b36e53cccd
nghttpx: Specify TLS protocol by version range
...
This commit deprecates --tls-proto-list option, and adds 2 new
options: --tls-min-proto-version and --tls-max-proto-version to
specify minimum and maximum protocol version respectively. Versions
between the two are enabled. The deprecated --tls-proto-list has
empty default value, and acts like enabling only specific protocol
versions in the range for now.
2017-02-14 00:01:09 +09:00
001d45efad
Merge branch 'nghttpx-graceful-sigusr2'
2017-02-12 23:52:03 +09:00
56c455bca4
nghttpx: Send SIGQUIT to the original master process
...
Previously, after sending SIGUSR2 to the original master process, and
the new master process gets ready, user has to send SIGQUIT to the
original master process to shut it down gracefully. With this commit,
the new master process sends SIGQUIT to the original master process
when it is ready to serve requests, eliminating for user to send
SIGQUIT manually.
This works nicely with systemd, because now you can replace nghttpx
binary with new one by "systemctl kill -s USR2 --kill-who=main
nghttpx".
2017-02-12 23:29:44 +09:00
4bf3cb2cc0
Revert "nghttpx: Don't capitalize h1 header fields"
...
This reverts commit f994664934
2017-02-12 23:27:38 +09:00
c78528d54b
nghttpx: Restrict HTTP major and minor in 0 or 1
2017-02-11 18:42:29 +09:00
f994664934
nghttpx: Don't capitalize h1 header fields
2017-02-11 18:41:52 +09:00
44e290da66
clang-format
2017-02-11 13:08:08 +09:00
8aed101585
Merge pull request #805 from pakdel/graceful_stop
...
graceful stop of nghttp2::asio_http2::server::http2
2017-02-11 13:07:10 +09:00
e44c58282e
Drop privilege of neverbleed daemon first
2017-02-10 17:43:19 +09:00
c02b1041d9
nghttpx: Use nullptr instead of NULL
2017-02-10 17:14:47 +09:00
23209baaf5
clang-format
2017-02-10 17:02:46 +09:00
9d2503f9c0
Merge pull request #802 from zdzichu/master
...
nghttpx: add systemd support
2017-02-10 16:17:01 +09:00
1c31213aef
More graceful stop of nghttp2::asio_http2::server::http2
...
Explicit io_service::stop() will prevent running streams from
finishing their task. That means if there are already reposnes
that we have called end(std::string) on them and they have not
finished sending back their data, they will be closed with a
NGHTTP2_INTERNAL_ERROR
Instead, we can stop accepting connections and destroy all
io_service::work objects to signals end of work.
2017-02-09 23:34:19 -05:00
fdb75ba5fe
nghttpx: add systemd support
...
Add systemd's Type=notify support by sending information about
master process PID around forks.
Add some hardening option to service unit.
2017-02-09 18:58:00 +01:00
8f888b29bd
clang-format
2017-02-09 21:00:47 +09:00
298808f276
Holding more shared_ptrs instead of raw ptrs to make sure called objects don't get deleted.
2017-02-09 21:00:11 +09:00
a231874e1e
Merge branch 'nghttpx-certs-per-sigalg'
2017-02-08 23:36:23 +09:00
2101f4ae3f
Merge branch 'mruby-send-1xx'
2017-02-08 22:18:11 +09:00
4a06f9684f
nghttpx: Fix crash on SIGHUP with multi thread configuration
2017-02-08 22:14:23 +09:00
9a85c5264a
nghttpx: Send 1xx non-final response using mruby script
2017-02-08 00:30:03 +09:00
68a724cf7b
nghttpx: Select certificate by client's supported signature algo
...
nghttpx supports multiple certificates using --subcert option.
Previously, SNI hostname is used to select certificate. With this
commit, signature algorithm presented by client is also taken into
consideration. nghttpx now accepts certificates which share the same
hostname (CN, SAN), but have different signature algorithm (e.g.,
ECDSA+SHA256, RSA+SHA256).
Currently, this feature requires OpenSSL >= 1.0.2. BoringSSL, and
LibreSSL do not work since they lack required APIs.
2017-02-04 23:37:24 +09:00
779ec50e73
Merge pull request #795 from clemahieu/close_stream_iterator
...
close_stream erases from streams_ while it's being iterated over.
2017-02-04 11:37:43 +09:00
1649948e78
asio: Add curly brackets to avoid possible well known issue
2017-02-04 11:33:21 +09:00
6d3e010ae7
Infinite loop in acceptor handler.
2017-02-04 11:31:12 +09:00
7dddac081e
clang-format
2017-02-04 11:29:10 +09:00
f0b6b9508d
close_stream erases from streams_ while it's being iterated over.
...
The destructor will already clean this structure up.
2017-02-03 01:36:18 -06:00
14ccb24be5
add support for link rel="preload" for --get-assets
2017-02-01 15:54:15 +01:00
025ec85144
Merge pull request #790 from nghttp2/nghttpx-backend-frontend-tls-parameter
...
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-31 21:49:51 +09:00
bd97886d8e
nghttpx: Use stack allocated buffer instead of making std::string
2017-01-29 22:11:33 +09:00
0b1ddad62b
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-28 22:19:14 +09:00
540853bde8
nghttpx: Fix typo
2017-01-28 22:18:17 +09:00
1cc08c0a51
nghttpx: Show warning if PSK options are used but not supported
2017-01-26 20:34:58 +09:00
16be89f9cc
nghttpx: Don't build PSK features with LibreSSL
...
LibreSSL removed PSK
Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
2017-01-26 20:21:55 +09:00
3ddc446ba2
nghttpx: Enable backend pattern matching with http2-proxy
2017-01-26 01:04:27 +09:00
b72c5f104e
h2load: Fix wrong req_stat updates
2017-01-26 00:26:35 +09:00
7e6eb7e02a
h2load: Explicitly count the number of requests left and inflight
2017-01-26 00:16:12 +09:00
ba9f2c3ae2
Compile with Android NDK r13b using clang
2017-01-23 00:32:51 +09:00
5311185333
nghttpx: Define the maximum number of digits in uint64_t
2017-01-22 22:33:52 +09:00
2fc2a27ac1
nghttpx: Use char instead of char[] if possible
2017-01-22 22:28:14 +09:00
db938afd66
nghttpx: Increase default backlog
2017-01-20 23:06:24 +09:00
89ddc47616
nghttpx: More constexpr
2017-01-20 23:04:48 +09:00
3176e872b3
nghttpx: Efficient access.log writer
...
Write integer to log buffer directly to improve efficiency. Remove
unused function templates. Use [first, last) style arguments for
copy() function templates.
2017-01-20 22:42:41 +09:00
16206d5f67
nghttp: Use std::unique_ptr for html_parser
2017-01-18 00:34:39 +09:00
0f33749790
nghttp: Take into account scheme and port when parsing HTML links
...
Previously, when parsing HTML links, we only take into account
overridden host. But we actually need more variables to consider. In
this commit, we take into account overridden scheme, host, and port to
parse HTML links.
2017-01-18 00:29:51 +09:00
5e7e4c0cc0
nghttp: config.headers should be inspected rather than req->req_nva
2017-01-17 23:00:37 +09:00
8f513fceca
Fix authority for --get-assets if IP adress is used in conjunction with user-defined :authority header
2017-01-17 21:14:36 +09:00
685e926494
nghttpx: Add --accesslog-write-early option
...
--accesslog-write-early option is analogous to HAProxy's logasap. If
used, nghttpx writes access log when response header fields are
received from backend rather than when request transaction finishes.
2017-01-13 22:12:21 +09:00
a2afd393ed
nghttpx: Remove field from LogSpec which can be got from Downstream
2017-01-11 22:30:12 +09:00
33aa327ef5
nghttpx: Fix access.log timestamp
...
access.log timestamp is now when request header fields are received,
rather than when access log is written.
2017-01-11 20:47:17 +09:00
9067ff5eee
nghttp: Use nghttp2::ssl::DEFAULT_CIPHER_LIST
2017-01-09 23:50:38 +09:00
efeede4192
nghttpx: Fix typo
2017-01-09 23:49:10 +09:00
6a8749873f
nghttpx: Add detailed TLS connection logging
2017-01-09 23:32:35 +09:00
9b574a5a76
nghttpx: Fix typo
2017-01-09 22:19:19 +09:00
0567f1f038
Add constexpr to StringRef(const CharT *, size_t)
2017-01-09 21:15:53 +09:00
4be5de1163
src: Move log related functions from util.cc to shrpx_log.cc
2017-01-09 19:34:40 +09:00
9db1c9467c
src: Add constexpr to long_options
2017-01-09 19:28:00 +09:00
3444b42d44
src: Add more constexpr
2017-01-09 17:17:48 +09:00
6595ae26ea
src: Add constexpr to const objects
2017-01-09 17:11:37 +09:00
7e1a0d204b
h2load: Show default cipher list in -h
2017-01-09 14:47:32 +09:00
cbca2e35b5
nghttpx: Show default cipher list in -h
2017-01-09 14:43:13 +09:00
fc9bdf024f
src: Make DEFAULT_CIPHER_LIST constexpr char[]
2017-01-09 14:42:40 +09:00
4fa150c494
nghttpx: Use Memchunk based read buffer for frontend connection
...
Previously, we have dedicated read buffer for each frontend
connection. With this commit, the buffer spaces are only used when
needed, and pooled if they are not used. This reduces memory usage
for idle client connections.
2017-01-08 23:20:14 +09:00
e8b2508036
nghttpx: Rename confusing names in HttpDownstreamConnection
2017-01-08 23:09:00 +09:00
ac399e41ac
nghttpx: Update doc
...
Mention client-ciphers, and no-http2-cipher-black-list options in
psk-secrets and client-psk-secrets options.
2017-01-08 23:04:07 +09:00
9c7e54d9b5
nghttpx: Add client-ciphers option
...
Previously, ciphers option sets cipher list for both frontend and
backend TLS connections. With this commit, ciphers option only sets
cipher list for frontend connections. The new client-ciphers option
sets cipher list for backend connection.
2017-01-08 22:40:58 +09:00
3c03024881
nghttpx: Add client-no-http2-cipher-black-list option
...
This commit adds client-no-http2-cipher-black-list option to disable
enforcement of HTTP/2 cipher black list on backend HTTP/2 connection.
Previously, existing no-http2-cipher-black-list option disables it for
both frontend and backend connections. Now no-http2-cipher-black-list
option only disables it for frontend connection.
2017-01-08 22:33:19 +09:00
36dfc0a56a
nghttpx: Reorganize client side TLS configuration
2017-01-08 22:25:30 +09:00
55bf6cdb15
Merge branch 'nghttpx-psk'
2017-01-08 21:10:07 +09:00
0abc220013
nghttpx: Fix the bug that no-http2-cipher-black-list does not work
...
Because of the redundant check in backend HTTP/2 session,
no-http2-cipher-black-list does not work on backend HTTP/2 connection.
This commit fixes it.
2017-01-08 19:43:24 +09:00
c28900990a
h2load: Show custom server temp key such as X25519
2017-01-08 17:58:19 +09:00
5108193d7b
h2load: Fix incorrect return value from spdylay_send_callback
2017-01-08 17:32:35 +09:00
79a24f5dd9
nghttpx: Add --client-psk-secret option to enable PSK in backend
2017-01-08 00:35:55 +09:00
83c759572c
nghttpx: Add --psk-secret option to enable PSK in frontend connection
2017-01-08 00:35:54 +09:00
1a07fb000b
nghttpx: Enable SCT with OpenSSL 1.1.0
2017-01-06 21:29:04 +09:00
b064d8a9ff
Merge branch 'nghttpx-fronend-proxyproto'
2017-01-03 17:28:20 +09:00
c6827a7dac
nghttpx: Fix assertion error in libev ev_io_start
2017-01-03 16:43:49 +09:00
55ecb082ee
nghttpx: Handle c-ares success without result
2017-01-03 14:35:05 +09:00
b313386988
nghttpx: Add proxyproto to frontend option to accept PROXY protocol
...
Previously, global accept-proxy-protocol option enables PROXY protocol
support for all frontend listeners, but this was inflexible. To fix
this issue, accept-proxy-protocol option is now deprecated, and
instead proxyproto parameter in frontend option enables PROXY protocol
support per frontend.
2017-01-03 12:47:03 +09:00
3933280d29
src: Fix assertion error with boringssl
...
boringssl says:
/* It is an error to clear any bits that have already been set. (We can't try
* to get a second close_notify or send two.) */
assert((SSL_get_shutdown(ssl) & mode) == SSL_get_shutdown(ssl));
2017-01-02 11:48:38 +09:00
d1ba43a69f
nghttpx: Fix bug that DNS timeout was erroneously disabled
2016-12-30 11:09:02 +09:00
a0779edec4
nghttpx: Fix bug that DNS timeout was ignored
2016-12-30 11:08:26 +09:00
25df164219
nghttpx: Don't write again after failure
...
Plain write(2) is OK, but SSL_write requires same arguments on retry.
It would be better to avoid calling them again.
2016-12-26 00:35:38 +09:00
bcfa333322
nghttpx: Refactor h1 backend retry code
2016-12-25 22:19:51 +09:00
c4aeadd57d
nghttpx: Retry h1 backend request if first write fails
2016-12-25 22:19:51 +09:00
e6b4454e48
Merge branch 'nghttpx-better-early-final-response-handling'
2016-12-24 23:02:52 +09:00
3226d21609
Merge pull request #755 from nghttp2/nghttpx-h1-frontend-keep-alive-timeout
...
nghttpx: Add frontend-keep-alive-timeout option
2016-12-24 23:01:17 +09:00
3d20c2dce6
nghttpx: Feed read event rather than calling on_read
...
on_read may fail, but we failed to check its return value most of the
places. This is because failure means deletion of ClientHandler, but
because of architecture, we cannot delete it. Feeding read event is
better since we can move call on_read from libev callback. We can
delete ClientHandler form there.
2016-12-24 22:57:59 +09:00
cd83d70e7b
nghttpx: Don't reset stream if we have already received response
2016-12-24 22:54:22 +09:00
a0ce5ea9ab
nghttpx: Keep reading after backend write failed
...
Because of bidirectional nature of TCP, we may fail write(2), but have
still pending read in TCP buffer, which may contain response body. To
forward them, we should keep reading until get EOF from backend.
To avoid stalling HTTP/1 upload when request buffer is full, and we
have received complete response from backend, drop connection in that
case.
2016-12-24 22:50:02 +09:00
3c600c103f
nghttpx: Add frontend-keep-alive-timeout option
2016-12-23 11:01:29 +09:00
841ac75c3e
nghttpx: Clarify that backend-keep-alive-timeout applies to h1 only
2016-12-23 10:49:39 +09:00
359730af54
Fix regression in ff64f64e1d
2016-12-21 23:19:10 +09:00
049e064e28
nghttpx: New error log format
...
To debug multi threaded configuration easier, we added current PID and
thread ID to error log. Previously, we didn't add date and time if
log level is NOTICE. In this change, we always write date and time
regardless of log level.
2016-12-20 23:13:19 +09:00
0463928a1e
nghttpx: Fix uninitialized errors found by coverity scan
2016-12-18 22:16:52 +09:00
02d34c8c4c
nghttpx: Fix dead code found by coverity scan
2016-12-18 22:14:26 +09:00
cab0a76795
Use pkg-config to detect libxml2
2016-12-18 00:20:30 +09:00
22bd9fb530
nghttpx: Set DNS cache expire date for error and ok statuses only
2016-12-11 11:49:24 +09:00
c487cd888f
nghttpx: Periodically remove expired DNS cache entries
2016-12-11 10:42:54 +09:00
fd403a85c8
nghttpx: Just return DNS_STATUS_ERROR
...
At the moment, we use both resolvers, and if either one is not
DNS_STATUS_IDLE, the other one is also not DNS_STATUS_IDLE. This may
change if we are going to configure DNS so that either A or AAAA
lookup is done. In that case, it is better to just return
DNS_STATUS_ERROR in the diff. This is because the calling side does
not expect DNS_STATUS_IDLE in that case.
2016-12-11 10:39:19 +09:00
a06a8c36a4
nghttpx: Add --dns-lookup-timeout and --dns-max-try options
2016-12-11 00:50:16 +09:00
0967ee9cb9
nghttpx: Better logging for DNS resolver
2016-12-10 23:10:18 +09:00
d66d34f9b9
Add libc-ares detection to cmake
2016-12-10 22:40:18 +09:00
264a98d106
nghttpx: Call c-ares initialization/cleanup functions
2016-12-10 21:41:03 +09:00
d66377d4b6
nghttpx: Add dns-cache-timeout option
...
This option controls how long cached DNS entries remain valid.
2016-12-10 21:09:51 +09:00
38b5cad4e3
nghttpx: Lookup backend host name dynamically
...
We have added "dns" parameter to backend option. If specified, name
lookup is done dynamically. If not, name lookup is done at start up,
or configuration reloading. nghttpx caches DNS result including error
case in 30 seconds in this commit. Later commit makes this
configurable.
DNS resolution is done asynchronously using c-ares library.
2016-12-10 21:09:50 +09:00
b6a9cf9ffa
nghttpx: Accept and ignore content-length: 0 in 204 response for now
2016-12-03 14:57:48 +09:00
85ba33c08f
nghttpx: Wait for child process to exit
...
Normally, we don't have wait for child process to exit, since init can
take care of them. But in containerized environment, pid 0 init might
not be available, and defunct processes can be piled up. This commit
ensures that OCSP and neverbleed processes are waited for before
worker process exits.
2016-11-30 22:59:02 +09:00
ff64f64e1d
nghttpx: Faster HTTP/1 frontend
2016-11-29 20:42:27 +09:00
2ff31bdd2b
nghttpx: Remove redundant check
2016-11-26 22:34:24 +09:00
2fa3d34af1
nghttpx: Use Connection::again_rt() in MemcachedConnection
2016-11-26 19:45:23 +09:00
fa3452ec68
nghttpx: Use Connection::again_rt() in LiveCheck
2016-11-26 19:45:23 +09:00
7451f2f212
nghttpx: Fix frequent crash with --backend-http-proxy-uri
2016-11-26 19:45:23 +09:00
e9ab75a386
nghttpx: Robust backend read timeout
2016-11-26 19:45:23 +09:00
d83949bc88
asio: server: Call on_close callback on connection close
2016-11-21 22:43:23 +09:00
50f42a80c9
nghttpx: Fix bug that mishandles response header from h1 backend
2016-11-18 22:33:29 +09:00
2b75aff32e
nghttpx: Fix bug that zero-length POST is not forwarded
2016-11-11 00:48:32 +09:00
f4474d57ec
nghttpx: Fix compile error with gcc
2016-11-07 23:11:52 +09:00
8471c9e92e
nghttpx: Parse te header field a bit more properly
2016-11-07 22:47:48 +09:00
f5a4c9d971
nghttpx: Don't copy non-final nva since they are backed by Downstream
2016-11-04 22:06:01 +09:00
a0dd8918eb
nghttpx: Don't mutate *_key_prev_ in add_header
2016-11-04 22:04:42 +09:00
baa9b1cac0
nghttpx: Remove optional reason-phrase from SPDY :status
2016-11-04 21:16:45 +09:00
38443d2195
nghttpx: Small optimization
2016-11-04 21:13:22 +09:00
208d71561a
src: Add missing mandatory SP after status code
2016-11-04 02:19:37 +09:00
25fbc7b435
nghttpx: Reset flags as well
2016-11-04 02:00:50 +09:00
6bd95d885d
Merge pull request #723 from nghttp2/strict-http-framing
...
Strict http framing
2016-11-03 23:30:38 +09:00
6bcdb178a5
nghttpx: Header key and value must be string in mruby script
2016-11-03 22:58:45 +09:00
5e10cc4cad
nghttpx: Use gc save/restore around downcase method
2016-11-03 22:47:52 +09:00
95e6c875f0
nghttpx: Use mrb_ary_ref instead of mrb_ary_entry
2016-11-03 22:44:42 +09:00
6eb2829ee8
nghttpx: Strip content-length with 204 or 200 to CONNECT in mruby
2016-11-03 22:25:15 +09:00
e082b7be72
nghttpx: Strict handling for Content-Length or Transfer-Encoding in h1
...
We now treat Content-Length or Transfer-Encoding as error if they come
with 204 or 1xx status code, or 200 to a CONNECT request in HTTP/1
response.
2016-11-03 17:00:05 +09:00
da01d8dedb
nghttpx: Delete outdated comment
2016-11-03 16:48:24 +09:00
d448eb54f9
Fix compilation with BoringSSL
2016-10-27 10:00:52 +00:00
46d1e6bb55
nghttpx: Increase block size of connection wide allocator to 512
2016-10-24 21:06:37 +09:00
3a831fa95c
nghttpx: Fix file descriptor leak in read_tls_sct_from_dir
2016-10-24 20:30:30 +09:00
5b9cacc2d7
nghttpx: Discard iaddrs early
2016-10-23 19:55:58 +09:00
10a84f3e3d
nghttpx: Rename errbuf for neverbleed as nb_errbuf for clarification
2016-10-23 19:26:22 +09:00
c42715ed6a
nghttpx: Fix compile error with --disable-threads
2016-10-23 19:26:22 +09:00
177d51ddab
nghttpx: Use thread_local if it is available
2016-10-23 19:26:22 +09:00
6c882e1ece
asio: Avoid repeated call of io_service::post
2016-10-20 22:12:31 +09:00
f09c5c4bf9
xsi_strerror: Use stddef.h so that we can use size_t
2016-10-19 23:50:28 +09:00
08a9a2eca9
asio: Fix bug when end() is called outside nghttp2 callback
2016-10-19 23:17:43 +09:00
19f1785cde
nghttpx: Avoid extra allocation on look up host key
2016-10-18 22:19:53 +09:00
8b64e7b4e1
src: Add XSI-compliant version strerror_r
2016-10-16 22:47:56 +09:00
3de2654223
src: Add noexcept to move constructor and assignment operator
2016-10-15 18:51:22 +09:00
0cf6848646
clang-format-3.9
2016-10-15 18:36:04 +09:00
1a37044d3c
nghttpx: Use pre-allocated buffer for timestamp string
2016-10-11 22:32:26 +09:00
00a8c378d4
nghttpx: Add --backend-connect-timeout option
2016-10-10 22:50:41 +09:00
7549341081
Fix typo
2016-10-10 15:35:12 +09:00
5db8473f12
Fix build error with OpenSSL < 1.0.2 (again)
2016-10-09 19:34:32 +09:00
00b89f10bd
Fix build error with OpenSSL < 1.0.2
2016-10-09 18:54:18 +09:00
Tatsuhiro Tsujikawa
Amir Pakdel
Tomasz Torcz
clemahieu
Benedikt Christoph Wolters
Bernard Spil
dalf