@@ -404,6 +404,7 @@ the server configuration chosen by SNI; in case of the , , +, and directives involved in processing request header fields, diff --git a/xml/ru/docs/http/ngx_http_core_module.xml b/xml/ru/docs/http/ngx_http_core_module.xml --- a/xml/ru/docs/http/ngx_http_core_module.xml +++ b/xml/ru/docs/http/ngx_http_core_module.xml @@ -10,7 +10,7 @@ + rev="108">

@@ -1774,6 +1774,30 @@ location = /user { + +????? +1000 +http +server +1.27.1 + + +???????????? ???????????? ?????????? ????? ????? ????????? ??????? ???????. +??? ?????????? ?????????? ??????????? ??????? ???????????? ?????? +. + + + +???? ????????? ??????? ?? ?????? , +?? ????? ?????????????? ???????? ?? ??????? ?? ?????????. +????????? ??. ? ??????? +?????? +???????????? ????????. + + + + + ????? diff --git a/xml/ru/docs/http/server_names.xml b/xml/ru/docs/http/server_names.xml --- a/xml/ru/docs/http/server_names.xml +++ b/xml/ru/docs/http/server_names.xml @@ -8,7 +8,7 @@

@@ -408,7 +408,8 @@ server { ? ?????? ????????????? ???????? , - +, + ? , ??????? ????????? ? ????????? ????? ????????? ???????, -- Maxim Dounin http://mdounin.ru/ From maksim.yevmenkin at gmail.com Thu May 23 18:22:17 2024 From: maksim.yevmenkin at gmail.com (Maksim Yevmenkin) Date: Thu, 23 May 2024 11:22:17 -0700 Subject: limiting number of HTTP request headers In-Reply-To: References: Message-ID: hello! [...] > Looking more into it while writing tests and docs, I tend to think > that just "max_headers" would be enough, similarly to > "ignore_invalid_headers" and "underscores_in_headers". > > Mostly identical patch below (s/max_client_headers/max_headers/), > as well as tests and docs. I'm going to commit these shortly > unless there are objections. > > Thanks for prodding this! no objections, thank you! max From mdounin at mdounin.ru Thu May 23 22:17:27 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 24 May 2024 01:17:27 +0300 Subject: [nginx] Added max_headers directive. Message-ID: details: http://freenginx.org/hg/nginx/rev/199dc0d6b05b branches: changeset: 9275:199dc0d6b05b user: Maxim Dounin date: Fri May 24 00:20:01 2024 +0300 description: Added max_headers directive. The directive limits the number of request headers accepted from clients. While the total amount of headers is believed to be sufficiently limited by the existing buffer size limits (client_header_buffer_size and large_client_header_buffers), the additional limit on the number of headers might be beneficial to better protect backend servers. Requested by Maksim Yevmenkin. diffstat: src/http/ngx_http_core_module.c | 10 ++++++++++ src/http/ngx_http_core_module.h | 2 ++ src/http/ngx_http_request.c | 9 +++++++++ src/http/ngx_http_request.h | 1 + src/http/v2/ngx_http_v2.c | 9 +++++++++ src/http/v3/ngx_http_v3_request.c | 9 +++++++++ 6 files changed, 40 insertions(+), 0 deletions(-) diffs (114 lines): diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -252,6 +252,13 @@ static ngx_command_t ngx_http_core_comm offsetof(ngx_http_core_srv_conf_t, large_client_header_buffers), NULL }, + { ngx_string("max_headers"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, + ngx_conf_set_num_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_core_srv_conf_t, max_headers), + NULL }, + { ngx_string("ignore_invalid_headers"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, ngx_conf_set_flag_slot, @@ -3463,6 +3470,7 @@ ngx_http_core_create_srv_conf(ngx_conf_t cscf->request_pool_size = NGX_CONF_UNSET_SIZE; cscf->client_header_timeout = NGX_CONF_UNSET_MSEC; cscf->client_header_buffer_size = NGX_CONF_UNSET_SIZE; + cscf->max_headers = NGX_CONF_UNSET_UINT; cscf->ignore_invalid_headers = NGX_CONF_UNSET; cscf->merge_slashes = NGX_CONF_UNSET; cscf->underscores_in_headers = NGX_CONF_UNSET; @@ -3504,6 +3512,8 @@ ngx_http_core_merge_srv_conf(ngx_conf_t return NGX_CONF_ERROR; } + ngx_conf_merge_uint_value(conf->max_headers, prev->max_headers, 1000); + ngx_conf_merge_value(conf->ignore_invalid_headers, prev->ignore_invalid_headers, 1); diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h --- a/src/http/ngx_http_core_module.h +++ b/src/http/ngx_http_core_module.h @@ -198,6 +198,8 @@ typedef struct { ngx_msec_t client_header_timeout; + ngx_uint_t max_headers; + ngx_flag_t ignore_invalid_headers; ngx_flag_t merge_slashes; ngx_flag_t underscores_in_headers; diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -1466,6 +1466,15 @@ ngx_http_process_request_headers(ngx_eve /* a header line has been parsed successfully */ + if (r->headers_in.count++ >= cscf->max_headers) { + r->lingering_close = 1; + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent too many header lines"); + ngx_http_finalize_request(r, + NGX_HTTP_REQUEST_HEADER_TOO_LARGE); + break; + } + h = ngx_list_push(&r->headers_in.headers); if (h == NULL) { ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h --- a/src/http/ngx_http_request.h +++ b/src/http/ngx_http_request.h @@ -182,6 +182,7 @@ typedef struct { typedef struct { ngx_list_t headers; + ngx_uint_t count; ngx_table_elt_t *host; ngx_table_elt_t *connection; diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c @@ -1814,6 +1814,15 @@ ngx_http_v2_state_process_header(ngx_htt } } else { + cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); + + if (r->headers_in.count++ >= cscf->max_headers) { + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, + "client sent too many header lines"); + ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE); + goto error; + } + h = ngx_list_push(&r->headers_in.headers); if (h == NULL) { return ngx_http_v2_connection_error(h2c, diff --git a/src/http/v3/ngx_http_v3_request.c b/src/http/v3/ngx_http_v3_request.c --- a/src/http/v3/ngx_http_v3_request.c +++ b/src/http/v3/ngx_http_v3_request.c @@ -657,6 +657,15 @@ ngx_http_v3_process_header(ngx_http_requ } } else { + cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); + + if (r->headers_in.count++ >= cscf->max_headers) { + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, + "client sent too many header lines"); + ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE); + return NGX_ERROR; + } + h = ngx_list_push(&r->headers_in.headers); if (h == NULL) { ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); From mdounin at mdounin.ru Thu May 23 22:17:44 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 24 May 2024 01:17:44 +0300 Subject: [nginx-tests] Tests: max_client_headers test. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/2d58bb10ff5d branches: changeset: 1979:2d58bb10ff5d user: Maxim Dounin date: Fri May 24 00:36:12 2024 +0300 description: Tests: max_client_headers test. diffstat: h2_max_headers.t | 92 +++++++++++++++++++++++++++++++++++++++++++ h3_max_headers.t | 112 +++++++++++++++++++++++++++++++++++++++++++++++++++++ http_max_headers.t | 73 ++++++++++++++++++++++++++++++++++ 3 files changed, 277 insertions(+), 0 deletions(-) diffs (292 lines): diff --git a/h2_max_headers.t b/h2_max_headers.t new file mode 100644 --- /dev/null +++ b/h2_max_headers.t @@ -0,0 +1,92 @@ +#!/usr/bin/perl + +# (C) Maxim Dounin + +# Tests for max_headers directive, HTTP/2. + +############################################################################### + +use warnings; +use strict; + +use Test::More; +use Socket qw/ CRLF /; + +BEGIN { use FindBin; chdir($FindBin::Bin); } + +use lib 'lib'; +use Test::Nginx; +use Test::Nginx::HTTP2; + +############################################################################### + +select STDERR; $| = 1; +select STDOUT; $| = 1; + +my $t = Test::Nginx->new()->has(qw/http http_v2 rewrite/); + +$t->write_file_expand('nginx.conf', <<'EOF'); + +%%TEST_GLOBALS%% + +daemon off; + +events { +} + +http { + %%TEST_GLOBALS_HTTP%% + + server { + listen 127.0.0.1:8080; + server_name localhost; + + http2 on; + max_headers 5; + + location / { + return 204; + } + } +} + +EOF + +$t->try_run('no max_headers')->plan(3); + +############################################################################### + +like(get('/'), qr/ 204/, 'two headers'); +like(get('/', ('Foo: bar') x 3), qr/ 204/, 'five headers'); +like(get('/', ('Foo: bar') x 4), qr/ 400/, 'six headers rejected'); + +############################################################################### + +sub get { + my ($url, @headers) = @_; + + my $s = Test::Nginx::HTTP2->new(); + my $sid = $s->new_stream({ + headers => [ + { name => ':method', value => 'GET' }, + { name => ':scheme', value => 'http' }, + { name => ':path', value => $url }, + { name => ':authority', value => 'localhost' }, + { name => 'foo', value => 'bar', mode => 2 }, + { name => 'foo', value => 'bar', mode => 2 }, + map { + my ($n, $v) = split /:/; + { name => lc $n, value => $v, mode => 2 }; + } @headers + ] + }); + + my $frames = $s->read(all => [{ sid => $sid, fin => 1 }]); + + my ($frame) = grep { $_->{type} eq "HEADERS" } @$frames; + + return join("\n", map { "$_: " . $frame->{headers}->{$_}; } + keys %{$frame->{headers}}); +} + +############################################################################### diff --git a/h3_max_headers.t b/h3_max_headers.t new file mode 100644 --- /dev/null +++ b/h3_max_headers.t @@ -0,0 +1,112 @@ +#!/usr/bin/perl + +# (C) Maxim Dounin + +# Tests for max_headers directive, HTTP/3. + +############################################################################### + +use warnings; +use strict; + +use Test::More; +use Socket qw/ CRLF /; + +BEGIN { use FindBin; chdir($FindBin::Bin); } + +use lib 'lib'; +use Test::Nginx; +use Test::Nginx::HTTP3; + +############################################################################### + +select STDERR; $| = 1; +select STDOUT; $| = 1; + +my $t = Test::Nginx->new()->has(qw/http http_v3 rewrite cryptx/); + +$t->write_file_expand('nginx.conf', <<'EOF'); + +%%TEST_GLOBALS%% + +daemon off; + +events { +} + +http { + %%TEST_GLOBALS_HTTP%% + + ssl_certificate localhost.crt; + ssl_certificate_key localhost.key; + + server { + listen 127.0.0.1:%%PORT_8980_UDP%% quic; + server_name localhost; + + max_headers 5; + + location / { + return 204; + } + } +} + +EOF + +$t->write_file('openssl.conf', <testdir(); + +foreach my $name ('localhost') { + system('openssl req -x509 -new ' + . "-config $d/openssl.conf -subj /CN=$name/ " + . "-out $d/$name.crt -keyout $d/$name.key " + . ">>$d/openssl.out 2>&1") == 0 + or die "Can't create certificate for $name: $!\n"; +} + +$t->try_run('no max_headers')->plan(3); + +############################################################################### + +like(get('/'), qr/ 204/, 'two headers'); +like(get('/', ('Foo: bar') x 3), qr/ 204/, 'five headers'); +like(get('/', ('Foo: bar') x 4), qr/ 400/, 'six headers rejected'); + +############################################################################### + +sub get { + my ($url, @headers) = @_; + + my $s = Test::Nginx::HTTP3->new(); + my $sid = $s->new_stream({ + headers => [ + { name => ':method', value => 'GET' }, + { name => ':scheme', value => 'http' }, + { name => ':path', value => $url }, + { name => ':authority', value => 'localhost' }, + { name => 'foo', value => 'bar' }, + { name => 'foo', value => 'bar' }, + map { + my ($n, $v) = split /:/; + { name => lc $n, value => $v }; + } @headers + ] + }); + + my $frames = $s->read(all => [{ sid => $sid, fin => 1 }]); + + my ($frame) = grep { $_->{type} eq "HEADERS" } @$frames; + + return join("\n", map { "$_: " . $frame->{headers}->{$_}; } + keys %{$frame->{headers}}); +} + +############################################################################### diff --git a/http_max_headers.t b/http_max_headers.t new file mode 100644 --- /dev/null +++ b/http_max_headers.t @@ -0,0 +1,73 @@ +#!/usr/bin/perl + +# (C) Maxim Dounin + +# Tests for max_headers directive. + +############################################################################### + +use warnings; +use strict; + +use Test::More; +use Socket qw/ CRLF /; + +BEGIN { use FindBin; chdir($FindBin::Bin); } + +use lib 'lib'; +use Test::Nginx; + +############################################################################### + +select STDERR; $| = 1; +select STDOUT; $| = 1; + +my $t = Test::Nginx->new()->has(qw/http rewrite/); + +$t->write_file_expand('nginx.conf', <<'EOF'); + +%%TEST_GLOBALS%% + +daemon off; + +events { +} + +http { + %%TEST_GLOBALS_HTTP%% + + server { + listen 127.0.0.1:8080; + server_name localhost; + + max_headers 5; + + location / { + return 204; + } + } +} + +EOF + +$t->try_run('no max_headers')->plan(3); + +############################################################################### + +like(get('/'), qr/ 204/, 'two headers'); +like(get('/', ('Foo: bar') x 3), qr/ 204/, 'five headers'); +like(get('/', ('Foo: bar') x 4), qr/ 400/, 'six headers rejected'); + +############################################################################### + +sub get { + my ($url, @headers) = @_; + return http( + "GET $url HTTP/1.1" . CRLF . + 'Host: localhost' . CRLF . + 'Connection: close' . CRLF . + join(CRLF, @headers) . CRLF . CRLF + ); +} + +############################################################################### From mdounin at mdounin.ru Thu May 23 22:20:03 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 24 May 2024 01:20:03 +0300 Subject: [nginx-site] Documented max_headers directive. Message-ID: details: http://freenginx.org/hg/nginx-site/rev/3b5594157fab branches: changeset: 3083:3b5594157fab user: Maxim Dounin date: Fri May 24 01:16:29 2024 +0300 description: Documented max_headers directive. diffstat: xml/en/docs/http/ngx_http_core_module.xml | 27 ++++++++++++++++++++++++++- xml/en/docs/http/server_names.xml | 3 ++- xml/ru/docs/http/ngx_http_core_module.xml | 26 +++++++++++++++++++++++++- xml/ru/docs/http/server_names.xml | 5 +++-- 4 files changed, 56 insertions(+), 5 deletions(-) diffs (129 lines): diff --git a/xml/en/docs/http/ngx_http_core_module.xml b/xml/en/docs/http/ngx_http_core_module.xml --- a/xml/en/docs/http/ngx_http_core_module.xml +++ b/xml/en/docs/http/ngx_http_core_module.xml @@ -10,7 +10,7 @@ + rev="108">

@@ -1778,6 +1778,31 @@ Enables or disables logging of subreques + +number +1000 +http +server +1.27.1 + + +Limits the maximum allowed number of client request header fields. +If the limit is exceeded, the + +error is returned to the client. + + + +If the directive is specified on the level, +the value from the default server can be used. +Details are provided in the +?Virtual +server selection? section. + + + + + number diff --git a/xml/en/docs/http/server_names.xml b/xml/en/docs/http/server_names.xml --- a/xml/en/docs/http/server_names.xml +++ b/xml/en/docs/http/server_names.xml @@ -8,7 +8,7 @@

@@ -408,7 +408,8 @@ server { ? ?????? ????????????? ???????? , - +, + ? , ??????? ????????? ? ????????? ????? ????????? ???????, From mdounin at mdounin.ru Fri May 24 00:54:13 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 24 May 2024 03:54:13 +0300 Subject: [nginx] Upstream: $upstream_cache_key variable. Message-ID: details: http://freenginx.org/hg/nginx/rev/5e7588d2d9cc branches: changeset: 9276:5e7588d2d9cc user: Kirill A. Korinsky date: Thu May 23 18:48:32 2024 +0300 description: Upstream: $upstream_cache_key variable. diffstat: src/http/ngx_http_upstream.c | 49 ++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 49 insertions(+), 0 deletions(-) diffs (73 lines): diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c @@ -23,6 +23,8 @@ static ngx_int_t ngx_http_upstream_cache ngx_http_upstream_t *u); static ngx_int_t ngx_http_upstream_cache_status(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data); +static ngx_int_t ngx_http_upstream_cache_key(ngx_http_request_t *r, + ngx_http_variable_value_t *v, uintptr_t data); static ngx_int_t ngx_http_upstream_cache_last_modified(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data); static ngx_int_t ngx_http_upstream_cache_etag(ngx_http_request_t *r, @@ -414,6 +416,10 @@ static ngx_http_variable_t ngx_http_ups ngx_http_upstream_cache_status, 0, NGX_HTTP_VAR_NOCACHEABLE, 0 }, + { ngx_string("upstream_cache_key"), NULL, + ngx_http_upstream_cache_key, 0, + NGX_HTTP_VAR_NOCACHEABLE, 0 }, + { ngx_string("upstream_cache_last_modified"), NULL, ngx_http_upstream_cache_last_modified, 0, NGX_HTTP_VAR_NOCACHEABLE|NGX_HTTP_VAR_NOHASH, 0 }, @@ -6004,6 +6010,49 @@ ngx_http_upstream_cache_status(ngx_http_ static ngx_int_t +ngx_http_upstream_cache_key(ngx_http_request_t *r, + ngx_http_variable_value_t *v, uintptr_t data) +{ + u_char *p; + size_t len; + ngx_str_t *key; + ngx_uint_t i; + ngx_http_cache_t *c; + + if (r->cache == NULL || r->cache->keys.nelts == 0) { + v->not_found = 1; + return NGX_OK; + } + + c = r->cache; + + len = 0; + key = c->keys.elts; + + for (i = 0; i < c->keys.nelts; i++) { + len += key[i].len; + } + + p = ngx_pnalloc(r->pool, len); + if (p == NULL) { + return NGX_ERROR; + } + + v->len = len; + v->valid = 1; + v->no_cacheable = 0; + v->not_found = 0; + v->data = p; + + for (i = 0; i < c->keys.nelts; i++) { + p = ngx_cpymem(p, key[i].data, key[i].len); + } + + return NGX_OK; +} + + +static ngx_int_t ngx_http_upstream_cache_last_modified(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data) { From mdounin at mdounin.ru Fri May 24 15:57:13 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 24 May 2024 18:57:13 +0300 Subject: [PATCH] Removed incorrect NGX_SUPPRESS_WARN usage Message-ID: # HG changeset patch # User Maxim Dounin # Date 1716562380 -10800 # Fri May 24 17:53:00 2024 +0300 # Node ID e2b22024f6a1c102b3a42016f184cd09e2a49067 # Parent 5e7588d2d9cc8be293eae25f27a319721623db81 Removed incorrect NGX_SUPPRESS_WARN usage. The len variable in ngx_http_variable_unknown_header() needs to be initialized to 0, as it is incremented by subsequent code. diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c --- a/src/http/ngx_http_variables.c +++ b/src/http/ngx_http_variables.c @@ -932,9 +932,7 @@ ngx_http_variable_unknown_header(ngx_htt ngx_table_elt_t *header, *h, **ph; ph = &h; -#if (NGX_SUPPRESS_WARN) len = 0; -#endif header = part->elts; From mdounin at mdounin.ru Sat May 25 00:48:25 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Sat, 25 May 2024 03:48:25 +0300 Subject: [PATCH] Tests: logging of certificate subjects instead of issuers Message-ID: # HG changeset patch # User Maxim Dounin # Date 1716597895 -10800 # Sat May 25 03:44:55 2024 +0300 # Node ID d732a96e05dfcad72b03eb82170e9bd08b2e6aae # Parent 2d58bb10ff5d78c07563af5d120a881c6e106c99 Tests: logging of certificate subjects instead of issuers. diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm --- a/lib/Test/Nginx.pm +++ b/lib/Test/Nginx.pm @@ -881,7 +881,7 @@ sub http_start($;%) { or die $IO::Socket::SSL::SSL_ERROR . "\n"; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } log_out($request); diff --git a/lib/Test/Nginx/IMAP.pm b/lib/Test/Nginx/IMAP.pm --- a/lib/Test/Nginx/IMAP.pm +++ b/lib/Test/Nginx/IMAP.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/POP3.pm b/lib/Test/Nginx/POP3.pm --- a/lib/Test/Nginx/POP3.pm +++ b/lib/Test/Nginx/POP3.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/SMTP.pm b/lib/Test/Nginx/SMTP.pm --- a/lib/Test/Nginx/SMTP.pm +++ b/lib/Test/Nginx/SMTP.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/Stream.pm b/lib/Test/Nginx/Stream.pm --- a/lib/Test/Nginx/Stream.pm +++ b/lib/Test/Nginx/Stream.pm @@ -63,7 +63,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); From mdounin at mdounin.ru Sun May 26 23:21:24 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Mon, 27 May 2024 02:21:24 +0300 Subject: [nginx-site] Documented $upstream_cache_key. Message-ID: details: http://freenginx.org/hg/nginx-site/rev/0bbf14c9fd66 branches: changeset: 3084:0bbf14c9fd66 user: Maxim Dounin date: Fri May 24 03:49:10 2024 +0300 description: Documented $upstream_cache_key. diffstat: xml/en/docs/http/ngx_http_upstream_module.xml | 8 +++++++- xml/ru/docs/http/ngx_http_upstream_module.xml | 8 +++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diffs (50 lines): diff --git a/xml/en/docs/http/ngx_http_upstream_module.xml b/xml/en/docs/http/ngx_http_upstream_module.xml --- a/xml/en/docs/http/ngx_http_upstream_module.xml +++ b/xml/en/docs/http/ngx_http_upstream_module.xml @@ -10,7 +10,7 @@ + rev="90">

@@ -574,6 +574,12 @@ are separated by commas and colons like $upstream_addr variable. +$upstream_cache_key + + +the cache key being used (1.27.1). + + $upstream_cache_status

diff --git a/xml/ru/docs/http/ngx_http_upstream_module.xml b/xml/ru/docs/http/ngx_http_upstream_module.xml --- a/xml/ru/docs/http/ngx_http_upstream_module.xml +++ b/xml/ru/docs/http/ngx_http_upstream_module.xml @@ -10,7 +10,7 @@ + rev="90">

@@ -581,6 +581,12 @@ server { $upstream_addr. +$upstream_cache_key + + +???????????? ???? ??????????? (1.27.1). + + $upstream_cache_status

From mdounin at mdounin.ru Mon May 27 21:26:05 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 28 May 2024 00:26:05 +0300 Subject: [PATCH 1 of 2] Added links to Mercurial repositories on download page Message-ID: <329fb2b5e16b065e64cc.1716845165@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1716845006 -10800 # Tue May 28 00:23:26 2024 +0300 # Node ID 329fb2b5e16b065e64ccc249744869ce4e0a6e27 # Parent 0bbf14c9fd6692c95dcca75bd02e979b2f50f45b Added links to Mercurial repositories on download page. Non-linked repo URLs, as well as "read-only" in the description, are artifacts from the time when SVN was used to maintain sources. While here, also listed nginx-tests repository. diff --git a/xml/en/download.xml b/xml/en/download.xml --- a/xml/en/download.xml +++ b/xml/en/download.xml @@ -8,7 +8,7 @@

+ rev="8">

@@ -28,14 +28,17 @@

-Read-only Mercurial repositories: +Mercurial repositories with source code: -code: http://freenginx.org/hg/nginx +code: http://freenginx.org/hg/nginx -site: http://freenginx.org/hg/nginx-site +site: http://freenginx.org/hg/nginx-site + + +tests: http://freenginx.org/hg/nginx-tests diff --git a/xml/ru/download.xml b/xml/ru/download.xml --- a/xml/ru/download.xml +++ b/xml/ru/download.xml @@ -8,7 +8,7 @@

+ rev="8">

@@ -28,14 +28,17 @@

-??????????? Mercurial, ????????? ?????? ??? ??????: +??????????? Mercurial ? ???????? ?????: -???: http://freenginx.org/hg/nginx +???: http://freenginx.org/hg/nginx -????: http://freenginx.org/hg/nginx-site +????: http://freenginx.org/hg/nginx-site + + +?????: http://freenginx.org/hg/nginx-tests From mdounin at mdounin.ru Mon May 27 21:26:06 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 28 May 2024 00:26:06 +0300 Subject: [PATCH 2 of 2] Added link to Github mirror In-Reply-To: <329fb2b5e16b065e64cc.1716845165@vm-bsd.mdounin.ru> References: <329fb2b5e16b065e64cc.1716845165@vm-bsd.mdounin.ru> Message-ID: <40d3fc1cccdb41ba89df.1716845166@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1716845008 -10800 # Tue May 28 00:23:28 2024 +0300 # Node ID 40d3fc1cccdb41ba89dfe934bdf128b65d7ed924 # Parent 329fb2b5e16b065e64ccc249744869ce4e0a6e27 Added link to Github mirror. diff --git a/xml/en/download.xml b/xml/en/download.xml --- a/xml/en/download.xml +++ b/xml/en/download.xml @@ -8,7 +8,7 @@

+ rev="9">

@@ -44,6 +44,11 @@ tests: http: + +Alternatively, Github mirror +is available. + +

diff --git a/xml/ru/download.xml b/xml/ru/download.xml --- a/xml/ru/download.xml +++ b/xml/ru/download.xml @@ -8,7 +8,7 @@

+ rev="9">

@@ -44,6 +44,11 @@ + +????? ???????? +??????? ?? Github. + +

From kasei at kasei.im Tue May 28 02:16:15 2024 From: kasei at kasei.im (Kasei Wang) Date: Tue, 28 May 2024 10:16:15 +0800 Subject: [PATCH]HTTP/2 connection not properly closing during graceful shutdown In-Reply-To: References: <0255e7345ffdebf8081563334ed7c931718d2c19.camel@kasei.im> Message-ID: Hello. I noticed that this patch has not been merged yet. Are there any other issues? Can I help with anything? On Tue, May 21, 2024 at 5:26?PM Maxim Dounin wrote: > > Hello! > > On Fri, May 17, 2024 at 04:35:57PM +0800, Kasei Wang wrote: > > > Hello! > > > > On Fri, May 17, 2024 at 2:06?AM Maxim Dounin wrote: > > > > > > Hello! > > > > > > On Wed, May 15, 2024 at 11:46:29AM +0800, Kasei Wang wrote: > > > > > > > Hello, > > > > > > > > I found that there is a slight probability of HTTP/2 connections not > > > > properly closing during graceful shutdown, leading to worker processes > > > > in shutting down state remaining stuck for an extended period. After > > > > investigation, the issue appears to stem from the following: > > > > > > > > 1. worker processes in shutting down state use > > > > ngx_close_idle_connections to close all idle connections, including > > > > HTTP/2 connections. > > > > 2. For HTTP/2 connections, c->idle is set to true in ngx_http_v2_init. > > > > According to the explanation in > > > > , GOAWAY should be sent to > > > > all HTTP/2 connections. > > > > 3. There might be a time gap between ngx_event_accept and > > > > ngx_http_v2_init. For TLS connections, ngx_http_v2_init will be > > > > executed after ALPN received, and for plaintext http2 connections, > > > > ngx_http_v2_init will be executed after parsing the http2 preface. If > > > > ngx_close_idle_connections is executed between ngx_event_accept and > > > > ngx_http_v2_init, there's a possibility that c->idle of some > > > > connections is set to true AFTER ngx_close_idle_connections, causing > > > > those connections to not enter the GOAWAY process and leading to the > > > > aforementioned problem. > > > > > > > > To verify this, I've written a simple HTTP/2 client. This program will > > > > wait 15 seconds after TCP connection establishment before starting to > > > > send data. The purpose of sleep is to to raise the probability of > > > > encountering the issue. You can reproduce the problem by executing > > > > "nginx -s reload" during this 15-second wait. If you're interested, you > > > > can try my test program > > > > () to reproduce > > > > the issue. > > > > > > > > The following patch would call ngx_http_v2_finalize_connection to close > > > > http2 connections which is initialized after > > > > ngx_close_idle_connections. > > > > > > > > And here are some previous discussion on the another maillist: > > > > > > > > > > > > > > > > Please confirm if this issue exists, review my analysis and the patch > > > > if possible. Thank you very much. > > > > > > I think your analysis is correct. Thanks for catching this. > > > > > > > # HG changeset patch > > > > # User Kasei Wang > > > > # Date 1715744317 -28800 > > > > # Wed May 15 11:38:37 2024 +0800 > > > > # Node ID 7f18358cc012039f6bb4e502a6f39a7bd50d669b > > > > # Parent 4cfd64a8330dd5bacd839796732fd8c49d87e86e > > > > HTTP/2: close http2 connections initialized during graceful shutdown. > > > > > > > > In some rare cases, a HTTP/2 connections can be initialized during a > > > > graceful shutdown. Now close such an connection to avoid unexcepted > > > > delays in the graceful shutdown. > > > > > > > > diff -r 4cfd64a8330d -r 7f18358cc012 src/http/v2/ngx_http_v2.c > > > > --- a/src/http/v2/ngx_http_v2.c Tue May 14 17:47:44 2024 +0300 > > > > +++ b/src/http/v2/ngx_http_v2.c Wed May 15 11:38:37 2024 +0800 > > > > @@ -304,6 +304,11 @@ > > > > c->idle = 1; > > > > ngx_reusable_connection(c, 0); > > > > > > > > + if (ngx_exiting) { > > > > + ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR); > > > > + return; > > > > + } > > > > + > > > > if (c->buffer) { > > > > p = c->buffer->pos; > > > > end = c->buffer->last; > > > > > > The patch looks working, though in the case in question the code > > > will do various otherwise unneeded things, notably will send > > > SETTINGS and WINDOW_UPDATE frames to the client. OTOH, avoiding > > > these might be tricky and will require more complex changes, and > > > probably don't worth the effort. > > > > > > Another approach might be to allow just one request if a > > > connection is established just before the shutdown, much like > > > HTTP/1.x code does. Something as simple as the following patch > > > should do the trick: > > > > > > diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c > > > --- a/src/http/v2/ngx_http_v2.c > > > +++ b/src/http/v2/ngx_http_v2.c > > > @@ -1336,7 +1336,8 @@ ngx_http_v2_state_headers(ngx_http_v2_co > > > clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx, > > > ngx_http_core_module); > > > > > > - if (clcf->keepalive_timeout == 0 > > > + if (ngx_exiting > > > + || clcf->keepalive_timeout == 0 > > > || h2c->connection->requests >= clcf->keepalive_requests > > > || ngx_current_msec - h2c->connection->start_time > > > > clcf->keepalive_time) > > > > > > > > > What do you think? > > [...] > > > Thanks for your response. > > > > Actually, I was worried that sending GOAWAY on stream 0 might cause > > compatibility issues for some clients. There are so many client > > implementations, and I can't be sure that all clients can correctly > > retry the request in this situation. > > > > The disadvantage of your approach is that the worker process may still > > need to wait for the first request to arrive. This is not a very long > > time, and it should be limited by the client_header_timeout, which is > > 60s by default. So I think the waiting is acceptable. The advantage of > > this approach is that the process to send GOAWAY frame would be more > > similar to the existing reload process, reducing the possibility of > > affecting client compatibility. > > > > Overall, I prefer your approach because it minimizes the change impact > > for the client. > > Thanks for sharing. > > For completeness, full patch with commit log below. > > # HG changeset patch > # User Maxim Dounin > # Date 1716283099 -10800 > # Tue May 21 12:18:19 2024 +0300 > # Node ID 429d40e8275d2606da7cb710de5bc40a905fe52f > # Parent 46ecad404a296042c0088e699f275a92758e5ab9 > HTTP/2: handling of connections initialized during shutdown. > > If an HTTP/2 connection opened before a graceful shutdown, but > ngx_http_v2_init() is called after idle connections were closed, such > a connection ended up being open till closed by the client (or up to > keepalive_time), delaying shutdown. > > With this change, such connections are allowed to serve just one request, > much like it happens in HTTP/1.x, and closed afterwards. > > Reported by Kasei Wang, > https://freenginx.org/pipermail/nginx-devel/2024-May/000277.html > > diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c > --- a/src/http/v2/ngx_http_v2.c > +++ b/src/http/v2/ngx_http_v2.c > @@ -1336,7 +1336,8 @@ ngx_http_v2_state_headers(ngx_http_v2_co > clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx, > ngx_http_core_module); > > - if (clcf->keepalive_timeout == 0 > + if (ngx_exiting > + || clcf->keepalive_timeout == 0 > || h2c->connection->requests >= clcf->keepalive_requests > || ngx_current_msec - h2c->connection->start_time > > clcf->keepalive_time) > > -- > Maxim Dounin > http://mdounin.ru/ > -- > nginx-devel mailing list > nginx-devel at freenginx.org > https://freenginx.org/mailman/listinfo/nginx-devel From mdounin at mdounin.ru Tue May 28 17:54:46 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 28 May 2024 20:54:46 +0300 Subject: [nginx] HTTP/2: handling of connections initialized during shutd... Message-ID: details: http://freenginx.org/hg/nginx/rev/4a0cd107c0f1 branches: changeset: 9277:4a0cd107c0f1 user: Maxim Dounin date: Tue May 28 20:43:50 2024 +0300 description: HTTP/2: handling of connections initialized during shutdown. If an HTTP/2 connection opened before a graceful shutdown, but ngx_http_v2_init() is called after idle connections were closed, such a connection ended up being open till closed by the client (or up to keepalive_time), delaying shutdown. With this change, such connections are allowed to serve just one request, much like it happens in HTTP/1.x, and closed afterwards. Reported by Kasei Wang, https://freenginx.org/pipermail/nginx-devel/2024-May/000277.html diffstat: src/http/v2/ngx_http_v2.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diffs (13 lines): diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c @@ -1336,7 +1336,8 @@ ngx_http_v2_state_headers(ngx_http_v2_co clcf = ngx_http_get_module_loc_conf(h2c->http_connection->conf_ctx, ngx_http_core_module); - if (clcf->keepalive_timeout == 0 + if (ngx_exiting + || clcf->keepalive_timeout == 0 || h2c->connection->requests >= clcf->keepalive_requests || ngx_current_msec - h2c->connection->start_time > clcf->keepalive_time) From mdounin at mdounin.ru Tue May 28 17:54:56 2024 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 28 May 2024 20:54:56 +0300 Subject: [PATCH]HTTP/2 connection not properly closing during graceful shutdown In-Reply-To: References: <0255e7345ffdebf8081563334ed7c931718d2c19.camel@kasei.im> Message-ID: Hello! On Tue, May 28, 2024 at 10:16:15AM +0800, Kasei Wang wrote: > I noticed that this patch has not been merged yet. Are there any other > issues? Can I help with anything? I was waiting for a feedback on the final patch version, just in case. Committed, thanks! -- Maxim Dounin http://mdounin.ru/ From maksim.yevmenkin at gmail.com Thu May 30 20:05:08 2024 From: maksim.yevmenkin at gmail.com (Maksim Yevmenkin) Date: Thu, 30 May 2024 13:05:08 -0700 Subject: proxy_cache_lock for content revalidation Message-ID: hello! it seems that the proxy_cache_lock directive operates only for cache misses (new content). while this behavior is documented, i am curious about the reasoning behind it. there are scenarios where proxy_cache_lock could be very beneficial for content revalidation. what are the community's thoughts on this? thanks! max From mdounin at mdounin.ru Thu May 30 23:33:55 2024 From: mdounin at mdounin.ru (Maxim Dounin) Date: Fri, 31 May 2024 02:33:55 +0300 Subject: proxy_cache_lock for content revalidation In-Reply-To: References: Message-ID: Hello! On Thu, May 30, 2024 at 01:05:08PM -0700, Maksim Yevmenkin wrote: > it seems that the proxy_cache_lock directive operates only for cache > misses (new content). while this behavior is documented, i am curious > about the reasoning behind it. there are scenarios where > proxy_cache_lock could be very beneficial for content revalidation. > what are the community's thoughts on this? The generic idea is that "proxy_cache_use_stale updating;" is a better option for existing cache items. As such, current implementation of proxy_cache_lock doesn't try to handle existing cache items to reduce complexity. Just in case, at least one previous attempt to extend proxy_cache_lock to work with existing cache items can be found here: https://mailman.nginx.org/pipermail/nginx-devel/2018-December/011710.html -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Fri May 31 00:58:25 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:25 +0300 Subject: [PATCH 0 of 7] QUIC / HTTP/3 fixes merge Message-ID: Hello! The following patch series merges QUIC / HTTP/3 fixes from F5. Additionally, there is a (different) fix for the HTTP/3 connection reuse issue. Comments are welcome. -- Maxim Dounin From mdounin at mdounin.ru Fri May 31 00:58:26 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:26 +0300 Subject: [PATCH 1 of 7] QUIC: fixed close timer processing with early data In-Reply-To: References: Message-ID: <9e9988d46171cfe26fe0.1717117106@vm-bsd.mdounin.ru> # HG changeset patch # User Vladimir Khomutov # Date 1712731090 -10800 # Wed Apr 10 09:38:10 2024 +0300 # Node ID 9e9988d46171cfe26fe0f9d24a51eb38926adbb8 # Parent 4a0cd107c0f1d56cd455df39c37eb0fffc085760 QUIC: fixed close timer processing with early data. The ngx_quic_run() function uses qc->close timer to limit the handshake duration. Normally it is removed by ngx_quic_do_init_streams() which is called once when we are done with initial SSL processing. The problem happens when the client sends early data and streams are initialized in the ngx_quic_run() -> ngx_quic_handle_datagram() call. The order of set/remove timer calls is now reversed; the close timer is set up and the timer fires when assigned, starting the unexpected connection close process. The fix is to skip setting the timer if streams were initialized during handling of the initial datagram. The idle timer for quic is set anyway, and stream-related timeouts are managed by application layer. diff --git a/src/event/quic/ngx_event_quic.c b/src/event/quic/ngx_event_quic.c --- a/src/event/quic/ngx_event_quic.c +++ b/src/event/quic/ngx_event_quic.c @@ -211,7 +211,10 @@ ngx_quic_run(ngx_connection_t *c, ngx_qu qc = ngx_quic_get_connection(c); ngx_add_timer(c->read, qc->tp.max_idle_timeout); - ngx_add_timer(&qc->close, qc->conf->handshake_timeout); + + if (!qc->streams.initialized) { + ngx_add_timer(&qc->close, qc->conf->handshake_timeout); + } ngx_quic_connstate_dbg(c); From mdounin at mdounin.ru Fri May 31 00:58:27 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:27 +0300 Subject: [PATCH 2 of 7] QUIC: client transport parameter data length checking In-Reply-To: References: Message-ID: # HG changeset patch # User Sergey Kandaurov # Date 1716902239 -14400 # Tue May 28 17:17:19 2024 +0400 # Node ID f9bd4667574b1e6b36a04eb0769c510235df5488 # Parent 9e9988d46171cfe26fe0f9d24a51eb38926adbb8 QUIC: client transport parameter data length checking. diff --git a/src/event/quic/ngx_event_quic_transport.c b/src/event/quic/ngx_event_quic_transport.c --- a/src/event/quic/ngx_event_quic_transport.c +++ b/src/event/quic/ngx_event_quic_transport.c @@ -1750,6 +1750,14 @@ ngx_quic_parse_transport_params(u_char * return NGX_ERROR; } + if ((size_t) (end - p) < len) { + ngx_log_error(NGX_LOG_INFO, log, 0, + "quic failed to parse" + " transport param id:0x%xL, data length %uL too long", + id, len); + return NGX_ERROR; + } + rc = ngx_quic_parse_transport_param(p, p + len, id, tp); if (rc == NGX_ERROR) { From mdounin at mdounin.ru Fri May 31 00:58:28 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:28 +0300 Subject: [PATCH 3 of 7] HTTP/3: fixed dynamic table overflow In-Reply-To: References: Message-ID: <352360116e2c2fef891a.1717117108@vm-bsd.mdounin.ru> # HG changeset patch # User Roman Arutyunyan # Date 1716902330 -14400 # Tue May 28 17:18:50 2024 +0400 # Node ID 352360116e2c2fef891a91284083fb1d6c36c72d # Parent f9bd4667574b1e6b36a04eb0769c510235df5488 HTTP/3: fixed dynamic table overflow. While inserting a new entry into the dynamic table, first the entry is added, and then older entries are evicted until table size is within capacity. After the first step, the number of entries may temporarily exceed the maximum calculated from capacity by one entry, which previously caused table overflow. The easiest way to trigger the issue is to keep adding entries with empty names and values until first eviction. The issue was introduced by 987bee4363d1. diff --git a/src/http/v3/ngx_http_v3_table.c b/src/http/v3/ngx_http_v3_table.c --- a/src/http/v3/ngx_http_v3_table.c +++ b/src/http/v3/ngx_http_v3_table.c @@ -308,7 +308,7 @@ ngx_http_v3_set_capacity(ngx_connection_ prev_max = dt->capacity / 32; if (max > prev_max) { - elts = ngx_alloc(max * sizeof(void *), c->log); + elts = ngx_alloc((max + 1) * sizeof(void *), c->log); if (elts == NULL) { return NGX_ERROR; } From mdounin at mdounin.ru Fri May 31 00:58:29 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:29 +0300 Subject: [PATCH 4 of 7] QUIC: ignore CRYPTO frames after handshake completion In-Reply-To: References: Message-ID: <8822af43e7e919b8c903.1717117109@vm-bsd.mdounin.ru> # HG changeset patch # User Roman Arutyunyan # Date 1716902348 -14400 # Tue May 28 17:19:08 2024 +0400 # Node ID 8822af43e7e919b8c903174886c8ffecdb25f017 # Parent 352360116e2c2fef891a91284083fb1d6c36c72d QUIC: ignore CRYPTO frames after handshake completion. Sending handshake-level CRYPTO frames after the client's Finished message could lead to memory disclosure and a potential segfault, if those frames are sent in one packet with the Finished frame. diff --git a/src/event/quic/ngx_event_quic_ssl.c b/src/event/quic/ngx_event_quic_ssl.c --- a/src/event/quic/ngx_event_quic_ssl.c +++ b/src/event/quic/ngx_event_quic_ssl.c @@ -326,6 +326,11 @@ ngx_quic_handle_crypto_frame(ngx_connect ngx_quic_crypto_frame_t *f; qc = ngx_quic_get_connection(c); + + if (!ngx_quic_keys_available(qc->keys, pkt->level, 0)) { + return NGX_OK; + } + ctx = ngx_quic_get_send_ctx(qc, pkt->level); f = &frame->u.crypto; From mdounin at mdounin.ru Fri May 31 00:58:30 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:30 +0300 Subject: [PATCH 5 of 7] QUIC: ngx_quic_buffer_t use-after-free protection In-Reply-To: References: Message-ID: <9e69f2b7026deeed2824.1717117110@vm-bsd.mdounin.ru> # HG changeset patch # User Roman Arutyunyan # Date 1716902361 -14400 # Tue May 28 17:19:21 2024 +0400 # Node ID 9e69f2b7026deeed2824422ef64d11e234c05bb1 # Parent 8822af43e7e919b8c903174886c8ffecdb25f017 QUIC: ngx_quic_buffer_t use-after-free protection. Previously the last chain field of ngx_quic_buffer_t could still reference freed chains and buffers after calling ngx_quic_free_buffer(). While normally an ngx_quic_buffer_t object should not be used after freeing, resetting last_chain field would prevent a potential use-after-free. diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c --- a/src/event/quic/ngx_event_quic_frames.c +++ b/src/event/quic/ngx_event_quic_frames.c @@ -648,6 +648,7 @@ ngx_quic_free_buffer(ngx_connection_t *c ngx_quic_free_chain(c, qb->chain); qb->chain = NULL; + qb->last_chain = NULL; } From mdounin at mdounin.ru Fri May 31 00:58:31 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:31 +0300 Subject: [PATCH 6 of 7] HTTP/3: fixed handling of zero-length literal field line In-Reply-To: References: Message-ID: <8eecd832d2711dca1f7d.1717117111@vm-bsd.mdounin.ru> # HG changeset patch # User Sergey Kandaurov # Date 1716902445 -14400 # Tue May 28 17:20:45 2024 +0400 # Node ID 8eecd832d2711dca1f7d4eff96369cdc3be514f4 # Parent 9e69f2b7026deeed2824422ef64d11e234c05bb1 HTTP/3: fixed handling of zero-length literal field line. Previously, st->value was passed with NULL data pointer to header handlers. diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c --- a/src/http/v3/ngx_http_v3_parse.c +++ b/src/http/v3/ngx_http_v3_parse.c @@ -810,6 +810,7 @@ ngx_http_v3_parse_field_lri(ngx_connecti st->literal.length = st->pint.value; if (st->literal.length == 0) { + st->value.data = (u_char *) ""; goto done; } @@ -932,6 +933,7 @@ ngx_http_v3_parse_field_l(ngx_connection st->literal.length = st->pint.value; if (st->literal.length == 0) { + st->value.data = (u_char *) ""; goto done; } @@ -1072,6 +1074,7 @@ ngx_http_v3_parse_field_lpbi(ngx_connect st->literal.length = st->pint.value; if (st->literal.length == 0) { + st->value.data = (u_char *) ""; goto done; } From mdounin at mdounin.ru Fri May 31 00:58:32 2024 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 03:58:32 +0300 Subject: [PATCH 7 of 7] HTTP/3: protection from recursion during connection reuse In-Reply-To: References: Message-ID: <5710b269079c37a0bc99.1717117112@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1717116498 -10800 # Fri May 31 03:48:18 2024 +0300 # Node ID 5710b269079c37a0bc99fcfc0e156f971fdfe75a # Parent 8eecd832d2711dca1f7d4eff96369cdc3be514f4 HTTP/3: protection from recursion during connection reuse. When draining a connection associated with an HTTP/3 stream, calling ngx_http_v3_send_cancel_stream() might result in an attempt to obtain a connection for the decoder stream. This in turn will trigger draining of the very same connection. Depending on the client settings, this might either lead to stack overflow or will end up in decoder stream creation error and destroying the connection at some point, potentially resulting in use-after-free on stack. Fix is to make sure that connection reuse is disabled in ngx_http_v3_reset_stream(), so the recursion in question won't happen regardless of what called functions do. diff --git a/src/http/v3/ngx_http_v3_request.c b/src/http/v3/ngx_http_v3_request.c --- a/src/http/v3/ngx_http_v3_request.c +++ b/src/http/v3/ngx_http_v3_request.c @@ -401,6 +401,8 @@ ngx_http_v3_reset_stream(ngx_connection_ ngx_http_v3_session_t *h3c; ngx_http_v3_srv_conf_t *h3scf; + ngx_reusable_connection(c, 0); + h3scf = ngx_http_v3_get_module_srv_conf(c, ngx_http_v3_module); h3c = ngx_http_v3_get_session(c); From mdounin at mdounin.ru Fri May 31 02:27:58 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 05:27:58 +0300 Subject: [nginx] Fixed Valgrind complaints about uninitialized values. Message-ID: details: http://freenginx.org/hg/nginx/rev/f53146df9a47 branches: changeset: 9278:f53146df9a47 user: Maxim Dounin date: Fri May 31 04:38:09 2024 +0300 description: Fixed Valgrind complaints about uninitialized values. In ngx_http_source_charset(), name->data was left uninitialized, and only name->len was set. Since it is used in debug logging, this resulted in the following complaints from Valgrind on systems with musl libc: ==42== Conditional jump or move depends on uninitialised value(s) ==42== at 0x12BC66: memcpy (string.h:51) ==42== by 0x12BC66: ngx_sprintf_str (ngx_string.c:586) ==42== by 0x12C03C: ngx_vslprintf (ngx_string.c:255) ==42== by 0x127694: ngx_log_error_core (ngx_log.c:135) ==42== by 0x1B8795: ngx_http_charset_header_filter (ngx_http_charset_filter_module.c:252) Similarly, ngx_http_split_args() returned uninitialized arg->data, which was then copied to r->args, and also used in debug logging: ==42== Conditional jump or move depends on uninitialised value(s) ==42== at 0x12BC10: memcpy (string.h:50) ==42== by 0x12BC10: ngx_sprintf_str (ngx_string.c:586) ==42== by 0x12C03C: ngx_vslprintf (ngx_string.c:255) ==42== by 0x127694: ngx_log_error_core (ngx_log.c:135) ==42== by 0x184EFB: ngx_http_internal_redirect (ngx_http_core_module.c:2526) ==42== by 0x1D8CCC: ngx_http_try_files_handler (ngx_http_try_files_module.c:209) Fix is to initialize data to NULL. Note that, while memcpy(p, NULL, 0) is also formally undefined now, it is used in multiple places in the code, and expected to be allowed in C2y (see WG14 proposals N3177, N3261, "Allow zero length operations on null pointers"). Prodded by Valgrind. diffstat: src/http/modules/ngx_http_charset_filter_module.c | 1 + src/http/ngx_http_parse.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diffs (22 lines): diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c --- a/src/http/modules/ngx_http_charset_filter_module.c +++ b/src/http/modules/ngx_http_charset_filter_module.c @@ -438,6 +438,7 @@ ngx_http_source_charset(ngx_http_request if (charset == NGX_HTTP_CHARSET_OFF) { name->len = 0; + name->data = NULL; return charset; } diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -2146,6 +2146,7 @@ ngx_http_split_args(ngx_http_request_t * } else { args->len = 0; + args->data = NULL; } } From mdounin at mdounin.ru Fri May 31 02:27:58 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 05:27:58 +0300 Subject: [nginx] Removed incorrect NGX_SUPPRESS_WARN usage. Message-ID: details: http://freenginx.org/hg/nginx/rev/2fce021888f9 branches: changeset: 9279:2fce021888f9 user: Maxim Dounin date: Fri May 31 04:38:40 2024 +0300 description: Removed incorrect NGX_SUPPRESS_WARN usage. The len variable in ngx_http_variable_unknown_header() needs to be initialized to 0, as it is incremented by subsequent code. diffstat: src/http/ngx_http_variables.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diffs (13 lines): diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c --- a/src/http/ngx_http_variables.c +++ b/src/http/ngx_http_variables.c @@ -932,9 +932,7 @@ ngx_http_variable_unknown_header(ngx_htt ngx_table_elt_t *header, *h, **ph; ph = &h; -#if (NGX_SUPPRESS_WARN) len = 0; -#endif header = part->elts; From mdounin at mdounin.ru Fri May 31 02:30:40 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 05:30:40 +0300 Subject: [nginx-site] Added links to Mercurial repositories on download p... Message-ID: details: http://freenginx.org/hg/nginx-site/rev/329fb2b5e16b branches: changeset: 3085:329fb2b5e16b user: Maxim Dounin date: Tue May 28 00:23:26 2024 +0300 description: Added links to Mercurial repositories on download page. Non-linked repo URLs, as well as "read-only" in the description, are artifacts from the time when SVN was used to maintain sources. While here, also listed nginx-tests repository. diffstat: xml/en/download.xml | 11 +++++++---- xml/ru/download.xml | 11 +++++++---- 2 files changed, 14 insertions(+), 8 deletions(-) diffs (66 lines): diff --git a/xml/en/download.xml b/xml/en/download.xml --- a/xml/en/download.xml +++ b/xml/en/download.xml @@ -8,7 +8,7 @@

+ rev="8">

@@ -28,14 +28,17 @@

+ rev="8">

@@ -28,14 +28,17 @@

-??????????? Mercurial, ????????? ?????? ??? ??????: +??????????? Mercurial ? ???????? ?????: -???: http://freenginx.org/hg/nginx +???: http://freenginx.org/hg/nginx -????: http://freenginx.org/hg/nginx-site +????: http://freenginx.org/hg/nginx-site + + +?????: http://freenginx.org/hg/nginx-tests From mdounin at mdounin.ru Fri May 31 02:30:40 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 05:30:40 +0300 Subject: [nginx-site] Added link to Github mirror. Message-ID: details: http://freenginx.org/hg/nginx-site/rev/40d3fc1cccdb branches: changeset: 3086:40d3fc1cccdb user: Maxim Dounin date: Tue May 28 00:23:28 2024 +0300 description: Added link to Github mirror. diffstat: xml/en/download.xml | 7 ++++++- xml/ru/download.xml | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diffs (48 lines): diff --git a/xml/en/download.xml b/xml/en/download.xml --- a/xml/en/download.xml +++ b/xml/en/download.xml @@ -8,7 +8,7 @@

+ rev="9">

@@ -44,6 +44,11 @@ tests: http: + +Alternatively, Github mirror +is available. + +

diff --git a/xml/ru/download.xml b/xml/ru/download.xml --- a/xml/ru/download.xml +++ b/xml/ru/download.xml @@ -8,7 +8,7 @@

+ rev="9">

@@ -44,6 +44,11 @@ + +????? ???????? +??????? ?? Github. + +

From mdounin at mdounin.ru Fri May 31 02:53:04 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 05:53:04 +0300 Subject: [nginx-tests] Tests: logging of certificate subjects instead of ... Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/d732a96e05df branches: changeset: 1980:d732a96e05df user: Maxim Dounin date: Sat May 25 03:44:55 2024 +0300 description: Tests: logging of certificate subjects instead of issuers. diffstat: lib/Test/Nginx.pm | 2 +- lib/Test/Nginx/IMAP.pm | 2 +- lib/Test/Nginx/POP3.pm | 2 +- lib/Test/Nginx/SMTP.pm | 2 +- lib/Test/Nginx/Stream.pm | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diffs (60 lines): diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm --- a/lib/Test/Nginx.pm +++ b/lib/Test/Nginx.pm @@ -881,7 +881,7 @@ sub http_start($;%) { or die $IO::Socket::SSL::SSL_ERROR . "\n"; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } log_out($request); diff --git a/lib/Test/Nginx/IMAP.pm b/lib/Test/Nginx/IMAP.pm --- a/lib/Test/Nginx/IMAP.pm +++ b/lib/Test/Nginx/IMAP.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/POP3.pm b/lib/Test/Nginx/POP3.pm --- a/lib/Test/Nginx/POP3.pm +++ b/lib/Test/Nginx/POP3.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/SMTP.pm b/lib/Test/Nginx/SMTP.pm --- a/lib/Test/Nginx/SMTP.pm +++ b/lib/Test/Nginx/SMTP.pm @@ -47,7 +47,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); diff --git a/lib/Test/Nginx/Stream.pm b/lib/Test/Nginx/Stream.pm --- a/lib/Test/Nginx/Stream.pm +++ b/lib/Test/Nginx/Stream.pm @@ -63,7 +63,7 @@ sub new { my $s = $self->{_socket}; log_in("ssl cipher: " . $s->get_cipher()); - log_in("ssl cert: " . $s->peer_certificate('issuer')); + log_in("ssl cert: " . $s->peer_certificate('subject')); } alarm(0); From mdounin at mdounin.ru Fri May 31 03:25:38 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 06:25:38 +0300 Subject: [nginx-tests] Tests: avoid changing non-localized $TODO. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/0e2b14c75232 branches: changeset: 1981:0e2b14c75232 user: Maxim Dounin date: Fri May 31 06:22:48 2024 +0300 description: Tests: avoid changing non-localized $TODO. This ensures that there will be no unrelated effects if the variable is actually changed, such as seen on sanitizer tests in 910:49579dd88e3f (reverted by this change). diffstat: lib/Test/Nginx.pm | 18 ++++++++---------- 1 files changed, 8 insertions(+), 10 deletions(-) diffs (33 lines): diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm --- a/lib/Test/Nginx.pm +++ b/lib/Test/Nginx.pm @@ -69,21 +69,19 @@ sub DESTROY { my @alerts = $self->read_file('error.log') =~ /.+\[alert\].+/gm; - if ($^O eq 'solaris') { - $Test::Nginx::TODO = 'alerts' if @alerts - && ! grep { $_ !~ /phantom event/ } @alerts; - } - if ($^O eq 'MSWin32') { - my $re = qr/CloseHandle|TerminateProcess/; - $Test::Nginx::TODO = 'alerts' if @alerts - && ! grep { $_ !~ $re } @alerts; - } + local $Test::Nginx::TODO = 'alerts' if @alerts + && $^O eq 'solaris' + && ! grep { $_ !~ /phantom event/ } @alerts; + + local $Test::Nginx::TODO = 'alerts' if @alerts + && $^O eq 'MSWin32' + && ! grep { $_ !~ qr/CloseHandle|TerminateProcess/ } + @alerts; Test::More::is(join("\n", @alerts), '', 'no alerts'); } if (Test::More->builder->expected_tests) { - local $Test::Nginx::TODO; my $errors = $self->read_file('error.log'); $errors = join "\n", $errors =~ /.+Sanitizer.+/gm; Test::More::is($errors, '', 'no sanitizer errors'); From mdounin at mdounin.ru Fri May 31 03:25:38 2024 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Fri, 31 May 2024 06:25:38 +0300 Subject: [nginx-tests] Tests: explicit Valgrind support. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/fb25cbe9d4ec branches: changeset: 1982:fb25cbe9d4ec user: Maxim Dounin date: Fri May 31 06:23:00 2024 +0300 description: Tests: explicit Valgrind support. Valgrind logging is done to a separate file, as it is not able to follow stderr redirection within nginx or append to a file without corrupting it. Further, Valgrind logging seems to interfere with error suppression in tests, and catches various startup errors and warnings, so the log is additionally filtered. Since startup under Valgrind can be really slow, timeout in waitforfile() was changed to 10 seconds. Prodded by Robert Mueller. diffstat: README | 4 ++++ lib/Test/Nginx.pm | 18 +++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diffs (63 lines): diff --git a/README b/README --- a/README +++ b/README @@ -40,6 +40,10 @@ TEST_NGINX_UNSAFE Run unsafe tests. +TEST_NGINX_VALGRIND + + Run nginx under Valgrind during tests. + TEST_NGINX_GLOBALS Sets additional directives in main context. diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm --- a/lib/Test/Nginx.pm +++ b/lib/Test/Nginx.pm @@ -87,6 +87,12 @@ sub DESTROY { Test::More::is($errors, '', 'no sanitizer errors'); } + if (Test::More->builder->expected_tests && $ENV{TEST_NGINX_VALGRIND}) { + my $errors = $self->read_file('valgrind.log'); + $errors = join "\n", $errors =~ /^==\d+== .+/gm; + Test::More::is($errors, '', 'no valgrind errors'); + } + if ($ENV{TEST_NGINX_CATLOG}) { system("cat $self->{_testdir}/error.log"); } @@ -365,7 +371,10 @@ sub try_run($$) { sub plan($) { my ($self, $plan) = @_; - Test::More::plan(tests => $plan + 2); + $plan += 2; + $plan += 1 if $ENV{TEST_NGINX_VALGRIND}; + + Test::More::plan(tests => $plan); return $self; } @@ -395,7 +404,10 @@ sub run(;$) { my @globals = $self->{_test_globals} ? () : ('-g', "pid $testdir/nginx.pid; " . "error_log $testdir/error.log debug;"); - exec($NGINX, '-p', "$testdir/", '-c', 'nginx.conf', + my @valgrind = (not $ENV{TEST_NGINX_VALGRIND}) ? + () : ('valgrind', '-q', + "--log-file=$testdir/valgrind.log"); + exec(@valgrind, $NGINX, '-p', "$testdir/", '-c', 'nginx.conf', '-e', 'error.log', @globals) or die "Unable to exec(): $!\n"; } @@ -481,7 +493,7 @@ sub waitforfile($;$) { # wait for file to appear # or specified process to exit - for (1 .. 50) { + for (1 .. 100) { return 1 if -e $file; return 0 if $exited; $exited = waitpid($pid, WNOHANG) != 0 if $pid; From maksim.yevmenkin at gmail.com Fri May 31 18:21:01 2024 From: maksim.yevmenkin at gmail.com (Maksim Yevmenkin) Date: Fri, 31 May 2024 11:21:01 -0700 Subject: proxy_cache_lock for content revalidation In-Reply-To: References: Message-ID: hello, > > it seems that the proxy_cache_lock directive operates only for cache > > misses (new content). while this behavior is documented, i am curious > > about the reasoning behind it. there are scenarios where > > proxy_cache_lock could be very beneficial for content revalidation. > > what are the community's thoughts on this? > > The generic idea is that "proxy_cache_use_stale updating;" is a > better option for existing cache items. As such, current > implementation of proxy_cache_lock doesn't try to handle existing > cache items to reduce complexity. right. there are instances where serving outdated content is not permissible, yet overwhelming the upstream servers with a flood of requests is highly undesirable. this situation occurs quite frequently. > Just in case, at least one previous attempt to extend > proxy_cache_lock to work with existing cache items can be found > here: > > https://mailman.nginx.org/pipermail/nginx-devel/2018-December/011710.html thank you! it seems the original post mentioned this exact issue. it also seems that the patch was removed. i am curious if it would be possible to restore the patch. thanks, max From maksim.yevmenkin at gmail.com Fri May 31 18:25:07 2024 From: maksim.yevmenkin at gmail.com (Maksim Yevmenkin) Date: Fri, 31 May 2024 11:25:07 -0700 Subject: proxy_cache_lock for content revalidation In-Reply-To: References:

Message-ID: [..] > > > > https://mailman.nginx.org/pipermail/nginx-devel/2018-December/011710.html > > thank you! it seems the original post mentioned this exact issue. it > also seems that the patch was removed. i am curious if it would be > possible to restore the patch. please never mind, i'm blind, sorry! thanks max From mdounin at mdounin.ru Fri May 31 23:03:21 2024 From: mdounin at mdounin.ru (Maxim Dounin) Date: Sat, 1 Jun 2024 02:03:21 +0300 Subject: [nginx] Add support for XOAUTH2 and OAUTHBEARER authentication In-Reply-To: References: Message-ID: Hello! On Tue, May 21, 2024 at 04:16:05AM +0300, Maxim Dounin wrote: [...] > Additionally, I tend to think that a better approach to > communicate with the auth server might be to parse SASL initial > responses as sent by clients, and provide parsed information, > username and the Bearer token, in the "Auth-User" and "Auth-Pass" > headers, similarly to what we do for other SASL mechanism, such as > PLAIN and CRAM-MD5. > > This will certainly work for XOAUTH2, since the only information > is the username and the Bearer token. In OAUTHBEARER some > additional information can be provided, but I very much doubt it > is used in practice (and, if needed, full initial response > can be sent separately, in a separate header). And parsing > implementation seems to be easy enough. > > Immediate benefits include early correctness checking (e.g., > "n,user=test at example.com,^A..." as used in tests and in some RFC 7628 > examples is incorrect, it should be "n,a=test at example.com,^A..." > instead) and simpler auth server implementation. > > I've provided proof-of-concept as a separate patch below. > > What do you think about this approach? Just for the record, below are login decoding fixes for the proof-of-concept patch in question, as well as test improvements and full merged patch to support XOAUTH2/OAUTHBEARER with parsing. I'm going to commit this shortly unless there are objections. [...] > # HG changeset patch > # User Maxim Dounin > # Date 1716247681 -10800 > # Tue May 21 02:28:01 2024 +0300 > # Node ID 377c966d4623000c0b9a5b2c0d47f9dd64b4cd9d > # Parent b06a347640e565012aced65e2a694a306ed2db5c > Mail: parsing of XOAUTH2 and OAUTHBEARER. > > For both mechanisms, the "Auth-User" header is set to the client identity > obtained from the initial SASL response sent by the client, and the > "Auth-Pass" header is set the Bearer token itself. > > Additionally, only continuation responses correct for the particular > mechanism are now accepted after errors ("AQ==" for OAUTHBEARER, empty > line for XOAUTH2). > > To be merged with the previous patch. [...] > +ngx_int_t > +ngx_mail_auth_oauthbearer(ngx_mail_session_t *s, ngx_connection_t *c, > + ngx_uint_t n) > +{ > + u_char *p, *last, *prev; > + ngx_str_t *arg, oauth; > + > + arg = s->args.elts; > + > + if (s->auth_err.len) { > + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, > + "mail auth oauthbearer cancel"); > + > + if (s->args.nelts == 1 > + && ngx_strncmp(arg[0].data, (u_char *) "AQ==", 4) == 0) > { > s->out = s->auth_err; > s->quit = s->auth_quit; > @@ -782,16 +885,14 @@ ngx_mail_auth_oauth(ngx_mail_session_t * > return NGX_OK; > } > > - invalid: > - > s->quit = s->auth_quit; > ngx_str_null(&s->auth_err); > > return NGX_MAIL_PARSE_INVALID_COMMAND; > } > > - ngx_log_debug2(NGX_LOG_DEBUG_MAIL, c->log, 0, > - "mail auth oauth: \"%V\" type %ui", &arg[n], auth_method); > + ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, > + "mail auth oauthbearer: \"%V\"", &arg[n]); > > oauth.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len)); > if (oauth.data == NULL) { > @@ -801,19 +902,113 @@ ngx_mail_auth_oauth(ngx_mail_session_t * > if (ngx_decode_base64(&oauth, &arg[n]) != NGX_OK) { > ngx_log_error(NGX_LOG_INFO, c->log, 0, > "client sent invalid base64 encoding in " > - "AUTH XOAUTH2/OAUTHBEARER command"); > + "AUTH OAUTHBEARER command"); > + return NGX_MAIL_PARSE_INVALID_COMMAND; > + } > + > + /* > + * RFC 7628 > + * "n,a=user at example.com,^A...^Aauth=Bearer ^A^A" > + */ > + > + p = oauth.data; > + last = p + oauth.len; > + > + s->login.len = 0; > + prev = NULL; > + > + while (p < last) { > + if (*p == ',') { > + if (prev > + && (size_t) (p - prev) > sizeof("a=") - 1 > + && ngx_strncasecmp(prev, (u_char *) "a=", sizeof("a=") - 1) > + == 0) > + { > + s->login.len = p - prev - (sizeof("a=") - 1); > + s->login.data = prev + sizeof("a=") - 1; > + break; > + } > + > + p++; > + prev = p; > + continue; > + } > + > + if (*p == '\1') { > + break; > + } > + > + p++; > + } > + > + if (s->login.len == 0) { > + ngx_log_error(NGX_LOG_INFO, c->log, 0, > + "client sent invalid login in AUTH OAUTHBEARER command"); > return NGX_MAIL_PARSE_INVALID_COMMAND; > } > > - s->passwd.len = oauth.len; > - s->passwd.data = oauth.data; > + s->passwd.len = 0; > + prev = NULL; > > - ngx_str_null(&s->login); > + while (p < last) { > + if (*p == '\1') { > + if (prev > + && (size_t) (p - prev) > sizeof("auth=Bearer ") - 1 > + && ngx_strncasecmp(prev, (u_char *) "auth=Bearer ", > + sizeof("auth=Bearer ") - 1) > + == 0) > + { > + s->passwd.len = p - prev - (sizeof("auth=Bearer ") - 1); > + s->passwd.data = prev + sizeof("auth=Bearer ") - 1; > + break; > + } > + > + p++; > + prev = p; > + continue; > + } > + > + p++; > + } > + > + if (s->passwd.len == 0) { > + ngx_log_error(NGX_LOG_INFO, c->log, 0, > + "client sent invalid token in AUTH OAUTHBEARER command"); > + return NGX_MAIL_PARSE_INVALID_COMMAND; > + } > > - ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, > - "mail auth oauth: \"%V\"", &s->passwd); > + /* decode =2C =3D in login */ > + > + p = s->login.data; > + last = s->login.data + s->login.len; > + > + while (p < last) { > + if (*p == '=') { > + if (p[1] == '2' && (p[2] == 'C' || p[2] == 'c')) { > + *p = ','; > + > + } else if (p[1] == '3' && (p[2] == 'D' || p[2] == 'd')) { > + *p = '='; > > - s->auth_method = auth_method; > + } else { > + ngx_log_error(NGX_LOG_INFO, c->log, 0, > + "client sent invalid login in " > + "AUTH OAUTHBEARER command"); > + return NGX_MAIL_PARSE_INVALID_COMMAND; > + } > + > + p += 3; > + continue; > + } > + > + p++; > + } > + > + ngx_log_debug2(NGX_LOG_DEBUG_MAIL, c->log, 0, > + "mail auth oauthbearer: \"%V\" \"%V\"", > + &s->login, &s->passwd); > + > + s->auth_method = NGX_MAIL_AUTH_OAUTHBEARER; > > return NGX_DONE; > } Login decoding is wrong here, here is a fix: diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c --- a/src/mail/ngx_mail_handler.c +++ b/src/mail/ngx_mail_handler.c @@ -865,7 +865,7 @@ ngx_int_t ngx_mail_auth_oauthbearer(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n) { - u_char *p, *last, *prev; + u_char *p, *d, *last, *prev; ngx_str_t *arg, oauth; arg = s->args.elts; @@ -980,15 +980,22 @@ ngx_mail_auth_oauthbearer(ngx_mail_sessi /* decode =2C =3D in login */ p = s->login.data; + d = s->login.data; last = s->login.data + s->login.len; while (p < last) { if (*p == '=') { + + /* + * login is always followed by other data, + * so p[1] and p[2] can be checked directly + */ + if (p[1] == '2' && (p[2] == 'C' || p[2] == 'c')) { - *p = ','; + *d++ = ','; } else if (p[1] == '3' && (p[2] == 'D' || p[2] == 'd')) { - *p = '='; + *d++ = '='; } else { ngx_log_error(NGX_LOG_INFO, c->log, 0, @@ -1001,9 +1008,11 @@ ngx_mail_auth_oauthbearer(ngx_mail_sessi continue; } - p++; + *d++ = *p++; } + s->login.len = d - s->login.data; + ngx_log_debug2(NGX_LOG_DEBUG_MAIL, c->log, 0, "mail auth oauthbearer: \"%V\" \"%V\"", &s->login, &s->passwd); And patch for tests: diff --git a/mail_oauth.t b/mail_oauth.t --- a/mail_oauth.t +++ b/mail_oauth.t @@ -71,17 +71,18 @@ http { smtp %%PORT_8026%%; } - map $http_auth_pass $reply { - ~secretok OK; + map $http_auth_user:$http_auth_pass $reply { + test at example.com:secretok OK; + test=, at example.com:secretok OK; default auth-failed; } + map $http_auth_pass $passw { - ~secretok secret; - default ""; + secretok secret; } + map $http_auth_pass $sasl { - ~saslfail "eyJzY2hlbWVzIjoiQmVhcmVyIiwic3RhdHVzIjoiNDAwIn0="; - default ""; + saslfail "eyJzY2hlbWVzIjoiQmVhcmVyIiwic3RhdHVzIjoiNDAwIn0="; } server { @@ -92,7 +93,6 @@ http { add_header Auth-Status $reply; add_header Auth-Server 127.0.0.1; add_header Auth-Port $proxy_port; - add_header Auth-User test at example.com; add_header Auth-Pass $passw; add_header Auth-Wait 1; add_header Auth-Error-SASL $sasl; @@ -106,7 +106,7 @@ EOF $t->run_daemon(\&Test::Nginx::IMAP::imap_test_daemon); $t->run_daemon(\&Test::Nginx::POP3::pop3_test_daemon); $t->run_daemon(\&Test::Nginx::SMTP::smtp_test_daemon); -$t->try_run('no oauth support')->plan(47); +$t->try_run('no oauth support')->plan(48); $t->waitforsocket('127.0.0.1:' . port(8144)); $t->waitforsocket('127.0.0.1:' . port(8111)); @@ -123,6 +123,8 @@ EOF my $s; my $token = encode_base64( "n,a=test\@example.com,\001auth=Bearer secretok\001\001", ''); +my $token_escaped = encode_base64( + "n,a=test=3D=2C\@example.com,\001auth=Bearer secretok\001\001", ''); my $token_saslfail = encode_base64( "n,a=test\@example.com,\001auth=Bearer saslfail\001\001", ''); my $token_bad = encode_base64( @@ -144,6 +146,11 @@ my $token_xoauth2_bad = encode_base64( $s = Test::Nginx::IMAP->new(); $s->read(); +$s->send('1 AUTHENTICATE OAUTHBEARER ' . $token_escaped); +$s->ok('imap oauthbearer escaped login'); + +$s = Test::Nginx::IMAP->new(); +$s->read(); $s->send('1 AUTHENTICATE OAUTHBEARER'); $s->check(qr/\+ /, 'imap oauthbearer challenge'); $s->send($token); Full XOAUTH2/OAUTHBEARER patch with parsing: # HG changeset patch # User Maxim Dounin # Date 1717195412 -10800 # Sat Jun 01 01:43:32 2024 +0300 # Node ID a87a01815c540faf782e96078ddd303adef2175d # Parent e73875d3d33e07948136a5eec2d313d6ffdfbe72 Mail: added support for XOAUTH2 and OAUTHBEARER authentication. This patch adds support for the OAUTHBEARER SASL mechanism as defined by RFC 7628, as well as pre-RFC XOAUTH2 SASL mechanism. For both mechanisms, the "Auth-User" header is set to the client identity obtained from the initial SASL response sent by the client, and the "Auth-Pass" header is set to the Bearer token itself. The auth server may return the "Auth-Error-SASL" header, which is passed to the client as an additional SASL challenge. It is expected to contain mechanism-specific error details, base64-encoded. After the client responds (with an empty SASL response for XAUTH2, or with "AQ==" dummy response for OAUTHBEARER), the error message from the "Auth-Status" header is sent. Based on a patch by Rob Mueller. diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h --- a/src/mail/ngx_mail.h +++ b/src/mail/ngx_mail.h @@ -141,7 +141,9 @@ typedef enum { ngx_pop3_auth_login_password, ngx_pop3_auth_plain, ngx_pop3_auth_cram_md5, - ngx_pop3_auth_external + ngx_pop3_auth_external, + ngx_pop3_auth_xoauth2, + ngx_pop3_auth_oauthbearer } ngx_pop3_state_e; @@ -152,6 +154,8 @@ typedef enum { ngx_imap_auth_plain, ngx_imap_auth_cram_md5, ngx_imap_auth_external, + ngx_imap_auth_xoauth2, + ngx_imap_auth_oauthbearer, ngx_imap_login, ngx_imap_user, ngx_imap_passwd @@ -165,6 +169,8 @@ typedef enum { ngx_smtp_auth_plain, ngx_smtp_auth_cram_md5, ngx_smtp_auth_external, + ngx_smtp_auth_xoauth2, + ngx_smtp_auth_oauthbearer, ngx_smtp_helo, ngx_smtp_helo_xclient, ngx_smtp_helo_auth, @@ -212,8 +218,9 @@ typedef struct { unsigned no_sync_literal:1; unsigned starttls:1; unsigned esmtp:1; - unsigned auth_method:3; + unsigned auth_method:4; unsigned auth_wait:1; + unsigned auth_quit:1; ngx_str_t login; ngx_str_t passwd; @@ -229,6 +236,8 @@ typedef struct { ngx_str_t smtp_from; ngx_str_t smtp_to; + ngx_str_t auth_err; + ngx_str_t cmd; ngx_uint_t command; @@ -303,15 +312,19 @@ typedef struct { #define NGX_MAIL_AUTH_APOP 3 #define NGX_MAIL_AUTH_CRAM_MD5 4 #define NGX_MAIL_AUTH_EXTERNAL 5 -#define NGX_MAIL_AUTH_NONE 6 +#define NGX_MAIL_AUTH_XOAUTH2 6 +#define NGX_MAIL_AUTH_OAUTHBEARER 7 +#define NGX_MAIL_AUTH_NONE 8 -#define NGX_MAIL_AUTH_PLAIN_ENABLED 0x0002 -#define NGX_MAIL_AUTH_LOGIN_ENABLED 0x0004 -#define NGX_MAIL_AUTH_APOP_ENABLED 0x0008 -#define NGX_MAIL_AUTH_CRAM_MD5_ENABLED 0x0010 -#define NGX_MAIL_AUTH_EXTERNAL_ENABLED 0x0020 -#define NGX_MAIL_AUTH_NONE_ENABLED 0x0040 +#define NGX_MAIL_AUTH_PLAIN_ENABLED 0x0002 +#define NGX_MAIL_AUTH_LOGIN_ENABLED 0x0004 +#define NGX_MAIL_AUTH_APOP_ENABLED 0x0008 +#define NGX_MAIL_AUTH_CRAM_MD5_ENABLED 0x0010 +#define NGX_MAIL_AUTH_EXTERNAL_ENABLED 0x0020 +#define NGX_MAIL_AUTH_XOAUTH2_ENABLED 0x0040 +#define NGX_MAIL_AUTH_OAUTHBEARER_ENABLED 0x0080 +#define NGX_MAIL_AUTH_NONE_ENABLED 0x0100 #define NGX_MAIL_PARSE_INVALID_COMMAND 20 @@ -399,6 +412,10 @@ ngx_int_t ngx_mail_auth_cram_md5_salt(ng ngx_int_t ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c); ngx_int_t ngx_mail_auth_external(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n); +ngx_int_t ngx_mail_auth_xoauth2(ngx_mail_session_t *s, ngx_connection_t *c, + ngx_uint_t n); +ngx_int_t ngx_mail_auth_oauthbearer(ngx_mail_session_t *s, ngx_connection_t *c, + ngx_uint_t n); ngx_int_t ngx_mail_auth_parse(ngx_mail_session_t *s, ngx_connection_t *c); void ngx_mail_send(ngx_event_t *wev); diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c --- a/src/mail/ngx_mail_auth_http_module.c +++ b/src/mail/ngx_mail_auth_http_module.c @@ -53,6 +53,7 @@ struct ngx_mail_auth_http_ctx_s { ngx_str_t err; ngx_str_t errmsg; ngx_str_t errcode; + ngx_str_t errsasl; time_t sleep; @@ -67,6 +68,7 @@ static void ngx_mail_auth_http_ignore_st static void ngx_mail_auth_http_process_headers(ngx_mail_session_t *s, ngx_mail_auth_http_ctx_t *ctx); static void ngx_mail_auth_sleep_handler(ngx_event_t *rev); +static void ngx_mail_auth_send_error(ngx_mail_session_t *s); static ngx_int_t ngx_mail_auth_http_parse_header_line(ngx_mail_session_t *s, ngx_mail_auth_http_ctx_t *ctx); static void ngx_mail_auth_http_block_read(ngx_event_t *rev); @@ -152,6 +154,8 @@ static ngx_str_t ngx_mail_auth_http_me ngx_string("apop"), ngx_string("cram-md5"), ngx_string("external"), + ngx_string("xoauth2"), + ngx_string("oauthbearer"), ngx_string("none") }; @@ -677,6 +681,51 @@ ngx_mail_auth_http_process_headers(ngx_m continue; } + if (len == sizeof("Auth-Error-SASL") - 1 + && ngx_strncasecmp(ctx->header_name_start, + (u_char *) "Auth-Error-SASL", + sizeof("Auth-Error-SASL") - 1) + == 0) + { + if (s->auth_method != NGX_MAIL_AUTH_XOAUTH2 + && s->auth_method != NGX_MAIL_AUTH_OAUTHBEARER) + { + continue; + } + + len = ctx->header_end - ctx->header_start; + + if (s->protocol == NGX_MAIL_SMTP_PROTOCOL) { + size = len + sizeof("334 " CRLF) - 1; + + } else { + size = len + sizeof("+ " CRLF) - 1; + } + + p = ngx_pnalloc(s->connection->pool, size); + if (p == NULL) { + ngx_close_connection(ctx->peer.connection); + ngx_destroy_pool(ctx->pool); + ngx_mail_session_internal_server_error(s); + return; + } + + ctx->errsasl.len = size; + ctx->errsasl.data = p; + + if (s->protocol == NGX_MAIL_SMTP_PROTOCOL) { + *p++ = '3'; *p++ = '3'; *p++ = '4'; *p++ = ' '; + + } else { + *p++ = '+'; *p++ = ' '; + } + + p = ngx_cpymem(p, ctx->header_start, len); + *p++ = CR; *p = LF; + + continue; + } + /* ignore other headers */ continue; @@ -717,14 +766,15 @@ ngx_mail_auth_http_process_headers(ngx_m *p++ = CR; *p = LF; } - s->out = ctx->err; + s->out = ctx->errsasl; + s->auth_err = ctx->err; timer = ctx->sleep; ngx_destroy_pool(ctx->pool); if (timer == 0) { - s->quit = 1; - ngx_mail_send(s->connection->write); + s->auth_quit = 1; + ngx_mail_auth_send_error(s); return; } @@ -858,9 +908,8 @@ ngx_mail_auth_http_process_headers(ngx_m static void ngx_mail_auth_sleep_handler(ngx_event_t *rev) { - ngx_connection_t *c; - ngx_mail_session_t *s; - ngx_mail_core_srv_conf_t *cscf; + ngx_connection_t *c; + ngx_mail_session_t *s; ngx_log_debug0(NGX_LOG_DEBUG_MAIL, rev->log, 0, "mail auth sleep handler"); @@ -877,33 +926,7 @@ ngx_mail_auth_sleep_handler(ngx_event_t return; } - cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module); - - rev->handler = cscf->protocol->auth_state; - - s->mail_state = 0; - s->auth_method = NGX_MAIL_AUTH_PLAIN; - s->tag.len = 0; - - c->log->action = "in auth state"; - - ngx_mail_send(c->write); - - if (c->destroyed) { - return; - } - - ngx_add_timer(rev, cscf->timeout); - - if (rev->ready) { - rev->handler(rev); - return; - } - - if (ngx_handle_read_event(rev, 0) != NGX_OK) { - ngx_mail_close_connection(c); - } - + ngx_mail_auth_send_error(s); return; } @@ -915,6 +938,57 @@ ngx_mail_auth_sleep_handler(ngx_event_t } +static void +ngx_mail_auth_send_error(ngx_mail_session_t *s) +{ + ngx_event_t *rev; + ngx_connection_t *c; + ngx_mail_core_srv_conf_t *cscf; + + c = s->connection; + rev = c->read; + + cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module); + + rev->handler = cscf->protocol->auth_state; + + s->auth_method = NGX_MAIL_AUTH_PLAIN; + + c->log->action = "in auth state"; + + if (s->out.len == 0) { + s->out = s->auth_err; + s->quit = s->auth_quit; + ngx_str_null(&s->auth_err); + + s->state = 0; + s->mail_state = 0; + s->tag.len = 0; + + } else { + s->auth_err.len -= s->tag.len; + s->auth_err.data += s->tag.len; + } + + ngx_mail_send(c->write); + + if (c->destroyed) { + return; + } + + ngx_add_timer(rev, cscf->timeout); + + if (rev->ready) { + rev->handler(rev); + return; + } + + if (ngx_handle_read_event(rev, 0) != NGX_OK) { + ngx_mail_close_connection(c); + } +} + + static ngx_int_t ngx_mail_auth_http_parse_header_line(ngx_mail_session_t *s, ngx_mail_auth_http_ctx_t *ctx) diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c --- a/src/mail/ngx_mail_handler.c +++ b/src/mail/ngx_mail_handler.c @@ -755,6 +755,274 @@ ngx_mail_auth_external(ngx_mail_session_ } +ngx_int_t +ngx_mail_auth_xoauth2(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n) +{ + u_char *p, *last; + ngx_str_t *arg, oauth; + + arg = s->args.elts; + + if (s->auth_err.len) { + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth xoauth2 cancel"); + + if (s->args.nelts == 1 && arg[0].len == 0) { + s->out = s->auth_err; + s->quit = s->auth_quit; + s->state = 0; + s->mail_state = 0; + ngx_str_null(&s->auth_err); + return NGX_OK; + } + + s->quit = s->auth_quit; + ngx_str_null(&s->auth_err); + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth xoauth2: \"%V\"", &arg[n]); + + oauth.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len)); + if (oauth.data == NULL) { + return NGX_ERROR; + } + + if (ngx_decode_base64(&oauth, &arg[n]) != NGX_OK) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid base64 encoding in " + "AUTH XOAUTH2 command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + /* + * https://developers.google.com/gmail/imap/xoauth2-protocol + * "user=" {User} "^Aauth=Bearer " {token} "^A^A" + */ + + p = oauth.data; + last = p + oauth.len; + + while (p < last) { + if (*p++ == '\1') { + s->login.len = p - oauth.data - 1; + s->login.data = oauth.data; + s->passwd.len = last - p; + s->passwd.data = p; + break; + } + } + + if (s->login.len < sizeof("user=") - 1 + || ngx_strncasecmp(s->login.data, (u_char *) "user=", + sizeof("user=") - 1) + != 0) + { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid login in AUTH XOAUTH2 command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + s->login.len -= sizeof("user=") - 1; + s->login.data += sizeof("user=") - 1; + + if (s->passwd.len < sizeof("auth=Bearer ") - 1 + || ngx_strncasecmp(s->passwd.data, (u_char *) "auth=Bearer ", + sizeof("auth=Bearer ") - 1) + != 0) + { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid token in AUTH XOAUTH2 command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + s->passwd.len -= sizeof("auth=Bearer ") - 1; + s->passwd.data += sizeof("auth=Bearer ") - 1; + + if (s->passwd.len < 2 + || s->passwd.data[s->passwd.len - 2] != '\1' + || s->passwd.data[s->passwd.len - 1] != '\1') + { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid token in AUTH XOAUTH2 command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + s->passwd.len -= 2; + + ngx_log_debug2(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth xoauth2: \"%V\" \"%V\"", &s->login, &s->passwd); + + s->auth_method = NGX_MAIL_AUTH_XOAUTH2; + + return NGX_DONE; +} + + +ngx_int_t +ngx_mail_auth_oauthbearer(ngx_mail_session_t *s, ngx_connection_t *c, + ngx_uint_t n) +{ + u_char *p, *d, *last, *prev; + ngx_str_t *arg, oauth; + + arg = s->args.elts; + + if (s->auth_err.len) { + ngx_log_debug0(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth oauthbearer cancel"); + + if (s->args.nelts == 1 + && ngx_strncmp(arg[0].data, (u_char *) "AQ==", 4) == 0) + { + s->out = s->auth_err; + s->quit = s->auth_quit; + s->state = 0; + s->mail_state = 0; + ngx_str_null(&s->auth_err); + return NGX_OK; + } + + s->quit = s->auth_quit; + ngx_str_null(&s->auth_err); + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth oauthbearer: \"%V\"", &arg[n]); + + oauth.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len)); + if (oauth.data == NULL) { + return NGX_ERROR; + } + + if (ngx_decode_base64(&oauth, &arg[n]) != NGX_OK) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid base64 encoding in " + "AUTH OAUTHBEARER command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + /* + * RFC 7628 + * "n,a=user at example.com,^A...^Aauth=Bearer ^A^A" + */ + + p = oauth.data; + last = p + oauth.len; + + s->login.len = 0; + prev = NULL; + + while (p < last) { + if (*p == ',') { + if (prev + && (size_t) (p - prev) > sizeof("a=") - 1 + && ngx_strncasecmp(prev, (u_char *) "a=", sizeof("a=") - 1) + == 0) + { + s->login.len = p - prev - (sizeof("a=") - 1); + s->login.data = prev + sizeof("a=") - 1; + break; + } + + p++; + prev = p; + continue; + } + + if (*p == '\1') { + break; + } + + p++; + } + + if (s->login.len == 0) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid login in AUTH OAUTHBEARER command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + s->passwd.len = 0; + prev = NULL; + + while (p < last) { + if (*p == '\1') { + if (prev + && (size_t) (p - prev) > sizeof("auth=Bearer ") - 1 + && ngx_strncasecmp(prev, (u_char *) "auth=Bearer ", + sizeof("auth=Bearer ") - 1) + == 0) + { + s->passwd.len = p - prev - (sizeof("auth=Bearer ") - 1); + s->passwd.data = prev + sizeof("auth=Bearer ") - 1; + break; + } + + p++; + prev = p; + continue; + } + + p++; + } + + if (s->passwd.len == 0) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid token in AUTH OAUTHBEARER command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + /* decode =2C =3D in login */ + + p = s->login.data; + d = s->login.data; + last = s->login.data + s->login.len; + + while (p < last) { + if (*p == '=') { + + /* + * login is always followed by other data, + * so p[1] and p[2] can be checked directly + */ + + if (p[1] == '2' && (p[2] == 'C' || p[2] == 'c')) { + *d++ = ','; + + } else if (p[1] == '3' && (p[2] == 'D' || p[2] == 'd')) { + *d++ = '='; + + } else { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent invalid login in " + "AUTH OAUTHBEARER command"); + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + p += 3; + continue; + } + + *d++ = *p++; + } + + s->login.len = d - s->login.data; + + ngx_log_debug2(NGX_LOG_DEBUG_MAIL, c->log, 0, + "mail auth oauthbearer: \"%V\" \"%V\"", + &s->login, &s->passwd); + + s->auth_method = NGX_MAIL_AUTH_OAUTHBEARER; + + return NGX_DONE; +} + + void ngx_mail_send(ngx_event_t *wev) { @@ -919,13 +1187,17 @@ ngx_mail_auth(ngx_mail_session_t *s, ngx { s->args.nelts = 0; - if (s->buffer->pos == s->buffer->last) { - s->buffer->pos = s->buffer->start; - s->buffer->last = s->buffer->start; + if (s->state) { + /* preserve tag */ + s->arg_start = s->buffer->pos; + + } else { + if (s->buffer->pos == s->buffer->last) { + s->buffer->pos = s->buffer->start; + s->buffer->last = s->buffer->start; + } } - s->state = 0; - if (c->read->timer_set) { ngx_del_timer(c->read); } diff --git a/src/mail/ngx_mail_imap_handler.c b/src/mail/ngx_mail_imap_handler.c --- a/src/mail/ngx_mail_imap_handler.c +++ b/src/mail/ngx_mail_imap_handler.c @@ -220,6 +220,14 @@ ngx_mail_imap_auth_state(ngx_event_t *re case ngx_imap_auth_external: rc = ngx_mail_auth_external(s, c, 0); break; + + case ngx_imap_auth_xoauth2: + rc = ngx_mail_auth_xoauth2(s, c, 0); + break; + + case ngx_imap_auth_oauthbearer: + rc = ngx_mail_auth_oauthbearer(s, c, 0); + break; } } else if (rc == NGX_IMAP_NEXT) { @@ -432,6 +440,38 @@ ngx_mail_imap_authenticate(ngx_mail_sess s->mail_state = ngx_imap_auth_external; return NGX_OK; + + case NGX_MAIL_AUTH_XOAUTH2: + + if (!(iscf->auth_methods & NGX_MAIL_AUTH_XOAUTH2_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_imap_auth_xoauth2; + return ngx_mail_auth_xoauth2(s, c, 1); + } + + ngx_str_set(&s->out, imap_plain_next); + s->mail_state = ngx_imap_auth_xoauth2; + + return NGX_OK; + + case NGX_MAIL_AUTH_OAUTHBEARER: + + if (!(iscf->auth_methods & NGX_MAIL_AUTH_OAUTHBEARER_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_imap_auth_oauthbearer; + return ngx_mail_auth_oauthbearer(s, c, 1); + } + + ngx_str_set(&s->out, imap_plain_next); + s->mail_state = ngx_imap_auth_oauthbearer; + + return NGX_OK; } return rc; diff --git a/src/mail/ngx_mail_imap_module.c b/src/mail/ngx_mail_imap_module.c --- a/src/mail/ngx_mail_imap_module.c +++ b/src/mail/ngx_mail_imap_module.c @@ -30,6 +30,8 @@ static ngx_conf_bitmask_t ngx_mail_imap { ngx_string("login"), NGX_MAIL_AUTH_LOGIN_ENABLED }, { ngx_string("cram-md5"), NGX_MAIL_AUTH_CRAM_MD5_ENABLED }, { ngx_string("external"), NGX_MAIL_AUTH_EXTERNAL_ENABLED }, + { ngx_string("xoauth2"), NGX_MAIL_AUTH_XOAUTH2_ENABLED }, + { ngx_string("oauthbearer"), NGX_MAIL_AUTH_OAUTHBEARER_ENABLED }, { ngx_null_string, 0 } }; @@ -40,6 +42,8 @@ static ngx_str_t ngx_mail_imap_auth_met ngx_null_string, /* APOP */ ngx_string("AUTH=CRAM-MD5"), ngx_string("AUTH=EXTERNAL"), + ngx_string("AUTH=XOAUTH2"), + ngx_string("AUTH=OAUTHBEARER"), ngx_null_string /* NONE */ }; @@ -182,7 +186,7 @@ ngx_mail_imap_merge_srv_conf(ngx_conf_t } for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (m & conf->auth_methods) { @@ -208,7 +212,7 @@ ngx_mail_imap_merge_srv_conf(ngx_conf_t auth = p; for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (m & conf->auth_methods) { diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c --- a/src/mail/ngx_mail_parse.c +++ b/src/mail/ngx_mail_parse.c @@ -953,6 +953,20 @@ ngx_mail_auth_parse(ngx_mail_session_t * return NGX_MAIL_PARSE_INVALID_COMMAND; } + if (arg[0].len == 7) { + + if (ngx_strncasecmp(arg[0].data, (u_char *) "XOAUTH2", 7) == 0) { + + if (s->args.nelts == 1 || s->args.nelts == 2) { + return NGX_MAIL_AUTH_XOAUTH2; + } + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + if (arg[0].len == 8) { if (ngx_strncasecmp(arg[0].data, (u_char *) "CRAM-MD5", 8) == 0) { @@ -976,5 +990,19 @@ ngx_mail_auth_parse(ngx_mail_session_t * return NGX_MAIL_PARSE_INVALID_COMMAND; } + if (arg[0].len == 11) { + + if (ngx_strncasecmp(arg[0].data, (u_char *) "OAUTHBEARER", 11) == 0) { + + if (s->args.nelts == 1 || s->args.nelts == 2) { + return NGX_MAIL_AUTH_OAUTHBEARER; + } + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + return NGX_MAIL_PARSE_INVALID_COMMAND; } diff --git a/src/mail/ngx_mail_pop3_handler.c b/src/mail/ngx_mail_pop3_handler.c --- a/src/mail/ngx_mail_pop3_handler.c +++ b/src/mail/ngx_mail_pop3_handler.c @@ -260,6 +260,14 @@ ngx_mail_pop3_auth_state(ngx_event_t *re case ngx_pop3_auth_external: rc = ngx_mail_auth_external(s, c, 0); break; + + case ngx_pop3_auth_xoauth2: + rc = ngx_mail_auth_xoauth2(s, c, 0); + break; + + case ngx_pop3_auth_oauthbearer: + rc = ngx_mail_auth_oauthbearer(s, c, 0); + break; } } @@ -553,6 +561,38 @@ ngx_mail_pop3_auth(ngx_mail_session_t *s s->mail_state = ngx_pop3_auth_external; return NGX_OK; + + case NGX_MAIL_AUTH_XOAUTH2: + + if (!(pscf->auth_methods & NGX_MAIL_AUTH_XOAUTH2_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_pop3_auth_xoauth2; + return ngx_mail_auth_xoauth2(s, c, 1); + } + + ngx_str_set(&s->out, pop3_next); + s->mail_state = ngx_pop3_auth_xoauth2; + + return NGX_OK; + + case NGX_MAIL_AUTH_OAUTHBEARER: + + if (!(pscf->auth_methods & NGX_MAIL_AUTH_OAUTHBEARER_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_pop3_auth_oauthbearer; + return ngx_mail_auth_oauthbearer(s, c, 1); + } + + ngx_str_set(&s->out, pop3_next); + s->mail_state = ngx_pop3_auth_oauthbearer; + + return NGX_OK; } return rc; diff --git a/src/mail/ngx_mail_pop3_module.c b/src/mail/ngx_mail_pop3_module.c --- a/src/mail/ngx_mail_pop3_module.c +++ b/src/mail/ngx_mail_pop3_module.c @@ -30,6 +30,8 @@ static ngx_conf_bitmask_t ngx_mail_pop3 { ngx_string("apop"), NGX_MAIL_AUTH_APOP_ENABLED }, { ngx_string("cram-md5"), NGX_MAIL_AUTH_CRAM_MD5_ENABLED }, { ngx_string("external"), NGX_MAIL_AUTH_EXTERNAL_ENABLED }, + { ngx_string("xoauth2"), NGX_MAIL_AUTH_XOAUTH2_ENABLED }, + { ngx_string("oauthbearer"), NGX_MAIL_AUTH_OAUTHBEARER_ENABLED }, { ngx_null_string, 0 } }; @@ -40,6 +42,8 @@ static ngx_str_t ngx_mail_pop3_auth_met ngx_null_string, /* APOP */ ngx_string("CRAM-MD5"), ngx_string("EXTERNAL"), + ngx_string("XOAUTH2"), + ngx_string("OAUTHBEARER"), ngx_null_string /* NONE */ }; @@ -183,7 +187,7 @@ ngx_mail_pop3_merge_srv_conf(ngx_conf_t size += sizeof("SASL") - 1 + sizeof(CRLF) - 1; for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (ngx_mail_pop3_auth_methods_names[i].len == 0) { @@ -214,7 +218,7 @@ ngx_mail_pop3_merge_srv_conf(ngx_conf_t p = ngx_cpymem(p, "SASL", sizeof("SASL") - 1); for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (ngx_mail_pop3_auth_methods_names[i].len == 0) { @@ -254,7 +258,7 @@ ngx_mail_pop3_merge_srv_conf(ngx_conf_t + sizeof("." CRLF) - 1; for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (ngx_mail_pop3_auth_methods_names[i].len == 0) { @@ -279,7 +283,7 @@ ngx_mail_pop3_merge_srv_conf(ngx_conf_t sizeof("+OK methods supported:" CRLF) - 1); for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (ngx_mail_pop3_auth_methods_names[i].len == 0) { diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c --- a/src/mail/ngx_mail_smtp_handler.c +++ b/src/mail/ngx_mail_smtp_handler.c @@ -548,6 +548,14 @@ ngx_mail_smtp_auth_state(ngx_event_t *re case ngx_smtp_auth_external: rc = ngx_mail_auth_external(s, c, 0); break; + + case ngx_smtp_auth_xoauth2: + rc = ngx_mail_auth_xoauth2(s, c, 0); + break; + + case ngx_smtp_auth_oauthbearer: + rc = ngx_mail_auth_oauthbearer(s, c, 0); + break; } } @@ -745,6 +753,38 @@ ngx_mail_smtp_auth(ngx_mail_session_t *s s->mail_state = ngx_smtp_auth_external; return NGX_OK; + + case NGX_MAIL_AUTH_XOAUTH2: + + if (!(sscf->auth_methods & NGX_MAIL_AUTH_XOAUTH2_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_smtp_auth_xoauth2; + return ngx_mail_auth_xoauth2(s, c, 1); + } + + ngx_str_set(&s->out, smtp_next); + s->mail_state = ngx_smtp_auth_xoauth2; + + return NGX_OK; + + case NGX_MAIL_AUTH_OAUTHBEARER: + + if (!(sscf->auth_methods & NGX_MAIL_AUTH_OAUTHBEARER_ENABLED)) { + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + + if (s->args.nelts == 2) { + s->mail_state = ngx_smtp_auth_oauthbearer; + return ngx_mail_auth_oauthbearer(s, c, 1); + } + + ngx_str_set(&s->out, smtp_next); + s->mail_state = ngx_smtp_auth_oauthbearer; + + return NGX_OK; } return rc; diff --git a/src/mail/ngx_mail_smtp_module.c b/src/mail/ngx_mail_smtp_module.c --- a/src/mail/ngx_mail_smtp_module.c +++ b/src/mail/ngx_mail_smtp_module.c @@ -22,6 +22,8 @@ static ngx_conf_bitmask_t ngx_mail_smtp { ngx_string("login"), NGX_MAIL_AUTH_LOGIN_ENABLED }, { ngx_string("cram-md5"), NGX_MAIL_AUTH_CRAM_MD5_ENABLED }, { ngx_string("external"), NGX_MAIL_AUTH_EXTERNAL_ENABLED }, + { ngx_string("xoauth2"), NGX_MAIL_AUTH_XOAUTH2_ENABLED }, + { ngx_string("oauthbearer"), NGX_MAIL_AUTH_OAUTHBEARER_ENABLED }, { ngx_string("none"), NGX_MAIL_AUTH_NONE_ENABLED }, { ngx_null_string, 0 } }; @@ -33,6 +35,8 @@ static ngx_str_t ngx_mail_smtp_auth_met ngx_null_string, /* APOP */ ngx_string("CRAM-MD5"), ngx_string("EXTERNAL"), + ngx_string("XOAUTH2"), + ngx_string("OAUTHBEARER"), ngx_null_string /* NONE */ }; @@ -210,7 +214,7 @@ ngx_mail_smtp_merge_srv_conf(ngx_conf_t auth_enabled = 0; for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (m & conf->auth_methods) { @@ -253,7 +257,7 @@ ngx_mail_smtp_merge_srv_conf(ngx_conf_t *p++ = 'A'; *p++ = 'U'; *p++ = 'T'; *p++ = 'H'; for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; - m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; + m < NGX_MAIL_AUTH_NONE_ENABLED; m <<= 1, i++) { if (m & conf->auth_methods) { -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Fri May 31 23:14:41 2024 From: mdounin at mdounin.ru (Maxim Dounin) Date: Sat, 1 Jun 2024 02:14:41 +0300 Subject: proxy_cache_lock for content revalidation In-Reply-To: References:

Message-ID: Hello! On Fri, May 31, 2024 at 11:25:07AM -0700, Maksim Yevmenkin wrote: > [..] > > > > > > > https://mailman.nginx.org/pipermail/nginx-devel/2018-December/011710.html > > > > thank you! it seems the original post mentioned this exact issue. it > > also seems that the patch was removed. i am curious if it would be > > possible to restore the patch. > > please never mind, i'm blind, sorry! Yep, the patch is there. It is however linked with a plain http link, which prevents at least Chrome from loading it unless requested separately. -- Maxim Dounin http://mdounin.ru/