unit.git - Universal Web Application Server

Age	Commit message (Collapse)	Author	Files	Lines
2021-05-26	Enabling SSL_CTX configuration by using SSL_CONF_cmd().	Andrey Suvorov	1	-8/+106
	To perform various configuration operations on SSL_CTX, OpenSSL provides SSL_CONF_cmd(). Specifically, to configure ciphers for a listener, "CipherString" and "Ciphersuites" file commands are used: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html This feature can be configured in the "tls/conf_commands" section.
2021-05-26	Fixing crash during TLS connection shutdown.	Andrey Suvorov	1	-6/+26
	A crash was caused by an incorrect timer handler nxt_h1p_idle_timeout() if SSL_shutdown() returned SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE. The flag SSL_RECEIVED_SHUTDOWN is used to avoid getting SSL_ERROR_WANT_READ, so the server won't wait for a close notification from a client. For SSL_ERROR_WANT_WRITE, a correct timer handler is set up.
2021-03-24	Added ability to configure multiple certificates on a listener.	Andrey Suvorov	1	-32/+372
	The certificate is selected by matching the arriving SNI to the common name and the alternatives names. If no certificate matches the name, the first bundle in the array is chosen.
2021-03-24	Workaround for an OpenSSL bug about not closing /dev/*random.	Max Romanov	1	-0/+11
	This is a workaround for an issue in OpenSSL 1.1.1, where the /dev/random and /dev/urandom files remain open after all listening sockets were removed: - https://github.com/openssl/openssl/issues/7419
2021-03-15	Fixed TLS connection shutdown on errors.	Valentin Bartenev	1	-4/+0
	An immediate return statement on connection errors was mistakenly added to the beginning of nxt_openssl_conn_io_shutdown() in ecd3c5bbf7d8, breaking the TLS connection finalization procedure. As a result, a TLS connection was left unfinalized if it had been closed prematurely or a fatal protocol error had occurred, which caused memory and socket descriptor leakage. Moreover, in some cases (notably, on handshake errors in tests with kqueue on macOS) the read event was triggered later and nxt_h1p_conn_error() was called the second time; after the change in af93c866b4f0, the latter call crashed the router process in an attempt to remove a connection from the idle queue twice.
2020-02-05	Kept the value of c->socket.read_handler while data is available.	Tiago Natel de Moura	1	-4/+0
	This closes #370 in GitHub.
2019-09-30	Fixed error processing in SSL operations.	Igor Sysoev	1	-13/+3
	Before this fix EWOULDBLOCK error was fatal for SSL write operation. This closes #325 issue on GitHub.
2019-03-01	Fixed TLS connections hanging.	Igor Sysoev	1	-4/+2
	After event is delivered from the kernel its further processing is blocked. Non-ready TSL I/O operation should mark connection I/O state as not ready to unblock events and to allow their further processing. Otherwise the connection hangs.
2018-11-13	Checking error states in I/O handlers.	Igor Sysoev	1	-6/+32

2018-11-13	Fixed nxt_openssl_chain_file() return type.	Valentin Bartenev	1	-3/+3
	This closes #182 issue on GitHub. Thanks to 洪志道 (Hong Zhi Dao).
2018-10-22	Compatibility with LibreSSL.	Sergey Kandaurov	1	-1/+1
	LibreSSL uses high OPENSSL_VERSION_NUMBER, but has no SSL_CTX_add0_chain_cert().
2018-09-20	Controller: certificates storage interface.	Valentin Bartenev	1	-7/+87

2018-09-20	Added SSL/TLS support on connection level.	Igor Sysoev	1	-231/+372

2018-03-05	Reduced number of critical log levels.	Valentin Bartenev	1	-11/+12

2017-06-20	Using new memory pool implementation.	Igor Sysoev	1	-1/+1

2017-06-14	nxt_event_conn_... functions and structures have been renamed	Igor Sysoev	1	-25/+21
	to nxt_conn_...
2017-02-22	I/O operations refactoring.	Igor Sysoev	1	-15/+10

2017-02-07	Event engines refactoring.	Igor Sysoev	1	-6/+6

2017-01-30	nxt_event_timer has been renamed to nxt_timer.	Igor Sysoev	1	-1/+1

2017-01-23	Introducing tasks.	Igor Sysoev	1	-46/+48

2017-01-17	Initial version.	Igor Sysoev	1	-0/+855