a4a2b6403b
nghttpx: Use SHRPX_LOGF_TLS_* instead of SHRPX_LOGF_SSL_*
2017-04-18 22:34:08 +09:00
03be97e437
nghttpx: Rename ssl_* log variables as tls_*
...
The exiting ssl_* log variables still work for backward compatibility.
2017-04-18 22:11:05 +09:00
0a2d1965df
nghttpx: Fix path matching bug
...
Previously, if path is empty or path does not start with "/", nghttpx
did not try to match with wildcard pattern. This commit fixes it.
2017-04-18 21:03:50 +09:00
c8a5f1e335
nghttpx: SNI based backend server selection
2017-04-16 23:47:10 +09:00
a1bc83a2ba
Merge pull request #881 from mway/dev/request-priority
...
Support specifying stream priority via session::submit()
2017-04-12 23:36:40 +09:00
bc3949db9e
Support specifying stream priority via session::submit()
2017-04-12 10:07:16 -04:00
6cfa885207
nghttpx: Remove unused lambda capture
2017-04-12 22:09:44 +09:00
e61ac4682e
Merge branch 'nghttpx-xfp-take2'
2017-04-09 16:02:53 +09:00
4d10dce61d
nghttpx: Only send SCT for leaf certificate
2017-04-09 14:38:18 +09:00
2d9fd87029
nghttpx: Enable signed_certificate_timestamp extension for TLSv1.3
2017-04-09 14:11:49 +09:00
cc9190ab37
nghttpx: Add options for X-Forwarded-Proto header field
...
This commit adds 2 new options to handle X-Forwarded-Proto header
field. The --no-add-x-forwarded-proto option makes nghttpx not to
append X-Forwarded-Proto value. The
--no-strip-incoming-x-forwarded-proto option prevents nghttpx from
stripping the header field from client.
Previously, nghttpx always strips incoming header field, and set its
own header field. This commit preserves this behaviour, and adds
additional knobs.
2017-04-08 18:46:36 +09:00
980570de71
Revert "nghttpx: Add options for X-Forwarded-Proto header field"
...
This reverts commit 8c0b2c684a
2017-04-08 18:37:54 +09:00
46ccc4332c
nghttpx: Fix bug that 204 from h1 backend is always treated as error
2017-04-07 21:45:13 +09:00
4e6bd54dd1
Merge branch 'nghttpx-single-process'
2017-04-06 20:18:33 +09:00
5c9f46a6b0
Merge branch 'nghttp-verify-server-certificate'
2017-04-06 20:17:29 +09:00
223e971c7e
nghttpx: Add --single-process option
...
With --single-process option, nghttpx will run in a single process
mode where master and worker are unified into one process. nghttpx
still spawns additional process for neverbleed. In the single process
mode, signal handling is disabled.
2017-04-06 20:02:57 +09:00
8c0b2c684a
nghttpx: Add options for X-Forwarded-Proto header field
...
This commit adds 2 new options to handle X-Forwarded-Proto header
field. The --add-x-forwarded-proto option makes nghttpx append
X-Forwarded-Proto value. The --strip-incoming-x-forwarded-proto
option makes nghttpx to strip the header field from client.
Previously, nghttpx always strips incoming header field, and set its
own header field. This commit changes this behaviour. Now nghttpx
does not strip, and append X-Forwarded-Proto header field by default.
The X-Forwarded-For, and Forwarded header fields are also handled in
the same way. To recover the old behaviour, use
--add-x-forwarded-proto and --strip-incoming-x-forwarded-proto
options.
2017-04-06 19:17:36 +09:00
7ae0b2dc09
nghttp: Verify server certificate and show warning if it fails
2017-04-01 17:49:57 +09:00
058122b804
nghttpx: Rename shrpx_ssl.{h,cc} as shrpx_tls.{h,cc}
...
The namespace shrpx::ssl was also renamed as shrpx::tls.
2017-04-01 15:12:28 +09:00
69f63c529d
src: Rename ssl.{h,cc} as tls.{h,cc}
...
nghttp2::ssl namespace was also renamed as nghttp2::tls.
2017-04-01 15:12:28 +09:00
e17a6b29b6
nghttpx: Use 502 as server error code
2017-04-01 14:04:55 +09:00
b12c2a13c0
nghttpx: Fail handshake if server certificate verification fails
...
Previously, we drop connection if server certificate verification
fails after handshake. With this commit, we fail handshake if that
happens.
2017-04-01 13:41:41 +09:00
236c835abc
nghttpx: Don't enable SSL_MODE_AUTO_RETRY since we do non-blocking I/O
2017-04-01 12:05:07 +09:00
ad338bfa44
asio: Fix crash if connect takes longer time than ping interval
2017-03-31 21:17:57 +09:00
a899522679
asio: Fix compile error
2017-03-31 21:14:08 +09:00
b9b58c781e
nghttpx: Avoid extra TLS handshake calls
2017-03-30 22:23:55 +09:00
aa1eec4642
nghttpx: Cache client side session inside openssl callback
2017-03-30 21:07:58 +09:00
0c8d9469ea
nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl
2017-03-27 23:58:49 +09:00
079e1bdffc
Revert "nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl"
...
This reverts commit b4337d1b54
2017-03-27 23:47:24 +09:00
b4337d1b54
nghttpx: Use SSL_CTX_set_early_data_enabled with boringssl
2017-03-27 23:29:28 +09:00
dbe287ff5e
nghttpx: Print version number with -v option
2017-03-27 22:49:53 +09:00
041531458b
Merge pull request #858 from nghttp2/nghttpx-ai-addrconfig
...
nghttpx: Retry getaddrinfo without AI_ADDRCONFIG
2017-03-27 22:37:07 +09:00
1374bb81fd
nghttpx: Enable X25519 with boringssl
2017-03-27 21:18:44 +09:00
f41ac103d3
nghttpx: Retry getaddrinfo without AI_ADDRCONFIG
2017-03-27 00:20:42 +09:00
f6301714db
nghttpx: Avoid copy of std::mt19937 which is huge
2017-03-26 21:14:34 +09:00
7dc39b1ee9
nghttpx: Failing to listen on server socket is fatal error
2017-03-26 11:04:45 +09:00
696a7ce407
Merge pull request #856 from nghttp2/escape-access-log
...
Escape access log
2017-03-25 23:36:02 +09:00
99122ee7bb
nghttpx: Find illegal character in path for SPDY CONNECT method
2017-03-25 19:18:35 +09:00
19ee7ec794
nghttpx: Escape certain characters in access log
...
The certain characters coming from client are now escaped with "\xNN"
where NN is the ascii code of the character in hex notation.
2017-03-25 19:17:24 +09:00
cd9ec0d20f
src: BoringSSL supports SSL_CTX_set_{min,max}_proto_version.
...
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
2017-03-23 19:26:49 -07:00
e77883e980
nghttpx: Fix typo
2017-03-22 22:53:46 +09:00
0994c92550
nghttpx: Don't cache session server side if TLS version is 1.3
2017-03-22 21:34:13 +09:00
465c7208cc
nghttpx: Don't look up session ID if length is 0
2017-03-22 21:33:31 +09:00
b7e7a4bf26
asio: client: Send PING after 30 seconds idle
2017-03-20 18:37:56 +09:00
c7df65309b
nghttpx: Ignore further input if connection is going to close
2017-03-19 13:24:12 +09:00
26900262f3
Revert "nghttpx: Attempt to avoid TCP RST on socket closure on Linux"
...
This reverts commit f69b52b1aa
2017-03-18 22:43:30 +09:00
9b5ce36368
nghttpx: Reset write timer on write
2017-03-18 21:33:00 +09:00
f69b52b1aa
nghttpx: Attempt to avoid TCP RST on socket closure on Linux
2017-03-18 00:59:26 +09:00
1e1d908c12
nghttpx: Eliminate global std::random_device
2017-03-17 22:25:10 +09:00
6c69d675da
nghttpx: Should take reference
2017-03-17 22:24:32 +09:00
feabd6f739
nghttpx: Delete unused delete_bio_method
2017-03-15 23:37:39 +09:00
1ea590c364
nghttpx: Return new BIO_METHOD object with OpenSSL < 1.1.0
2017-03-15 23:36:38 +09:00
b21779e685
nghttpx: Use raw pointer for apis
2017-03-15 23:33:07 +09:00
12a4e7c3a2
src: Use raw pointer for ssl_global_locks
2017-03-15 23:24:28 +09:00
799a76de74
nghttpx: Lesser usage of DIE
2017-03-15 23:14:07 +09:00
b1fee8ff63
nghttpx: Use raw pointer for config
2017-03-15 23:13:14 +09:00
9cc223d419
nghttpx: Use constexpr
2017-03-15 23:12:50 +09:00
20edd64301
nghttpx: Handle return value of write(2)
2017-03-15 21:28:53 +09:00
9aee518352
nghttpx: Effectively revert ff64f64e1d
2017-03-15 00:07:57 +09:00
51b933c5f0
src: Use "Modern compatibility" ciphers by default
2017-03-11 23:58:52 +09:00
3e0e3f5459
src: Fix typo
2017-03-10 23:10:13 +09:00
fa074145a4
Merge pull request #788 from nghttp2/nghttpx-h2-proxy-pattern-match
...
nghttpx: Enable backend pattern matching with http2-proxy
2017-03-06 21:22:34 +09:00
b2d6550179
src: BoringSSL only requires CRYPTO_library_init
2017-03-05 21:36:52 +09:00
62dd1f5177
src: OpenSSL 1.1.0 does not require explicit initialization
2017-03-05 19:57:06 +09:00
a6dda5f91c
nghttpx: Log rstatus in hex
2017-03-01 23:21:11 +09:00
c1f7795dd6
nghttpx: Set close-on-exec flag on listener in worker process
2017-03-01 23:20:36 +09:00
4989e6e419
nghttpx: Don't call functions which are not async-signal-safe
...
.. after fork but before execv in multithreaded process.
2017-03-01 22:42:30 +09:00
d725255784
nghttp2_gzip: fix this statement may fall through [-Werror=implicit-fallthrough=] found by gcc7
2017-02-27 21:38:55 +01:00
373be22d7e
nghttpx: Simpler
2017-02-23 22:32:04 +09:00
b647a7c5b7
nghttpx: Simplify code using parse_uint
2017-02-23 22:22:49 +09:00
e1b8317ae8
nghttpx: Strip version number from server header field
2017-02-22 20:56:40 +09:00
2af57c3cfc
nghttpx: Add --single-worker option
...
Previously, nghttpx will use only one single thread inside the worker
process if --workers=1 (this is default). If --workers=N, N > 1, we
use additional threads for accepting connections, or API request
processing, etc.
With this commit, we use the same processing model for N > 1 even if N
== 1. To restore the original single thread execution mode,
--single-worker option is added. If threading is disabled
--single-worker is always true.
2017-02-21 22:19:34 +09:00
0c8b1a4f74
nghttpx: Fix bug that send_reply does not participate graceful shutdown
2017-02-21 21:27:57 +09:00
9d16292fe4
nghttpx: Add --frontend-max-requests option
2017-02-20 23:36:50 +09:00
e2b9590c0f
nghttpx: Enable stream-write-timeout by default
2017-02-20 22:18:49 +09:00
24fb640a55
nghttpx: Fix stream wtimer handling
2017-02-20 22:08:39 +09:00
450ffaa6f0
nghttpx: Add configrevision API endpoint
...
This commit adds configuration revision, which is considered opaque
string, and changes after reloading configuration with SIGHUP. This
revision is returned as a response to configrevision API endpoint.
This allows external application to know whether nghttpx has finished
reloading new configuration or not. Note that this revision does not
change on backendconfig API calls.
2017-02-19 23:40:06 +09:00
dc15832030
nghttpx: Refactor API downstream connection to allow more endpoints
2017-02-19 22:49:53 +09:00
a7c780a732
nghttpx: Redirect to HTTPS URI with redirect-if-not-tls param
...
This commit removes frontend-tls parameter, and adds
redirect-if-not-tls parameter parameter to --backend option. nghttpx
now responds to the request with 308 status code to redirect the
request to https URI if frontend connection is not TLS encrypted, and
redirect-if-no-tls parameter is used in --backend option. The port
number in Location header field is 443 by default (thus omitted), but
it can be configurable using --redirect-https-port option.
2017-02-18 22:32:27 +09:00
e06ed85747
nghttpx: Fix travis gcc compile error
2017-02-17 00:42:25 +09:00
83fd72c97e
nghttpx: Use std::chrono::duration_cast
2017-02-17 00:33:26 +09:00
ace40f298d
nghttpx: Update log time stamp in millisecond interval
2017-02-17 00:18:07 +09:00
1133cc0bbc
nghttpx: Don't call get_config() repeatedly
2017-02-16 23:41:23 +09:00
6960039aee
nghttpx: C++ style cast
2017-02-16 23:02:19 +09:00
bf5eeb831b
nghttpx: Better error message when private key and certificate are missing
2017-02-16 23:00:25 +09:00
e5b84fad09
nghttpx: Fix bug that old config is used during reloading config
2017-02-16 22:46:22 +09:00
cfb39171a7
nghttpx: Remove redundant StringRef ctor invocation
2017-02-16 22:45:55 +09:00
9e8d9d658a
src: Enable TLSv1.3 if OpenSSL supports it
...
If OpenSSL supports TLSv1.3, enable it by default for all applications
under src. BoringSSL can work at the moment although it does not
unlock all the features nghttpx offers. OpenSSL's TLSv1.3 support is
still WIP at the time of writing.
2017-02-15 22:34:53 +09:00
6ecfac6954
nghttpx: Parse default TLS min and max versions from string
2017-02-15 21:28:40 +09:00
56e86cd944
src: h2 requires >= TLSv1.2
2017-02-14 22:21:35 +09:00
b36e53cccd
nghttpx: Specify TLS protocol by version range
...
This commit deprecates --tls-proto-list option, and adds 2 new
options: --tls-min-proto-version and --tls-max-proto-version to
specify minimum and maximum protocol version respectively. Versions
between the two are enabled. The deprecated --tls-proto-list has
empty default value, and acts like enabling only specific protocol
versions in the range for now.
2017-02-14 00:01:09 +09:00
001d45efad
Merge branch 'nghttpx-graceful-sigusr2'
2017-02-12 23:52:03 +09:00
56c455bca4
nghttpx: Send SIGQUIT to the original master process
...
Previously, after sending SIGUSR2 to the original master process, and
the new master process gets ready, user has to send SIGQUIT to the
original master process to shut it down gracefully. With this commit,
the new master process sends SIGQUIT to the original master process
when it is ready to serve requests, eliminating for user to send
SIGQUIT manually.
This works nicely with systemd, because now you can replace nghttpx
binary with new one by "systemctl kill -s USR2 --kill-who=main
nghttpx".
2017-02-12 23:29:44 +09:00
4bf3cb2cc0
Revert "nghttpx: Don't capitalize h1 header fields"
...
This reverts commit f994664934
2017-02-12 23:27:38 +09:00
c78528d54b
nghttpx: Restrict HTTP major and minor in 0 or 1
2017-02-11 18:42:29 +09:00
f994664934
nghttpx: Don't capitalize h1 header fields
2017-02-11 18:41:52 +09:00
44e290da66
clang-format
2017-02-11 13:08:08 +09:00
8aed101585
Merge pull request #805 from pakdel/graceful_stop
...
graceful stop of nghttp2::asio_http2::server::http2
2017-02-11 13:07:10 +09:00
e44c58282e
Drop privilege of neverbleed daemon first
2017-02-10 17:43:19 +09:00
c02b1041d9
nghttpx: Use nullptr instead of NULL
2017-02-10 17:14:47 +09:00
23209baaf5
clang-format
2017-02-10 17:02:46 +09:00
9d2503f9c0
Merge pull request #802 from zdzichu/master
...
nghttpx: add systemd support
2017-02-10 16:17:01 +09:00
1c31213aef
More graceful stop of nghttp2::asio_http2::server::http2
...
Explicit io_service::stop() will prevent running streams from
finishing their task. That means if there are already reposnes
that we have called end(std::string) on them and they have not
finished sending back their data, they will be closed with a
NGHTTP2_INTERNAL_ERROR
Instead, we can stop accepting connections and destroy all
io_service::work objects to signals end of work.
2017-02-09 23:34:19 -05:00
fdb75ba5fe
nghttpx: add systemd support
...
Add systemd's Type=notify support by sending information about
master process PID around forks.
Add some hardening option to service unit.
2017-02-09 18:58:00 +01:00
8f888b29bd
clang-format
2017-02-09 21:00:47 +09:00
298808f276
Holding more shared_ptrs instead of raw ptrs to make sure called objects don't get deleted.
2017-02-09 21:00:11 +09:00
a231874e1e
Merge branch 'nghttpx-certs-per-sigalg'
2017-02-08 23:36:23 +09:00
2101f4ae3f
Merge branch 'mruby-send-1xx'
2017-02-08 22:18:11 +09:00
4a06f9684f
nghttpx: Fix crash on SIGHUP with multi thread configuration
2017-02-08 22:14:23 +09:00
9a85c5264a
nghttpx: Send 1xx non-final response using mruby script
2017-02-08 00:30:03 +09:00
68a724cf7b
nghttpx: Select certificate by client's supported signature algo
...
nghttpx supports multiple certificates using --subcert option.
Previously, SNI hostname is used to select certificate. With this
commit, signature algorithm presented by client is also taken into
consideration. nghttpx now accepts certificates which share the same
hostname (CN, SAN), but have different signature algorithm (e.g.,
ECDSA+SHA256, RSA+SHA256).
Currently, this feature requires OpenSSL >= 1.0.2. BoringSSL, and
LibreSSL do not work since they lack required APIs.
2017-02-04 23:37:24 +09:00
779ec50e73
Merge pull request #795 from clemahieu/close_stream_iterator
...
close_stream erases from streams_ while it's being iterated over.
2017-02-04 11:37:43 +09:00
1649948e78
asio: Add curly brackets to avoid possible well known issue
2017-02-04 11:33:21 +09:00
6d3e010ae7
Infinite loop in acceptor handler.
2017-02-04 11:31:12 +09:00
7dddac081e
clang-format
2017-02-04 11:29:10 +09:00
f0b6b9508d
close_stream erases from streams_ while it's being iterated over.
...
The destructor will already clean this structure up.
2017-02-03 01:36:18 -06:00
14ccb24be5
add support for link rel="preload" for --get-assets
2017-02-01 15:54:15 +01:00
025ec85144
Merge pull request #790 from nghttp2/nghttpx-backend-frontend-tls-parameter
...
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-31 21:49:51 +09:00
bd97886d8e
nghttpx: Use stack allocated buffer instead of making std::string
2017-01-29 22:11:33 +09:00
0b1ddad62b
nghttpx: Add frontend-tls parameter to backend to require client TLS
2017-01-28 22:19:14 +09:00
540853bde8
nghttpx: Fix typo
2017-01-28 22:18:17 +09:00
1cc08c0a51
nghttpx: Show warning if PSK options are used but not supported
2017-01-26 20:34:58 +09:00
16be89f9cc
nghttpx: Don't build PSK features with LibreSSL
...
LibreSSL removed PSK
Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
2017-01-26 20:21:55 +09:00
3ddc446ba2
nghttpx: Enable backend pattern matching with http2-proxy
2017-01-26 01:04:27 +09:00
b72c5f104e
h2load: Fix wrong req_stat updates
2017-01-26 00:26:35 +09:00
7e6eb7e02a
h2load: Explicitly count the number of requests left and inflight
2017-01-26 00:16:12 +09:00
ba9f2c3ae2
Compile with Android NDK r13b using clang
2017-01-23 00:32:51 +09:00
5311185333
nghttpx: Define the maximum number of digits in uint64_t
2017-01-22 22:33:52 +09:00
2fc2a27ac1
nghttpx: Use char instead of char[] if possible
2017-01-22 22:28:14 +09:00
db938afd66
nghttpx: Increase default backlog
2017-01-20 23:06:24 +09:00
89ddc47616
nghttpx: More constexpr
2017-01-20 23:04:48 +09:00
3176e872b3
nghttpx: Efficient access.log writer
...
Write integer to log buffer directly to improve efficiency. Remove
unused function templates. Use [first, last) style arguments for
copy() function templates.
2017-01-20 22:42:41 +09:00
16206d5f67
nghttp: Use std::unique_ptr for html_parser
2017-01-18 00:34:39 +09:00
0f33749790
nghttp: Take into account scheme and port when parsing HTML links
...
Previously, when parsing HTML links, we only take into account
overridden host. But we actually need more variables to consider. In
this commit, we take into account overridden scheme, host, and port to
parse HTML links.
2017-01-18 00:29:51 +09:00
5e7e4c0cc0
nghttp: config.headers should be inspected rather than req->req_nva
2017-01-17 23:00:37 +09:00
8f513fceca
Fix authority for --get-assets if IP adress is used in conjunction with user-defined :authority header
2017-01-17 21:14:36 +09:00
685e926494
nghttpx: Add --accesslog-write-early option
...
--accesslog-write-early option is analogous to HAProxy's logasap. If
used, nghttpx writes access log when response header fields are
received from backend rather than when request transaction finishes.
2017-01-13 22:12:21 +09:00
a2afd393ed
nghttpx: Remove field from LogSpec which can be got from Downstream
2017-01-11 22:30:12 +09:00
33aa327ef5
nghttpx: Fix access.log timestamp
...
access.log timestamp is now when request header fields are received,
rather than when access log is written.
2017-01-11 20:47:17 +09:00
9067ff5eee
nghttp: Use nghttp2::ssl::DEFAULT_CIPHER_LIST
2017-01-09 23:50:38 +09:00
efeede4192
nghttpx: Fix typo
2017-01-09 23:49:10 +09:00
6a8749873f
nghttpx: Add detailed TLS connection logging
2017-01-09 23:32:35 +09:00
9b574a5a76
nghttpx: Fix typo
2017-01-09 22:19:19 +09:00
0567f1f038
Add constexpr to StringRef(const CharT *, size_t)
2017-01-09 21:15:53 +09:00
4be5de1163
src: Move log related functions from util.cc to shrpx_log.cc
2017-01-09 19:34:40 +09:00
9db1c9467c
src: Add constexpr to long_options
2017-01-09 19:28:00 +09:00
3444b42d44
src: Add more constexpr
2017-01-09 17:17:48 +09:00
6595ae26ea
src: Add constexpr to const objects
2017-01-09 17:11:37 +09:00
7e1a0d204b
h2load: Show default cipher list in -h
2017-01-09 14:47:32 +09:00
cbca2e35b5
nghttpx: Show default cipher list in -h
2017-01-09 14:43:13 +09:00
Tatsuhiro Tsujikawa
Matt Way
Piotr Sikora
Alexis La Goutte
Amir Pakdel
Tomasz Torcz
clemahieu
Benedikt Christoph Wolters
Bernard Spil