From mdounin at mdounin.ru Sat Nov 1 06:49:24 2025 From: mdounin at mdounin.ru (Maxim Dounin) Date: Sat, 1 Nov 2025 09:49:24 +0300 Subject: [PATCH] Upstream: max_fails doesn't respect the next_upstream config In-Reply-To: References: Message-ID: Hello! On Fri, Oct 31, 2025 at 02:31:38PM +0800, solomon wrote: > Thank you for your reply. It makes sense to me. I didn't intend to > change the behavior. I thought the implementation doesn't > match the docs and didn't notice the docs have clarified this > behavior. > > Now I understand it better. For the cases of error, timeout, and > invalid_header, ngx_http_upstream_next is called directly. Since > they are always considered unsuccessful attempts, there is no > need to check the ft_type against u->conf->next_upstream. For other > cases, ngx_http_upstream_test_next has already checked the status > against u->conf->next_upstream to determine whether to call > ngx_http_upstream_next, so there is also no need to check again. Ok, so you've just misread the docs, thanks for clarifying this. Note that in most cases it is better to check the code as the source of truth, and not docs, since docs might fail to document things correctly. In contrast, the code defines how things work, and often contains many additional informations, such as comments explaining why the code works this way and commit logs explaining details about various changes made in the past. > I have another question though. When peer.free is called from > ngx_http_upstream_next, the state argument is correctly passed. > But for the last attempt that doesn't finally enter > ngx_http_upstream_next, peer.free is called from > ngx_http_upstream_finalize_request with the state being 0, in this case > the last attempt is always considered successful. But in fact it may > be unsuccessful. So I think the status should also be checked there > in order to pass the correct state. I have created a PR for this. Could > you have a look? Thanks. > https://github.com/nginx/nginx/pull/959 That's a known edge case with existing peer.free() handling: for http_500, http_502, http_503, http_504, and http_429 cases, where proxy_next_upstream controls if the particular attempt is considered to be successful or not, peer state reported to peer.free() actually matches proxy_next_upstream status: if we've switched to the next upstream, peer is reported as failed, and if we've instead used the response, peer is reported as not failed. >From formal point of view this can be seen as correct behaviour, as the reported peer state matches what proxy_next_upstream defines - with all the limitation it implies, such as not retrying non-idempotent requests by default, limited number of tries and total time. On the other hand, it is more or less obvious that current behaviour might be suboptimal in some cases, and it might be desired to report peer as failed even if wasn't able to switch to the next upstream for some reason. Further, in some cases it might be desired to report peer as failed even if we haven't even tried to switch to the next upstream, but, for example, have proxy_cache_use_stale configured for a particular error code. At the same time, another limitation of proxy_next_upstream is that it cannot handle errors and timeouts which happen after the response header was sent. But we still can report peer as failed due to this. This needs to be done with care though, as this might be a major change for some setups (for example, if responses are expected to be incomplete and/or to time out at some point). Summing the above, I think that current behaviour might be improved, but it needs to be carefully thought what exactly it needs to do, and how. As for the pull request F5 NGINX you've referenced, I don't think that suggested change addresses the last attempt issue you've mentioned, as after the error response (got for the last attempt) will be sent to the client, the code will call ngx_http_upstream_finalize_request() with NGX_OK. Note though that I'm not F5 and cannot do anything with the pull request in question. [...] -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Tue Nov 4 02:42:24 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 04 Nov 2025 05:42:24 +0300 Subject: [PATCH 0 of 2] XSLT filter improvements Message-ID: Hello! The following patch series addresses some shortcomings of the XSLT filter module (ngx_http_xslt_module), notably: - Attempts to load external entities over network are now rejected. These anyway won't work with libxml2 2.13.0 or later, but with older versions of the library attempts to load external entities over network might block the entire worker process for a long time, and therefore shouldn't be used. - Loading of external entities from the internal DTD subset (that is, the XML document itself) via system identifiers are now forbidden by default, making it slightly safer to use the module with untrusted XML documents. Loading via public identifiers (with appropriate system XML catalogs) and from the external DTD subset (provided with the "xml_entities" directive) still works as usual. If loading of external entities from the internal DTD subset via system identifiers is intentional, the "xml_external_entities" directive can be used to re-enable loading of such entities. Review and testing appreciated. -- Maxim Dounin From mdounin at mdounin.ru Tue Nov 4 02:42:25 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 04 Nov 2025 05:42:25 +0300 Subject: [PATCH 1 of 2] Xslt: disabled loading of external entities over network In-Reply-To: References: Message-ID: <11dfa80270f8358caaac.1762224145@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1762216128 -10800 # Tue Nov 04 03:28:48 2025 +0300 # Node ID 11dfa80270f8358caaaca66363f4f8a3446b43b5 # Parent 6c1b100b965a34be2bc16d67341f7fddf1f38fd2 Xslt: disabled loading of external entities over network. Loading of external entities, including ones defined with the xml_entities directive, happens while parsing the XML response, and therefore loading over network can block the entire worker process for a long time. Loading of external DTD subset is disabled for the very same reason since initial version of the module. Further, loading over network is anyway not available by default since libxml2 2.13.0 (Jun 12 2024) and completely removed in libxml2 2.15.0 (Sep 15 2025). As such, the XML_PARSE_NONET parsing option (available since libxml2 2.6.2 from 2003) is now used to prevent loading of external entities over network. diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -382,7 +382,7 @@ ngx_http_xslt_add_chunk(ngx_http_request return NGX_ERROR; } xmlCtxtUseOptions(ctxt, XML_PARSE_NOENT|XML_PARSE_DTDLOAD - |XML_PARSE_NOWARNING); + |XML_PARSE_NONET|XML_PARSE_NOWARNING); ctxt->sax->externalSubset = ngx_http_xslt_sax_external_subset; ctxt->sax->setDocumentLocator = NULL; From mdounin at mdounin.ru Tue Nov 4 02:42:26 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 04 Nov 2025 05:42:26 +0300 Subject: [PATCH 2 of 2] Xslt: xml_external_entities directive In-Reply-To: References: Message-ID: <4940e420aef6c1caed8d.1762224146@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1762216523 -10800 # Tue Nov 04 03:35:23 2025 +0300 # Node ID 4940e420aef6c1caed8da846a6bc885a7eb9f9c0 # Parent 11dfa80270f8358caaaca66363f4f8a3446b43b5 Xslt: xml_external_entities directive. Loading of external entities defined in the internal DTD subset, that is, in the XML document itself, is now disabled by default, and can be re-enabled with "xml_external_entities on;". This makes processing of untrusted XML responses with the xslt module slightly safer (though still not recommended unless you thoughtfully considered risks). To prevent loading we intercept entities defined in the internal subset via the entityDecl callback, and remove system identifiers from entities. This ensures that entities cannot be loaded directly, but still allows using of public entities with appropriate system XML catalog. Additionally, since libxml2 before 2.14.0 (Mar 27 2025) accepts in-document catalogs by default, these are explicitly disabled. diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -11,6 +11,7 @@ #include #include +#include #include #include #include @@ -21,6 +22,10 @@ #include #endif +#if (defined LIBXML_CATALOG_ENABLED && LIBXML_VERSION < 21400) +#include +#endif + #ifndef NGX_HTTP_XSLT_REUSE_DTD #define NGX_HTTP_XSLT_REUSE_DTD 1 @@ -59,6 +64,7 @@ typedef struct { ngx_array_t *types_keys; ngx_array_t *params; /* ngx_http_xslt_param_t */ ngx_flag_t last_modified; + ngx_flag_t external_entities; } ngx_http_xslt_filter_loc_conf_t; @@ -81,6 +87,9 @@ static ngx_int_t ngx_http_xslt_add_chunk static void ngx_http_xslt_sax_external_subset(void *data, const xmlChar *name, const xmlChar *externalId, const xmlChar *systemId); +static void ngx_http_xslt_sax_entity_decl(void *data, const xmlChar *name, + int type, const xmlChar *publicId, const xmlChar *systemId, + xmlChar *content); static void ngx_cdecl ngx_http_xslt_sax_error(void *data, const char *msg, ...); @@ -124,6 +133,13 @@ static ngx_command_t ngx_http_xslt_filt 0, NULL }, + { ngx_string("xml_external_entities"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_xslt_filter_loc_conf_t, external_entities), + NULL }, + { ngx_string("xslt_stylesheet"), NGX_HTTP_LOC_CONF|NGX_CONF_1MORE, ngx_http_xslt_stylesheet, @@ -385,6 +401,7 @@ ngx_http_xslt_add_chunk(ngx_http_request |XML_PARSE_NONET|XML_PARSE_NOWARNING); ctxt->sax->externalSubset = ngx_http_xslt_sax_external_subset; + ctxt->sax->entityDecl = ngx_http_xslt_sax_entity_decl; ctxt->sax->setDocumentLocator = NULL; ctxt->sax->error = ngx_http_xslt_sax_error; ctxt->sax->fatalError = ngx_http_xslt_sax_error; @@ -460,6 +477,64 @@ ngx_http_xslt_sax_external_subset(void * } +static void +ngx_http_xslt_sax_entity_decl(void *data, const xmlChar *name, int type, + const xmlChar *publicId, const xmlChar *systemId, xmlChar *content) +{ + xmlParserCtxtPtr ctxt = data; + + ngx_http_request_t *r; + ngx_http_xslt_filter_ctx_t *ctx; + ngx_http_xslt_filter_loc_conf_t *conf; + + ctx = ctxt->sax->_private; + r = ctx->request; + + ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "xslt filter entityDecl: \"%s\" \"%s\" \"%s\"", + name ? name : (xmlChar *) "", + publicId ? publicId : (xmlChar *) "", + systemId ? systemId : (xmlChar *) ""); + + conf = ngx_http_get_module_loc_conf(r, ngx_http_xslt_filter_module); + + if (systemId && !conf->external_entities) { + + /* + * If external entiries in the internal DTD subset are disabled, + * we remove system identifiers from such entities. This makes sure + * that external entities cannot be used to directly request arbitrary + * files, but still can be used with public identifiers, assuming these + * are included into XML catalogs on the system. + */ + + ngx_log_error(NGX_LOG_WARN, r->connection->log, 0, + "xslt filter external entity ignored: " + "\"%s\" \"%s\" \"%s\"", + name ? name : (xmlChar *) "", + publicId ? publicId : (xmlChar *) "", + systemId ? systemId : (xmlChar *) ""); + + if (publicId) { + xmlSAX2EntityDecl(data, name, type, publicId, (xmlChar *) "", + content); + + } else if (type == XML_EXTERNAL_GENERAL_PARSED_ENTITY) { + xmlSAX2EntityDecl(data, name, XML_INTERNAL_GENERAL_ENTITY, + NULL, NULL, (xmlChar *) ""); + + } else if (type == XML_EXTERNAL_PARAMETER_ENTITY) { + xmlSAX2EntityDecl(data, name, XML_INTERNAL_PARAMETER_ENTITY, + NULL, NULL, (xmlChar *) ""); + } + + return; + } + + xmlSAX2EntityDecl(data, name, type, publicId, systemId, content); +} + + static void ngx_cdecl ngx_http_xslt_sax_error(void *data, const char *msg, ...) { @@ -1090,6 +1165,7 @@ ngx_http_xslt_filter_create_conf(ngx_con */ conf->last_modified = NGX_CONF_UNSET; + conf->external_entities = NGX_CONF_UNSET; return conf; } @@ -1122,6 +1198,7 @@ ngx_http_xslt_filter_merge_conf(ngx_conf } ngx_conf_merge_value(conf->last_modified, prev->last_modified, 0); + ngx_conf_merge_value(conf->external_entities, prev->external_entities, 0); return NGX_CONF_OK; } @@ -1136,6 +1213,10 @@ ngx_http_xslt_filter_preconfiguration(ng exsltRegisterAll(); #endif +#if (defined LIBXML_CATALOG_ENABLED && LIBXML_VERSION < 21400) + xmlCatalogSetDefaults(XML_CATA_ALLOW_GLOBAL); +#endif + return NGX_OK; } From mdounin at mdounin.ru Tue Nov 4 02:45:40 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Tue, 04 Nov 2025 05:45:40 +0300 Subject: [PATCH] Tests: various types of XML entities In-Reply-To: References: Message-ID: <52fc6dbea2a59f10dc52.1762224340@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1762216981 -10800 # Tue Nov 04 03:43:01 2025 +0300 # Node ID 52fc6dbea2a59f10dc52a30ad1bd2d0272d5d313 # Parent f3f2fec834c495b40f1085e210f372fd1c0468dc Tests: various types of XML entities. diff --git a/xslt_entities.t b/xslt_entities.t new file mode 100644 --- /dev/null +++ b/xslt_entities.t @@ -0,0 +1,352 @@ +#!/usr/bin/perl + +# (C) Maxim Dounin + +# Tests for nginx xslt filter module, various entities. + +############################################################################### + +use warnings; +use strict; + +use Test::More; + +BEGIN { use FindBin; chdir($FindBin::Bin); } + +use lib 'lib'; +use Test::Nginx; + +############################################################################### + +select STDERR; $| = 1; +select STDOUT; $| = 1; + +my $t = Test::Nginx->new()->has(qw/http xslt/); + +$t->write_file_expand('nginx.conf', <<'EOF'); + +%%TEST_GLOBALS%% + +daemon off; + +worker_processes 2; + +env XML_CATALOG_FILES; + +events { +} + +http { + %%TEST_GLOBALS_HTTP%% + + server { + listen 127.0.0.1:8080; + server_name localhost; + + default_type text/xml; + + location = /test.xml { + xslt_stylesheet test.xslt; + xml_entities entities.dtd; + } + + location = /network.xml { + xslt_stylesheet test.xslt; + xml_entities entities.dtd; + } + + location = /internal.xml { + xslt_stylesheet test.xslt; + } + + location = /internal-public.xml { + xslt_stylesheet test.xslt; + } + + location = /enabled.xml { + xslt_stylesheet test.xslt; + xml_external_entities on; + } + + location = /enabled-network.xml { + xslt_stylesheet test.xslt; + xml_external_entities on; + } + + location = /catalog.xml { + xslt_stylesheet test.xslt; + } + + location = /catalog-system.xml { + xslt_stylesheet test.xslt; + } + + location / { + # static files + } + } +} + +EOF + +my $d = $t->testdir(); +my $port = port(8080); + +$t->write_file('test.xslt', <<'EOF'); + + + + + + + + + + + +EOF + +$t->write_file('entities.dtd', < + + + +%placeholder; +EOF + +$t->write_file('external.txt', <write_file('network.txt', <write_file('parameter.dtd', < +EOF + +$t->write_file('network.dtd', < +EOF + +# Test file for external DTD subset testing: +# all entities are expected to come from "xml_entities entities.dtd" +# defined in the configuration (and not from "network.dtd", which should +# not be loaded) + +$t->write_file('test.xml', < + + +simple: &simple; +external: &external; +parameter: ¶meter; + +EOF + +$t->write_file('network.xml', < + + +simple: &simple; +network: &network; + +EOF + +# Test file for internal DTD subset testing: +# entities are defined in the file itself, but external entities should +# not be loaded; note that there is no base URL, so external entities +# use absolute names + +$t->write_file('internal.xml', < + + + + +%placeholder; +]> + +simple: &simple; +external: &external; +network: &network; +parameter: ¶meter; + +EOF + +$t->write_file('internal-public.xml', < + + +]> + +simple: &simple; +public: &public; + +EOF + +$t->write_file('enabled.xml', < + + + + +%placeholder; +]> + +simple: &simple; +external: &external; +public: &public; +parameter: ¶meter; + +EOF + +$t->write_file('enabled-network.xml', < + + +]> + +simple: &simple; +network: &network; + +EOF + +# Tests for in-document XML catalogs: these used to be allowed +# by default till libxml2 2.14.0 + +$ENV{XML_DEBUG_CATALOG} = 1; +$ENV{XML_CATALOG_FILES} = "$d/catalog.system.xml"; + +$t->write_file('catalog.xml', < + + +]> + +catalog: &catalog; + +EOF + +$t->write_file('catalog-system.xml', < + + +]> + +system: &system; + +EOF + +$t->write_file('catalog.document.xml', < + + + + +EOF + +$t->write_file('catalog.system.xml', < + + + + +EOF + +$t->try_run('no xml_external_entities')->plan(16); + +############################################################################### + +my $r; + +# External DTD subset, all entities from "xml_entities entities.dtd" +# in the configuration + +$r = http_get('/test.xml'); + +like($r, qr/simple: simple entity/, 'simple entity'); +like($r, qr/external: external entity/, 'external entity'); +like($r, qr/parameter: external parameter entity/, + 'external parameter entity'); + +# Network entity tested separately, as attempt to load it results +# in parser error in some libxml2 versions (for example, libxml2 2.9.7 +# as seen on Rocky Linux 8) + +$r = http_get('/network.xml'); + +unlike($r, qr/network: external network entity/, + 'external network entity not loaded'); + +# Internal DTD subset, no external entities are loaded + +$r = http_get('/internal.xml'); + +like($r, qr/simple: simple entity/, 'internal subset, simple entity'); +unlike($r, qr/external: external entity/, + 'internal subset, external entity not loaded'); +unlike($r, qr/network: external network entity/, + 'internal subset, external network entity not loaded'); +unlike($r, qr/parameter: external parameter entity/, + 'internal subset, external parameter entity not loaded'); + +# Public entity tested separately, as attempt to load it results +# in parser error in some libxml2 versions + +$r = http_get('/internal-public.xml'); + +unlike($r, qr/public: external entity/, + 'internal subset, external public entity not loaded'); + +# In-document XML catalogs + +$r = http_get('/catalog.xml'); + +unlike($r, qr/catalog: external entity/, + 'internal subset, external entity via document catalog not loaded'); + +$r = http_get('/catalog-system.xml'); + +like($r, qr/system: external entity/, + 'internal subset, external entity via system catalog'); + +# Re-enabled external entities in internal DTD subset with +# the xml_external_entities directive + +$r = http_get('/enabled.xml'); + +like($r, qr/simple: simple entity/, 'internal subset, simple entity'); +like($r, qr/external: external entity/, + 'internal subset, external entity enabled'); +like($r, qr/public: external entity/, + 'internal subset, external public entity enabled'); + +# External parameter entities in internal DTD subset are broken in +# libxml2 2.11.x (but work fine in 2.10.x and 2.12.x), hence TODO + +TODO: { +local $TODO = 'broken in libxml2 2.11.x' + unless $r =~ /parameter: external parameter entity/; + +like($r, qr/parameter: external parameter entity/, + 'internal subset, external parameter entity enabled'); + +} + +$r = http_get('/enabled-network.xml'); + +unlike($r, qr/network: external network entity/, + 'internal subset, external network entity not loaded anyway'); + +############################################################################### From mdounin at mdounin.ru Wed Nov 5 09:25:14 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Wed, 05 Nov 2025 12:25:14 +0300 Subject: [PATCH] Documented "store:..." certificates and keys Message-ID: <00967d8711526c1526b2.1762334714@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1762274238 -10800 # Tue Nov 04 19:37:18 2025 +0300 # Node ID 00967d8711526c1526b2c32d1e8e9bc847442963 # Parent 6f11c0a052568a4cd51ed096cfe10c6ba6aaf85e Documented "store:..." certificates and keys. diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml --- a/xml/en/docs/http/ngx_http_grpc_module.xml +++ b/xml/en/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="11">
@@ -483,6 +483,14 @@ used for authentication to a gRPC SSL se +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -510,6 +518,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/http/ngx_http_proxy_module.xml b/xml/en/docs/http/ngx_http_proxy_module.xml --- a/xml/en/docs/http/ngx_http_proxy_module.xml +++ b/xml/en/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="82">
@@ -1855,6 +1855,14 @@ used for authentication to a proxied HTT +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -1883,6 +1891,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/http/ngx_http_ssl_module.xml b/xml/en/docs/http/ngx_http_ssl_module.xml --- a/xml/en/docs/http/ngx_http_ssl_module.xml +++ b/xml/en/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="66">
@@ -199,6 +199,14 @@ such as writing secret key data to +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + It should be kept in mind that due to the HTTPS protocol limitations for maximum interoperability virtual servers should listen on different @@ -227,6 +235,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:$variable diff --git a/xml/en/docs/http/ngx_http_uwsgi_module.xml b/xml/en/docs/http/ngx_http_uwsgi_module.xml --- a/xml/en/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/en/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="53">
@@ -1275,6 +1275,14 @@ used for authentication to a secured uws +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -1303,6 +1311,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/mail/ngx_mail_ssl_module.xml b/xml/en/docs/mail/ngx_mail_ssl_module.xml --- a/xml/en/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/en/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="29">
@@ -152,6 +152,14 @@ such as writing secret key data to error log. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + @@ -174,6 +182,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:key diff --git a/xml/en/docs/stream/ngx_stream_proxy_module.xml b/xml/en/docs/stream/ngx_stream_proxy_module.xml --- a/xml/en/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/en/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -370,6 +370,14 @@ used for authentication to a proxied ser +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -388,6 +396,14 @@ used for authentication to a proxied ser +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/stream/ngx_stream_ssl_module.xml b/xml/en/docs/stream/ngx_stream_ssl_module.xml --- a/xml/en/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/en/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -169,6 +169,14 @@ such as writing secret key data to error log. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + @@ -191,6 +199,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:$variable diff --git a/xml/ru/docs/http/ngx_http_grpc_module.xml b/xml/ru/docs/http/ngx_http_grpc_module.xml --- a/xml/ru/docs/http/ngx_http_grpc_module.xml +++ b/xml/ru/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="11">
@@ -483,6 +483,13 @@ grpc_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -509,6 +516,13 @@ grpc_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/http/ngx_http_proxy_module.xml b/xml/ru/docs/http/ngx_http_proxy_module.xml --- a/xml/ru/docs/http/ngx_http_proxy_module.xml +++ b/xml/ru/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="82">
@@ -1854,6 +1854,13 @@ proxy_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -1881,6 +1888,13 @@ proxy_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml --- a/xml/ru/docs/http/ngx_http_ssl_module.xml +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="66">
@@ -201,6 +201,13 @@ ssl_certificate_key $ssl_server_name.key +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ????? ????? ? ????, ??? ??-?? ??????????? ????????? HTTPS ??? ???????????? ????????????? ??????????? ??????? ?????? ??????? ?? ?????? @@ -228,6 +235,13 @@ IP-???????. ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:$?????????? (1.15.10), diff --git a/xml/ru/docs/http/ngx_http_uwsgi_module.xml b/xml/ru/docs/http/ngx_http_uwsgi_module.xml --- a/xml/ru/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/ru/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="53">
@@ -1270,6 +1270,13 @@ uwsgi-??????. +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -1297,6 +1304,13 @@ uwsgi-??????. +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/mail/ngx_mail_ssl_module.xml b/xml/ru/docs/mail/ngx_mail_ssl_module.xml --- a/xml/ru/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/ru/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="29">
@@ -153,6 +153,13 @@ server { ??? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + @@ -174,6 +181,13 @@ server { ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:???? (1.15.10), diff --git a/xml/ru/docs/stream/ngx_stream_proxy_module.xml b/xml/ru/docs/stream/ngx_stream_proxy_module.xml --- a/xml/ru/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/ru/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -371,6 +371,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -389,6 +396,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/stream/ngx_stream_ssl_module.xml b/xml/ru/docs/stream/ngx_stream_ssl_module.xml --- a/xml/ru/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/ru/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -171,6 +171,13 @@ ssl_certificate_key $ssl_server_name.key ??? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + @@ -192,6 +199,13 @@ ssl_certificate_key $ssl_server_name.key ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:$?????????? (1.15.10), From osa at freebsd.org.ru Thu Nov 6 02:29:01 2025 From: osa at freebsd.org.ru (Sergey A. Osokin) Date: Thu, 6 Nov 2025 05:29:01 +0300 Subject: [PATCH] Documented "store:..." certificates and keys In-Reply-To: <00967d8711526c1526b2.1762334714@vm-bsd.mdounin.ru> References: <00967d8711526c1526b2.1762334714@vm-bsd.mdounin.ru> Message-ID: On Wed, Nov 05, 2025 at 12:25:14PM +0300, Maxim Dounin wrote: > # HG changeset patch > # User Maxim Dounin > # Date 1762274238 -10800 > # Tue Nov 04 19:37:18 2025 +0300 > # Node ID 00967d8711526c1526b2c32d1e8e9bc847442963 > # Parent 6f11c0a052568a4cd51ed096cfe10c6ba6aaf85e > Documented "store:..." certificates and keys. > > diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml > --- a/xml/en/docs/http/ngx_http_grpc_module.xml > +++ b/xml/en/docs/http/ngx_http_grpc_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/http/ngx_http_grpc_module.html" > lang="en" > - rev="10"> > + rev="11"> > >
> > @@ -483,6 +483,14 @@ used for authentication to a gRPC SSL se > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > @@ -510,6 +518,14 @@ from the OpenSSL engine name > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > diff --git a/xml/en/docs/http/ngx_http_proxy_module.xml b/xml/en/docs/http/ngx_http_proxy_module.xml > --- a/xml/en/docs/http/ngx_http_proxy_module.xml > +++ b/xml/en/docs/http/ngx_http_proxy_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/http/ngx_http_proxy_module.html" > lang="en" > - rev="81"> > + rev="82"> > >
> > @@ -1855,6 +1855,14 @@ used for authentication to a proxied HTT > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > @@ -1883,6 +1891,14 @@ from the OpenSSL engine name > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > diff --git a/xml/en/docs/http/ngx_http_ssl_module.xml b/xml/en/docs/http/ngx_http_ssl_module.xml > --- a/xml/en/docs/http/ngx_http_ssl_module.xml > +++ b/xml/en/docs/http/ngx_http_ssl_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/http/ngx_http_ssl_module.html" > lang="en" > - rev="65"> > + rev="66"> > >
> > @@ -199,6 +199,14 @@ such as writing secret key data to > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > + > It should be kept in mind that due to the HTTPS protocol limitations > for maximum interoperability virtual servers should listen on > different > @@ -227,6 +235,14 @@ which loads a secret key with a specifie > from the OpenSSL engine name. > > > + > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > > The value > data:$variable > diff --git a/xml/en/docs/http/ngx_http_uwsgi_module.xml b/xml/en/docs/http/ngx_http_uwsgi_module.xml > --- a/xml/en/docs/http/ngx_http_uwsgi_module.xml > +++ b/xml/en/docs/http/ngx_http_uwsgi_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/http/ngx_http_uwsgi_module.html" > lang="en" > - rev="52"> > + rev="53"> > >
> > @@ -1275,6 +1275,14 @@ used for authentication to a secured uws > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > @@ -1303,6 +1311,14 @@ from the OpenSSL engine name > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > diff --git a/xml/en/docs/mail/ngx_mail_ssl_module.xml b/xml/en/docs/mail/ngx_mail_ssl_module.xml > --- a/xml/en/docs/mail/ngx_mail_ssl_module.xml > +++ b/xml/en/docs/mail/ngx_mail_ssl_module.xml > @@ -10,7 +10,7 @@ > link="/en/docs/mail/ngx_mail_ssl_module.html" > lang="en" > - rev="28"> > + rev="29"> > >
> > @@ -152,6 +152,14 @@ such as writing secret key data to > error log. > > > + > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > > > > @@ -174,6 +182,14 @@ which loads a secret key with a specifie > from the OpenSSL engine name. > > > + > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > > The value > data:key > diff --git a/xml/en/docs/stream/ngx_stream_proxy_module.xml b/xml/en/docs/stream/ngx_stream_proxy_module.xml > --- a/xml/en/docs/stream/ngx_stream_proxy_module.xml > +++ b/xml/en/docs/stream/ngx_stream_proxy_module.xml > @@ -9,7 +9,7 @@ > link="/en/docs/stream/ngx_stream_proxy_module.html" > lang="en" > - rev="33"> > + rev="34"> > >
> > @@ -370,6 +370,14 @@ used for authentication to a proxied ser > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > @@ -388,6 +396,14 @@ used for authentication to a proxied ser > > > > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > + > Since version 1.21.0, variables can be used in the file name. > > > diff --git a/xml/en/docs/stream/ngx_stream_ssl_module.xml b/xml/en/docs/stream/ngx_stream_ssl_module.xml > --- a/xml/en/docs/stream/ngx_stream_ssl_module.xml > +++ b/xml/en/docs/stream/ngx_stream_ssl_module.xml > @@ -9,7 +9,7 @@ > link="/en/docs/stream/ngx_stream_ssl_module.html" > lang="en" > - rev="33"> > + rev="34"> > >
> > @@ -169,6 +169,14 @@ such as writing secret key data to > error log. > > > + > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a certificate with a specified uri > +from an OpenSSL store. > + > + > > > > @@ -191,6 +199,14 @@ which loads a secret key with a specifie > from the OpenSSL engine name. > > > + > +The value > +store:uri > +can be specified instead of the file (1.29.3), > +which loads a secret key with a specified uri > +from an OpenSSL store. > + > + > > The value > data:$variable > diff --git a/xml/ru/docs/http/ngx_http_grpc_module.xml b/xml/ru/docs/http/ngx_http_grpc_module.xml > --- a/xml/ru/docs/http/ngx_http_grpc_module.xml > +++ b/xml/ru/docs/http/ngx_http_grpc_module.xml > @@ -10,7 +10,7 @@ > link="/ru/docs/http/ngx_http_grpc_module.html" > lang="ru" > - rev="10"> > + rev="11"> > >
> > @@ -483,6 +483,13 @@ grpc_set_header Accept-Encoding ""; > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > @@ -509,6 +516,13 @@ grpc_set_header Accept-Encoding ""; > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > diff --git a/xml/ru/docs/http/ngx_http_proxy_module.xml b/xml/ru/docs/http/ngx_http_proxy_module.xml > --- a/xml/ru/docs/http/ngx_http_proxy_module.xml > +++ b/xml/ru/docs/http/ngx_http_proxy_module.xml > @@ -10,7 +10,7 @@ > link="/ru/docs/http/ngx_http_proxy_module.html" > lang="ru" > - rev="81"> > + rev="82"> > >
> > @@ -1854,6 +1854,13 @@ proxy_set_header Accept-Encoding ""; > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > @@ -1881,6 +1888,13 @@ proxy_set_header Accept-Encoding ""; > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml > --- a/xml/ru/docs/http/ngx_http_ssl_module.xml > +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml > @@ -10,7 +10,7 @@ > link="/ru/docs/http/ngx_http_ssl_module.html" > lang="ru" > - rev="65"> > + rev="66"> > >
> > @@ -201,6 +201,13 @@ ssl_certificate_key $ssl_server_name.key > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > + > ????? ????? ? ????, ??? ??-?? ??????????? ????????? HTTPS > ??? ???????????? ????????????? ??????????? ??????? ?????? ??????? ?? > ?????? > @@ -228,6 +235,13 @@ IP-???????. > ?? OpenSSL engine ? ???????? ??????. > > > + > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > > ?????? ????? ????? ??????? ???????? > data:$?????????? (1.15.10), > diff --git a/xml/ru/docs/http/ngx_http_uwsgi_module.xml b/xml/ru/docs/http/ngx_http_uwsgi_module.xml > --- a/xml/ru/docs/http/ngx_http_uwsgi_module.xml > +++ b/xml/ru/docs/http/ngx_http_uwsgi_module.xml > @@ -10,7 +10,7 @@ > link="/ru/docs/http/ngx_http_uwsgi_module.html" > lang="ru" > - rev="52"> > + rev="53"> > >
> > @@ -1270,6 +1270,13 @@ uwsgi-??????. > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > @@ -1297,6 +1304,13 @@ uwsgi-??????. > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > diff --git a/xml/ru/docs/mail/ngx_mail_ssl_module.xml b/xml/ru/docs/mail/ngx_mail_ssl_module.xml > --- a/xml/ru/docs/mail/ngx_mail_ssl_module.xml > +++ b/xml/ru/docs/mail/ngx_mail_ssl_module.xml > @@ -10,7 +10,7 @@ > link="/ru/docs/mail/ngx_mail_ssl_module.html" > lang="ru" > - rev="28"> > + rev="29"> > >
> > @@ -153,6 +153,13 @@ server { > ??? ??????. > > > + > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > > > > @@ -174,6 +181,13 @@ server { > ?? OpenSSL engine ? ???????? ??????. > > > + > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > > ?????? ????? ????? ??????? ???????? > data:???? (1.15.10), > diff --git a/xml/ru/docs/stream/ngx_stream_proxy_module.xml b/xml/ru/docs/stream/ngx_stream_proxy_module.xml > --- a/xml/ru/docs/stream/ngx_stream_proxy_module.xml > +++ b/xml/ru/docs/stream/ngx_stream_proxy_module.xml > @@ -9,7 +9,7 @@ > link="/ru/docs/stream/ngx_stream_proxy_module.html" > lang="ru" > - rev="33"> > + rev="34"> > >
> > @@ -371,6 +371,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > @@ -389,6 +396,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? > > > > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > + > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > diff --git a/xml/ru/docs/stream/ngx_stream_ssl_module.xml b/xml/ru/docs/stream/ngx_stream_ssl_module.xml > --- a/xml/ru/docs/stream/ngx_stream_ssl_module.xml > +++ b/xml/ru/docs/stream/ngx_stream_ssl_module.xml > @@ -9,7 +9,7 @@ > link="/ru/docs/stream/ngx_stream_ssl_module.html" > lang="ru" > - rev="33"> > + rev="34"> > >
> > @@ -171,6 +171,13 @@ ssl_certificate_key $ssl_server_name.key > ??? ??????. > > > + > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ?????????? ? ????????? uri > +?? OpenSSL store. > + > + > > > > @@ -192,6 +199,13 @@ ssl_certificate_key $ssl_server_name.key > ?? OpenSSL engine ? ???????? ??????. > > > + > +?????? ????? ????? ??????? ???????? > +store:uri (1.29.3), > +??????? ????????? ???? ? ????????? uri > +?? OpenSSL store. > + > + > > ?????? ????? ????? ??????? ???????? > data:$?????????? (1.15.10), Looks good to me. -- Sergey A. Osokin https://tipi.work/ From mdounin at mdounin.ru Thu Nov 6 13:27:19 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Thu, 06 Nov 2025 16:27:19 +0300 Subject: [nginx-site] Documented "store:..." certificates and keys. Message-ID: details: http://freenginx.org/hg/nginx-site/rev/00967d871152 branches: changeset: 3121:00967d871152 user: Maxim Dounin date: Tue Nov 04 19:37:18 2025 +0300 description: Documented "store:..." certificates and keys. diffstat: xml/en/docs/http/ngx_http_grpc_module.xml | 18 +++++++++++++++++- xml/en/docs/http/ngx_http_proxy_module.xml | 18 +++++++++++++++++- xml/en/docs/http/ngx_http_ssl_module.xml | 18 +++++++++++++++++- xml/en/docs/http/ngx_http_uwsgi_module.xml | 18 +++++++++++++++++- xml/en/docs/mail/ngx_mail_ssl_module.xml | 18 +++++++++++++++++- xml/en/docs/stream/ngx_stream_proxy_module.xml | 18 +++++++++++++++++- xml/en/docs/stream/ngx_stream_ssl_module.xml | 18 +++++++++++++++++- xml/ru/docs/http/ngx_http_grpc_module.xml | 16 +++++++++++++++- xml/ru/docs/http/ngx_http_proxy_module.xml | 16 +++++++++++++++- xml/ru/docs/http/ngx_http_ssl_module.xml | 16 +++++++++++++++- xml/ru/docs/http/ngx_http_uwsgi_module.xml | 16 +++++++++++++++- xml/ru/docs/mail/ngx_mail_ssl_module.xml | 16 +++++++++++++++- xml/ru/docs/stream/ngx_stream_proxy_module.xml | 16 +++++++++++++++- xml/ru/docs/stream/ngx_stream_ssl_module.xml | 16 +++++++++++++++- 14 files changed, 224 insertions(+), 14 deletions(-) diffs (574 lines): diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml --- a/xml/en/docs/http/ngx_http_grpc_module.xml +++ b/xml/en/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="11">
@@ -483,6 +483,14 @@ used for authentication to a gRPC SSL se +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -510,6 +518,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/http/ngx_http_proxy_module.xml b/xml/en/docs/http/ngx_http_proxy_module.xml --- a/xml/en/docs/http/ngx_http_proxy_module.xml +++ b/xml/en/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="82">
@@ -1855,6 +1855,14 @@ used for authentication to a proxied HTT +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -1883,6 +1891,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/http/ngx_http_ssl_module.xml b/xml/en/docs/http/ngx_http_ssl_module.xml --- a/xml/en/docs/http/ngx_http_ssl_module.xml +++ b/xml/en/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="66">
@@ -199,6 +199,14 @@ such as writing secret key data to +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + It should be kept in mind that due to the HTTPS protocol limitations for maximum interoperability virtual servers should listen on different @@ -227,6 +235,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:$variable diff --git a/xml/en/docs/http/ngx_http_uwsgi_module.xml b/xml/en/docs/http/ngx_http_uwsgi_module.xml --- a/xml/en/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/en/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="53">
@@ -1275,6 +1275,14 @@ used for authentication to a secured uws +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -1303,6 +1311,14 @@ from the OpenSSL engine name +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/mail/ngx_mail_ssl_module.xml b/xml/en/docs/mail/ngx_mail_ssl_module.xml --- a/xml/en/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/en/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="29">
@@ -152,6 +152,14 @@ such as writing secret key data to error log. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + @@ -174,6 +182,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:key diff --git a/xml/en/docs/stream/ngx_stream_proxy_module.xml b/xml/en/docs/stream/ngx_stream_proxy_module.xml --- a/xml/en/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/en/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -370,6 +370,14 @@ used for authentication to a proxied ser +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. @@ -388,6 +396,14 @@ used for authentication to a proxied ser +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + + Since version 1.21.0, variables can be used in the file name. diff --git a/xml/en/docs/stream/ngx_stream_ssl_module.xml b/xml/en/docs/stream/ngx_stream_ssl_module.xml --- a/xml/en/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/en/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -169,6 +169,14 @@ such as writing secret key data to error log. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a certificate with a specified uri +from an OpenSSL store. + + @@ -191,6 +199,14 @@ which loads a secret key with a specifie from the OpenSSL engine name. + +The value +store:uri +can be specified instead of the file (1.29.3), +which loads a secret key with a specified uri +from an OpenSSL store. + + The value data:$variable diff --git a/xml/ru/docs/http/ngx_http_grpc_module.xml b/xml/ru/docs/http/ngx_http_grpc_module.xml --- a/xml/ru/docs/http/ngx_http_grpc_module.xml +++ b/xml/ru/docs/http/ngx_http_grpc_module.xml @@ -10,7 +10,7 @@ + rev="11">
@@ -483,6 +483,13 @@ grpc_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -509,6 +516,13 @@ grpc_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/http/ngx_http_proxy_module.xml b/xml/ru/docs/http/ngx_http_proxy_module.xml --- a/xml/ru/docs/http/ngx_http_proxy_module.xml +++ b/xml/ru/docs/http/ngx_http_proxy_module.xml @@ -10,7 +10,7 @@ + rev="82">
@@ -1854,6 +1854,13 @@ proxy_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -1881,6 +1888,13 @@ proxy_set_header Accept-Encoding ""; +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml --- a/xml/ru/docs/http/ngx_http_ssl_module.xml +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="66">
@@ -201,6 +201,13 @@ ssl_certificate_key $ssl_server_name.key +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ????? ????? ? ????, ??? ??-?? ??????????? ????????? HTTPS ??? ???????????? ????????????? ??????????? ??????? ?????? ??????? ?? ?????? @@ -228,6 +235,13 @@ IP-???????. ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:$?????????? (1.15.10), diff --git a/xml/ru/docs/http/ngx_http_uwsgi_module.xml b/xml/ru/docs/http/ngx_http_uwsgi_module.xml --- a/xml/ru/docs/http/ngx_http_uwsgi_module.xml +++ b/xml/ru/docs/http/ngx_http_uwsgi_module.xml @@ -10,7 +10,7 @@ + rev="53">
@@ -1270,6 +1270,13 @@ uwsgi-??????. +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -1297,6 +1304,13 @@ uwsgi-??????. +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/mail/ngx_mail_ssl_module.xml b/xml/ru/docs/mail/ngx_mail_ssl_module.xml --- a/xml/ru/docs/mail/ngx_mail_ssl_module.xml +++ b/xml/ru/docs/mail/ngx_mail_ssl_module.xml @@ -10,7 +10,7 @@ + rev="29">
@@ -153,6 +153,13 @@ server { ??? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + @@ -174,6 +181,13 @@ server { ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:???? (1.15.10), diff --git a/xml/ru/docs/stream/ngx_stream_proxy_module.xml b/xml/ru/docs/stream/ngx_stream_proxy_module.xml --- a/xml/ru/docs/stream/ngx_stream_proxy_module.xml +++ b/xml/ru/docs/stream/ngx_stream_proxy_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -371,6 +371,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. @@ -389,6 +396,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + + ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. diff --git a/xml/ru/docs/stream/ngx_stream_ssl_module.xml b/xml/ru/docs/stream/ngx_stream_ssl_module.xml --- a/xml/ru/docs/stream/ngx_stream_ssl_module.xml +++ b/xml/ru/docs/stream/ngx_stream_ssl_module.xml @@ -9,7 +9,7 @@ + rev="34">
@@ -171,6 +171,13 @@ ssl_certificate_key $ssl_server_name.key ??? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ?????????? ? ????????? uri +?? OpenSSL store. + + @@ -192,6 +199,13 @@ ssl_certificate_key $ssl_server_name.key ?? OpenSSL engine ? ???????? ??????. + +?????? ????? ????? ??????? ???????? +store:uri (1.29.3), +??????? ????????? ???? ? ????????? uri +?? OpenSSL store. + + ?????? ????? ????? ??????? ???????? data:$?????????? (1.15.10), From mdounin at mdounin.ru Thu Nov 6 13:28:46 2025 From: mdounin at mdounin.ru (Maxim Dounin) Date: Thu, 6 Nov 2025 16:28:46 +0300 Subject: [PATCH] Documented "store:..." certificates and keys In-Reply-To: References: <00967d8711526c1526b2.1762334714@vm-bsd.mdounin.ru> Message-ID: Hello! On Thu, Nov 06, 2025 at 05:29:01AM +0300, Sergey A. Osokin wrote: > On Wed, Nov 05, 2025 at 12:25:14PM +0300, Maxim Dounin wrote: > > # HG changeset patch > > # User Maxim Dounin > > # Date 1762274238 -10800 > > # Tue Nov 04 19:37:18 2025 +0300 > > # Node ID 00967d8711526c1526b2c32d1e8e9bc847442963 > > # Parent 6f11c0a052568a4cd51ed096cfe10c6ba6aaf85e > > Documented "store:..." certificates and keys. > > > > diff --git a/xml/en/docs/http/ngx_http_grpc_module.xml b/xml/en/docs/http/ngx_http_grpc_module.xml > > --- a/xml/en/docs/http/ngx_http_grpc_module.xml > > +++ b/xml/en/docs/http/ngx_http_grpc_module.xml > > @@ -10,7 +10,7 @@ > > > link="/en/docs/http/ngx_http_grpc_module.html" > > lang="en" > > - rev="10"> > > + rev="11"> > > > >
> > > > @@ -483,6 +483,14 @@ used for authentication to a gRPC SSL se > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > @@ -510,6 +518,14 @@ from the OpenSSL engine name > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > diff --git a/xml/en/docs/http/ngx_http_proxy_module.xml b/xml/en/docs/http/ngx_http_proxy_module.xml > > --- a/xml/en/docs/http/ngx_http_proxy_module.xml > > +++ b/xml/en/docs/http/ngx_http_proxy_module.xml > > @@ -10,7 +10,7 @@ > > > link="/en/docs/http/ngx_http_proxy_module.html" > > lang="en" > > - rev="81"> > > + rev="82"> > > > >
> > > > @@ -1855,6 +1855,14 @@ used for authentication to a proxied HTT > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > @@ -1883,6 +1891,14 @@ from the OpenSSL engine name > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > diff --git a/xml/en/docs/http/ngx_http_ssl_module.xml b/xml/en/docs/http/ngx_http_ssl_module.xml > > --- a/xml/en/docs/http/ngx_http_ssl_module.xml > > +++ b/xml/en/docs/http/ngx_http_ssl_module.xml > > @@ -10,7 +10,7 @@ > > > link="/en/docs/http/ngx_http_ssl_module.html" > > lang="en" > > - rev="65"> > > + rev="66"> > > > >
> > > > @@ -199,6 +199,14 @@ such as writing secret key data to > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > It should be kept in mind that due to the HTTPS protocol limitations > > for maximum interoperability virtual servers should listen on > > different > > @@ -227,6 +235,14 @@ which loads a secret key with a specifie > > from the OpenSSL engine name. > > > > > > + > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > > > The value > > data:$variable > > diff --git a/xml/en/docs/http/ngx_http_uwsgi_module.xml b/xml/en/docs/http/ngx_http_uwsgi_module.xml > > --- a/xml/en/docs/http/ngx_http_uwsgi_module.xml > > +++ b/xml/en/docs/http/ngx_http_uwsgi_module.xml > > @@ -10,7 +10,7 @@ > > > link="/en/docs/http/ngx_http_uwsgi_module.html" > > lang="en" > > - rev="52"> > > + rev="53"> > > > >
> > > > @@ -1275,6 +1275,14 @@ used for authentication to a secured uws > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > @@ -1303,6 +1311,14 @@ from the OpenSSL engine name > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > diff --git a/xml/en/docs/mail/ngx_mail_ssl_module.xml b/xml/en/docs/mail/ngx_mail_ssl_module.xml > > --- a/xml/en/docs/mail/ngx_mail_ssl_module.xml > > +++ b/xml/en/docs/mail/ngx_mail_ssl_module.xml > > @@ -10,7 +10,7 @@ > > > link="/en/docs/mail/ngx_mail_ssl_module.html" > > lang="en" > > - rev="28"> > > + rev="29"> > > > >
> > > > @@ -152,6 +152,14 @@ such as writing secret key data to > > error log. > > > > > > + > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > > > > > > > @@ -174,6 +182,14 @@ which loads a secret key with a specifie > > from the OpenSSL engine name. > > > > > > + > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > > > The value > > data:key > > diff --git a/xml/en/docs/stream/ngx_stream_proxy_module.xml b/xml/en/docs/stream/ngx_stream_proxy_module.xml > > --- a/xml/en/docs/stream/ngx_stream_proxy_module.xml > > +++ b/xml/en/docs/stream/ngx_stream_proxy_module.xml > > @@ -9,7 +9,7 @@ > > > link="/en/docs/stream/ngx_stream_proxy_module.html" > > lang="en" > > - rev="33"> > > + rev="34"> > > > >
> > > > @@ -370,6 +370,14 @@ used for authentication to a proxied ser > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > @@ -388,6 +396,14 @@ used for authentication to a proxied ser > > > > > > > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > + > > Since version 1.21.0, variables can be used in the file name. > > > > > > diff --git a/xml/en/docs/stream/ngx_stream_ssl_module.xml b/xml/en/docs/stream/ngx_stream_ssl_module.xml > > --- a/xml/en/docs/stream/ngx_stream_ssl_module.xml > > +++ b/xml/en/docs/stream/ngx_stream_ssl_module.xml > > @@ -9,7 +9,7 @@ > > > link="/en/docs/stream/ngx_stream_ssl_module.html" > > lang="en" > > - rev="33"> > > + rev="34"> > > > >
> > > > @@ -169,6 +169,14 @@ such as writing secret key data to > > error log. > > > > > > + > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a certificate with a specified uri > > +from an OpenSSL store. > > + > > + > > > > > > > > @@ -191,6 +199,14 @@ which loads a secret key with a specifie > > from the OpenSSL engine name. > > > > > > + > > +The value > > +store:uri > > +can be specified instead of the file (1.29.3), > > +which loads a secret key with a specified uri > > +from an OpenSSL store. > > + > > + > > > > The value > > data:$variable > > diff --git a/xml/ru/docs/http/ngx_http_grpc_module.xml b/xml/ru/docs/http/ngx_http_grpc_module.xml > > --- a/xml/ru/docs/http/ngx_http_grpc_module.xml > > +++ b/xml/ru/docs/http/ngx_http_grpc_module.xml > > @@ -10,7 +10,7 @@ > > > link="/ru/docs/http/ngx_http_grpc_module.html" > > lang="ru" > > - rev="10"> > > + rev="11"> > > > >
> > > > @@ -483,6 +483,13 @@ grpc_set_header Accept-Encoding ""; > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > @@ -509,6 +516,13 @@ grpc_set_header Accept-Encoding ""; > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > diff --git a/xml/ru/docs/http/ngx_http_proxy_module.xml b/xml/ru/docs/http/ngx_http_proxy_module.xml > > --- a/xml/ru/docs/http/ngx_http_proxy_module.xml > > +++ b/xml/ru/docs/http/ngx_http_proxy_module.xml > > @@ -10,7 +10,7 @@ > > > link="/ru/docs/http/ngx_http_proxy_module.html" > > lang="ru" > > - rev="81"> > > + rev="82"> > > > >
> > > > @@ -1854,6 +1854,13 @@ proxy_set_header Accept-Encoding ""; > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > @@ -1881,6 +1888,13 @@ proxy_set_header Accept-Encoding ""; > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml > > --- a/xml/ru/docs/http/ngx_http_ssl_module.xml > > +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml > > @@ -10,7 +10,7 @@ > > > link="/ru/docs/http/ngx_http_ssl_module.html" > > lang="ru" > > - rev="65"> > > + rev="66"> > > > >
> > > > @@ -201,6 +201,13 @@ ssl_certificate_key $ssl_server_name.key > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ????? ????? ? ????, ??? ??-?? ??????????? ????????? HTTPS > > ??? ???????????? ????????????? ??????????? ??????? ?????? ??????? ?? > > ?????? > > @@ -228,6 +235,13 @@ IP-???????. > > ?? OpenSSL engine ? ???????? ??????. > > > > > > + > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > > > ?????? ????? ????? ??????? ???????? > > data:$?????????? (1.15.10), > > diff --git a/xml/ru/docs/http/ngx_http_uwsgi_module.xml b/xml/ru/docs/http/ngx_http_uwsgi_module.xml > > --- a/xml/ru/docs/http/ngx_http_uwsgi_module.xml > > +++ b/xml/ru/docs/http/ngx_http_uwsgi_module.xml > > @@ -10,7 +10,7 @@ > > > link="/ru/docs/http/ngx_http_uwsgi_module.html" > > lang="ru" > > - rev="52"> > > + rev="53"> > > > >
> > > > @@ -1270,6 +1270,13 @@ uwsgi-??????. > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > @@ -1297,6 +1304,13 @@ uwsgi-??????. > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > diff --git a/xml/ru/docs/mail/ngx_mail_ssl_module.xml b/xml/ru/docs/mail/ngx_mail_ssl_module.xml > > --- a/xml/ru/docs/mail/ngx_mail_ssl_module.xml > > +++ b/xml/ru/docs/mail/ngx_mail_ssl_module.xml > > @@ -10,7 +10,7 @@ > > > link="/ru/docs/mail/ngx_mail_ssl_module.html" > > lang="ru" > > - rev="28"> > > + rev="29"> > > > >
> > > > @@ -153,6 +153,13 @@ server { > > ??? ??????. > > > > > > + > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > > > > > > > @@ -174,6 +181,13 @@ server { > > ?? OpenSSL engine ? ???????? ??????. > > > > > > + > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > > > ?????? ????? ????? ??????? ???????? > > data:???? (1.15.10), > > diff --git a/xml/ru/docs/stream/ngx_stream_proxy_module.xml b/xml/ru/docs/stream/ngx_stream_proxy_module.xml > > --- a/xml/ru/docs/stream/ngx_stream_proxy_module.xml > > +++ b/xml/ru/docs/stream/ngx_stream_proxy_module.xml > > @@ -9,7 +9,7 @@ > > > link="/ru/docs/stream/ngx_stream_proxy_module.html" > > lang="ru" > > - rev="33"> > > + rev="34"> > > > >
> > > > @@ -371,6 +371,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > @@ -389,6 +396,13 @@ C????? ?????????? ????? ???????? ???? ???????? ????????? > > > > > > > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > + > > ??????? ? ?????? 1.21.0 ? ????? ????? ????? ???????????? ??????????. > > > > > > diff --git a/xml/ru/docs/stream/ngx_stream_ssl_module.xml b/xml/ru/docs/stream/ngx_stream_ssl_module.xml > > --- a/xml/ru/docs/stream/ngx_stream_ssl_module.xml > > +++ b/xml/ru/docs/stream/ngx_stream_ssl_module.xml > > @@ -9,7 +9,7 @@ > > > link="/ru/docs/stream/ngx_stream_ssl_module.html" > > lang="ru" > > - rev="33"> > > + rev="34"> > > > >
> > > > @@ -171,6 +171,13 @@ ssl_certificate_key $ssl_server_name.key > > ??? ??????. > > > > > > + > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ?????????? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > > > > > > > @@ -192,6 +199,13 @@ ssl_certificate_key $ssl_server_name.key > > ?? OpenSSL engine ? ???????? ??????. > > > > > > + > > +?????? ????? ????? ??????? ???????? > > +store:uri (1.29.3), > > +??????? ????????? ???? ? ????????? uri > > +?? OpenSSL store. > > + > > + > > > > ?????? ????? ????? ??????? ???????? > > data:$?????????? (1.15.10), > > Looks good to me. Committed, thanks for looking. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Sat Nov 8 12:57:50 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Sat, 08 Nov 2025 15:57:50 +0300 Subject: [PATCH] Documented xml_external_entities directive In-Reply-To: References: Message-ID: <177acdc2dd4f5fe27f33.1762606670@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1762606468 -10800 # Sat Nov 08 15:54:28 2025 +0300 # Node ID 177acdc2dd4f5fe27f33ba71401e98b42b01df3b # Parent 00967d8711526c1526b2c32d1e8e9bc847442963 Documented xml_external_entities directive. diff --git a/xml/en/docs/http/ngx_http_xslt_module.xml b/xml/en/docs/http/ngx_http_xslt_module.xml --- a/xml/en/docs/http/ngx_http_xslt_module.xml +++ b/xml/en/docs/http/ngx_http_xslt_module.xml @@ -10,7 +10,7 @@ + rev="4">
@@ -73,6 +73,36 @@ It is enough to declare just the require + +on | off +off +http +server +location +1.29.3 + + +Enables loading of external character entities +declared in the internal DTD subset, +that is, in the processed XML document itself. + + + +By default, loading of external entities +declared in the internal DTD subset +is disabled since version 1.29.3. +Loading can be enabled with this directive, +but it should be kept in mind that this makes it possible to +access all local files readable by the worker process. + + + +Only loading of file-based external entities is supported. + + + + + on | off off diff --git a/xml/ru/docs/http/ngx_http_xslt_module.xml b/xml/ru/docs/http/ngx_http_xslt_module.xml --- a/xml/ru/docs/http/ngx_http_xslt_module.xml +++ b/xml/ru/docs/http/ngx_http_xslt_module.xml @@ -10,7 +10,7 @@ + rev="4">
@@ -73,6 +73,36 @@ location / { + +on | off +off +http +server +location +1.29.3 + + +????????? ???????? ??????? ?????????? ?????????, +??????????? ?? ?????????? ???????????? DTD, +?? ???? ??????????????? ? ?????????????? XML-?????????. + + + +?? ????????? ???????? ??????? ?????????, +??????????? ?? ?????????? ???????????? DTD, +????????? ??????? ? ?????? 1.29.3. +???????? ????? ???? ????????? ? ??????? ?????? ?????????, +?? ??????? ?????????, ??? ??? ?????? ????????? +?????? ????? ????????? ??????, ????????? ???????? ????????. + + + +?????????????? ?????? ???????? ??????? ????????? ?? ??????. + + + + + on | off off From mdounin at mdounin.ru Sun Nov 9 09:59:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 09 Nov 2025 12:59:21 +0300 Subject: [nginx] Xslt: disabled loading of external entities over the net... Message-ID: details: http://freenginx.org/hg/nginx/rev/081c50f47347 branches: changeset: 9434:081c50f47347 user: Maxim Dounin date: Sun Nov 09 12:01:35 2025 +0300 description: Xslt: disabled loading of external entities over the network. Loading of external entities, including ones defined with the xml_entities directive, happens while parsing the XML response, and therefore loading over the network can block the entire worker process for a long time. Loading of external DTD subset is disabled for the very same reason since initial version of the module. Further, loading over the network is anyway not available by default since libxml2 2.13.0 (Jun 12 2024) and completely removed in libxml2 2.15.0 (Sep 15 2025). As such, the XML_PARSE_NONET parsing option (available since libxml2 2.6.2 from 2003) is now used to prevent loading of external entities over the network. diffstat: src/http/modules/ngx_http_xslt_filter_module.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diffs (12 lines): diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -382,7 +382,7 @@ ngx_http_xslt_add_chunk(ngx_http_request return NGX_ERROR; } xmlCtxtUseOptions(ctxt, XML_PARSE_NOENT|XML_PARSE_DTDLOAD - |XML_PARSE_NOWARNING); + |XML_PARSE_NONET|XML_PARSE_NOWARNING); ctxt->sax->externalSubset = ngx_http_xslt_sax_external_subset; ctxt->sax->setDocumentLocator = NULL; From mdounin at mdounin.ru Sun Nov 9 09:59:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 09 Nov 2025 12:59:21 +0300 Subject: [nginx] Xslt: xml_external_entities directive. Message-ID: details: http://freenginx.org/hg/nginx/rev/94dae9ab1018 branches: changeset: 9435:94dae9ab1018 user: Maxim Dounin date: Sun Nov 09 12:01:38 2025 +0300 description: Xslt: xml_external_entities directive. Loading of external entities defined in the internal DTD subset, that is, in the XML document itself, is now disabled by default, and can be re-enabled with "xml_external_entities on;". This makes processing of untrusted XML responses with the xslt module slightly safer (though still not recommended unless you thoughtfully considered risks). To prevent loading we intercept entities defined in the internal subset via the entityDecl callback, and remove system identifiers from entities. This ensures that entities cannot be loaded directly, but still allows using of public entities with appropriate system XML catalog. Additionally, since libxml2 before 2.14.0 (Mar 27 2025) accepts in-document catalogs by default, these are explicitly disabled. diffstat: src/http/modules/ngx_http_xslt_filter_module.c | 81 ++++++++++++++++++++++++++ 1 files changed, 81 insertions(+), 0 deletions(-) diffs (154 lines): diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -11,6 +11,7 @@ #include #include +#include #include #include #include @@ -21,6 +22,10 @@ #include #endif +#if (defined LIBXML_CATALOG_ENABLED && LIBXML_VERSION < 21400) +#include +#endif + #ifndef NGX_HTTP_XSLT_REUSE_DTD #define NGX_HTTP_XSLT_REUSE_DTD 1 @@ -59,6 +64,7 @@ typedef struct { ngx_array_t *types_keys; ngx_array_t *params; /* ngx_http_xslt_param_t */ ngx_flag_t last_modified; + ngx_flag_t external_entities; } ngx_http_xslt_filter_loc_conf_t; @@ -81,6 +87,9 @@ static ngx_int_t ngx_http_xslt_add_chunk static void ngx_http_xslt_sax_external_subset(void *data, const xmlChar *name, const xmlChar *externalId, const xmlChar *systemId); +static void ngx_http_xslt_sax_entity_decl(void *data, const xmlChar *name, + int type, const xmlChar *publicId, const xmlChar *systemId, + xmlChar *content); static void ngx_cdecl ngx_http_xslt_sax_error(void *data, const char *msg, ...); @@ -124,6 +133,13 @@ static ngx_command_t ngx_http_xslt_filt 0, NULL }, + { ngx_string("xml_external_entities"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_LOC_CONF_OFFSET, + offsetof(ngx_http_xslt_filter_loc_conf_t, external_entities), + NULL }, + { ngx_string("xslt_stylesheet"), NGX_HTTP_LOC_CONF|NGX_CONF_1MORE, ngx_http_xslt_stylesheet, @@ -385,6 +401,7 @@ ngx_http_xslt_add_chunk(ngx_http_request |XML_PARSE_NONET|XML_PARSE_NOWARNING); ctxt->sax->externalSubset = ngx_http_xslt_sax_external_subset; + ctxt->sax->entityDecl = ngx_http_xslt_sax_entity_decl; ctxt->sax->setDocumentLocator = NULL; ctxt->sax->error = ngx_http_xslt_sax_error; ctxt->sax->fatalError = ngx_http_xslt_sax_error; @@ -460,6 +477,64 @@ ngx_http_xslt_sax_external_subset(void * } +static void +ngx_http_xslt_sax_entity_decl(void *data, const xmlChar *name, int type, + const xmlChar *publicId, const xmlChar *systemId, xmlChar *content) +{ + xmlParserCtxtPtr ctxt = data; + + ngx_http_request_t *r; + ngx_http_xslt_filter_ctx_t *ctx; + ngx_http_xslt_filter_loc_conf_t *conf; + + ctx = ctxt->sax->_private; + r = ctx->request; + + ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "xslt filter entityDecl: \"%s\" \"%s\" \"%s\"", + name ? name : (xmlChar *) "", + publicId ? publicId : (xmlChar *) "", + systemId ? systemId : (xmlChar *) ""); + + conf = ngx_http_get_module_loc_conf(r, ngx_http_xslt_filter_module); + + if (systemId && !conf->external_entities) { + + /* + * If external entiries in the internal DTD subset are disabled, + * we remove system identifiers from such entities. This makes sure + * that external entities cannot be used to directly request arbitrary + * files, but still can be used with public identifiers, assuming these + * are included into XML catalogs on the system. + */ + + ngx_log_error(NGX_LOG_WARN, r->connection->log, 0, + "xslt filter external entity ignored: " + "\"%s\" \"%s\" \"%s\"", + name ? name : (xmlChar *) "", + publicId ? publicId : (xmlChar *) "", + systemId ? systemId : (xmlChar *) ""); + + if (publicId) { + xmlSAX2EntityDecl(data, name, type, publicId, (xmlChar *) "", + content); + + } else if (type == XML_EXTERNAL_GENERAL_PARSED_ENTITY) { + xmlSAX2EntityDecl(data, name, XML_INTERNAL_GENERAL_ENTITY, + NULL, NULL, (xmlChar *) ""); + + } else if (type == XML_EXTERNAL_PARAMETER_ENTITY) { + xmlSAX2EntityDecl(data, name, XML_INTERNAL_PARAMETER_ENTITY, + NULL, NULL, (xmlChar *) ""); + } + + return; + } + + xmlSAX2EntityDecl(data, name, type, publicId, systemId, content); +} + + static void ngx_cdecl ngx_http_xslt_sax_error(void *data, const char *msg, ...) { @@ -1090,6 +1165,7 @@ ngx_http_xslt_filter_create_conf(ngx_con */ conf->last_modified = NGX_CONF_UNSET; + conf->external_entities = NGX_CONF_UNSET; return conf; } @@ -1122,6 +1198,7 @@ ngx_http_xslt_filter_merge_conf(ngx_conf } ngx_conf_merge_value(conf->last_modified, prev->last_modified, 0); + ngx_conf_merge_value(conf->external_entities, prev->external_entities, 0); return NGX_CONF_OK; } @@ -1136,6 +1213,10 @@ ngx_http_xslt_filter_preconfiguration(ng exsltRegisterAll(); #endif +#if (defined LIBXML_CATALOG_ENABLED && LIBXML_VERSION < 21400) + xmlCatalogSetDefaults(XML_CATA_ALLOW_GLOBAL); +#endif + return NGX_OK; } From mdounin at mdounin.ru Sun Nov 9 10:00:17 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 09 Nov 2025 13:00:17 +0300 Subject: [nginx-tests] Tests: various types of XML entities. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/f84dd67e4cf8 branches: changeset: 2032:f84dd67e4cf8 user: Maxim Dounin date: Sun Nov 09 12:04:58 2025 +0300 description: Tests: various types of XML entities. diffstat: xslt_entities.t | 352 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 352 insertions(+), 0 deletions(-) diffs (357 lines): diff --git a/xslt_entities.t b/xslt_entities.t new file mode 100644 --- /dev/null +++ b/xslt_entities.t @@ -0,0 +1,352 @@ +#!/usr/bin/perl + +# (C) Maxim Dounin + +# Tests for nginx xslt filter module, various entities. + +############################################################################### + +use warnings; +use strict; + +use Test::More; + +BEGIN { use FindBin; chdir($FindBin::Bin); } + +use lib 'lib'; +use Test::Nginx; + +############################################################################### + +select STDERR; $| = 1; +select STDOUT; $| = 1; + +my $t = Test::Nginx->new()->has(qw/http xslt/); + +$t->write_file_expand('nginx.conf', <<'EOF'); + +%%TEST_GLOBALS%% + +daemon off; + +worker_processes 2; + +env XML_CATALOG_FILES; + +events { +} + +http { + %%TEST_GLOBALS_HTTP%% + + server { + listen 127.0.0.1:8080; + server_name localhost; + + default_type text/xml; + + location = /test.xml { + xslt_stylesheet test.xslt; + xml_entities entities.dtd; + } + + location = /network.xml { + xslt_stylesheet test.xslt; + xml_entities entities.dtd; + } + + location = /internal.xml { + xslt_stylesheet test.xslt; + } + + location = /internal-public.xml { + xslt_stylesheet test.xslt; + } + + location = /enabled.xml { + xslt_stylesheet test.xslt; + xml_external_entities on; + } + + location = /enabled-network.xml { + xslt_stylesheet test.xslt; + xml_external_entities on; + } + + location = /catalog.xml { + xslt_stylesheet test.xslt; + } + + location = /catalog-system.xml { + xslt_stylesheet test.xslt; + } + + location / { + # static files + } + } +} + +EOF + +my $d = $t->testdir(); +my $port = port(8080); + +$t->write_file('test.xslt', <<'EOF'); + + + + + + + + + + + +EOF + +$t->write_file('entities.dtd', < + + + +%placeholder; +EOF + +$t->write_file('external.txt', <write_file('network.txt', <write_file('parameter.dtd', < +EOF + +$t->write_file('network.dtd', < +EOF + +# Test file for external DTD subset testing: +# all entities are expected to come from "xml_entities entities.dtd" +# defined in the configuration (and not from "network.dtd", which should +# not be loaded) + +$t->write_file('test.xml', < + + +simple: &simple; +external: &external; +parameter: ¶meter; + +EOF + +$t->write_file('network.xml', < + + +simple: &simple; +network: &network; + +EOF + +# Test file for internal DTD subset testing: +# entities are defined in the file itself, but external entities should +# not be loaded; note that there is no base URL, so external entities +# use absolute names + +$t->write_file('internal.xml', < + + + + +%placeholder; +]> + +simple: &simple; +external: &external; +network: &network; +parameter: ¶meter; + +EOF + +$t->write_file('internal-public.xml', < + + +]> + +simple: &simple; +public: &public; + +EOF + +$t->write_file('enabled.xml', < + + + + +%placeholder; +]> + +simple: &simple; +external: &external; +public: &public; +parameter: ¶meter; + +EOF + +$t->write_file('enabled-network.xml', < + + +]> + +simple: &simple; +network: &network; + +EOF + +# Tests for in-document XML catalogs: these used to be allowed +# by default till libxml2 2.14.0 + +$ENV{XML_DEBUG_CATALOG} = 1; +$ENV{XML_CATALOG_FILES} = "$d/catalog.system.xml"; + +$t->write_file('catalog.xml', < + + +]> + +catalog: &catalog; + +EOF + +$t->write_file('catalog-system.xml', < + + +]> + +system: &system; + +EOF + +$t->write_file('catalog.document.xml', < + + + + +EOF + +$t->write_file('catalog.system.xml', < + + + + +EOF + +$t->try_run('no xml_external_entities')->plan(16); + +############################################################################### + +my $r; + +# External DTD subset, all entities from "xml_entities entities.dtd" +# in the configuration + +$r = http_get('/test.xml'); + +like($r, qr/simple: simple entity/, 'simple entity'); +like($r, qr/external: external entity/, 'external entity'); +like($r, qr/parameter: external parameter entity/, + 'external parameter entity'); + +# Network entity tested separately, as attempt to load it results +# in parser error in some libxml2 versions (for example, libxml2 2.9.7 +# as seen on Rocky Linux 8) + +$r = http_get('/network.xml'); + +unlike($r, qr/network: external network entity/, + 'external network entity not loaded'); + +# Internal DTD subset, no external entities are loaded + +$r = http_get('/internal.xml'); + +like($r, qr/simple: simple entity/, 'internal subset, simple entity'); +unlike($r, qr/external: external entity/, + 'internal subset, external entity not loaded'); +unlike($r, qr/network: external network entity/, + 'internal subset, external network entity not loaded'); +unlike($r, qr/parameter: external parameter entity/, + 'internal subset, external parameter entity not loaded'); + +# Public entity tested separately, as attempt to load it results +# in parser error in some libxml2 versions + +$r = http_get('/internal-public.xml'); + +unlike($r, qr/public: external entity/, + 'internal subset, external public entity not loaded'); + +# In-document XML catalogs + +$r = http_get('/catalog.xml'); + +unlike($r, qr/catalog: external entity/, + 'internal subset, external entity via document catalog not loaded'); + +$r = http_get('/catalog-system.xml'); + +like($r, qr/system: external entity/, + 'internal subset, external entity via system catalog'); + +# Re-enabled external entities in internal DTD subset with +# the xml_external_entities directive + +$r = http_get('/enabled.xml'); + +like($r, qr/simple: simple entity/, 'internal subset, simple entity'); +like($r, qr/external: external entity/, + 'internal subset, external entity enabled'); +like($r, qr/public: external entity/, + 'internal subset, external public entity enabled'); + +# External parameter entities in internal DTD subset are broken in +# libxml2 2.11.x (but work fine in 2.10.x and 2.12.x), hence TODO + +TODO: { +local $TODO = 'broken in libxml2 2.11.x' + unless $r =~ /parameter: external parameter entity/; + +like($r, qr/parameter: external parameter entity/, + 'internal subset, external parameter entity enabled'); + +} + +$r = http_get('/enabled-network.xml'); + +unlike($r, qr/network: external network entity/, + 'internal subset, external network entity not loaded anyway'); + +############################################################################### From mdounin at mdounin.ru Sun Nov 9 10:14:31 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 09 Nov 2025 13:14:31 +0300 Subject: [nginx-site] Documented xml_external_entities directive. Message-ID: details: http://freenginx.org/hg/nginx-site/rev/9af0065a1b69 branches: changeset: 3122:9af0065a1b69 user: Maxim Dounin date: Sun Nov 09 13:14:10 2025 +0300 description: Documented xml_external_entities directive. diffstat: xml/en/docs/http/ngx_http_xslt_module.xml | 32 ++++++++++++++++++++++++++++++- xml/ru/docs/http/ngx_http_xslt_module.xml | 32 ++++++++++++++++++++++++++++++- 2 files changed, 62 insertions(+), 2 deletions(-) diffs (98 lines): diff --git a/xml/en/docs/http/ngx_http_xslt_module.xml b/xml/en/docs/http/ngx_http_xslt_module.xml --- a/xml/en/docs/http/ngx_http_xslt_module.xml +++ b/xml/en/docs/http/ngx_http_xslt_module.xml @@ -10,7 +10,7 @@ + rev="4">
@@ -73,6 +73,36 @@ It is enough to declare just the require + +on | off +off +http +server +location +1.29.3 + + +Enables loading of external character entities +declared in the internal DTD subset, +that is, in the processed XML document itself. + + + +By default, loading of external entities +declared in the internal DTD subset +is disabled since version 1.29.3. +Loading can be enabled with this directive, +but it should be kept in mind that this makes it possible to +access all local files readable by the worker process. + + + +Only loading of file-based external entities is supported. + + + + + on | off off diff --git a/xml/ru/docs/http/ngx_http_xslt_module.xml b/xml/ru/docs/http/ngx_http_xslt_module.xml --- a/xml/ru/docs/http/ngx_http_xslt_module.xml +++ b/xml/ru/docs/http/ngx_http_xslt_module.xml @@ -10,7 +10,7 @@ + rev="4">
@@ -73,6 +73,36 @@ location / { + +on | off +off +http +server +location +1.29.3 + + +????????? ???????? ??????? ?????????? ?????????, +??????????? ?? ?????????? ???????????? DTD, +?? ???? ??????????????? ? ?????????????? XML-?????????. + + + +?? ????????? ???????? ??????? ?????????, +??????????? ?? ?????????? ???????????? DTD, +????????? ??????? ? ?????? 1.29.3. +???????? ????? ???? ????????? ? ??????? ?????? ?????????, +?? ??????? ?????????, ??? ??? ?????? ????????? +?????? ????? ????????? ??????, ????????? ???????? ????????. + + + +?????????????? ?????? ???????? ??????? ????????? ?? ??????. + + + + + on | off off From mdounin at mdounin.ru Mon Nov 10 23:26:00 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 11 Nov 2025 02:26:00 +0300 Subject: [nginx-tests] Tests: fixed ssl_store.t on Windows. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/5ab28d196497 branches: changeset: 2033:5ab28d196497 user: Maxim Dounin date: Tue Nov 11 01:21:29 2025 +0300 description: Tests: fixed ssl_store.t on Windows. OpenSSL requires "file:..." store URIs to start with "/" as per RFC 8089, which is not the case for %%TESTDIR%% on Windows. Fix is to add "///" before %%TESTDIR%%, which results in correct file URIs for both Windows and Unix systems. diffstat: ssl_store.t | 36 ++++++++++++++++++------------------ 1 files changed, 18 insertions(+), 18 deletions(-) diffs (99 lines): diff --git a/ssl_store.t b/ssl_store.t --- a/ssl_store.t +++ b/ssl_store.t @@ -48,24 +48,24 @@ http { listen 127.0.0.1:8443 ssl; server_name localhost; - ssl_certificate store:file:%%TESTDIR%%/localhost.crt; - ssl_certificate_key store:file:%%TESTDIR%%/localhost.key; + ssl_certificate store:file:///%%TESTDIR%%/localhost.crt; + ssl_certificate_key store:file:///%%TESTDIR%%/localhost.key; } server { listen 127.0.0.1:8443 ssl; server_name crt_key; - ssl_certificate store:file:%%TESTDIR%%/localhost.crt_key; - ssl_certificate_key store:file:%%TESTDIR%%/localhost.crt_key; + ssl_certificate store:file:///%%TESTDIR%%/localhost.crt_key; + ssl_certificate_key store:file:///%%TESTDIR%%/localhost.crt_key; } server { listen 127.0.0.1:8443 ssl; server_name key_crt; - ssl_certificate store:file:%%TESTDIR%%/localhost.key_crt; - ssl_certificate_key store:file:%%TESTDIR%%/localhost.key_crt; + ssl_certificate store:file:///%%TESTDIR%%/localhost.key_crt; + ssl_certificate_key store:file:///%%TESTDIR%%/localhost.key_crt; } server { @@ -73,8 +73,8 @@ http { server_name encrypted; ssl_password_file passwords; - ssl_certificate store:file:%%TESTDIR%%/encrypted.crt; - ssl_certificate_key store:file:%%TESTDIR%%/encrypted.key; + ssl_certificate store:file:///%%TESTDIR%%/encrypted.crt; + ssl_certificate_key store:file:///%%TESTDIR%%/encrypted.key; } server { @@ -82,8 +82,8 @@ http { server_name encrypted_crt_key; ssl_password_file passwords; - ssl_certificate store:file:%%TESTDIR%%/encrypted.crt_key; - ssl_certificate_key store:file:%%TESTDIR%%/encrypted.crt_key; + ssl_certificate store:file:///%%TESTDIR%%/encrypted.crt_key; + ssl_certificate_key store:file:///%%TESTDIR%%/encrypted.crt_key; } server { @@ -91,16 +91,16 @@ http { server_name encrypted_key_crt; ssl_password_file passwords; - ssl_certificate store:file:%%TESTDIR%%/encrypted.key_crt; - ssl_certificate_key store:file:%%TESTDIR%%/encrypted.key_crt; + ssl_certificate store:file:///%%TESTDIR%%/encrypted.key_crt; + ssl_certificate_key store:file:///%%TESTDIR%%/encrypted.key_crt; } server { listen 127.0.0.1:8443 ssl; server_name dynamic no_password; - ssl_certificate store:file:%%TESTDIR%%/$ssl_server_name.crt; - ssl_certificate_key store:file:%%TESTDIR%%/$ssl_server_name.key; + ssl_certificate store:file:///%%TESTDIR%%/$ssl_server_name.crt; + ssl_certificate_key store:file:///%%TESTDIR%%/$ssl_server_name.key; } server { @@ -108,8 +108,8 @@ http { server_name password; ssl_password_file password; - ssl_certificate store:file:%%TESTDIR%%/$ssl_server_name.crt; - ssl_certificate_key store:file:%%TESTDIR%%/$ssl_server_name.key; + ssl_certificate store:file:///%%TESTDIR%%/$ssl_server_name.crt; + ssl_certificate_key store:file:///%%TESTDIR%%/$ssl_server_name.key; } server { @@ -117,8 +117,8 @@ http { server_name multiple; ssl_password_file passwords; - ssl_certificate store:file:%%TESTDIR%%/$ssl_server_name.crt; - ssl_certificate_key store:file:%%TESTDIR%%/$ssl_server_name.key; + ssl_certificate store:file:///%%TESTDIR%%/$ssl_server_name.crt; + ssl_certificate_key store:file:///%%TESTDIR%%/$ssl_server_name.key; } } From mdounin at mdounin.ru Mon Nov 10 23:27:16 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 11 Nov 2025 02:27:16 +0300 Subject: [nginx] Updated OpenSSL and PCRE used for win32 builds. Message-ID: details: http://freenginx.org/hg/nginx/rev/a590407d066d branches: changeset: 9436:a590407d066d user: Maxim Dounin date: Mon Nov 10 22:50:38 2025 +0300 description: Updated OpenSSL and PCRE used for win32 builds. diffstat: auto/lib/pcre/make | 2 ++ misc/GNUmakefile | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diffs (31 lines): diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make --- a/auto/lib/pcre/make +++ b/auto/lib/pcre/make @@ -37,10 +37,12 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then pcre2_xclass.c" ngx_pcre_test="pcre2_chkdint.c \ + pcre2_compile_cgroup.c \ pcre2_compile_class.c \ pcre2_convert.c \ pcre2_extuni.c \ pcre2_find_bracket.c \ + pcre2_match_next.c \ pcre2_script_run.c \ pcre2_serialize.c" diff --git a/misc/GNUmakefile b/misc/GNUmakefile --- a/misc/GNUmakefile +++ b/misc/GNUmakefile @@ -6,9 +6,9 @@ TEMP = tmp CC = cl OBJS = objs.msvc8 -OPENSSL = openssl-3.0.17 +OPENSSL = openssl-3.0.18 ZLIB = zlib-1.3.1 -PCRE = pcre2-10.46 +PCRE = pcre2-10.47 release: export From mdounin at mdounin.ru Mon Nov 10 23:31:13 2025 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 11 Nov 2025 02:31:13 +0300 Subject: freenginx-1.29.3 changes draft Message-ID: Hello! Changes with freenginx 1.29.3 11 Nov 2025 *) Feature: loading of certificates and secret keys from hardware tokens with OpenSSL STORE API. *) Change: loading of external character entities declared in the internal DTD subset is now disabled by default in the ngx_http_xslt_filter_module; loading can be enabled with the "xml_external_entities" directive. *) Bugfix: the ngx_http_xslt_filter_module might try loading of external character entities over the network, which might cause blocking of the worker process for a significant time. *) Bugfix: the "working_directory", "google_perftools_profiles", "geoip_country", "geoip_city", "geoip_org", and "xml_entities" directives incorrectly handled relative paths. ????????? ? freenginx 1.29.3 11.11.2025 *) ??????????: ??????????? ???????? ???????????? ? ????????? ?????? ? ?????????? ????????? ? ??????? OpenSSL STORE API. *) ?????????: ? ?????? ngx_http_xslt_filter_module ?????? ?? ????????? ????????? ???????? ??????? ?????????? ?????????, ??????????? ?? ?????????? ???????????? DTD; ???????? ????? ???? ????????? ? ??????? ????????? xml_external_entities. *) ???????????: ?????? ngx_http_xslt_filter_module ??? ???????? ????????? ??????? ?????????? ???????? ?? ????, ??? ????? ????????? ? ??????????????? ?????????? ??????? ????????. *) ???????????: ????????? working_directory, google_perftools_profiles, geoip_country, geoip_city, geoip_org ? xml_entities ??????????? ???????????? ????????????? ????. -- Maxim Dounin http://mdounin.ru/ From mdounin at mdounin.ru Tue Nov 11 13:37:07 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 11 Nov 2025 16:37:07 +0300 Subject: [nginx] freenginx-1.29.3-RELEASE Message-ID: details: http://freenginx.org/hg/nginx/rev/2175d3bea2a8 branches: changeset: 9437:2175d3bea2a8 user: Maxim Dounin date: Tue Nov 11 16:30:38 2025 +0300 description: freenginx-1.29.3-RELEASE diffstat: docs/xml/nginx/changes.xml | 59 ++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 59 insertions(+), 0 deletions(-) diffs (69 lines): diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml --- a/docs/xml/nginx/changes.xml +++ b/docs/xml/nginx/changes.xml @@ -7,6 +7,65 @@
+ + + + +??????????? ???????? ???????????? ? ????????? ?????? ? ?????????? ????????? +? ??????? OpenSSL STORE API. + + +loading of certificates and secret keys from hardware tokens +with OpenSSL STORE API. + + + + + +? ?????? ngx_http_xslt_filter_module +?????? ?? ????????? ????????? +???????? ??????? ?????????? ?????????, +??????????? ?? ?????????? ???????????? DTD; +???????? ????? ???? ????????? ? ??????? ????????? xml_external_entities. + + +loading of external character entities +declared in the internal DTD subset +is now disabled by default +in the ngx_http_xslt_filter_module; +loading can be enabled with the "xml_external_entities" directive. + + + + + +?????? ngx_http_xslt_filter_module +??? ???????? ????????? ??????? ?????????? ???????? ?? ????, +??? ????? ????????? ? ??????????????? ?????????? ???????? ????????. + + +the ngx_http_xslt_filter_module +might try loading of external character entities over the network, +which might cause blocking of the worker process for a significant time. + + + + + +????????? working_directory, google_perftools_profiles, +geoip_country, geoip_city, geoip_org ? xml_entities +??????????? ???????????? ????????????? ????. + + +the "working_directory", "google_perftools_profiles", +"geoip_country", "geoip_city", "geoip_org", and "xml_entities" directives +incorrectly handled relative paths. + + + + + + From mdounin at mdounin.ru Tue Nov 11 13:37:07 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 11 Nov 2025 16:37:07 +0300 Subject: [nginx] release-1.29.3 tag Message-ID: details: http://freenginx.org/hg/nginx/rev/6598df9118f9 branches: changeset: 9438:6598df9118f9 user: Maxim Dounin date: Tue Nov 11 16:30:39 2025 +0300 description: release-1.29.3 tag diffstat: .hgtags | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diffs (8 lines): diff --git a/.hgtags b/.hgtags --- a/.hgtags +++ b/.hgtags @@ -488,3 +488,4 @@ 6731069e4b635d9dca49d6de04f0241cf3d856dd 441d59c1052d602143764a5765d65c51388c1d7b release-1.29.0 8ccd477736c998c0ea64c477b75c647cb28b356c release-1.29.1 56d817adaa1dd4f522114e921b1ff599c2ab4db2 release-1.29.2 +2175d3bea2a84f7265b90c6f9efea7fb9b41bdd7 release-1.29.3 From mdounin at mdounin.ru Tue Nov 11 13:37:32 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Tue, 11 Nov 2025 16:37:32 +0300 Subject: [nginx-site] freenginx-1.29.3 Message-ID: details: http://freenginx.org/hg/nginx-site/rev/b0c7016f8868 branches: changeset: 3123:b0c7016f8868 user: Maxim Dounin date: Tue Nov 11 16:36:28 2025 +0300 description: freenginx-1.29.3 diffstat: text/en/CHANGES | 19 +++++++++++++++++++ text/ru/CHANGES.ru | 19 +++++++++++++++++++ xml/index.xml | 16 ++++++++++++++++ xml/versions.xml | 1 + 4 files changed, 55 insertions(+), 0 deletions(-) diffs (91 lines): diff --git a/text/en/CHANGES b/text/en/CHANGES --- a/text/en/CHANGES +++ b/text/en/CHANGES @@ -1,4 +1,23 @@ +Changes with freenginx 1.29.3 11 Nov 2025 + + *) Feature: loading of certificates and secret keys from hardware tokens + with OpenSSL STORE API. + + *) Change: loading of external character entities declared in the + internal DTD subset is now disabled by default in the + ngx_http_xslt_filter_module; loading can be enabled with the + "xml_external_entities" directive. + + *) Bugfix: the ngx_http_xslt_filter_module might try loading of external + character entities over the network, which might cause blocking of + the worker process for a significant time. + + *) Bugfix: the "working_directory", "google_perftools_profiles", + "geoip_country", "geoip_city", "geoip_org", and "xml_entities" + directives incorrectly handled relative paths. + + Changes with freenginx 1.29.2 23 Sep 2025 *) Feature: support for the Encrypted Client Hello (ECH) extension of diff --git a/text/ru/CHANGES.ru b/text/ru/CHANGES.ru --- a/text/ru/CHANGES.ru +++ b/text/ru/CHANGES.ru @@ -1,4 +1,23 @@ +????????? ? freenginx 1.29.3 11.11.2025 + + *) ??????????: ??????????? ???????? ???????????? ? ????????? ?????? ? + ?????????? ????????? ? ??????? OpenSSL STORE API. + + *) ?????????: ? ?????? ngx_http_xslt_filter_module ?????? ?? ????????? + ????????? ???????? ??????? ?????????? ?????????, ??????????? ?? + ?????????? ???????????? DTD; ???????? ????? ???? ????????? ? ??????? + ????????? xml_external_entities. + + *) ???????????: ?????? ngx_http_xslt_filter_module ??? ???????? + ????????? ??????? ?????????? ???????? ?? ????, ??? ????? ????????? ? + ??????????????? ?????????? ???????? ????????. + + *) ???????????: ????????? working_directory, google_perftools_profiles, + geoip_country, geoip_city, geoip_org ? xml_entities ??????????? + ???????????? ????????????? ????. + + ????????? ? freenginx 1.29.2 23.09.2025 *) ??????????: ????????? ?????????? Encrypted Client Hello (ECH) diff --git a/xml/index.xml b/xml/index.xml --- a/xml/index.xml +++ b/xml/index.xml @@ -8,6 +8,22 @@ + + +freenginx-1.29.3 +mainline version has been released, +featuring +support for loading SSL certificates and secret keys from hardware tokens +via OpenSSL stores using the +?store:...? syntax +and +improvements to the +XSLT module. + + + freenginx-1.29.2 diff --git a/xml/versions.xml b/xml/versions.xml --- a/xml/versions.xml +++ b/xml/versions.xml @@ -9,6 +9,7 @@ + From mdounin at mdounin.ru Wed Nov 19 14:10:38 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Wed, 19 Nov 2025 17:10:38 +0300 Subject: [PATCH 1 of 3] Auth basic: fixed file descriptor leak on memory allocation errors Message-ID: # HG changeset patch # User Maxim Dounin # Date 1763512313 -10800 # Wed Nov 19 03:31:53 2025 +0300 # Node ID a7a3126061282c50ed79c86f9ca72ddd72a10310 # Parent 6598df9118f93b8f731114ef56069c270e44488b Auth basic: fixed file descriptor leak on memory allocation errors. If ngx_pnalloc() for pwd.data failed when handling an incomplete last line of a user file, file descriptor for the file wasn't closed before returning the error. The issue was introduced in 7637:0cb942c1c1aa (1.17.10), as the particular error path wasn't converted to the "goto cleanup" pattern introduced in the commit, but file closing was moved to the end of the function. The issue is, however, unlikely to happen in practice, as it only happens when handling an incorrectly formatted user file (newline at end of file), and only if memory allocation of a small string fails, which is unlikely even on memory-constrained systems. The fix is to use the "goto cleanup" pattern, similarly to how other errors are handled since 7637:0cb942c1c1aa. This also ensures that the buffer is properly zeroed out if the particular memory allocation fails. Found by Coverity (CID 1643265). diff --git a/src/http/modules/ngx_http_auth_basic_module.c b/src/http/modules/ngx_http_auth_basic_module.c --- a/src/http/modules/ngx_http_auth_basic_module.c +++ b/src/http/modules/ngx_http_auth_basic_module.c @@ -253,7 +253,8 @@ ngx_http_auth_basic_handler(ngx_http_req pwd.len = i - passwd; pwd.data = ngx_pnalloc(r->pool, pwd.len + 1); if (pwd.data == NULL) { - return NGX_HTTP_INTERNAL_SERVER_ERROR; + rc = NGX_HTTP_INTERNAL_SERVER_ERROR; + goto cleanup; } ngx_cpystrn(pwd.data, &buf[passwd], pwd.len + 1); From mdounin at mdounin.ru Wed Nov 19 14:10:39 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Wed, 19 Nov 2025 17:10:39 +0300 Subject: [PATCH 2 of 3] Geo: fixed ngx_file_info() error handling In-Reply-To: References: Message-ID: <38d3d6ce245e081a4551.1763561439@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1763517200 -10800 # Wed Nov 19 04:53:20 2025 +0300 # Node ID 38d3d6ce245e081a4551dbad95e04d3a78ffca39 # Parent a7a3126061282c50ed79c86f9ca72ddd72a10310 Geo: fixed ngx_file_info() error handling. When ngx_file_info() on the text include file failed when loading a binary include, the code failed to restore binary file name in "name". While it is generally not needed after an error, an additional error might theoretically happen when closing the binary include, and wrong "name" will result in incorrect file name in the error message. The fix is to restore "name", much like it is done in the normal code path. Prodded by Coverity (CID 1306890, 1643342). diff --git a/src/http/modules/ngx_http_geo_module.c b/src/http/modules/ngx_http_geo_module.c --- a/src/http/modules/ngx_http_geo_module.c +++ b/src/http/modules/ngx_http_geo_module.c @@ -1464,6 +1464,7 @@ ngx_http_geo_include_binary_base(ngx_con if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) { ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, ngx_file_info_n " \"%s\" failed", name->data); + name->data[name->len - 4] = ch; goto failed; } diff --git a/src/stream/ngx_stream_geo_module.c b/src/stream/ngx_stream_geo_module.c --- a/src/stream/ngx_stream_geo_module.c +++ b/src/stream/ngx_stream_geo_module.c @@ -1390,6 +1390,7 @@ ngx_stream_geo_include_binary_base(ngx_c if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) { ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, ngx_file_info_n " \"%s\" failed", name->data); + name->data[name->len - 4] = ch; goto failed; } From mdounin at mdounin.ru Wed Nov 19 14:10:40 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Wed, 19 Nov 2025 17:10:40 +0300 Subject: [PATCH 3 of 3] Geo: fixed Valgrind complaints about uninitialized values In-Reply-To: References: Message-ID: <4b46d6ba035fc38f85da.1763561440@vm-bsd.mdounin.ru> # HG changeset patch # User Maxim Dounin # Date 1763527854 -10800 # Wed Nov 19 07:50:54 2025 +0300 # Node ID 4b46d6ba035fc38f85dae96dfdd0f9e518e3d46e # Parent 38d3d6ce245e081a4551dbad95e04d3a78ffca39 Geo: fixed Valgrind complaints about uninitialized values. In ngx_http_geo_value(), variable values were initialized to the extent used by the lookup code. But the same structures are also fully copied into the binary range base by ngx_http_geo_copy_values(), including unused members and padding, and Valgrind complains about uninitialized memory being used: ==42== Use of uninitialised value of size 8 ==42== at 0x40F0C20: ngx_crc32_long (ngx_crc32.h:46) ==42== by 0x40F0C20: ngx_http_geo_create_binary_base (ngx_http_geo_module.c:1648) ==42== by 0x40F0C20: ngx_http_geo_block (ngx_http_geo_module.c:516) ==42== by 0x404BA94: ngx_conf_handler (ngx_conf_file.c:463) ==42== by 0x404BA94: ngx_conf_parse (ngx_conf_file.c:319) ==42== by 0x408C462: ngx_http_block (ngx_http.c:239) ==42== by 0x404BA94: ngx_conf_handler (ngx_conf_file.c:463) ==42== by 0x404BA94: ngx_conf_parse (ngx_conf_file.c:319) ==42== by 0x4048880: ngx_init_cycle (ngx_cycle.c:286) ==42== by 0x40348EB: main (nginx.c:293)' Fix is to fully initialize ngx_http_variable_value_t structures during allocation by using ngx_pcalloc(). Prodded by Valgrind. diff --git a/src/http/modules/ngx_http_geo_module.c b/src/http/modules/ngx_http_geo_module.c --- a/src/http/modules/ngx_http_geo_module.c +++ b/src/http/modules/ngx_http_geo_module.c @@ -1259,7 +1259,7 @@ ngx_http_geo_value(ngx_conf_t *cf, ngx_h return gvvn->value; } - val = ngx_palloc(ctx->pool, sizeof(ngx_http_variable_value_t)); + val = ngx_pcalloc(ctx->pool, sizeof(ngx_http_variable_value_t)); if (val == NULL) { return NULL; } diff --git a/src/stream/ngx_stream_geo_module.c b/src/stream/ngx_stream_geo_module.c --- a/src/stream/ngx_stream_geo_module.c +++ b/src/stream/ngx_stream_geo_module.c @@ -1209,7 +1209,7 @@ ngx_stream_geo_value(ngx_conf_t *cf, ngx return gvvn->value; } - val = ngx_palloc(ctx->pool, sizeof(ngx_stream_variable_value_t)); + val = ngx_pcalloc(ctx->pool, sizeof(ngx_stream_variable_value_t)); if (val == NULL) { return NULL; } From mdounin at mdounin.ru Wed Nov 19 14:11:27 2025 From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=) Date: Wed, 19 Nov 2025 17:11:27 +0300 Subject: [PATCH] Tests: lifted unsafe restriction on geo binary tests Message-ID: # HG changeset patch # User Maxim Dounin # Date 1763561013 -10800 # Wed Nov 19 17:03:33 2025 +0300 # Node ID c8f7c3ada8991c29972c6f669d410bd6f07333ef # Parent 5ab28d1964976d4e5c0ad45ddd47d822e1091bc8 Tests: lifted unsafe restriction on geo binary tests. The restriction was originally introduced in 1044:1fe8d33f75ad to ensure constrained startup times and not triggering waitforfile() timeout while starting nginx. Since then, timeout for watforfile() was raised from 3 to 10 seconds, and the test normally works less than a second even on relatively slow hosts, which is well under the limit. While here, adjusted "base.conf" generation to produce a proper text file with lines of reasonable length. diff --git a/geo_binary.t b/geo_binary.t --- a/geo_binary.t +++ b/geo_binary.t @@ -22,8 +22,6 @@ use Test::Nginx; select STDERR; $| = 1; select STDOUT; $| = 1; -plan(skip_all => 'long configuration parsing') unless $ENV{TEST_NGINX_UNSAFE}; - my $t = Test::Nginx->new()->has(qw/http geo/); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -66,7 +64,7 @@ EOF $t->write_file('base.conf', join('', map { "127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." . $_ % 256 . "-127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." .$_ % 256 . " " . - ($_ == 1 ? "loopback" : "range$_") . ";" } (0 .. 100000))); + ($_ == 1 ? "loopback" : "range$_") . ";\n" } (0 .. 100000))); $t->run(); diff --git a/stream_geo_binary.t b/stream_geo_binary.t --- a/stream_geo_binary.t +++ b/stream_geo_binary.t @@ -23,8 +23,6 @@ use Test::Nginx::Stream qw/ stream /; select STDERR; $| = 1; select STDOUT; $| = 1; -plan(skip_all => 'long configuration parsing') unless $ENV{TEST_NGINX_UNSAFE}; - my $t = Test::Nginx->new()->has(qw/stream stream_return stream_geo/); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -61,7 +59,7 @@ EOF $t->write_file('base.conf', join('', map { "127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." . $_ % 256 . "-127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." .$_ % 256 . " " . - ($_ == 1 ? "loopback" : "range$_") . ";" } (0 .. 100000))); + ($_ == 1 ? "loopback" : "range$_") . ";\n" } (0 .. 100000))); $t->run()->plan(2); From mdounin at mdounin.ru Sun Nov 30 06:44:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 30 Nov 2025 09:44:21 +0300 Subject: [nginx] Version bump. Message-ID: details: http://freenginx.org/hg/nginx/rev/5b8d5566e782 branches: changeset: 9439:5b8d5566e782 user: Maxim Dounin date: Sun Nov 30 06:20:33 2025 +0300 description: Version bump. diffstat: src/core/nginx.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diffs (14 lines): diff --git a/src/core/nginx.h b/src/core/nginx.h --- a/src/core/nginx.h +++ b/src/core/nginx.h @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1029003 -#define NGINX_VERSION "1.29.3" +#define nginx_version 1029004 +#define NGINX_VERSION "1.29.4" #define freenginx 1 From mdounin at mdounin.ru Sun Nov 30 06:44:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 30 Nov 2025 09:44:21 +0300 Subject: [nginx] Auth basic: fixed file descriptor leak on memory allocat... Message-ID: details: http://freenginx.org/hg/nginx/rev/65b7b311347d branches: changeset: 9440:65b7b311347d user: Maxim Dounin date: Sun Nov 30 06:20:51 2025 +0300 description: Auth basic: fixed file descriptor leak on memory allocation errors. If ngx_pnalloc() for pwd.data failed when handling an incomplete last line of a user file, file descriptor for the file wasn't closed before returning the error. The issue was introduced in 7637:0cb942c1c1aa (1.17.10), as the particular error path wasn't converted to the "goto cleanup" pattern introduced in the commit, but file closing was moved to the end of the function. The issue is, however, unlikely to happen in practice, as it only happens when handling an incorrectly formatted user file (newline at end of file), and only if memory allocation of a small string fails, which is unlikely even on memory-constrained systems. The fix is to use the "goto cleanup" pattern, similarly to how other errors are handled since 7637:0cb942c1c1aa. This also ensures that the buffer is properly zeroed out if the particular memory allocation fails. Found by Coverity (CID 1643265). diffstat: src/http/modules/ngx_http_auth_basic_module.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diffs (13 lines): diff --git a/src/http/modules/ngx_http_auth_basic_module.c b/src/http/modules/ngx_http_auth_basic_module.c --- a/src/http/modules/ngx_http_auth_basic_module.c +++ b/src/http/modules/ngx_http_auth_basic_module.c @@ -253,7 +253,8 @@ ngx_http_auth_basic_handler(ngx_http_req pwd.len = i - passwd; pwd.data = ngx_pnalloc(r->pool, pwd.len + 1); if (pwd.data == NULL) { - return NGX_HTTP_INTERNAL_SERVER_ERROR; + rc = NGX_HTTP_INTERNAL_SERVER_ERROR; + goto cleanup; } ngx_cpystrn(pwd.data, &buf[passwd], pwd.len + 1); From mdounin at mdounin.ru Sun Nov 30 06:44:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 30 Nov 2025 09:44:21 +0300 Subject: [nginx] Geo: fixed ngx_file_info() error handling. Message-ID: details: http://freenginx.org/hg/nginx/rev/93554e06fe71 branches: changeset: 9441:93554e06fe71 user: Maxim Dounin date: Sun Nov 30 06:21:19 2025 +0300 description: Geo: fixed ngx_file_info() error handling. When ngx_file_info() on the text include file failed when loading a binary include, the code failed to restore binary file name in "name". While it is generally not needed after an error, an additional error might theoretically happen when closing the binary include, and wrong "name" will result in incorrect file name in the error message. The fix is to restore "name", much like it is done in the normal code path. Prodded by Coverity (CID 1306890, 1643342). diffstat: src/http/modules/ngx_http_geo_module.c | 1 + src/stream/ngx_stream_geo_module.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diffs (22 lines): diff --git a/src/http/modules/ngx_http_geo_module.c b/src/http/modules/ngx_http_geo_module.c --- a/src/http/modules/ngx_http_geo_module.c +++ b/src/http/modules/ngx_http_geo_module.c @@ -1464,6 +1464,7 @@ ngx_http_geo_include_binary_base(ngx_con if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) { ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, ngx_file_info_n " \"%s\" failed", name->data); + name->data[name->len - 4] = ch; goto failed; } diff --git a/src/stream/ngx_stream_geo_module.c b/src/stream/ngx_stream_geo_module.c --- a/src/stream/ngx_stream_geo_module.c +++ b/src/stream/ngx_stream_geo_module.c @@ -1390,6 +1390,7 @@ ngx_stream_geo_include_binary_base(ngx_c if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) { ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno, ngx_file_info_n " \"%s\" failed", name->data); + name->data[name->len - 4] = ch; goto failed; } From mdounin at mdounin.ru Sun Nov 30 06:44:21 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 30 Nov 2025 09:44:21 +0300 Subject: [nginx] Geo: fixed Valgrind complaints about uninitialized values. Message-ID: details: http://freenginx.org/hg/nginx/rev/ff8c3ef06fd5 branches: changeset: 9442:ff8c3ef06fd5 user: Maxim Dounin date: Sun Nov 30 06:21:56 2025 +0300 description: Geo: fixed Valgrind complaints about uninitialized values. In ngx_http_geo_value(), variable values were initialized to the extent used by the lookup code. But the same structures are also fully copied into the binary range base by ngx_http_geo_copy_values(), including unused members and padding, and Valgrind complains about uninitialized memory being used: ==42== Use of uninitialised value of size 8 ==42== at 0x40F0C20: ngx_crc32_long (ngx_crc32.h:46) ==42== by 0x40F0C20: ngx_http_geo_create_binary_base (ngx_http_geo_module.c:1648) ==42== by 0x40F0C20: ngx_http_geo_block (ngx_http_geo_module.c:516) ==42== by 0x404BA94: ngx_conf_handler (ngx_conf_file.c:463) ==42== by 0x404BA94: ngx_conf_parse (ngx_conf_file.c:319) ==42== by 0x408C462: ngx_http_block (ngx_http.c:239) ==42== by 0x404BA94: ngx_conf_handler (ngx_conf_file.c:463) ==42== by 0x404BA94: ngx_conf_parse (ngx_conf_file.c:319) ==42== by 0x4048880: ngx_init_cycle (ngx_cycle.c:286) ==42== by 0x40348EB: main (nginx.c:293)' Fix is to fully initialize ngx_http_variable_value_t structures during allocation by using ngx_pcalloc(). Prodded by Valgrind. diffstat: src/http/modules/ngx_http_geo_module.c | 2 +- src/stream/ngx_stream_geo_module.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diffs (24 lines): diff --git a/src/http/modules/ngx_http_geo_module.c b/src/http/modules/ngx_http_geo_module.c --- a/src/http/modules/ngx_http_geo_module.c +++ b/src/http/modules/ngx_http_geo_module.c @@ -1259,7 +1259,7 @@ ngx_http_geo_value(ngx_conf_t *cf, ngx_h return gvvn->value; } - val = ngx_palloc(ctx->pool, sizeof(ngx_http_variable_value_t)); + val = ngx_pcalloc(ctx->pool, sizeof(ngx_http_variable_value_t)); if (val == NULL) { return NULL; } diff --git a/src/stream/ngx_stream_geo_module.c b/src/stream/ngx_stream_geo_module.c --- a/src/stream/ngx_stream_geo_module.c +++ b/src/stream/ngx_stream_geo_module.c @@ -1209,7 +1209,7 @@ ngx_stream_geo_value(ngx_conf_t *cf, ngx return gvvn->value; } - val = ngx_palloc(ctx->pool, sizeof(ngx_stream_variable_value_t)); + val = ngx_pcalloc(ctx->pool, sizeof(ngx_stream_variable_value_t)); if (val == NULL) { return NULL; } From mdounin at mdounin.ru Sun Nov 30 06:44:49 2025 From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=) Date: Sun, 30 Nov 2025 09:44:49 +0300 Subject: [nginx-tests] Tests: lifted unsafe restriction on geo binary tests. Message-ID: details: http://freenginx.org/hg/nginx-tests/rev/55ff381e5d3a branches: changeset: 2034:55ff381e5d3a user: Maxim Dounin date: Sun Nov 30 06:23:01 2025 +0300 description: Tests: lifted unsafe restriction on geo binary tests. The restriction was originally introduced in 1044:1fe8d33f75ad to ensure constrained startup times and not triggering waitforfile() timeout while starting nginx. Since then, timeout for watforfile() was raised from 3 to 10 seconds, and the test normally works less than a second even on relatively slow hosts, which is well under the limit. While here, adjusted "base.conf" generation to produce a proper text file with lines of reasonable length. diffstat: geo_binary.t | 4 +--- stream_geo_binary.t | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diffs (42 lines): diff --git a/geo_binary.t b/geo_binary.t --- a/geo_binary.t +++ b/geo_binary.t @@ -22,8 +22,6 @@ use Test::Nginx; select STDERR; $| = 1; select STDOUT; $| = 1; -plan(skip_all => 'long configuration parsing') unless $ENV{TEST_NGINX_UNSAFE}; - my $t = Test::Nginx->new()->has(qw/http geo/); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -66,7 +64,7 @@ EOF $t->write_file('base.conf', join('', map { "127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." . $_ % 256 . "-127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." .$_ % 256 . " " . - ($_ == 1 ? "loopback" : "range$_") . ";" } (0 .. 100000))); + ($_ == 1 ? "loopback" : "range$_") . ";\n" } (0 .. 100000))); $t->run(); diff --git a/stream_geo_binary.t b/stream_geo_binary.t --- a/stream_geo_binary.t +++ b/stream_geo_binary.t @@ -23,8 +23,6 @@ use Test::Nginx::Stream qw/ stream /; select STDERR; $| = 1; select STDOUT; $| = 1; -plan(skip_all => 'long configuration parsing') unless $ENV{TEST_NGINX_UNSAFE}; - my $t = Test::Nginx->new()->has(qw/stream stream_return stream_geo/); $t->write_file_expand('nginx.conf', <<'EOF'); @@ -61,7 +59,7 @@ EOF $t->write_file('base.conf', join('', map { "127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." . $_ % 256 . "-127." . $_/256/256 % 256 . "." . $_/256 % 256 . "." .$_ % 256 . " " . - ($_ == 1 ? "loopback" : "range$_") . ";" } (0 .. 100000))); + ($_ == 1 ? "loopback" : "range$_") . ";\n" } (0 .. 100000))); $t->run()->plan(2);