Commit Graph

310 Commits

Author SHA1 Message Date
Tatsuhiro Tsujikawa a7c780a732 nghttpx: Redirect to HTTPS URI with redirect-if-not-tls param
This commit removes frontend-tls parameter, and adds
redirect-if-not-tls parameter parameter to --backend option.  nghttpx
now responds to the request with 308 status code to redirect the
request to https URI if frontend connection is not TLS encrypted, and
redirect-if-no-tls parameter is used in --backend option.  The port
number in Location header field is 443 by default (thus omitted), but
it can be configurable using --redirect-https-port option.
2017-02-18 22:32:27 +09:00
Tatsuhiro Tsujikawa cfb39171a7 nghttpx: Remove redundant StringRef ctor invocation 2017-02-16 22:45:55 +09:00
Tatsuhiro Tsujikawa b36e53cccd nghttpx: Specify TLS protocol by version range
This commit deprecates --tls-proto-list option, and adds 2 new
options: --tls-min-proto-version and --tls-max-proto-version to
specify minimum and maximum protocol version respectively.  Versions
between the two are enabled.  The deprecated --tls-proto-list has
empty default value, and acts like enabling only specific protocol
versions in the range for now.
2017-02-14 00:01:09 +09:00
Tatsuhiro Tsujikawa 0b1ddad62b nghttpx: Add frontend-tls parameter to backend to require client TLS 2017-01-28 22:19:14 +09:00
Tatsuhiro Tsujikawa 1cc08c0a51 nghttpx: Show warning if PSK options are used but not supported 2017-01-26 20:34:58 +09:00
Bernard Spil 16be89f9cc nghttpx: Don't build PSK features with LibreSSL
LibreSSL removed PSK

Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
2017-01-26 20:21:55 +09:00
Tatsuhiro Tsujikawa 685e926494 nghttpx: Add --accesslog-write-early option
--accesslog-write-early option is analogous to HAProxy's logasap.  If
used, nghttpx writes access log when response header fields are
received from backend rather than when request transaction finishes.
2017-01-13 22:12:21 +09:00
Tatsuhiro Tsujikawa 9b574a5a76 nghttpx: Fix typo 2017-01-09 22:19:19 +09:00
Tatsuhiro Tsujikawa 9c7e54d9b5 nghttpx: Add client-ciphers option
Previously, ciphers option sets cipher list for both frontend and
backend TLS connections.  With this commit, ciphers option only sets
cipher list for frontend connections.  The new client-ciphers option
sets cipher list for backend connection.
2017-01-08 22:40:58 +09:00
Tatsuhiro Tsujikawa 3c03024881 nghttpx: Add client-no-http2-cipher-black-list option
This commit adds client-no-http2-cipher-black-list option to disable
enforcement of HTTP/2 cipher black list on backend HTTP/2 connection.
Previously, existing no-http2-cipher-black-list option disables it for
both frontend and backend connections.  Now no-http2-cipher-black-list
option only disables it for frontend connection.
2017-01-08 22:33:19 +09:00
Tatsuhiro Tsujikawa 36dfc0a56a nghttpx: Reorganize client side TLS configuration 2017-01-08 22:25:30 +09:00
Tatsuhiro Tsujikawa 79a24f5dd9 nghttpx: Add --client-psk-secret option to enable PSK in backend 2017-01-08 00:35:55 +09:00
Tatsuhiro Tsujikawa 83c759572c nghttpx: Add --psk-secret option to enable PSK in frontend connection 2017-01-08 00:35:54 +09:00
Tatsuhiro Tsujikawa b313386988 nghttpx: Add proxyproto to frontend option to accept PROXY protocol
Previously, global accept-proxy-protocol option enables PROXY protocol
support for all frontend listeners, but this was inflexible.  To fix
this issue, accept-proxy-protocol option is now deprecated, and
instead proxyproto parameter in frontend option enables PROXY protocol
support per frontend.
2017-01-03 12:47:03 +09:00
Tatsuhiro Tsujikawa 3c600c103f nghttpx: Add frontend-keep-alive-timeout option 2016-12-23 11:01:29 +09:00
Tatsuhiro Tsujikawa a06a8c36a4 nghttpx: Add --dns-lookup-timeout and --dns-max-try options 2016-12-11 00:50:16 +09:00
Tatsuhiro Tsujikawa d66377d4b6 nghttpx: Add dns-cache-timeout option
This option controls how long cached DNS entries remain valid.
2016-12-10 21:09:51 +09:00
Tatsuhiro Tsujikawa 38b5cad4e3 nghttpx: Lookup backend host name dynamically
We have added "dns" parameter to backend option.  If specified, name
lookup is done dynamically.  If not, name lookup is done at start up,
or configuration reloading.  nghttpx caches DNS result including error
case in 30 seconds in this commit.  Later commit makes this
configurable.

DNS resolution is done asynchronously using c-ares library.
2016-12-10 21:09:50 +09:00
Tatsuhiro Tsujikawa 3a831fa95c nghttpx: Fix file descriptor leak in read_tls_sct_from_dir 2016-10-24 20:30:30 +09:00
Tatsuhiro Tsujikawa 8b64e7b4e1 src: Add XSI-compliant version strerror_r 2016-10-16 22:47:56 +09:00
Tatsuhiro Tsujikawa 0cf6848646 clang-format-3.9 2016-10-15 18:36:04 +09:00
Tatsuhiro Tsujikawa 00a8c378d4 nghttpx: Add --backend-connect-timeout option 2016-10-10 22:50:41 +09:00
Tatsuhiro Tsujikawa 412c8f9e67 nghttpx: Add TLS signed_certificate_timestamp extension support 2016-10-09 18:43:36 +09:00
Tatsuhiro Tsujikawa 8babaac8c3 nghttpx: Add --ecdh-curves option to specify list of named curves
This option requires OpenSSL >= 1.0.2.  With OpenSSL 1.0.2, the
default value is "P-256".  With OpenSSL 1.1.0 or later, the default
value is "X25519:P-256".
2016-10-08 10:50:56 +09:00
Tatsuhiro Tsujikawa 9439ba75d3 nghttpx: Fix heap-use-after-free when executing new binary 2016-10-04 00:32:02 +09:00
Tatsuhiro Tsujikawa dba0d2791c nghttpx: Use emplace_back instead of push_back 2016-10-03 22:09:46 +09:00
Tatsuhiro Tsujikawa 8efccddcf4 nghttpx: Use StringRef for HttpProxy 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa 97843e3874 nghttpx: Use StringRef for tls_proto_list 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa 5dd2704051 nghttpx: Use StringRef for tls.npn_list 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa de7b7fd440 nghttpx: Use StringRef for tls.subcerts 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa 1037d3ad26 nghttpx: Use StringRef for tls.ticket.files 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa c4368a9416 nghttpx: Use StringRef for AltSvc fields 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa fdc1eb526b nghttpx: Use HeaderRefs for add_request_headers and add_response_headers 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa 99a91e3172 nghttpx: Add BlockAllocator to Config object 2016-10-03 22:09:45 +09:00
Tatsuhiro Tsujikawa 272cfa320e nghttpx: Use BlockAllocator per DownstreamConfig 2016-10-02 22:28:43 +09:00
Tatsuhiro Tsujikawa f4016644a9 nghttpx: Add option to specify HPACK encoder/decoder dynamic table size 2016-09-12 22:53:02 +09:00
Tatsuhiro Tsujikawa 456038e3de nghttpx: Fix compile error with gcc 2016-09-10 16:51:35 +09:00
Tatsuhiro Tsujikawa f5a2f1da25 nghttpx: Add --frontend-http2-window-size option, and its family
We added --frontend-http2-window-size,
--frontend-http2-connection-window-size, --backend-http2-window-size,
and --backend-http2-connection-window-size option to replace existing
*-bits options.  The old options are not flexible because they only
specify number of bits.  Now we can specify integer value, with
possible g, m, and k unit.  The old options are still available for
backend compatibility, but are deprecated.
2016-09-10 16:27:48 +09:00
Tatsuhiro Tsujikawa 27b250ac8e nghttpx: Add experimental TCP optimization for h2 frontend 2016-09-10 16:27:48 +09:00
Tatsuhiro Tsujikawa 136aae725f nghttpx: Add --no-server-rewrite option not to rewrite server header field 2016-08-31 23:47:15 +09:00
Tatsuhiro Tsujikawa 13d3f785bd Make ImmutableString(const std::string&) explicit 2016-08-26 22:52:08 +09:00
Tatsuhiro Tsujikawa 39c068974d Make ImmutableString(const char*) explicit 2016-08-26 22:40:59 +09:00
Tatsuhiro Tsujikawa 0d4d1a63d4 nghttpx: Add --server-name option to change server response header field 2016-08-26 22:28:09 +09:00
Tatsuhiro Tsujikawa ad3d43b8be nghttpx: Add access log variable for backend host and port
Use $backend_host and $backend_port.  $backend_host is backend host
name given in --backend option.  It could be a path to UNIX domain
socket.
2016-08-05 00:04:47 +09:00
Tatsuhiro Tsujikawa 8c3e864989 nghttpx: Define ~Config for automatic clean up with std::unique_ptr
Now config global is backed with std::unique_ptr.  configuration
swapping dance is now a bit cleaner, but YMMV.
2016-07-31 19:01:29 +09:00
Tatsuhiro Tsujikawa 1214f9e23b nghttpx: Reload configuration with SIGHUP
This commit implements configuration reloading with SIGHUP.
There are rough edges left:

* Rename SignalServer with more meaningful name, say, WorkerProcess.
* We should introduce global configuration object which is not
  affected by configuration reloading.  It should hold cmdcfgs, argc,
  argv, and last worker PID.
* We should close the listener file descriptor when some operation was
  failed after that.
2016-07-31 15:57:41 +09:00
Tatsuhiro Tsujikawa 30f26a2b9d nghttpx: Explicitly cast to uint32_t for hash calculation 2016-07-06 23:58:53 +09:00
Tatsuhiro Tsujikawa 2bbe4422d2 nghttpx: Use consistent hashing for client IP based session affinity
We use technique described in https://github.com/RJ/ketama
2016-07-06 23:31:10 +09:00
Tatsuhiro Tsujikawa aa16412850 nghttpx: Add --backend-max-backoff option 2016-06-22 00:13:43 +09:00
Tatsuhiro Tsujikawa e2bdf1d734 nghttpx: Enforce the fact that api and healthmon are mutually exclusive 2016-06-21 22:44:26 +09:00