walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity
nghttp2/gennghttpxfun.py

219 lines
5.9 KiB
Python
Raw Normal View History

Require python3 for python scripts
2020-12-29 09:01:31 +01:00
#!/usr/bin/env python3
nghttpx: Refactor option name lookup
2015-07-14 16:21:38 +02:00
from gentokenlookup import gentokenlookup
OPTIONS = [
"private-key-file",
"private-key-passwd-file",
"certificate-file",
"dh-param-file",
"subcert",
"backend",
"frontend",
"workers",
"http2-max-concurrent-streams",
"log-level",
"daemon",
"http2-proxy",
"http2-bridge",
"client-proxy",
"add-x-forwarded-for",
"strip-incoming-x-forwarded-for",
"no-via",
"frontend-http2-read-timeout",
"frontend-read-timeout",
"frontend-write-timeout",
"backend-read-timeout",
"backend-write-timeout",
"stream-read-timeout",
"stream-write-timeout",
"accesslog-file",
"accesslog-syslog",
"accesslog-format",
"errorlog-file",
"errorlog-syslog",
"backend-keep-alive-timeout",
"frontend-http2-window-bits",
"backend-http2-window-bits",
"frontend-http2-connection-window-bits",
"backend-http2-connection-window-bits",
"frontend-no-tls",
"backend-no-tls",
"backend-tls-sni-field",
"pid-file",
"user",
"syslog-facility",
"backlog",
"ciphers",
"client",
"insecure",
"cacert",
"backend-ipv4",
"backend-ipv6",
"backend-http-proxy-uri",
"read-rate",
"read-burst",
"write-rate",
"write-burst",
"worker-read-rate",
"worker-read-burst",
"worker-write-rate",
"worker-write-burst",
"npn-list",
"tls-proto-list",
"verify-client",
"verify-client-cacert",
"client-private-key-file",
"client-cert-file",
"frontend-http2-dump-request-header",
"frontend-http2-dump-response-header",
"http2-no-cookie-crumbling",
"frontend-frame-debug",
"padding",
"altsvc",
"add-request-header",
"add-response-header",
"worker-frontend-connections",
"no-location-rewrite",
"no-host-rewrite",
"backend-http1-connections-per-host",
"backend-http1-connections-per-frontend",
"listener-disable-timeout",
"tls-ticket-key-file",
"rlimit-nofile",
"backend-request-buffer",
"backend-response-buffer",
"no-server-push",
"backend-http2-connections-per-worker",
"fetch-ocsp-response-file",
"ocsp-update-interval",
"no-ocsp",
"include",
nghttpx: Rename --tls-ticket-cipher as --tls-ticket-key-cipher
2015-07-28 16:49:37 +02:00
"tls-ticket-key-cipher",
nghttpx: Don't rewrite host header field by default In reverse proxy usage, backend server most likely wants to see the original header field. So this commit turns off host header rewrite by default. --no-host-rewrite option is deprecated, and if it is used, warning message is displayed. --host-rewrite option is added to enable host rewrite.
2015-07-23 16:54:56 +02:00
"host-rewrite",
nghttpx: Add shared session cache using memcached
2015-07-25 15:22:17 +02:00
"tls-session-cache-memcached",
nghttpx: Add TLS support for session cache memcached connection
2016-02-11 14:56:45 +01:00
"tls-session-cache-memcached-tls",
nghttpx: Add TLS ticket key sharing among nghttpx instances using memcached
2015-07-27 17:54:44 +02:00
"tls-ticket-key-memcached",
nghttpx: Add --tls-ticket-key-memcached-interval option
2015-07-27 18:02:33 +02:00
"tls-ticket-key-memcached-interval",
nghttpx: Add options to set maximum retry and failure when getting ticket keys
2015-07-27 18:17:29 +02:00
"tls-ticket-key-memcached-max-retry",
"tls-ticket-key-memcached-max-fail",
nghttpx: Change mruby script handling This commit changes nghttpx's mruby script handling. Previously we have 2 options to specify the mruby script file to be run on request and on response. Now they are merged into 1 option, namely --mruby-file. It now must return object. On request, the object's on_req(env) method is invoked with env object. Similarly, on response, the object's on_resp(env) method is invoked. The specification of Env object has not changed.
2015-10-05 17:10:42 +02:00
"mruby-file",
nghttpx: Implement PROXY protocol version 1 Use --accept-proxy-protocol to enable PROXY protocol handling
2015-09-06 11:39:32 +02:00
"accept-proxy-protocol",
nghttpx: Refactor option name lookup
2015-07-14 16:21:38 +02:00
"conf",
Added support for RFC 7413 (TCP Fast Open) on nghttpx proxy listening connections. Fixed code as per PR comments
2015-10-03 00:32:58 +02:00
"fastopen",
Add TLS dynamic record size behaviour command line options
2015-10-21 12:22:46 +02:00
"tls-dyn-rec-warmup-threshold",
nghttpx: Add RFC 7239 Forwarded header field support
2016-01-15 15:04:58 +01:00
"tls-dyn-rec-idle-timeout",
"add-forwarded",
"strip-incoming-forwarded",
"forwarded-by",
nghttpx: Limit header fields from backend
2016-02-06 04:25:34 +01:00
"forwarded-for",
"response-header-field-buffer",
nghttpx: Add --no-http2-cipher-black-list to allow black listed cipher suite
2016-02-06 09:05:14 +01:00
"max-response-header-fields",
nghttpx: Add request-header-field-buffer and max-request-header-fields options This commit adds request-header-field-buffer and max-request-header-fields, and deprecates header-field-buffer and max-header-fields options.
2016-02-06 09:22:23 +01:00
"request-header-field-buffer",
"max-request-header-fields",
"header-field-buffer",
"max-header-fields",
Replace black-list with block-list nghttpx --no-http2-cipher-black-list and --client-no-http2-cipher-black-list are deprecated and replaced with --no-http2-cipher-block-list and --client-no-http2-cipher-block-list respectively.
2021-04-02 15:31:15 +02:00
"no-http2-cipher-block-list",
nghttpx: Add TLS support for HTTP/1 backend
2016-02-06 11:50:21 +01:00
"no-http2-cipher-black-list",
nghttpx: Add option to specify maximum number of session cache
2016-02-06 16:16:14 +01:00
"backend-http1-tls",
nghttpx: Add client auth options for session cache memcached TLS connection
2016-02-12 16:20:38 +01:00
"tls-session-cache-memcached-cert-file",
nghttpx: Add encryption support for TLS ticket key retrieval
2016-02-13 10:17:11 +01:00
"tls-session-cache-memcached-private-key-file",
nghttpx: Add options to specify address family of memcached connections
2016-02-13 10:45:23 +01:00
"tls-session-cache-memcached-address-family",
nghttpx: Add encryption support for TLS ticket key retrieval
2016-02-13 10:17:11 +01:00
"tls-ticket-key-memcached-tls",
"tls-ticket-key-memcached-cert-file",
nghttpx: Add options to specify address family of memcached connections
2016-02-13 10:45:23 +01:00
"tls-ticket-key-memcached-private-key-file",
"tls-ticket-key-memcached-address-family",
nghttpx: Deprecate --http2-max-concurrent-streams option We added 2 new option instead: --frontend-http2-max-concurrent-streams and --backend-http2-max-concurrent-streams.
2016-02-27 16:06:40 +01:00
"backend-address-family",
"frontend-http2-max-concurrent-streams",
nghttpx: Deprecate backend-http1-connections-per-frontend in favor of backend-connections-per-frontend
2016-02-28 09:11:12 +01:00
"backend-http2-max-concurrent-streams",
nghttpx: Restructure mode settings It is very hard to support multiple protocols in backend while retaining multiple mode settings. Therefore, we dropped modes except for default and HTTP/2 proxy mode. The other removed modes can be emulated using combinations of options. Now the backend connection is not encrypted by default. To enable encryption on backend connection, use --backend-tls option.
2016-02-28 13:35:26 +01:00
"backend-connections-per-frontend",
nghttpx: Deprecate backend-http1-connections-per-host in favor of backend-connections-per-host
2016-02-28 14:15:49 +01:00
"backend-tls",
nghttpx: Add custom error pages
2016-03-19 15:41:21 +01:00
"backend-connections-per-host",
"error-page",
nghttpx: Enable kqueue by default We enabled libev kqueue backend in nghttpx by default. Since it might not work on some platforms, we also added --no-kqueue option to disable it.
2016-05-06 16:10:09 +02:00
"no-kqueue",
nghttpx: Make SETTINGS timeout value configurable SETTINGS timeout can be configurable using --frontend-http2-settings-timeout and --backend-http2-settings-timeout.
2016-05-21 07:13:57 +02:00
"frontend-http2-settings-timeout",
"backend-http2-settings-timeout",
nghttpx: Add --api-max-request-body option to set maximum API request body size
2016-06-04 10:24:54 +02:00
"api-max-request-body",
nghttpx: Add --backend-max-backoff option
2016-06-21 17:13:43 +02:00
"backend-max-backoff",
nghttpx: Add --server-name option to change server response header field
2016-08-26 15:28:09 +02:00
"server-name",
nghttpx: Add --no-server-rewrite option not to rewrite server header field
2016-08-31 16:47:15 +02:00
"no-server-rewrite",
nghttpx: Add experimental TCP optimization for h2 frontend
2016-09-08 15:49:36 +02:00
"frontend-http2-optimize-write-buffer-size",
"frontend-http2-optimize-window-size",
nghttpx: Add --frontend-http2-window-size option, and its family We added --frontend-http2-window-size, --frontend-http2-connection-window-size, --backend-http2-window-size, and --backend-http2-connection-window-size option to replace existing *-bits options. The old options are not flexible because they only specify number of bits. Now we can specify integer value, with possible g, m, and k unit. The old options are still available for backend compatibility, but are deprecated.
2016-09-09 14:05:37 +02:00
"frontend-http2-window-size",
"frontend-http2-connection-window-size",
"backend-http2-window-size",
"backend-http2-connection-window-size",
nghttpx: Add option to specify HPACK encoder/decoder dynamic table size
2016-09-12 15:53:02 +02:00
"frontend-http2-encoder-dynamic-table-size",
"frontend-http2-decoder-dynamic-table-size",
"backend-http2-encoder-dynamic-table-size",
"backend-http2-decoder-dynamic-table-size",
nghttpx: Add --ecdh-curves option to specify list of named curves This option requires OpenSSL >= 1.0.2. With OpenSSL 1.0.2, the default value is "P-256". With OpenSSL 1.1.0 or later, the default value is "X25519:P-256".
2016-10-08 03:50:28 +02:00
"ecdh-curves",
nghttpx: Add TLS signed_certificate_timestamp extension support
2016-10-08 12:03:21 +02:00
"tls-sct-dir",
nghttpx: Add --backend-connect-timeout option
2016-10-10 15:50:41 +02:00
"backend-connect-timeout",
nghttpx: Add dns-cache-timeout option This option controls how long cached DNS entries remain valid.
2016-12-10 09:48:28 +01:00
"dns-cache-timeout",
nghttpx: Add --dns-lookup-timeout and --dns-max-try options
2016-12-10 16:50:16 +01:00
"dns-lookup-timeout",
"dns-max-try",
nghttpx: Add frontend-keep-alive-timeout option
2016-12-23 03:01:29 +01:00
"frontend-keep-alive-timeout",
nghttpx: Add --psk-secret option to enable PSK in frontend connection
2017-01-07 15:42:51 +01:00
"psk-secrets",
nghttpx: Add --client-psk-secret option to enable PSK in backend
2017-01-07 16:24:33 +01:00
"client-psk-secrets",
Replace black-list with block-list nghttpx --no-http2-cipher-black-list and --client-no-http2-cipher-black-list are deprecated and replaced with --no-http2-cipher-block-list and --client-no-http2-cipher-block-list respectively.
2021-04-02 15:31:15 +02:00
"client-no-http2-cipher-block-list",
nghttpx: Add client-no-http2-cipher-black-list option This commit adds client-no-http2-cipher-black-list option to disable enforcement of HTTP/2 cipher black list on backend HTTP/2 connection. Previously, existing no-http2-cipher-black-list option disables it for both frontend and backend connections. Now no-http2-cipher-black-list option only disables it for frontend connection.
2017-01-08 14:33:19 +01:00
"client-no-http2-cipher-black-list",
nghttpx: Add client-ciphers option Previously, ciphers option sets cipher list for both frontend and backend TLS connections. With this commit, ciphers option only sets cipher list for frontend connections. The new client-ciphers option sets cipher list for backend connection.
2017-01-08 14:40:58 +01:00
"client-ciphers",
nghttpx: Add --accesslog-write-early option --accesslog-write-early option is analogous to HAProxy's logasap. If used, nghttpx writes access log when response header fields are received from backend rather than when request transaction finishes.
2017-01-11 11:27:08 +01:00
"accesslog-write-early",
nghttpx: Specify TLS protocol by version range This commit deprecates --tls-proto-list option, and adds 2 new options: --tls-min-proto-version and --tls-max-proto-version to specify minimum and maximum protocol version respectively. Versions between the two are enabled. The deprecated --tls-proto-list has empty default value, and acts like enabling only specific protocol versions in the range for now.
2017-02-13 15:34:45 +01:00
"tls-min-proto-version",
"tls-max-proto-version",
nghttpx: Redirect to HTTPS URI with redirect-if-not-tls param This commit removes frontend-tls parameter, and adds redirect-if-not-tls parameter parameter to --backend option. nghttpx now responds to the request with 308 status code to redirect the request to https URI if frontend connection is not TLS encrypted, and redirect-if-no-tls parameter is used in --backend option. The port number in Location header field is 443 by default (thus omitted), but it can be configurable using --redirect-https-port option.
2017-02-18 10:23:06 +01:00
"redirect-https-port",
nghttpx: Add --frontend-max-requests option
2017-02-20 15:36:50 +01:00
"frontend-max-requests",
nghttpx: Add --single-worker option Previously, nghttpx will use only one single thread inside the worker process if --workers=1 (this is default). If --workers=N, N > 1, we use additional threads for accepting connections, or API request processing, etc. With this commit, we use the same processing model for N > 1 even if N == 1. To restore the original single thread execution mode, --single-worker option is added. If threading is disabled --single-worker is always true.
2017-02-21 14:19:34 +01:00
"single-thread",
nghttpx: Add --single-process option With --single-process option, nghttpx will run in a single process mode where master and worker are unified into one process. nghttpx still spawns additional process for neverbleed. In the single process mode, signal handling is disabled.
2017-04-06 12:53:39 +02:00
"single-process",
nghttpx: Add options for X-Forwarded-Proto header field This commit adds 2 new options to handle X-Forwarded-Proto header field. The --no-add-x-forwarded-proto option makes nghttpx not to append X-Forwarded-Proto value. The --no-strip-incoming-x-forwarded-proto option prevents nghttpx from stripping the header field from client. Previously, nghttpx always strips incoming header field, and set its own header field. This commit preserves this behaviour, and adds additional knobs.
2017-04-05 15:50:18 +02:00
"no-add-x-forwarded-proto",
"no-strip-incoming-x-forwarded-proto",
nghttpx: Run OCSP at startup With --ocsp-startup option, nghttpx starts accepting connections after initial attempts to get OCSP responses finish. It does not matter some of the attempts fail. This feature is useful if OCSP responses must be available before accepting connections.
2017-05-18 14:11:10 +02:00
"ocsp-startup",
nghttpx: Add --no-verify-ocsp to disable OCSP response verification
2017-05-25 15:12:54 +02:00
"no-verify-ocsp",
nghttpx: Add an option to accept expired client certificate
2018-02-08 08:51:23 +01:00
"verify-client-tolerate-expired",
nghttpx: Per-pattern not per-backend
2018-08-28 10:50:01 +02:00
"ignore-per-pattern-mruby-error",
nghttpx: Should postpone early data by default
2018-09-08 12:22:30 +02:00
"tls-no-postpone-early-data",
Specify SSL_CTX_set_max_early_data and add an option to change max value
2018-05-20 15:54:59 +02:00
"tls-max-early-data",
nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
2018-09-09 09:32:34 +02:00
"tls13-ciphers",
"tls13-client-ciphers",
nghttpx: Strip incoming Early-Data header field by default
2018-09-09 15:37:22 +02:00
"no-strip-incoming-early-data",
nghttpx: Refactor option name lookup
2015-07-14 16:21:38 +02:00
]
LOGVARS = [
"remote_addr",
"time_local",
"time_iso8601",
"request",
"status",
"body_bytes_sent",
"remote_port",
"server_port",
"request_time",
"pid",
"alpn",
"ssl_cipher",
"ssl_protocol",
"ssl_session_id",
"ssl_session_reused",
nghttpx: Rename ssl_* log variables as tls_* The exiting ssl_* log variables still work for backward compatibility.
2017-04-18 14:39:33 +02:00
"tls_cipher",
"tls_protocol",
"tls_session_id",
"tls_session_reused",
nghttpx: Add $tls_sni access log variable
2017-04-18 15:44:26 +02:00
"tls_sni",
nghttpx: Add tls_client_fingerprint_sha1 to mruby and accesslog Also tls_client_fingerprint is renamed to tls_client_fingerprint_sha256.
2017-10-31 13:41:40 +01:00
"tls_client_fingerprint_sha256",
"tls_client_fingerprint_sha1",
nghttpx: Add client fingerprint and subject name to accesslog
2017-10-29 13:44:51 +01:00
"tls_client_subject_name",
Add tls_client_issuer_name log variable and expose it to mruby
2017-11-15 15:41:47 +01:00
"tls_client_issuer_name",
nghttpx: Add $tls_client_serial log variable
2017-11-16 13:40:33 +01:00
"tls_client_serial",
nghttpx: Add access log variable for backend host and port Use $backend_host and $backend_port. $backend_host is backend host name given in --backend option. It could be a path to UNIX domain socket.
2016-08-04 17:04:47 +02:00
"backend_host",
"backend_port",
nghttpx: Add accesslog variables to record request path without query This commit the following variables to construct request line without including query component: * $method * $path * $path_without_query * $protocol_version
2020-09-19 16:58:37 +02:00
"method",
"path",
"path_without_query",
"protocol_version",
nghttpx: Refactor option name lookup
2015-07-14 16:21:38 +02:00
]
if __name__ == '__main__':
nghttpx: Convert LogFragmentType to enum class
2018-10-17 04:21:06 +02:00
gentokenlookup(OPTIONS, 'SHRPX_OPTID_', value_type='char', comp_fun='util::strieq_l')
gentokenlookup(LOGVARS, 'LogFragmentType::', value_type='char', comp_fun='util::strieq_l', return_type='LogFragmentType', fail_value='LogFragmentType::NONE')