ngx_resolver_create_name_query(). If name passed for resolution was { 0, NULL } (e.g. as a result of name server returning CNAME pointing to ".") pointer wrapped to (void *) -1 resulting in segmentation fault on an attempt to dereference it. Reported by Lanshun Zhou. *) Resolver: protection from duplicate responses. If we already had CNAME in resolver node (i.e. rn->cnlen and rn->u.cname set), and got additional response with A record, it resulted in rn->cnlen set and rn->u.cname overwritten by rn->u.addr (or rn->u.addrs), causing segmentation fault later in ngx_resolver_free_node() on an attempt to free overwritten rn->u.cname. The opposite (i.e. CNAME got after A) might cause similar problems as well. -
-
Merge of r4615: write handler reset in ngx_http_named_location().
On internal redirects this happens via ngx_http_handler() call, which is not called on named location redirect. As a result incorrect write handler remained (if previously set) and this might cause incorrect behaviour (likely request hang). Patch by Yichun Zhang (agentzh).
-
Added r->state reset on fastcgi/scgi/uwsgi request start. Failing to do so results in problems if 400 or 414 requests are redirected to fastcgi/scgi/uwsgi upstream, as well as after invalid headers got from upstream. This was already fixed for proxy in r3478, but fastcgi (the only affected protocol at that time) was missed. Reported by Matthieu Tourne.
-
Merge of r4617: fastcgi padding fix.
Fastcgi: fixed padding handling on fixed-size records. Padding was incorrectly ignored on end request, empty stdout and stderr fastcgi records. This resulted in protocol desynchronization if fastcgi application used these records with padding for some reason. Reported by Ilia Vinokurov.
-
Merge of r4618: rewrite escaping fix (ticket #162).
The following code resulted in incorrect escaping of uri and possible segfault: location / { rewrite ^(.*) $1?c=$1; return 200 "$uri"; } If there were arguments in a rewrite's replacement string, and length was actually calculated (due to duplicate captures as in the example above, or variables present), the is_args flag was set and incorrectly copied after length calculation. This resulted in escaping applied to the uri part of the replacement, resulting in incorrect escaping. Additionally, buffer was allocated without escaping expected, thus this also resulted in buffer overrun and possible segfault. -
Merge of r4619: accept moderation on EMFILE/ENFILE.
In case of EMFILE/ENFILE returned from accept() we disable accept events, and (in case of no accept mutex used) arm timer to re-enable them later. With accept mutex we just drop it, and rely on normal accept mutex handling to re-enable accept events once it's acquired again. As we now handle errors in question, logging level was changed to "crit" (instead of "alert" used for unknown errors). Note: the code might call ngx_enable_accept_events() multiple times if there are many listen sockets. The ngx_enable_accept_events() function was modified to check if connection is already active (via c->read->active) and skip it then, thus making multiple calls safe.
-
Merge of r4621, r4641: filter_finalize fixes.
*) Fixed possible request hang with filter finalization. With r->filter_finalize set the ngx_http_finalize_connection() wasn't called from ngx_http_finalize_request() called with NGX_OK, resulting in r->main->count not being decremented, thus causing request hang in some rare situations. Patch by Yichun Zhang (agentzh). *) Fixed segfault with filter_finalize introduced in r4621 (1.3.0). See the following thread for more details: http://mailman.nginx.org/pipermail/nginx-devel/2012-May/002190.html
-
Merge of r4622, r4623: balancing changes.
*) Upstream: smooth weighted round-robin balancing. For edge case weights like { 5, 1, 1 } we now produce { a, a, b, a, c, a, a } sequence instead of { c, b, a, a, a, a, a } produced previously. Algorithm is as follows: on each peer selection we increase current_weight of each eligible peer by its weight, select peer with greatest current_weight and reduce its current_weight by total number of weight points distributed among peers. In case of { 5, 1, 1 } weights this gives the following sequence of current_weight's: a b c 0 0 0 (initial state) 5 1 1 (a selected) -2 1 1 3 2 2 (a selected) -4 2 2 1 3 3 (b selected) 1 -4 3 6 -3 4 (a selected) -1 -3 4 4 -2 5 (c selected) 4 -2 -2 9 -1 -1 (a selected) 2 -1 -1 7 0 0 (a selected) 0 0 0 To preserve weight reduction in case of failures the effective_weight variable was introduced, which usually matches peer's weight, but is reduced temporarily on peer failures. This change also fixes loop with backup servers and proxy_next_upstream http_404 (ticket #47), and skipping alive upstreams in some cases if there are multiple dead ones (ticket #64). *) Upstream: fixed ip_hash rebalancing with the "down" flag. Due to weight being set to 0 for down peers, order of peers after sorting wasn't the same as without the "down" flag (with down peers at the end), resulting in client rebalancing for clients on other servers. The only rebalancing which should happen after adding "down" to a server is one for clients on the server. The problem was introduced in r1377 (which fixed endless loop by setting weight to 0 for down servers). The loop is no longer possible with new smooth algorithm, so preserving original weight is safe. -
Merge of r4614, r4624-r4629, r4631: proxy recursive changes.
*) Added IPv6 and UNIX-domain socket support in "debug_connection" directive. *) New function ngx_http_get_forwarded_addr() to look up real client address. On input it takes an original address, string in the X-Forwarded-For format and its length, list of trusted proxies, and a flag indicating to perform the recursive search. On output it returns NGX_OK and the "deepest" valid address in a chain, or NGX_DECLINED. It supports AF_INET and AF_INET6. Additionally, original address and/or proxy may be specified as AF_UNIX. *) Realip: chains of trusted proxies and IPv6 support. The module now supports recursive search of client address through the chain of trusted proxies, controlled by the "real_ip_recursive" directive (closes #2). It also gets full IPv6 support (closes #44) and canonical value of the $client_addr variable on address change. Example: real_ip_header X-Forwarded-For; set_real_ip_from 127.0.0.0/8; set_real_ip_from ::1; set_real_ip_from unix:; real_ip_recursive on; *) Geo: chains of trusted proxies and partial IPv6 support. The module now supports recursive search of client address through the chain of trusted proxies, controlled by the "proxy_recursive" directive in the "geo" block. It also gets partial IPv6 support: now proxies may be specified with IPv6 addresses. Example: geo $test { ... proxy 127.0.0.1; proxy ::1; proxy_recursive; } There's also a slight change in behavior. When original client address (as specified by the "geo" directive) is one of the trusted proxies, and the value of the X-Forwarded-For request header cannot not be parsed as a valid address, an original client address will be used for lookup. Previously, 255.255.255.255 was used in this case. *) Geoip: trusted proxies support and partial IPv6 support. The module now supports recursive search of client address through the chain of trusted proxies (closes #100), in the same scope as the geo module. Proxies are listed by the "geoip_proxy" directive, recursive search is enabled by the "geoip_proxy_recursive" directive. IPv6 is partially supported: proxies may be specified with IPv6 addresses. Example: geoip_country .../GeoIP.dat; geoip_proxy 127.0.0.1; geoip_proxy ::1; geoip_proxy 10.0.0.0/8; geoip_proxy_recursive on;
-
Merge of r4630: fixed c->sent with unbuffered ssl.
Update c->sent in ngx_ssl_send_chain() even if SSL buffer is not used.
Commits on Jun 5, 2012
-
-
Merge of r4674, r4675, r4676: win32 fixes.
*) Win32: disallowed access to various non-canonical name variants. This includes trailings dots and spaces, NTFS streams (and short names, as previously checked). The checks are now also done in ngx_file_info(), thus allowing to use the "try_files" directive to protect external scripts. *) Win32: normalization of trailing dot inside uri. Windows treats "/directory./" identical to "/directory/". Do the same when working on Windows. Note that the behaviour is different from one with last path component (where multiple spaces and dots are ignored by Windows). *) Win32: uris with ":$" are now rejected. There are too many problems with special NTFS streams, notably "::$data", "::$index_allocation" and ":$i30:$index_allocation". For now we don't reject all URIs with ":" like Apache does as there are no good reasons seen yet, and there are multiple programs using it in URLs (e.g. MediaWiki).
-
Commits on Jun 25, 2012
Commits on Jun 26, 2012
Commits on Jun 29, 2012
-
Merge of r4636, r4637, r4638: config sanity checks.
*) Added syntax checking of the second parameter of the "split_clients" directive. *) Capped the status code that may be returned with "return" and "try_files". *) Zero padded the returned and logged HTTP status code, and fixed possible buffer overrun in $status handling.
-
Merge of r4639, r4640: C++ fixes.
Fixed the ngx_regex.h header file compatibility with C++. Fixed building --with-cpp_test_module on some systems.
Commits on Jul 2, 2012
-
Fixed core variables dynamic access after reconfiguration. If variable was indexed in previous configuration but not in current one, the NGX_HTTP_VAR_INDEXED flag was left set and confused ngx_http_get_variable(). Patch by Yichun Zhang (agentzh), slightly modified.
-
Removed historical and now redundant syntax pre-checks in ngx_parse_url().
-
Fixed potential null pointer dereference in ngx_resolver_create(). While here, improved error message.
-
Merge of r4646: jemalloc 3.0.0 compatibility.
Fixed compilation with -DNGX_DEBUG_MALLOC on FreeBSD 10. After jemalloc 3.0.0 import there is no _malloc_options symbol, it has been replaced with the malloc_conf one with a different syntax.
-
Fixed the reuse of parsed DTDs and XSLTs. Patch by Kuramoto Eiji.
-
Merge of r4648, r4649, r4650: memory leak with $geoip_org.
Patch by Denis F. Latypoff (slightly modified).
-
Merge of r4651: proxy_cookie_* fix.
Fixed returned value handling from the cookie rewrite handler. If the "proxy_cookie_domain" or "proxy_cookie_path" directive is used and there are no matches in Set-Cookie header then ngx_http_proxy_rewrite_cookie() returns NGX_DECLINED to indicate that the header was not rewritten. Returning this value further from the upstream headers copy handler resulted in 500 error response. See here for report: http://mailman.nginx.org/pipermail/nginx/2012-May/033858.html
-
Merge of r4652: ssl without buffer should not set c->buffered.
Removed mistaken setting of NGX_SSL_BUFFERED flag in ngx_ssl_send_chain() if SSL buffer is not used.
-
Merge of r4653: ngx_inet.c code reduction.
Code reduction (no functional changes).
-
Merge of r4654, r4672, r4684, r4685, r4692: resolver changes.
*) Resolver: fixed format specification. Patch by Yichun Zhang (agentzh). *) Support for IPv6 literals and an optional port in resolver. *) Fixed crash in ngx_resolver_cleanup_tree(). If sending a DNS request fails with an error (e.g., when mistakenly trying to send it to a local IP broadcast), such a request is not deleted if there are clients waiting on it. However, it was still erroneously removed from the queue. Later ngx_resolver_cleanup_tree() attempted to remove it from the queue again that resulted in a NULL pointer dereference. *) When "resolver" is configured with a domain name, only the first resolved address was used. Now all addresses will be used. *) Fixed segfault with poll and resolver used. Poll event method needs ngx_cycle->files to work, and use of ngx_exit_cycle without files set caused null pointer dereference in resolver's cleanup on udp socket close.
-
Merge of r4655, r4656, r4657, r4695, r4696: upstream changes.
*) Upstream: least_conn balancer module. *) Upstream: weights and IPv6 support in ip_hash balancer. *) Upstream keepalive: "single" parameter deprecated.
-
Merge of r4682, r4694, r4699, r4704, r4705: minor nits.
*) Fixed spelling of "endianness", and called it "byte ordering" in the user visible part. *) Fixed return type of ngx_strerror_init(). *) Fixed a harmless error in spelling of "Connection: close" when computing the response header length. *) Style. *) Added code to look up Google perftools in /opt/local/, for MacPorts.
-
Merge of r4686, r4687: $status variable.
Contains response status code as a 3-digit integer (with leading zeroes if necessary), or one of the following values: 000 - response status code has not yet been assigned 009 - HTTP/0.9 request is being processed -
*) Mp4: fixed non-keyframe seeks in some cases (ticket #175). Number of entries in stsc atom was wrong if we've added an entry to split a chunk. Additionally, there is no need to add an entry if we are going to split last chunk in an entry, it's enough to update the entry we already have. Previously new entry was added and old one was left as is, resulting in incorrect entry with zero chunks which might confuse some software. *) Mp4: fixed streaming if moov atom is at buffer edge.
-
Merge of r4690: conflicting wildcard server names fix.
With previous code wildcard names were added to hash even if conflict was detected. This resulted in identical names in hash and segfault later in ngx_hash_wildcard_init().
-
Merge of r4691: changed default alignment to 16.
This fixes alignment problems observerd on ARMs, and likely also needed for MIPSes. Unless we know alignment is not required just assume we need 16, which appears to be safe default for all architectures. See here for details: http://mailman.nginx.org/pipermail/nginx/2012-June/034139.html
-
Merge of r4693: fixed "sendmsg() failed" alerts on HP-UX.
HP-UX needs _HPUX_ALT_XOPEN_SOCKET_API to be defined to be able to use various POSIX versions of networking functions. Notably sendmsg() resulted in "sendmsg() failed (9: Bad file number)" alerts without it. See xopen_networking(7) for more details.
-
Merge of r4697: disabled gzip in OpenSSL prior to 1.0.0.
Disabled gzip compression in OpenSSL prior to 1.0.0 version. This saves about 522K per connection.
-
Merge of r4698: X-Forwarded-For conditionals.
Fixed compile-time conditionals used to detect if X-Forwarded-For support is needed. Note: compatibility shims were added during merge to avoid possible breakage of 3rd party modules. At least cache purge module was broken by the original commit, as it used to rely on NGX_HTTP_PROXY define.
Commits on Jul 3, 2012
Commits on Aug 6, 2012
-
Merge of r4713: map hostnames fix (ticket #182).
The final dot wasn't stripped before looking up in a map of hostnames.
-
-
Merge of r4737: r->uri_changed in a named location fix.
Reset r->uri_changed in a named location (ticket #184).
-
Merge of r4738: struct flock initialization.
Made sure to initialize the entire "struct flock" allocated on stack.
There are no files selected for viewing