Commit Graph

110 Commits

Author SHA1 Message Date
Tatsuhiro Tsujikawa a7c780a732 nghttpx: Redirect to HTTPS URI with redirect-if-not-tls param
This commit removes frontend-tls parameter, and adds
redirect-if-not-tls parameter parameter to --backend option.  nghttpx
now responds to the request with 308 status code to redirect the
request to https URI if frontend connection is not TLS encrypted, and
redirect-if-no-tls parameter is used in --backend option.  The port
number in Location header field is 443 by default (thus omitted), but
it can be configurable using --redirect-https-port option.
2017-02-18 22:32:27 +09:00
Tatsuhiro Tsujikawa b36e53cccd nghttpx: Specify TLS protocol by version range
This commit deprecates --tls-proto-list option, and adds 2 new
options: --tls-min-proto-version and --tls-max-proto-version to
specify minimum and maximum protocol version respectively.  Versions
between the two are enabled.  The deprecated --tls-proto-list has
empty default value, and acts like enabling only specific protocol
versions in the range for now.
2017-02-14 00:01:09 +09:00
Tatsuhiro Tsujikawa 685e926494 nghttpx: Add --accesslog-write-early option
--accesslog-write-early option is analogous to HAProxy's logasap.  If
used, nghttpx writes access log when response header fields are
received from backend rather than when request transaction finishes.
2017-01-13 22:12:21 +09:00
Tatsuhiro Tsujikawa 9c7e54d9b5 nghttpx: Add client-ciphers option
Previously, ciphers option sets cipher list for both frontend and
backend TLS connections.  With this commit, ciphers option only sets
cipher list for frontend connections.  The new client-ciphers option
sets cipher list for backend connection.
2017-01-08 22:40:58 +09:00
Tatsuhiro Tsujikawa 3c03024881 nghttpx: Add client-no-http2-cipher-black-list option
This commit adds client-no-http2-cipher-black-list option to disable
enforcement of HTTP/2 cipher black list on backend HTTP/2 connection.
Previously, existing no-http2-cipher-black-list option disables it for
both frontend and backend connections.  Now no-http2-cipher-black-list
option only disables it for frontend connection.
2017-01-08 22:33:19 +09:00
Tatsuhiro Tsujikawa 79a24f5dd9 nghttpx: Add --client-psk-secret option to enable PSK in backend 2017-01-08 00:35:55 +09:00
Tatsuhiro Tsujikawa 83c759572c nghttpx: Add --psk-secret option to enable PSK in frontend connection 2017-01-08 00:35:54 +09:00
Tatsuhiro Tsujikawa 3c600c103f nghttpx: Add frontend-keep-alive-timeout option 2016-12-23 11:01:29 +09:00
Tatsuhiro Tsujikawa a06a8c36a4 nghttpx: Add --dns-lookup-timeout and --dns-max-try options 2016-12-11 00:50:16 +09:00
Tatsuhiro Tsujikawa d66377d4b6 nghttpx: Add dns-cache-timeout option
This option controls how long cached DNS entries remain valid.
2016-12-10 21:09:51 +09:00
Tatsuhiro Tsujikawa 00a8c378d4 nghttpx: Add --backend-connect-timeout option 2016-10-10 22:50:41 +09:00
Tatsuhiro Tsujikawa 412c8f9e67 nghttpx: Add TLS signed_certificate_timestamp extension support 2016-10-09 18:43:36 +09:00
Tatsuhiro Tsujikawa 8babaac8c3 nghttpx: Add --ecdh-curves option to specify list of named curves
This option requires OpenSSL >= 1.0.2.  With OpenSSL 1.0.2, the
default value is "P-256".  With OpenSSL 1.1.0 or later, the default
value is "X25519:P-256".
2016-10-08 10:50:56 +09:00
Tatsuhiro Tsujikawa f4016644a9 nghttpx: Add option to specify HPACK encoder/decoder dynamic table size 2016-09-12 22:53:02 +09:00
Tatsuhiro Tsujikawa f5a2f1da25 nghttpx: Add --frontend-http2-window-size option, and its family
We added --frontend-http2-window-size,
--frontend-http2-connection-window-size, --backend-http2-window-size,
and --backend-http2-connection-window-size option to replace existing
*-bits options.  The old options are not flexible because they only
specify number of bits.  Now we can specify integer value, with
possible g, m, and k unit.  The old options are still available for
backend compatibility, but are deprecated.
2016-09-10 16:27:48 +09:00
Tatsuhiro Tsujikawa 27b250ac8e nghttpx: Add experimental TCP optimization for h2 frontend 2016-09-10 16:27:48 +09:00
Tatsuhiro Tsujikawa 136aae725f nghttpx: Add --no-server-rewrite option not to rewrite server header field 2016-08-31 23:47:15 +09:00
Tatsuhiro Tsujikawa 0d4d1a63d4 nghttpx: Add --server-name option to change server response header field 2016-08-26 22:28:09 +09:00
Tatsuhiro Tsujikawa ad3d43b8be nghttpx: Add access log variable for backend host and port
Use $backend_host and $backend_port.  $backend_host is backend host
name given in --backend option.  It could be a path to UNIX domain
socket.
2016-08-05 00:04:47 +09:00
Tatsuhiro Tsujikawa aa16412850 nghttpx: Add --backend-max-backoff option 2016-06-22 00:13:43 +09:00
Tatsuhiro Tsujikawa 8288f5713b nghttpx: Add --api-max-request-body option to set maximum API request body size 2016-06-04 17:24:54 +09:00
Tatsuhiro Tsujikawa 0fca352114 nghttpx: Make SETTINGS timeout value configurable
SETTINGS timeout can be configurable using
--frontend-http2-settings-timeout and
--backend-http2-settings-timeout.
2016-05-21 14:13:57 +09:00
Tatsuhiro Tsujikawa d39335829d nghttpx: Enable kqueue by default
We enabled libev kqueue backend in nghttpx by default.  Since it might
not work on some platforms, we also added --no-kqueue option to
disable it.
2016-05-06 23:10:09 +09:00
Tatsuhiro Tsujikawa 9e64d10223 nghttpx: Move fall/rise configuration to --backend option
This commit removes --backend-fall and --backend-rise options.  The
these configurations are now set as fall and rise parameters in
--backend option.
2016-04-09 21:58:08 +09:00
Tatsuhiro Tsujikawa 7bc35044c7 nghttpx: Add --backend-fall and --backend-rise options
These options are analogous to fall and rise parameter found in
haproxy.
2016-04-08 23:07:17 +09:00
Tatsuhiro Tsujikawa d7051f5207 nghttpx: Add custom error pages 2016-03-19 23:41:21 +09:00
Tatsuhiro Tsujikawa 2326337d32 nghttpx: Deprecate backend-http1-connections-per-host in favor of backend-connections-per-host 2016-02-28 22:15:49 +09:00
Tatsuhiro Tsujikawa 06921f35f3 nghttpx: Restructure mode settings
It is very hard to support multiple protocols in backend while
retaining multiple mode settings.  Therefore, we dropped modes except
for default and HTTP/2 proxy mode.  The other removed modes can be
emulated using combinations of options.  Now the backend connection is
not encrypted by default.  To enable encryption on backend connection,
use --backend-tls option.
2016-02-28 21:35:26 +09:00
Tatsuhiro Tsujikawa 44d3801760 nghttpx: Deprecate backend-http1-connections-per-frontend in favor of backend-connections-per-frontend 2016-02-28 17:11:12 +09:00
Tatsuhiro Tsujikawa aafcc55006 nghttpx: Deprecate --http2-max-concurrent-streams option
We added 2 new option instead: --frontend-http2-max-concurrent-streams
and --backend-http2-max-concurrent-streams.
2016-02-28 00:19:18 +09:00
Tatsuhiro Tsujikawa c098b4ac70 nghttpx: Remove --backend-tls-session-cache-per-worker option 2016-02-25 22:46:25 +09:00
Tatsuhiro Tsujikawa 72877379ec nghttpx: Deprecate --backend-ipv4 and --backend-ipv6 in favor of --backend-address-family 2016-02-13 19:09:39 +09:00
Tatsuhiro Tsujikawa c0078ab45a nghttpx: Add options to specify address family of memcached connections 2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa 3a41e4dd1a nghttpx: Add encryption support for TLS ticket key retrieval 2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa 3297a303bf nghttpx: Add client auth options for session cache memcached TLS connection 2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa f1580f95d4 nghttpx: Add TLS support for session cache memcached connection 2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa e763770f3e nghttpx: Add option to specify maximum number of session cache 2016-02-07 17:43:30 +09:00
Tatsuhiro Tsujikawa bb4e2f6a24 nghttpx: Add TLS support for HTTP/1 backend 2016-02-07 17:43:30 +09:00
Tatsuhiro Tsujikawa ee07694783 nghttpx: Add request-header-field-buffer and max-request-header-fields options
This commit adds request-header-field-buffer and
max-request-header-fields, and deprecates header-field-buffer and
max-header-fields options.
2016-02-06 17:22:23 +09:00
Tatsuhiro Tsujikawa 8741503db1 nghttpx: Add --no-http2-cipher-black-list to allow black listed cipher suite 2016-02-06 17:05:14 +09:00
Tatsuhiro Tsujikawa eec409dba7 nghttpx: Limit header fields from backend 2016-02-06 12:27:01 +09:00
Tatsuhiro Tsujikawa 9ac3e643d8 Revert "nghttpx: Add --curves option to specify supported elliptic curves"
This reverts commit e278893b64.

SSL_CONF_CTX functions are not working correctly with OpenSSL 1.0.2.
It requires 1.1.0 to make it work.
2016-01-21 19:50:38 +09:00
Tatsuhiro Tsujikawa e278893b64 nghttpx: Add --curves option to specify supported elliptic curves 2016-01-21 18:23:13 +09:00
Tatsuhiro Tsujikawa 5c3f74b424 nghttpx: Add RFC 7239 Forwarded header field support 2016-01-16 11:32:14 +09:00
Lucas Pardue dcc9aaaa24 Add TLS dynamic record size behaviour command line options 2015-10-22 14:07:18 +00:00
Tatsuhiro Tsujikawa f1eb7638d1 nghttpx: Change mruby script handling
This commit changes nghttpx's mruby script handling.  Previously we
have 2 options to specify the mruby script file to be run on request
and on response.  Now they are merged into 1 option, namely
--mruby-file.  It now must return object.  On request, the object's
on_req(env) method is invoked with env object.  Similarly, on
response, the object's on_resp(env) method is invoked.  The
specification of Env object has not changed.
2015-10-08 23:32:15 +09:00
Peeyush Aggarwal 349f3e2c7b Added support for RFC 7413 (TCP Fast Open) on nghttpx proxy listening connections.
Fixed code as per PR comments
2015-10-05 13:40:45 -07:00
Tatsuhiro Tsujikawa ce53bd239e nghttpx: Implement PROXY protocol version 1
Use --accept-proxy-protocol to enable PROXY protocol handling
2015-09-06 21:30:19 +09:00
Tatsuhiro Tsujikawa d722a09581 nghttpx: Rename mruby script options 2015-09-04 01:19:57 +09:00
Tatsuhiro Tsujikawa baadec5ef4 nghttpx: Add response mruby hook 2015-09-03 01:33:52 +09:00
Tatsuhiro Tsujikawa 1508c50a45 nghttpx: Add basic infrastructure for mruby support 2015-09-02 02:45:15 +09:00
Tatsuhiro Tsujikawa a1288a5826 nghttpx: Rename --tls-ticket-cipher as --tls-ticket-key-cipher 2015-07-28 23:49:37 +09:00
Tatsuhiro Tsujikawa a6fdca730d nghttpx: Add options to set maximum retry and failure when getting ticket keys 2015-07-28 01:17:29 +09:00
Tatsuhiro Tsujikawa 4949dd4888 nghttpx: Add --tls-ticket-key-memcached-interval option 2015-07-28 01:02:33 +09:00
Tatsuhiro Tsujikawa 2f2a300e83 nghttpx: Add TLS ticket key sharing among nghttpx instances using memcached 2015-07-28 00:54:44 +09:00
Tatsuhiro Tsujikawa 90b4b48c7e nghttpx: Add shared session cache using memcached 2015-07-26 23:33:06 +09:00
Tatsuhiro Tsujikawa cab6c7871c nghttpx: Don't rewrite host header field by default
In reverse proxy usage, backend server most likely wants to see the
original header field.  So this commit turns off host header rewrite
by default.  --no-host-rewrite option is deprecated, and if it is
used, warning message is displayed.  --host-rewrite option is added to
enable host rewrite.
2015-07-23 23:54:56 +09:00
Tatsuhiro Tsujikawa e8167ceea7 nghttpx: Add AES-256-CBC encryption for TLS session ticket 2015-07-18 02:02:33 +09:00
Tatsuhiro Tsujikawa 4fed7a1476 nghttpx: Refactor log format parsing 2015-07-14 23:36:44 +09:00
Tatsuhiro Tsujikawa 8c1e863523 nghttpx: Refactor option name lookup 2015-07-14 23:21:38 +09:00