319d5ab1c6
nghttpx: Fix request stall
...
Fix request stall if backend connection is reused and buffer is full.
2019-08-06 20:50:29 +09:00
4f7aedc9d2
cmake: Support building nghttpx with systemd
2019-07-29 13:55:05 +03:00
7a5908933e
Fix clang-8 warning
2019-06-22 17:44:16 +09:00
ee44313445
Fix FPE with default backend
2019-06-11 23:15:01 +09:00
abef9b90ef
Fix log-level is not set with cmd-line or configuration file
2019-06-11 23:13:43 +09:00
b7220f075c
cmake: Remove SPDY related files
2019-06-08 00:23:17 +09:00
77f1c872b1
nghttpx: Fix unchanged log level on configuration reload
...
Previously, if log-level is not mentioned in configuration file and
reload happens, the log level was not set to the default value NOTICE.
Instead, the log level stayed the same. This commit fixes this bug.
2019-06-05 21:17:23 +09:00
b0f5e5cc79
Implement daemon() using fork() for OSX
2019-05-30 23:22:44 +09:00
2e1975ddf6
clang-format-8
2019-05-18 10:28:35 +09:00
4fca2502d8
nghttpx: Ignore Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT
...
A well known server sends content-length: 0 in 101 response. RFC 7230
says Content-Length or Transfer-Encoding in 200 response to CONNECT
request: https://tools.ietf.org/html/rfc7230#section-3.3.3
2019-05-17 22:58:26 +09:00
0288093caf
Fix llhttp_get_error_pos usage
...
It returns NULL if return value is HPE_OK.
2019-04-21 00:07:11 +09:00
c64d2573dc
Replace http-parser with llhttp
...
llhttp does not include URL parser. We extracted URL parser code from
http-parser and put it under third-party/url-parser.
llhttp bd3d224eb8cdc92c6fc8f508d7bbe0ba266e8e92
2019-04-20 18:42:30 +09:00
f028cc4392
clang-format
2019-04-18 23:37:48 +09:00
cbba1ebf8f
asio: support boost-1.70
...
In boost 1.70, deprecated get_io_context() has finally been removed.
Introduce GET_IO_SERVICE macro that based on boost version uses
old get_io_service() interface (boost < 1.70), or get_executor().context()
for boost 1.70+.
Commit based idea seen in monero-project/monero@17769db946
2019-04-18 12:35:54 +02:00
a35059e3f1
nghttpx: Fix bug that altered authority and path affect backend selection
...
Fix bug that altered authority and path by per-pattern mruby script
affect backend selection on retry.
2019-04-16 22:18:30 +09:00
5a30fafdda
Merge branch 'nghttpx-fix-chunked-request-stall'
2019-04-16 00:26:18 +09:00
2cff8b43cf
nghttpx: Fix bug that chunked request stalls
2019-04-15 23:58:30 +09:00
be96654d56
nghttpx: Don't log authorization request header field value with -LINFO
2019-04-15 22:59:26 +09:00
ec519f22dc
Merge pull request #1270 from baitisj/master
...
Fix for compilation against modern LibreSSL
2019-03-13 20:52:50 +09:00
371bc3a8f7
clang-format
2019-03-08 00:19:34 +09:00
f5feb16ef4
Merge pull request #1295 from bratkartoffel/fix-compile-boringssl
...
Fix compilation with boringssl
2019-02-20 00:13:00 +09:00
2591960e2f
Explicitly set install location when building shared libs
2019-02-06 10:26:30 -08:00
d93842db3e
nghttpx: Fix backend stall if header and request body are sent in 2 packets
2019-01-23 17:57:12 +09:00
8dc2b263ba
nghttpx: Use std::priority_queue
2019-01-22 00:01:17 +09:00
1ff9de4c87
nghttpx: Backend address selection with weight
2019-01-21 22:23:19 +09:00
34482ed4df
Fix compilation with boringssl
2019-01-18 20:12:57 +01:00
ab2aa5672b
Fix test failure
...
Now http_parser_parse_url returns nonzero if empty URI is given.
2019-01-17 23:16:49 +09:00
e9c9838cdc
nghttpx: Pool h1 backend connection per address
...
Pool HTTP/1.1 backend connection per address and reuse it only when
the next round robin index refers to this address. Previously if
there is a pooled connection, there is no round robin selection.
2019-01-14 22:20:58 +09:00
803d4ba948
Merge branch 'nghttpx-randomize-roundrobin-order'
2019-01-14 22:17:12 +09:00
732245e562
make clang-format
2019-01-12 00:11:31 +09:00
fdcdb21c38
nghttpx: Randomize backend address round robin order per thread
2019-01-11 22:36:45 +09:00
11d0533cfc
nghttpx: Ensure that cert serial does not exceed 20 bytes
2019-01-05 10:03:44 +09:00
5b2efc0a12
Fix getting long serial numbers for openssl < 1.1
...
From https://www.ietf.org/rfc/rfc5280.txt
> As noted in Section 4.1.2.2, serial numbers can be expected to
> contain long integers. Certificate users MUST be able to handle
> serialNumber values up to 20 octets in length. Conforming CAs MUST
> NOT use serialNumber values longer than 20 octets.
Without this, nghttpx will fatal.
jbraeg$ openssl x509 -in ~/test_certs/client.crt -serial -noout
serial=E0CFDFC7CEA10DF8AAF715C37FAEB410
jbraeg$ curl -k --key ~/test_certs/client.key --cert ~/test_certs/client.crt https://192.168.98.100:3000/ ; echo
curl: (56) Unexpected EOF
...
Assertion failed: n == b.size() (shrpx_tls.cc: get_x509_serial: 2051)
2019-01-03T20:25:21.289Z 1 1 f84316ae NOTICE (shrpx_log.cc:895) Worker process: [9] exited abnormally with status 0x06; exit status 0; signal Aborted(6)
2019-01-03T20:25:21.290Z 1 1 f84316ae NOTICE (shrpx.cc:4311) Shutdown momentarily
2019-01-03 13:20:29 -08:00
124c7848c0
nghttpx: Add missing return
2018-12-11 22:52:34 +09:00
f3f40840b3
nghttpx: Fix broken trailing slash handling
...
nghttpx allows a pattern with trailing slash to match a request path
without it. Previously, under certain pattern registration, this does
not work.
2018-12-09 17:07:28 +09:00
2c1570595e
Fix for compilation against modern LibreSSL
2018-12-02 13:30:42 -08:00
302abf1b46
h2load: Fix compile error with gcc
2018-11-23 14:39:51 +09:00
089a03be42
h2load: Write log file with write(2)
2018-11-23 13:08:38 +09:00
d1b3a83f59
h2load: add an option to write per-request logs
2018-11-23 12:11:00 +09:00
6800d317e7
added access to the number of the current server port
2018-11-23 10:56:21 +09:00
f51e696e4a
asio: Add stop() to listen_and_serve doc
2018-11-18 17:30:35 +09:00
a433b132fc
Merge pull request #1260 from nghttp2/h2load-non-final-response
...
h2load: Handle HTTP/1 non-final response
2018-11-15 17:32:15 +09:00
6cad1b243b
nghttpx: Write mruby send_info early
2018-11-15 10:17:47 +09:00
3c393dca58
nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
2018-11-15 10:17:41 +09:00
172924457f
h2load: Handle HTTP/1 non-final response
2018-11-15 10:13:19 +09:00
dcbe0c690f
nghttpx: Simplify move ctor and operator
2018-11-02 15:40:53 +09:00
2996c28456
nghttpx: Cleanup
2018-11-02 15:16:36 +09:00
42e8ceb656
nghttpx: Convert API status code to enum class
2018-11-02 14:14:48 +09:00
1daf9ce8b7
nghttpx: Convert WorkerEventType to enum class
2018-11-02 14:14:48 +09:00
d68edf56c0
nghttpx: Convert MemcachedStatusCode to enum class
2018-11-02 14:14:48 +09:00
0c4e9fef29
nghttpx: Convert memcached op to enum class
2018-11-02 14:14:48 +09:00
571404c6e8
nghttpx: Convert MemcachedParseState to enum class
2018-11-02 14:14:48 +09:00
4d562b773b
nghttpx: Convert LogFragmentType to enum class
2018-11-02 14:14:48 +09:00
e62258713e
nghttpx: Convert connection check status to enum class
2018-11-02 14:14:48 +09:00
4bd075defd
nghttpx: Convert Http2Session state to enum class
2018-11-02 14:14:48 +09:00
b46a324943
nghttpx: Convert FreelistZone to enum class
2018-10-17 14:19:58 +09:00
4bd44b9cdf
nghttpx: Convert dispatch state to enum class
2018-10-17 14:19:58 +09:00
1b42110d4f
nghttpx: Make Downstream state enum class
2018-10-17 14:19:58 +09:00
0735ec55f3
nghttpx: Convert shrpx_connect_proto to enum class
2018-10-17 14:19:58 +09:00
00554779e1
nghttpx: Convert DNSResolverStatus to enum class
2018-10-17 14:19:58 +09:00
0963f38935
nghttpx: Convert SerialEventType to enum class
2018-10-17 14:19:58 +09:00
1abfa3ca5f
nghttpx: Make TLS handshake state enum class
2018-10-17 08:52:27 +09:00
f2159bc2c1
nghttpx: Convert UpstreamAltMode to enum class
2018-10-17 08:38:55 +09:00
b0eb68ee9e
nghttpx: Convert shrpx_forwarded_node_type to enum class
2018-10-16 23:10:17 +09:00
e7b7b037f6
nghttpx: Convert shrpx_cookie_secure to enum class
2018-10-16 23:06:59 +09:00
5e4f434fd8
nghttpx: Convert shrpx_session_affinity to enum class
2018-10-16 23:03:17 +09:00
20ea964f2f
nghttpx: Convert shrpx_proto to enum class
2018-10-16 22:59:34 +09:00
d105619bc3
src: Remove extra braces if possible
2018-10-15 23:46:33 +09:00
ec5729b1fa
Use std::make_unique
2018-10-15 23:02:44 +09:00
46576178a3
Don't send Transfer-Encoding to pre-HTTP/1.1 clients
2018-10-14 22:57:54 +09:00
5e925f873e
Update doc
2018-10-14 22:57:11 +09:00
153531d4d0
nghttpx: Use the same type as standard stream operator<<
2018-10-07 22:19:00 +09:00
7c8cb3a0ce
nghttpx: Improve CONNECT response status handling
2018-10-04 12:04:15 +09:00
aeb92bbbe2
nghttpx: Add read/write-timeout parameters to backend option
2018-09-30 12:32:43 +09:00
fc7489e044
nghttpx: Fix mruby parameter validation
2018-09-30 12:30:19 +09:00
87ac872fdc
nghttpx: Update doc
2018-09-30 12:28:43 +09:00
c278adde7a
nghttpx: Log error when mruby file cannot be opened
2018-09-30 12:23:01 +09:00
f94d720909
Merge pull request #1234 from nghttp2/nghttpx-rfc8441
...
nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
2018-09-29 11:54:47 +09:00
02566ee383
nghttpx: Update doc
2018-09-29 11:42:37 +09:00
3002f31b1f
src: Add debug output for SETTINGS_ENABLE_CONNECT_PROTOCOL
2018-09-29 11:39:49 +09:00
d2a594a753
nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
2018-09-29 11:35:41 +09:00
a42faf1cc2
nghttpx: Write TLS alert during handshake
2018-09-23 18:01:38 +09:00
88ff8c69a0
Update mruby 1.4.1
2018-09-16 22:54:09 +09:00
a63558a1eb
nghttpx: Call OCSP_response_get1_basic only when OCSP status is successful
2018-09-16 22:19:27 +09:00
3575a1325e
nghttpx: Fix crash with plain text HTTP
2018-09-15 12:16:23 +09:00
9c824b87fe
nghttpx: Get rid of std::stringstream from Log
2018-09-14 22:58:48 +09:00
ed7c9db2a6
nghttpx: Add mruby env.tls_handshake_finished
2018-09-09 22:59:35 +09:00
5b42815afb
nghttpx: Strip incoming Early-Data header field by default
2018-09-09 22:37:22 +09:00
cfe7fa9a75
nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
2018-09-09 16:35:47 +09:00
cb8a9d58fd
src: Remove TLSv1.3 ciphers from DEFAULT_CIPHER_LIST
...
TLSv1.3 ciphers are treated differently from the ciphers for TLSv1.2
or earlier.
2018-09-09 15:53:04 +09:00
9b03c64f68
nghttpx: Should postpone early data by default
2018-09-08 19:22:30 +09:00
b8eccec62d
nghttpx: Disable OpenSSL anti-replay
2018-09-08 19:10:59 +09:00
9f21258720
Specify SSL_CTX_set_max_early_data and add an option to change max value
2018-09-08 17:59:28 +09:00
47f6012407
nghttpx: Add an option to postpone early data processing
2018-09-08 17:57:21 +09:00
770e44de4d
Implement draft-ietf-httpbis-replay-02
...
nghttpx sends early-data header field when forwarding requests which
are received in TLSv1.3 early data, and the TLS handshake is still in
progress.
2018-09-08 17:54:35 +09:00
2ab319c137
Don't hide error code from openssl
2018-09-08 17:54:35 +09:00
3992302432
Remove SSL_ERROR_WANT_WRITE handling
2018-09-08 17:54:35 +09:00
b30f312a70
Honor SSL_read semantics
2018-09-08 17:54:35 +09:00
c5cdb78a95
nghttpx: Add TLSv1.3 0-RTT early data support
2018-09-08 17:54:35 +09:00
e959e7338e
src: Refactor utos
2018-09-01 22:29:11 +09:00
fb9a204de2
nghttpx: Fix compile error without mruby
2018-08-31 21:58:35 +09:00
7417fd71a4
nghttpx: Per-pattern not per-backend
2018-08-28 17:50:01 +09:00
45acc922eb
clang-format
2018-08-27 21:34:18 +09:00
214d089910
Merge branch 'master' of https://github.com/akonskarm/nghttp2 into akonskarm-master
2018-08-27 21:30:36 +09:00
31fd707d0c
nghttpx: Fix broken healthmon frontend
2018-08-27 21:21:55 +09:00
9a2e38e058
fix code for reuse addr on asio client
2018-08-27 10:53:14 +03:00
6195d747ce
nghttpx: Share mruby context if it is compiled from same file
2018-08-24 23:11:21 +09:00
fb97f596e1
nghttpx: Allocate mruby file because fopen requires NULL terminated string
2018-08-24 23:08:15 +09:00
0ccc7a770d
nghttpx: Move blocked request data to request buffer for API request
2018-08-24 23:07:43 +09:00
32826466f5
nghttpx: Fix crash with API request
2018-08-24 23:07:16 +09:00
0422f8a844
nghttpx: Fix worker process crash with neverbleed write error
2018-08-24 22:22:53 +09:00
e329479a99
Merge pull request #1215 from nghttp2/mruby-per-backend
...
nghttpx: Support per-backend mruby script
2018-08-23 18:41:40 +09:00
866ac6ab27
add option reuse addr in local endpoint configuration of asio client
2018-08-23 18:19:10 +09:00
b574ae6aa2
nghttpx: Support per-backend mruby script
2018-08-23 18:13:29 +09:00
32d7883c47
nghttpx: Downstream::request_buf_full: take into account blocked_request_buf_
2018-08-23 10:55:42 +09:00
9b24e19763
nghttpx: Choose h1 protocol if headers have been sent to backend on retry
2018-08-22 23:20:13 +09:00
9d5b781df6
Fix stream reset if data from client is arrived before dconn is attached
2018-08-22 22:32:25 +09:00
c6d8c4013c
support definition of local endpoint for cleartext client session
2018-08-02 16:18:23 +09:00
880f948684
Enable IndentPPDirectives
2018-06-09 16:21:30 +09:00
fc94018b97
clang-format-6.0
2018-06-09 16:02:26 +09:00
388e785822
Fix typo
2018-06-03 13:10:32 +09:00
325612bcde
nghttp: Receive ORIGIN frame
2018-05-12 12:35:08 +09:00
3e4f257b91
asio: Support client side SNI
2018-05-03 20:29:16 +09:00
c65ca20a49
h2load: -r and --duration are mutually exclusive
2018-04-28 00:30:43 +09:00
009646421c
Use LIBRESSL_IN_USE instead of defined(LIBRESSL_VERSION_NUMBER)
2018-04-14 18:31:57 +09:00
8d0b4544f8
libressl 2.7 has X509_VERIFY_PARAM_*
2018-04-14 18:31:57 +09:00
d8a34131e1
libressl 2.7 has SSL_CTX_get0_certificate
2018-04-14 18:31:57 +09:00
5db17d0af9
Compile with libressl 2.7.2
2018-04-14 18:09:47 +09:00
1bf69b5662
Define LIBRESSL_LEGACY_API and LIBRESSL_2_7_API
...
LIBRESSL_LEGACY_API is drop-in replacement for LIBRESSL_IN_USE. In
the upcoming commits, we will add changes to support libressl 2.7.
2018-04-14 18:09:47 +09:00
e65e7711ca
Add comment on #endif
2018-04-03 21:39:44 +09:00
636ef51b0f
Fix compile error with -Wunused-function
2018-04-03 21:33:09 +09:00
400934e5a3
[PATCH] Allow building without NPN
...
NPN has been superseeded by ALPN. OpenSSL provides a configure
option to disable npn (no-npn) which results in an OpenSSL
installation that defines OPENSSL_NO_NEXTPROTONEG in opensslconf.h
The #ifdef's look safe here (as the next_proto is initialized as
nullptr). Alteratively, macros could be defined for the used npn
methods that return a 0 for next_proto.
Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
2018-03-25 18:27:23 +02:00
45d76cf501
nghttpx: Close listening socket on graceful shutdown
2018-02-26 22:40:24 +09:00
e70195ae91
nghttpx: Update doc
2018-02-22 16:12:38 +09:00
eb951c2ce4
src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro
2018-02-12 16:22:47 +09:00
39f0ce7c25
Merge pull request #1126 from nghttp2/nghttpx-expired-client-cert
...
nghttpx: Add an option to accept expired client certificate
2018-02-10 16:00:43 +09:00
e8af7afc65
nghttpx: Add an option to accept expired client certificate
2018-02-08 16:51:23 +09:00
38abfd1863
nghttpx: Add mruby tls_client_not_before, and tls_client_not_after
2018-02-08 16:25:31 +09:00
ff3edc09ed
nghttpx: Fix potential memory leak
2018-02-03 18:21:42 +09:00
c1a496cf4e
nghttpx: Fix bug that h1 backend idle timeout expires sooner
2018-02-02 21:09:04 +09:00
e098a21132
mruby: Fix bug that response header is unexpectedly overwritten
...
The bug is the same bug fixed by
6deee2037d
2018-01-28 19:41:45 +09:00
6deee2037d
Fix #1119 : Stop overwrite of first header on mruby call to env.req.set_header(..)
2018-01-26 18:49:08 -08:00
5cc3d159e1
nghttpx: Add upgrade-scheme parameter to backend option
...
If "upgrade-scheme" parameter is present in backend option along with
"tls" paramter, HTTP/2 :scheme pseudo header field is changed to
"https" from "http" when forwarding a request to this particular
backend. This is a workaround for a server which requests "https"
scheme on HTTP/2 connection encrypted by TLS.
2018-01-08 18:08:01 +09:00
0fbb46edd6
Merge pull request #1101 from nghttp2/remember-pushed-links
...
nghttpx: Remember which resource is pushed
2018-01-04 23:15:35 +09:00
74754982f1
nghttpx: Fix missing ALPN validation (--npn-list)
...
This commit fixes the bug that ALPN validation does not occur when
ALPN list is not sent from client.
2018-01-04 22:43:47 +09:00
a31a2e3b2c
nghttpx: Remember which resource is pushed
...
Remember which resource is pushed in order to conform to the semantics
described in RFC 8297.
2018-01-04 22:35:22 +09:00
cfd926f09b
src: Define 103 status code
2017-12-20 19:30:55 +09:00
4d1139f653
Remove SPDY
2017-12-17 13:28:44 +09:00
48f574076c
nghttpx: Update doc
2017-12-16 00:13:27 +09:00
216f4dad83
nghttpx: Remove redundant check
2017-12-14 21:39:22 +09:00
a4e27d766b
Revert "nghttpx: Use an existing h2 backend connection as much as possible"
...
This reverts commit f507b5eee4
2017-12-14 21:34:04 +09:00
03f7ec0f60
nghttpx: Write API request body in temporary file
2017-12-03 16:19:57 +09:00
2056e812bd
nghttpx: Increase api-max-request-body
2017-12-02 13:49:42 +09:00
04348ff20e
Merge pull request #1081 from nghttp2/nghttpx-faster-parse-config
...
nghttpx: Faster configuration loading with lots of backends
2017-12-01 23:47:34 +09:00
1ebb6810a1
nghttpx: Faster configuration loading with lots of backends
2017-12-01 23:06:06 +09:00
a3ebeeafba
nghttpx: Fix crash with --backend-http-proxy-uri option
2017-12-01 22:28:16 +09:00
ff200bfcf3
clang-format-5.0
2017-11-23 14:19:12 +09:00
0028275d7b
nghttpx: Add affinity-cookie-secure parameter to backend option
2017-11-21 22:29:22 +09:00
194acb1f2c
src: Use nghttp2_error_callback2
2017-11-19 16:51:52 +09:00
73344ae9aa
nghttpx: Use plain hex string format for client serial
2017-11-17 00:04:23 +09:00
eca0a3025b
nghttpx: Add $tls_client_serial log variable
2017-11-16 22:53:54 +09:00
4720c5cb3d
nghttpx: Make client serial available in mruby script
2017-11-16 22:53:54 +09:00
cd55ab28ab
nghttpx: Add function to get serial number from certificate
2017-11-16 22:53:54 +09:00
22502182d0
Add tls_client_issuer_name log variable and expose it to mruby
2017-11-15 23:41:47 +09:00
f5ddd7f43b
nghttpx: Make initial_addr_idx_ unsigned
2017-11-04 17:30:56 +09:00
88abbce7e7
nghttpx: Fix compile error with gcc
2017-11-04 17:30:27 +09:00
16e9036568
nghttpx: Fix affinity retry
2017-11-04 17:13:45 +09:00
fa7945c627
nghttpx: Refactor
2017-11-04 15:55:25 +09:00
daca43f0dd
nghttpx: Fix stalled backend connection on retry
2017-11-04 15:46:08 +09:00
16bc11e670
nghttpx: Remove duplicated util::make_socket_nodelay
2017-11-04 13:00:17 +09:00
8c0ea56bb8
Merge pull request #1036 from nghttp2/nghttpx-affinity-cookie
...
nghttpx: Cookie based session affinity
2017-11-01 22:45:38 +09:00
549053710b
nghttpx: Refactor
2017-11-01 22:33:49 +09:00
be5c39a1cf
src: Add tests
2017-11-01 22:18:03 +09:00
b8fda6808b
nghttpx: Cookie based session affinity
2017-11-01 22:18:03 +09:00
539e27812b
nghttpx: Add tls_client_fingerprint_sha1 to mruby and accesslog
...
Also tls_client_fingerprint is renamed to
tls_client_fingerprint_sha256.
2017-10-31 21:41:40 +09:00
7008afd40e
nghttpx: Refactor get_x509_fingerprint to accept hash function
2017-10-31 21:28:16 +09:00
60baca27e4
nghttpx: Add more TLS related attributes to mruby Env object
...
The added attributes are:
* tls_cipher
* tls_protocol
* tls_session_id
* tls_session_reused
* alpn
2017-10-29 22:42:30 +09:00
cb376bcd80
nghttpx: Add client fingerprint and subject name to accesslog
2017-10-29 21:47:00 +09:00
f2b8edd1e2
nghttpx: Fix memory leak
2017-10-29 21:46:12 +09:00
c4f8afcfde
nghttpx: Get TLS info only when it is necessary when writing accesslog
2017-10-29 21:22:33 +09:00
9f80a82c1a
nghttpx: Add client fingerprint and subject name to mruby env
2017-10-29 19:54:42 +09:00
c573c80bd3
nghttpx: Pass a pointer to SSL instead of TLSSessionInfo to LogSpec
2017-10-29 19:47:39 +09:00
3cd6817e21
Fix typos
2017-10-29 16:54:21 +09:00
aaeeec8f1c
Fix typos
2017-10-28 22:25:42 +09:00
5119e82b93
src: Fix memory leak in unit test
2017-10-24 21:40:30 +09:00
3be5856c82
nghttpx: Fix unused function warnings
2017-10-24 21:40:30 +09:00
a319143901
nghttpx: Fix bug that header fields are missing in HTTP/1.0 response
2017-10-22 01:11:32 +09:00
f507b5eee4
nghttpx: Use an existing h2 backend connection as much as possible
...
h2load measurement reveals that this strategy is 3 times faster than
the previous implementations.
2017-10-19 21:15:08 +09:00
aaa0b858e4
Amend some macro comments
2017-10-14 11:50:16 +09:00
5fa1938691
clang-format
2017-10-14 11:45:41 +09:00
c2d9a1ed6f
Support for Windows / MinGW
2017-10-12 18:15:12 +02:00
8ffe389daa
h2load: Print out h2 header fields with --verbose option
2017-09-22 18:12:20 +09:00
2576855ded
nghttpx: Send non-final response to HTTP/1.1 or HTTP/2 client only
2017-09-21 21:42:56 +09:00
cc6f759190
src: Add static to constexpr char[]
2017-09-20 23:54:10 +09:00
323001238a
clang-format
2017-09-20 22:08:22 +09:00
91f062f873
src: Fix compile error
2017-09-20 22:08:08 +09:00
a170023f23
nghttpx: Verify OCSP response using trusted CA certificates
2017-09-01 21:35:38 +09:00
4be4c0cddc
Revert "nghttpx: Verify OCSP response using trusted CA certificates"
...
This reverts commit 59c78d5809
2017-08-30 22:27:02 +09:00
5996798a34
Fix OCSP related error when building with BoringSSL
...
BoringSSL has no "openssl/ocsp.h" nor most OCSP related APIs used in
shrpx_tls.cc. This commit add ifdefs to disable related code to allow
building nghttp2 with BoringSSL (again).
It's possible to use !defined(OPENSSL_IS_BORINGSSL), but since BoringSSL
defines OPENSSL_NO_OCSP which is more specific, I chose to go with the
latter one.
2017-08-24 11:56:46 -04:00
6fec532012
Merge pull request #998 from nghttp2/h2load-fix-timing-script-stall
...
Fix bug that timing script stalls with -m1
2017-08-24 21:17:43 +09:00
15713e0b7c
h2load: Ignore -n for timing-based mode instead of requiring -n=0
2017-08-23 20:35:01 +09:00
a6a561af47
Fix bug that timing script stalls with -m1
2017-08-23 20:10:23 +09:00
bcda1c2409
Fix assertion failure
2017-08-23 19:22:23 +09:00
afcd8d9ab1
clang-format
2017-08-23 19:19:00 +09:00
c9b1c91944
Fix compile error
2017-08-23 19:18:27 +09:00
5d9434eb09
Merge branch 'master' of https://github.com/sohamm17/nghttp2 into sohamm17-master
2017-08-23 19:16:40 +09:00
1a44b5d52a
Merge pull request #984 from nghttp2/h2load-reservoir-sampling
...
h2load: Reservoir sampling
2017-08-23 19:00:28 +09:00
af926fbe1f
Refactoring include directories for build as CMake subdirectory (add_subdirectory(nghttp2))
2017-08-16 21:28:12 +03:00
83039ae2d4
h2load: Reservoir sampling
2017-08-14 20:25:02 +09:00
4d76606fa2
Fix bug that forwarded for is not affected by proxy protocol
2017-08-09 22:44:14 +09:00
1baf7d34b3
Duration watcher and warmup watcher is initialised in Worker constructor. Statistic calculation is removed from duration watcher call_back, it's done in free_client.
2017-08-08 17:26:37 -04:00
c78159469a
Added a function to free a client from Worker's list of client, if the client is destroyed
2017-08-07 18:58:12 -04:00
b72ca0289c
formatting issue
2017-08-04 14:20:00 -04:00
46f670f8a2
concurrent connections are created in timing-based mode. Some safety asserts added.
2017-08-03 16:15:14 -04:00
4b44362b9f
minor style changes
2017-08-01 20:22:20 -04:00
d068a29798
removed unnecessary code
2017-08-01 19:51:47 -04:00
0836a51408
Handling requests starting in warm-up phase and ending in MAIN_DURATION
2017-08-01 18:29:00 -04:00
566cee8fe7
MAIN_DURATION is initiliazed in Worker constructor, MAIN_DURATION check is removed from two functions because those functions are needed in warm-up phase as well.
2017-08-01 17:45:52 -04:00
e85698e131
MAIN_DURATION is initiliazed in Worker constructor, MAIN_DURATION check is removed from two functions because those functions are needed in warm-up phase as well.
2017-08-01 17:45:18 -04:00
5f3c541c4c
enabled --duration option.
2017-07-28 17:31:13 -04:00
3c43e00d8a
Timing ( #1 )
...
* Adding timing-sensitive load test option in h2load.
* more checks added for parameters
* A worker thread can control its clients' warmup and main duration.
* Changed warmup to an enum variable.
* removed unnecessary call to ev_timer_stop
* assertion is done before starting main measurement phase
* phase variable is implemented only inside the Worker class
* enum to enum class
* else indentation corrected
* check added for timing-based test when duration CB is called explicitly
* New argument is introduced for timing-based benchmarking.
* styling corrections
* duration watcher initialization is pushed back into warmup timeout
* Warmup and Duration timer is moved to Worker instead of clients. Now both timers and phase belongs to the Workers.
* some client functions are modified to return if it's not main_duration phase. client is not destructed but sessions are terminated
* outputs are adjusted for thread.
* Needed to check if a session exist before terminating
* formatting
* more formatting
* formatting
2017-07-28 17:08:20 -04:00
1002c6da1c
src: Use llround instead of round
2017-07-12 23:23:47 +09:00
18dd20ce55
nghttp: Fix bug that upgrade fails if reason-phrase is missing
2017-06-28 01:01:39 +09:00
a18d154e0e
Merge pull request #943 from nghttp2/nghttpx-verify-ocsp-resp-with-cacerts
...
nghttpx: Verify OCSP response using trusted CA certificates
2017-06-15 20:56:44 +09:00
59c78d5809
nghttpx: Verify OCSP response using trusted CA certificates
2017-06-13 23:00:26 +09:00
be164fc8f9
nghttpx: Set default minimum TLS version to TLSv1.2
...
Previously, the default minimum TLS version was TLSv1.1, but the
default cipher list didn't include any compatible ciphers with it.
This made handshake fail if TLSv1.1 was negotiated because there was
no shared ciphers. To make the default settings consistent, the
default minimum TLS version is now TLSv1.2.
2017-06-12 23:54:12 +09:00
6ec7683991
nghttpx: Use nocopy version to send trailer headers to backend
...
It looks like we can use nocopy version here. We use nocopy version
in frontend in day 1.
2017-06-02 22:38:39 +09:00
8f7fa1b1bf
nghttpx: Fix crash in OCSP response verification
2017-05-30 23:52:38 +09:00
db7483ef10
Merge branch 'nghttpx-verify-ocsp'
2017-05-25 23:37:34 +09:00
74c2f1257a
nghttpx: Add --no-verify-ocsp to disable OCSP response verification
2017-05-25 23:14:58 +09:00
1428a5e3ae
nghttpx: Verify OCSP response
...
At least we should make sure that the OCSP response is targeted to the
expected certificate. This is important because we pass the file path
to the external script, and if the file is replaced because of
renewal, and nghttpx has not reloaded its configuration, the
certificate nghttpx has loaded and the one included in the file
differ. Verifying the OCSP response detects this, and avoids to send
wrong OCSP response.
2017-05-25 23:14:57 +09:00
c57bf21306
src: memchunks: Don't use std::unique_ptr to avoid potential SO
2017-05-25 00:23:51 +09:00
8401e16a15
nghttpx: Fix compile error with gcc
2017-05-22 22:10:55 +09:00
07fb5854f3
nghttpx: Compile with openssl 1.0.2
2017-05-22 22:09:34 +09:00
796ab87b14
nghttpx: Fix certificate selection based on pub key algorithm
2017-05-21 11:12:47 +09:00
ed1fad3bd4
nghttpx: Call ERR_clear_error()
...
Call ERR_clear_error() before the OpenSSL function if we use
SSL_get_error() to examine error stack.
2017-05-21 10:32:12 +09:00
9c1876f542
nghttpx: Fix certificate indexing bug
2017-05-21 00:19:33 +09:00
7d111d9963
Merge pull request #923 from nghttp2/compile-with-disable-assert
...
Compile with --disable-assert
2017-05-18 23:49:41 +09:00
1b442cb16f
Compile with --disable-assert
2017-05-18 23:10:44 +09:00
0d4f0f0db5
nghttpx: Run OCSP at startup
...
With --ocsp-startup option, nghttpx starts accepting connections after
initial attempts to get OCSP responses finish. It does not matter
some of the attempts fail. This feature is useful if OCSP responses
must be available before accepting connections.
2017-05-18 22:33:49 +09:00
14edd12304
nghttpx: Refactor the code for the anti-replay
2017-05-14 17:45:35 +09:00
e6ffdb23a4
nghttpx: Share session_cache_ssl_ctx across threads
2017-05-14 17:43:11 +09:00
b5007d45f7
nghttpx: Wildcard path matching
...
This commit adds wildcard path matching. If path pattern given in
backend option ends with "*", it is considered as wildcard path. "*"
must match at least one character. All paths which include wildcard
path without last "*" as prefix, and are strictly longer than wildcard
path without last "*" are matched.
2017-05-11 22:15:28 +09:00
a584cf5a4f
Use clang-format-4.0
2017-04-30 15:45:53 +09:00
196673bbce
nghttp: Remove unused short option 'g'
2017-04-28 22:39:12 +09:00
794d13082c
Merge branch 'nghttp-no-verify-peer'
2017-04-28 22:36:23 +09:00
5f5cf4107e
nghttpx: Reseve rcbufs_
2017-04-28 22:31:09 +09:00
6f3ec54b9f
nghttp: Add -y, --no-verify-peer option to suppress peer verify warn
2017-04-28 09:53:37 +09:00
58043a6b04
nghttpx: Guard the presence of TLS1_3_VERSION
2017-04-27 23:13:15 +09:00
a885315ef5
Merge branch 'nghttpx-unrecognized-sni'
2017-04-27 22:57:54 +09:00
d7581525ac
nghttpx: Update TLSv1.3 TLS record overhead
2017-04-27 22:57:06 +09:00
1085f68018
nghttpx: Return SSL_TLSEXT_ERR_NOACK if server name is not recognized
...
With this commit, SSL_TLSEXT_ERR_NOACK is returned from
servername_callback, which removes server_name extension from
ServerHello. CertLookupTree is now used even if the number of server
certificate is one. It is better to exercise it regularly.
2017-04-27 22:25:58 +09:00
d63b4c1034
nghttpx: Forward multiple via, xff, and xfp header fields
...
Previously, for Via, X-Forwarded-For, and X-Forwarded-Proto header
field, nghttpx only forwarded the last header field of each. With
this commit, nghttpx forwards all of them if it is configured to do
so.
2017-04-26 21:23:13 +09:00
c3f5f5ca36
nghttpx: Clarify --conf option behaviour
2017-04-20 22:25:38 +09:00
911d12f7c4
nghttpx: Add log when loading configuration file
2017-04-20 22:22:29 +09:00
17614312e0
Merge pull request #892 from nghttp2/nghttpx-sni-fwd
...
nghttpx: SNI based backend server selection
2017-04-19 21:22:15 +09:00
a2e35a0757
nghttpx: Add $tls_sni access log variable
2017-04-18 22:44:26 +09:00
a4a2b6403b
nghttpx: Use SHRPX_LOGF_TLS_* instead of SHRPX_LOGF_SSL_*
2017-04-18 22:34:08 +09:00
03be97e437
nghttpx: Rename ssl_* log variables as tls_*
...
The exiting ssl_* log variables still work for backward compatibility.
2017-04-18 22:11:05 +09:00
0a2d1965df
nghttpx: Fix path matching bug
...
Previously, if path is empty or path does not start with "/", nghttpx
did not try to match with wildcard pattern. This commit fixes it.
2017-04-18 21:03:50 +09:00
c8a5f1e335
nghttpx: SNI based backend server selection
2017-04-16 23:47:10 +09:00
a1bc83a2ba
Merge pull request #881 from mway/dev/request-priority
...
Support specifying stream priority via session::submit()
2017-04-12 23:36:40 +09:00
bc3949db9e
Support specifying stream priority via session::submit()
2017-04-12 10:07:16 -04:00
6cfa885207
nghttpx: Remove unused lambda capture
2017-04-12 22:09:44 +09:00
e61ac4682e
Merge branch 'nghttpx-xfp-take2'
2017-04-09 16:02:53 +09:00
4d10dce61d
nghttpx: Only send SCT for leaf certificate
2017-04-09 14:38:18 +09:00
2d9fd87029
nghttpx: Enable signed_certificate_timestamp extension for TLSv1.3
2017-04-09 14:11:49 +09:00
cc9190ab37
nghttpx: Add options for X-Forwarded-Proto header field
...
This commit adds 2 new options to handle X-Forwarded-Proto header
field. The --no-add-x-forwarded-proto option makes nghttpx not to
append X-Forwarded-Proto value. The
--no-strip-incoming-x-forwarded-proto option prevents nghttpx from
stripping the header field from client.
Previously, nghttpx always strips incoming header field, and set its
own header field. This commit preserves this behaviour, and adds
additional knobs.
2017-04-08 18:46:36 +09:00
980570de71
Revert "nghttpx: Add options for X-Forwarded-Proto header field"
...
This reverts commit 8c0b2c684a
2017-04-08 18:37:54 +09:00
46ccc4332c
nghttpx: Fix bug that 204 from h1 backend is always treated as error
2017-04-07 21:45:13 +09:00
4e6bd54dd1
Merge branch 'nghttpx-single-process'
2017-04-06 20:18:33 +09:00
5c9f46a6b0
Merge branch 'nghttp-verify-server-certificate'
2017-04-06 20:17:29 +09:00
223e971c7e
nghttpx: Add --single-process option
...
With --single-process option, nghttpx will run in a single process
mode where master and worker are unified into one process. nghttpx
still spawns additional process for neverbleed. In the single process
mode, signal handling is disabled.
2017-04-06 20:02:57 +09:00
8c0b2c684a
nghttpx: Add options for X-Forwarded-Proto header field
...
This commit adds 2 new options to handle X-Forwarded-Proto header
field. The --add-x-forwarded-proto option makes nghttpx append
X-Forwarded-Proto value. The --strip-incoming-x-forwarded-proto
option makes nghttpx to strip the header field from client.
Previously, nghttpx always strips incoming header field, and set its
own header field. This commit changes this behaviour. Now nghttpx
does not strip, and append X-Forwarded-Proto header field by default.
The X-Forwarded-For, and Forwarded header fields are also handled in
the same way. To recover the old behaviour, use
--add-x-forwarded-proto and --strip-incoming-x-forwarded-proto
options.
2017-04-06 19:17:36 +09:00
7ae0b2dc09
nghttp: Verify server certificate and show warning if it fails
2017-04-01 17:49:57 +09:00
058122b804
nghttpx: Rename shrpx_ssl.{h,cc} as shrpx_tls.{h,cc}
...
The namespace shrpx::ssl was also renamed as shrpx::tls.
2017-04-01 15:12:28 +09:00
69f63c529d
src: Rename ssl.{h,cc} as tls.{h,cc}
...
nghttp2::ssl namespace was also renamed as nghttp2::tls.
2017-04-01 15:12:28 +09:00
e17a6b29b6
nghttpx: Use 502 as server error code
2017-04-01 14:04:55 +09:00
b12c2a13c0
nghttpx: Fail handshake if server certificate verification fails
...
Previously, we drop connection if server certificate verification
fails after handshake. With this commit, we fail handshake if that
happens.
2017-04-01 13:41:41 +09:00
236c835abc
nghttpx: Don't enable SSL_MODE_AUTO_RETRY since we do non-blocking I/O
2017-04-01 12:05:07 +09:00
ad338bfa44
asio: Fix crash if connect takes longer time than ping interval
2017-03-31 21:17:57 +09:00
a899522679
asio: Fix compile error
2017-03-31 21:14:08 +09:00
b9b58c781e
nghttpx: Avoid extra TLS handshake calls
2017-03-30 22:23:55 +09:00
aa1eec4642
nghttpx: Cache client side session inside openssl callback
2017-03-30 21:07:58 +09:00
0c8d9469ea
nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl
2017-03-27 23:58:49 +09:00
079e1bdffc
Revert "nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl"
...
This reverts commit b4337d1b54
2017-03-27 23:47:24 +09:00
b4337d1b54
nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl
2017-03-27 23:29:28 +09:00
dbe287ff5e
nghttpx: Print version number with -v option
2017-03-27 22:49:53 +09:00
041531458b
Merge pull request #858 from nghttp2/nghttpx-ai-addrconfig
...
nghttpx: Retry getaddrinfo without AI_ADDRCONFIG
2017-03-27 22:37:07 +09:00
1374bb81fd
nghttpx: Enable X25519 with boringssl
2017-03-27 21:18:44 +09:00
f41ac103d3
nghttpx: Retry getaddrinfo without AI_ADDRCONFIG
2017-03-27 00:20:42 +09:00
f6301714db
nghttpx: Avoid copy of std::mt19937 which is huge
2017-03-26 21:14:34 +09:00
7dc39b1ee9
nghttpx: Failing to listen on server socket is fatal error
2017-03-26 11:04:45 +09:00
696a7ce407
Merge pull request #856 from nghttp2/escape-access-log
...
Escape access log
2017-03-25 23:36:02 +09:00
99122ee7bb
nghttpx: Find illegal character in path for SPDY CONNECT method
2017-03-25 19:18:35 +09:00
19ee7ec794
nghttpx: Escape certain characters in access log
...
The certain characters coming from client are now escaped with "\xNN"
where NN is the ascii code of the character in hex notation.
2017-03-25 19:17:24 +09:00
cd9ec0d20f
src: BoringSSL supports SSL_CTX_set_{min,max}_proto_version.
...
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
2017-03-23 19:26:49 -07:00
e77883e980
nghttpx: Fix typo
2017-03-22 22:53:46 +09:00
0994c92550
nghttpx: Don't cache session server side if TLS version is 1.3
2017-03-22 21:34:13 +09:00
465c7208cc
nghttpx: Don't look up session ID if length is 0
2017-03-22 21:33:31 +09:00
b7e7a4bf26
asio: client: Send PING after 30 seconds idle
2017-03-20 18:37:56 +09:00
c7df65309b
nghttpx: Ignore further input if connection is going to close
2017-03-19 13:24:12 +09:00
26900262f3
Revert "nghttpx: Attempt to avoid TCP RST on socket closure on Linux"
...
This reverts commit f69b52b1aa
2017-03-18 22:43:30 +09:00
9b5ce36368
nghttpx: Reset write timer on write
2017-03-18 21:33:00 +09:00
f69b52b1aa
nghttpx: Attempt to avoid TCP RST on socket closure on Linux
2017-03-18 00:59:26 +09:00
1e1d908c12
nghttpx: Eliminate global std::random_device
2017-03-17 22:25:10 +09:00
6c69d675da
nghttpx: Should take reference
2017-03-17 22:24:32 +09:00
feabd6f739
nghttpx: Delete unused delete_bio_method
2017-03-15 23:37:39 +09:00
1ea590c364
nghttpx: Return new BIO_METHOD object with OpenSSL < 1.1.0
2017-03-15 23:36:38 +09:00
b21779e685
nghttpx: Use raw pointer for apis
2017-03-15 23:33:07 +09:00
12a4e7c3a2
src: Use raw pointer for ssl_global_locks
2017-03-15 23:24:28 +09:00
799a76de74
nghttpx: Lesser usage of DIE
2017-03-15 23:14:07 +09:00
b1fee8ff63
nghttpx: Use raw pointer for config
2017-03-15 23:13:14 +09:00
9cc223d419
nghttpx: Use constexpr
2017-03-15 23:12:50 +09:00
20edd64301
nghttpx: Handle return value of write(2)
2017-03-15 21:28:53 +09:00
9aee518352
nghttpx: Effectively revert ff64f64e1d
2017-03-15 00:07:57 +09:00
51b933c5f0
src: Use "Modern compatibility" ciphers by default
2017-03-11 23:58:52 +09:00
3e0e3f5459
src: Fix typo
2017-03-10 23:10:13 +09:00
fa074145a4
Merge pull request #788 from nghttp2/nghttpx-h2-proxy-pattern-match
...
nghttpx: Enable backend pattern matching with http2-proxy
2017-03-06 21:22:34 +09:00
b2d6550179
src: BoringSSL only requires CRYPTO_library_init
2017-03-05 21:36:52 +09:00
62dd1f5177
src: OpenSSL 1.1.0 does not require explicit initialization
2017-03-05 19:57:06 +09:00
a6dda5f91c
nghttpx: Log rstatus in hex
2017-03-01 23:21:11 +09:00
c1f7795dd6
nghttpx: Set close-on-exec flag on listener in worker process
2017-03-01 23:20:36 +09:00
4989e6e419
nghttpx: Don't call functions which are not async-signal-safe
...
.. after fork but before execv in multithreaded process.
2017-03-01 22:42:30 +09:00
d725255784
nghttp2_gzip: fix this statement may fall through [-Werror=implicit-fallthrough=] found by gcc7
2017-02-27 21:38:55 +01:00
373be22d7e
nghttpx: Simpler
2017-02-23 22:32:04 +09:00
b647a7c5b7
nghttpx: Simplify code using parse_uint
2017-02-23 22:22:49 +09:00
e1b8317ae8
nghttpx: Strip version number from server header field
2017-02-22 20:56:40 +09:00
2af57c3cfc
nghttpx: Add --single-worker option
...
Previously, nghttpx will use only one single thread inside the worker
process if --workers=1 (this is default). If --workers=N, N > 1, we
use additional threads for accepting connections, or API request
processing, etc.
With this commit, we use the same processing model for N > 1 even if N
== 1. To restore the original single thread execution mode,
--single-worker option is added. If threading is disabled
--single-worker is always true.
2017-02-21 22:19:34 +09:00
0c8b1a4f74
nghttpx: Fix bug that send_reply does not participate graceful shutdown
2017-02-21 21:27:57 +09:00
9d16292fe4
nghttpx: Add --frontend-max-requests option
2017-02-20 23:36:50 +09:00
e2b9590c0f
nghttpx: Enable stream-write-timeout by default
2017-02-20 22:18:49 +09:00
24fb640a55
nghttpx: Fix stream wtimer handling
2017-02-20 22:08:39 +09:00
450ffaa6f0
nghttpx: Add configrevision API endpoint
...
This commit adds configuration revision, which is considered opaque
string, and changes after reloading configuration with SIGHUP. This
revision is returned as a response to configrevision API endpoint.
This allows external application to know whether nghttpx has finished
reloading new configuration or not. Note that this revision does not
change on backendconfig API calls.
2017-02-19 23:40:06 +09:00
dc15832030
nghttpx: Refactor API downstream connection to allow more endpoints
2017-02-19 22:49:53 +09:00
a7c780a732
nghttpx: Redirect to HTTPS URI with redirect-if-not-tls param
...
This commit removes frontend-tls parameter, and adds
redirect-if-not-tls parameter parameter to --backend option. nghttpx
now responds to the request with 308 status code to redirect the
request to https URI if frontend connection is not TLS encrypted, and
redirect-if-no-tls parameter is used in --backend option. The port
number in Location header field is 443 by default (thus omitted), but
it can be configurable using --redirect-https-port option.
2017-02-18 22:32:27 +09:00
e06ed85747
nghttpx: Fix travis gcc compile error
2017-02-17 00:42:25 +09:00
83fd72c97e
nghttpx: Use std::chrono::duration_cast
2017-02-17 00:33:26 +09:00
ace40f298d
nghttpx: Update log time stamp in millisecond interval
2017-02-17 00:18:07 +09:00
1133cc0bbc
nghttpx: Don't call get_config() repeatedly
2017-02-16 23:41:23 +09:00
6960039aee
nghttpx: C++ style cast
2017-02-16 23:02:19 +09:00
bf5eeb831b
nghttpx: Better error message when private key and certificate are missing
2017-02-16 23:00:25 +09:00
e5b84fad09
nghttpx: Fix bug that old config is used during reloading config
2017-02-16 22:46:22 +09:00
cfb39171a7
nghttpx: Remove redundant StringRef ctor invocation
2017-02-16 22:45:55 +09:00
9e8d9d658a
src: Enable TLSv1.3 if OpenSSL supports it
...
If OpenSSL supports TLSv1.3, enable it by default for all applications
under src. BoringSSL can work at the moment although it does not
unlock all the features nghttpx offers. OpenSSL's TLSv1.3 support is
still WIP at the time of writing.
2017-02-15 22:34:53 +09:00
6ecfac6954
nghttpx: Parse default TLS min and max versions from string
2017-02-15 21:28:40 +09:00
56e86cd944
src: h2 requires >= TLSv1.2
2017-02-14 22:21:35 +09:00
b36e53cccd
nghttpx: Specify TLS protocol by version range
...
This commit deprecates --tls-proto-list option, and adds 2 new
options: --tls-min-proto-version and --tls-max-proto-version to
specify minimum and maximum protocol version respectively. Versions
between the two are enabled. The deprecated --tls-proto-list has
empty default value, and acts like enabling only specific protocol
versions in the range for now.
2017-02-14 00:01:09 +09:00
001d45efad
Merge branch 'nghttpx-graceful-sigusr2'
2017-02-12 23:52:03 +09:00
56c455bca4
nghttpx: Send SIGQUIT to the original master process
...
Previously, after sending SIGUSR2 to the original master process, and
the new master process gets ready, user has to send SIGQUIT to the
original master process to shut it down gracefully. With this commit,
the new master process sends SIGQUIT to the original master process
when it is ready to serve requests, eliminating for user to send
SIGQUIT manually.
This works nicely with systemd, because now you can replace nghttpx
binary with new one by "systemctl kill -s USR2 --kill-who=main
nghttpx".
2017-02-12 23:29:44 +09:00
4bf3cb2cc0
Revert "nghttpx: Don't capitalize h1 header fields"
...
This reverts commit f994664934
2017-02-12 23:27:38 +09:00
c78528d54b
nghttpx: Restrict HTTP major and minor in 0 or 1
2017-02-11 18:42:29 +09:00
f994664934
nghttpx: Don't capitalize h1 header fields
2017-02-11 18:41:52 +09:00
44e290da66
clang-format
2017-02-11 13:08:08 +09:00
8aed101585
Merge pull request #805 from pakdel/graceful_stop
...
graceful stop of nghttp2::asio_http2::server::http2
2017-02-11 13:07:10 +09:00
e44c58282e
Drop privilege of neverbleed daemon first
2017-02-10 17:43:19 +09:00
c02b1041d9
nghttpx: Use nullptr instead of NULL
2017-02-10 17:14:47 +09:00
23209baaf5
clang-format
2017-02-10 17:02:46 +09:00
9d2503f9c0
Merge pull request #802 from zdzichu/master
...
nghttpx: add systemd support
2017-02-10 16:17:01 +09:00
1c31213aef
More graceful stop of nghttp2::asio_http2::server::http2
...
Explicit io_service::stop() will prevent running streams from
finishing their task. That means if there are already reposnes
that we have called end(std::string) on them and they have not
finished sending back their data, they will be closed with a
NGHTTP2_INTERNAL_ERROR
Instead, we can stop accepting connections and destroy all
io_service::work objects to signals end of work.
2017-02-09 23:34:19 -05:00
fdb75ba5fe
nghttpx: add systemd support
...
Add systemd's Type=notify support by sending information about
master process PID around forks.
Add some hardening option to service unit.
2017-02-09 18:58:00 +01:00
8f888b29bd
clang-format
2017-02-09 21:00:47 +09:00
298808f276
Holding more shared_ptrs instead of raw ptrs to make sure called objects don't get deleted.
2017-02-09 21:00:11 +09:00
a231874e1e
Merge branch 'nghttpx-certs-per-sigalg'
2017-02-08 23:36:23 +09:00
2101f4ae3f
Merge branch 'mruby-send-1xx'
2017-02-08 22:18:11 +09:00
4a06f9684f
nghttpx: Fix crash on SIGHUP with multi thread configuration
2017-02-08 22:14:23 +09:00
9a85c5264a
nghttpx: Send 1xx non-final response using mruby script
2017-02-08 00:30:03 +09:00
68a724cf7b
nghttpx: Select certificate by client's supported signature algo
...
nghttpx supports multiple certificates using --subcert option.
Previously, SNI hostname is used to select certificate. With this
commit, signature algorithm presented by client is also taken into
consideration. nghttpx now accepts certificates which share the same
hostname (CN, SAN), but have different signature algorithm (e.g.,
ECDSA+SHA256, RSA+SHA256).
Currently, this feature requires OpenSSL >= 1.0.2. BoringSSL, and
LibreSSL do not work since they lack required APIs.
2017-02-04 23:37:24 +09:00
779ec50e73
Merge pull request #795 from clemahieu/close_stream_iterator
...
close_stream erases from streams_ while it's being iterated over.
2017-02-04 11:37:43 +09:00
1649948e78
asio: Add curly brackets to avoid possible well known issue
2017-02-04 11:33:21 +09:00
6d3e010ae7
Infinite loop in acceptor handler.
2017-02-04 11:31:12 +09:00
7dddac081e
clang-format
2017-02-04 11:29:10 +09:00
f0b6b9508d
close_stream erases from streams_ while it's being iterated over.
...
The destructor will already clean this structure up.
2017-02-03 01:36:18 -06:00
14ccb24be5
add support for link rel="preload" for --get-assets
2017-02-01 15:54:15 +01:00
025ec85144
Merge pull request #790 from nghttp2/nghttpx-backend-frontend-tls-parameter
...
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-31 21:49:51 +09:00
bd97886d8e
nghttpx: Use stack allocated buffer instead of making std::string
2017-01-29 22:11:33 +09:00
0b1ddad62b
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-28 22:19:14 +09:00
540853bde8
nghttpx: Fix typo
2017-01-28 22:18:17 +09:00
1cc08c0a51
nghttpx: Show warning if PSK options are used but not supported
2017-01-26 20:34:58 +09:00
16be89f9cc
nghttpx: Don't build PSK features with LibreSSL
...
LibreSSL removed PSK
Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
2017-01-26 20:21:55 +09:00
3ddc446ba2
nghttpx: Enable backend pattern matching with http2-proxy
2017-01-26 01:04:27 +09:00
b72c5f104e
h2load: Fix wrong req_stat updates
2017-01-26 00:26:35 +09:00
7e6eb7e02a
h2load: Explicitly count the number of requests left and inflight
2017-01-26 00:16:12 +09:00
ba9f2c3ae2
Compile with Android NDK r13b using clang
2017-01-23 00:32:51 +09:00
5311185333
nghttpx: Define the maximum number of digits in uint64_t
2017-01-22 22:33:52 +09:00
2fc2a27ac1
nghttpx: Use char instead of char[] if possible
2017-01-22 22:28:14 +09:00
db938afd66
nghttpx: Increase default backlog
2017-01-20 23:06:24 +09:00
89ddc47616
nghttpx: More constexpr
2017-01-20 23:04:48 +09:00
3176e872b3
nghttpx: Efficient access.log writer
...
Write integer to log buffer directly to improve efficiency. Remove
unused function templates. Use [first, last) style arguments for
copy() function templates.
2017-01-20 22:42:41 +09:00
16206d5f67
nghttp: Use std::unique_ptr for html_parser
2017-01-18 00:34:39 +09:00
0f33749790
nghttp: Take into account scheme and port when parsing HTML links
...
Previously, when parsing HTML links, we only take into account
overridden host. But we actually need more variables to consider. In
this commit, we take into account overridden scheme, host, and port to
parse HTML links.
2017-01-18 00:29:51 +09:00
5e7e4c0cc0
nghttp: config.headers should be inspected rather than req->req_nva
2017-01-17 23:00:37 +09:00
8f513fceca
Fix authority for --get-assets if IP adress is used in conjunction with user-defined :authority header
2017-01-17 21:14:36 +09:00
685e926494
nghttpx: Add --accesslog-write-early option
...
--accesslog-write-early option is analogous to HAProxy's logasap. If
used, nghttpx writes access log when response header fields are
received from backend rather than when request transaction finishes.
2017-01-13 22:12:21 +09:00
a2afd393ed
nghttpx: Remove field from LogSpec which can be got from Downstream
2017-01-11 22:30:12 +09:00
33aa327ef5
nghttpx: Fix access.log timestamp
...
access.log timestamp is now when request header fields are received,
rather than when access log is written.
2017-01-11 20:47:17 +09:00
9067ff5eee
nghttp: Use nghttp2::ssl::DEFAULT_CIPHER_LIST
2017-01-09 23:50:38 +09:00
efeede4192
nghttpx: Fix typo
2017-01-09 23:49:10 +09:00
6a8749873f
nghttpx: Add detailed TLS connection logging
2017-01-09 23:32:35 +09:00
9b574a5a76
nghttpx: Fix typo
2017-01-09 22:19:19 +09:00
Tatsuhiro Tsujikawa
Andrew Penkrat
Adam Gołębiowski
Tatsuhiro Tsujikawa
Don
Simon Frankenberger
Josh Braegger
Jeff 'Raid' Baitis
dawg
Pedro Santos
Alexandros Konstantinakis-Karmis
Bernard Spil
Dylan Plecki
Daniel Evers
Rick Lei
Dmitriy Vetutnev
Soham Sinha
Soham Sinha
Matt Way
Piotr Sikora
Alexis La Goutte
Amir Pakdel
Tomasz Torcz
clemahieu
Benedikt Christoph Wolters