Mercurial > hg > nginx
annotate src/http/modules/ngx_http_ssi_filter_module.h @ 9286:d9fe808c1841 default tip
HTTP/3: protection from recursion during connection reuse.
When draining a connection associated with an HTTP/3 stream, calling
ngx_http_v3_send_cancel_stream() might result in an attempt to obtain
a connection for the decoder stream. This in turn will trigger draining
of the very same connection. Depending on the client settings, this
might either lead to stack overflow or will end up in decoder stream
creation error and destroying the connection at some point, potentially
resulting in use-after-free on stack.
Fix is to make sure that connection reuse is disabled in
ngx_http_v3_reset_stream(), so the recursion in question won't happen
regardless of what called functions do.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sun, 02 Jun 2024 23:51:55 +0300 |
parents | 49e7db44b57c |
children |
rev | line source |
---|---|
597 | 1 |
2 /* | |
3 * Copyright (C) Igor Sysoev | |
4412 | 4 * Copyright (C) Nginx, Inc. |
597 | 5 */ |
6 | |
7 | |
8 #ifndef _NGX_HTTP_SSI_FILTER_H_INCLUDED_ | |
9 #define _NGX_HTTP_SSI_FILTER_H_INCLUDED_ | |
10 | |
11 | |
12 #include <ngx_config.h> | |
13 #include <ngx_core.h> | |
14 #include <ngx_http.h> | |
15 | |
16 | |
1545 | 17 #define NGX_HTTP_SSI_MAX_PARAMS 16 |
597 | 18 |
1545 | 19 #define NGX_HTTP_SSI_COMMAND_LEN 32 |
20 #define NGX_HTTP_SSI_PARAM_LEN 32 | |
21 #define NGX_HTTP_SSI_PARAMS_N 4 | |
597 | 22 |
23 | |
1545 | 24 #define NGX_HTTP_SSI_COND_IF 1 |
25 #define NGX_HTTP_SSI_COND_ELSE 2 | |
26 | |
27 | |
28 #define NGX_HTTP_SSI_NO_ENCODING 0 | |
29 #define NGX_HTTP_SSI_URL_ENCODING 1 | |
30 #define NGX_HTTP_SSI_ENTITY_ENCODING 2 | |
629 | 31 |
32 | |
597 | 33 typedef struct { |
34 ngx_hash_t hash; | |
35 ngx_hash_keys_arrays_t commands; | |
36 } ngx_http_ssi_main_conf_t; | |
37 | |
38 | |
39 typedef struct { | |
40 ngx_buf_t *buf; | |
41 | |
42 u_char *pos; | |
43 u_char *copy_start; | |
44 u_char *copy_end; | |
45 | |
46 ngx_uint_t key; | |
47 ngx_str_t command; | |
48 ngx_array_t params; | |
49 ngx_table_elt_t *param; | |
50 ngx_table_elt_t params_array[NGX_HTTP_SSI_PARAMS_N]; | |
51 | |
52 ngx_chain_t *in; | |
53 ngx_chain_t *out; | |
54 ngx_chain_t **last_out; | |
55 ngx_chain_t *busy; | |
56 ngx_chain_t *free; | |
57 | |
58 ngx_uint_t state; | |
59 ngx_uint_t saved_state; | |
60 size_t saved; | |
61 size_t looked; | |
62 | |
63 size_t value_len; | |
64 | |
777
4ab852b691f5
<!--#include virtual=... set=... -->
Igor Sysoev <igor@sysoev.ru>
parents:
758
diff
changeset
|
65 ngx_list_t *variables; |
667 | 66 ngx_array_t *blocks; |
597 | 67 |
4381
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
68 #if (NGX_PCRE) |
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
69 ngx_uint_t ncaptures; |
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
70 int *captures; |
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
71 u_char *captures_data; |
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
72 #endif |
e9a0427f4139
SSI: added regex captures support in the expression of the "if" command.
Valentin Bartenev <vbart@nginx.com>
parents:
1545
diff
changeset
|
73 |
8102
49e7db44b57c
SSI: handling of subrequests from other modules (ticket #1263).
Ciel Zhao <i@ciel.dev>
parents:
4412
diff
changeset
|
74 unsigned shared:1; |
629 | 75 unsigned conditional:2; |
1545 | 76 unsigned encoding:2; |
667 | 77 unsigned block:1; |
629 | 78 unsigned output:1; |
79 unsigned output_chosen:1; | |
597 | 80 |
758
86bb73dc8d40
fix <!--#include virtual=... wait="yes" -->
Igor Sysoev <igor@sysoev.ru>
parents:
667
diff
changeset
|
81 ngx_http_request_t *wait; |
609 | 82 void *value_buf; |
597 | 83 ngx_str_t timefmt; |
84 ngx_str_t errmsg; | |
85 } ngx_http_ssi_ctx_t; | |
86 | |
87 | |
88 typedef ngx_int_t (*ngx_http_ssi_command_pt) (ngx_http_request_t *r, | |
89 ngx_http_ssi_ctx_t *ctx, ngx_str_t **); | |
90 | |
91 | |
92 typedef struct { | |
93 ngx_str_t name; | |
94 ngx_uint_t index; | |
95 | |
96 unsigned mandatory:1; | |
97 unsigned multiple:1; | |
98 } ngx_http_ssi_param_t; | |
99 | |
100 | |
101 typedef struct { | |
102 ngx_str_t name; | |
103 ngx_http_ssi_command_pt handler; | |
104 ngx_http_ssi_param_t *params; | |
105 | |
629 | 106 unsigned conditional:2; |
667 | 107 unsigned block:1; |
597 | 108 unsigned flush:1; |
109 } ngx_http_ssi_command_t; | |
110 | |
111 | |
112 extern ngx_module_t ngx_http_ssi_filter_module; | |
113 | |
114 | |
115 #endif /* _NGX_HTTP_SSI_FILTER_H_INCLUDED_ */ |