Mercurial > hg > nginx-quic
annotate src/stream/ngx_stream_handler.c @ 6671:6b1b8c4b7a95
Realip: fixed uninitialized memory access.
Previously, the realip module could be left with uninitialized context after an
error in the ngx_http_realip_set_addr() function. That context could be later
accessed by $realip_remote_addr and $realip_remote_port variable handlers.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Thu, 01 Sep 2016 14:33:51 +0300 |
parents | 164a0824ce20 |
children | 38143d1abdec |
rev | line source |
---|---|
6115 | 1 |
2 /* | |
3 * Copyright (C) Roman Arutyunyan | |
4 * Copyright (C) Nginx, Inc. | |
5 */ | |
6 | |
7 | |
8 #include <ngx_config.h> | |
9 #include <ngx_core.h> | |
10 #include <ngx_event.h> | |
11 #include <ngx_stream.h> | |
12 | |
13 | |
14 static u_char *ngx_stream_log_error(ngx_log_t *log, u_char *buf, size_t len); | |
15 static void ngx_stream_init_session(ngx_connection_t *c); | |
16 | |
17 #if (NGX_STREAM_SSL) | |
18 static void ngx_stream_ssl_init_connection(ngx_ssl_t *ssl, ngx_connection_t *c); | |
19 static void ngx_stream_ssl_handshake_handler(ngx_connection_t *c); | |
20 #endif | |
21 | |
22 | |
23 void | |
24 ngx_stream_init_connection(ngx_connection_t *c) | |
25 { | |
6221
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
26 int tcp_nodelay; |
6175 | 27 u_char text[NGX_SOCKADDR_STRLEN]; |
28 size_t len; | |
29 ngx_int_t rc; | |
30 ngx_uint_t i; | |
6669
164a0824ce20
Stream: the $session_time variable.
Vladimir Homutov <vl@nginx.com>
parents:
6607
diff
changeset
|
31 ngx_time_t *tp; |
6175 | 32 struct sockaddr *sa; |
33 ngx_stream_port_t *port; | |
34 struct sockaddr_in *sin; | |
35 ngx_stream_in_addr_t *addr; | |
36 ngx_stream_session_t *s; | |
37 ngx_stream_addr_conf_t *addr_conf; | |
6115 | 38 #if (NGX_HAVE_INET6) |
6175 | 39 struct sockaddr_in6 *sin6; |
40 ngx_stream_in6_addr_t *addr6; | |
6115 | 41 #endif |
6175 | 42 ngx_stream_core_srv_conf_t *cscf; |
43 ngx_stream_core_main_conf_t *cmcf; | |
6115 | 44 |
45 /* find the server configuration for the address:port */ | |
46 | |
47 port = c->listening->servers; | |
48 | |
49 if (port->naddrs > 1) { | |
50 | |
51 /* | |
52 * There are several addresses on this port and one of them | |
53 * is the "*:port" wildcard so getsockname() is needed to determine | |
54 * the server address. | |
55 * | |
6436 | 56 * AcceptEx() and recvmsg() already gave this address. |
6115 | 57 */ |
58 | |
59 if (ngx_connection_local_sockaddr(c, NULL, 0) != NGX_OK) { | |
60 ngx_stream_close_connection(c); | |
61 return; | |
62 } | |
63 | |
64 sa = c->local_sockaddr; | |
65 | |
66 switch (sa->sa_family) { | |
67 | |
68 #if (NGX_HAVE_INET6) | |
69 case AF_INET6: | |
70 sin6 = (struct sockaddr_in6 *) sa; | |
71 | |
72 addr6 = port->addrs; | |
73 | |
74 /* the last address is "*" */ | |
75 | |
76 for (i = 0; i < port->naddrs - 1; i++) { | |
77 if (ngx_memcmp(&addr6[i].addr6, &sin6->sin6_addr, 16) == 0) { | |
78 break; | |
79 } | |
80 } | |
81 | |
82 addr_conf = &addr6[i].conf; | |
83 | |
84 break; | |
85 #endif | |
86 | |
87 default: /* AF_INET */ | |
88 sin = (struct sockaddr_in *) sa; | |
89 | |
90 addr = port->addrs; | |
91 | |
92 /* the last address is "*" */ | |
93 | |
94 for (i = 0; i < port->naddrs - 1; i++) { | |
95 if (addr[i].addr == sin->sin_addr.s_addr) { | |
96 break; | |
97 } | |
98 } | |
99 | |
100 addr_conf = &addr[i].conf; | |
101 | |
102 break; | |
103 } | |
104 | |
105 } else { | |
106 switch (c->local_sockaddr->sa_family) { | |
107 | |
108 #if (NGX_HAVE_INET6) | |
109 case AF_INET6: | |
110 addr6 = port->addrs; | |
111 addr_conf = &addr6[0].conf; | |
112 break; | |
113 #endif | |
114 | |
115 default: /* AF_INET */ | |
116 addr = port->addrs; | |
117 addr_conf = &addr[0].conf; | |
118 break; | |
119 } | |
120 } | |
121 | |
122 s = ngx_pcalloc(c->pool, sizeof(ngx_stream_session_t)); | |
123 if (s == NULL) { | |
124 ngx_stream_close_connection(c); | |
125 return; | |
126 } | |
127 | |
128 s->signature = NGX_STREAM_MODULE; | |
129 s->main_conf = addr_conf->ctx->main_conf; | |
130 s->srv_conf = addr_conf->ctx->srv_conf; | |
131 | |
132 s->connection = c; | |
133 c->data = s; | |
134 | |
135 cscf = ngx_stream_get_module_srv_conf(s, ngx_stream_core_module); | |
136 | |
6129
187aa751ad62
Core: the ngx_set_connection_log() macro.
Vladimir Homutov <vl@nginx.com>
parents:
6115
diff
changeset
|
137 ngx_set_connection_log(c, cscf->error_log); |
6115 | 138 |
139 len = ngx_sock_ntop(c->sockaddr, c->socklen, text, NGX_SOCKADDR_STRLEN, 1); | |
140 | |
6461
a01e315b3a78
Stream: additional logging for UDP.
Vladimir Homutov <vl@nginx.com>
parents:
6436
diff
changeset
|
141 ngx_log_error(NGX_LOG_INFO, c->log, 0, "*%uA %sclient %*s connected to %V", |
a01e315b3a78
Stream: additional logging for UDP.
Vladimir Homutov <vl@nginx.com>
parents:
6436
diff
changeset
|
142 c->number, c->type == SOCK_DGRAM ? "udp " : "", |
a01e315b3a78
Stream: additional logging for UDP.
Vladimir Homutov <vl@nginx.com>
parents:
6436
diff
changeset
|
143 len, text, &addr_conf->addr_text); |
6115 | 144 |
145 c->log->connection = c->number; | |
146 c->log->handler = ngx_stream_log_error; | |
147 c->log->data = s; | |
148 c->log->action = "initializing connection"; | |
149 c->log_error = NGX_ERROR_INFO; | |
150 | |
6175 | 151 cmcf = ngx_stream_get_module_main_conf(s, ngx_stream_core_module); |
152 | |
6607
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
153 s->variables = ngx_pcalloc(s->connection->pool, |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
154 cmcf->variables.nelts |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
155 * sizeof(ngx_stream_variable_value_t)); |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
156 |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
157 if (s->variables == NULL) { |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
158 ngx_stream_close_connection(c); |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
159 return; |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
160 } |
c70b7f4537e1
Stream: variables and script.
Vladimir Homutov <vl@nginx.com>
parents:
6461
diff
changeset
|
161 |
6669
164a0824ce20
Stream: the $session_time variable.
Vladimir Homutov <vl@nginx.com>
parents:
6607
diff
changeset
|
162 tp = ngx_timeofday(); |
164a0824ce20
Stream: the $session_time variable.
Vladimir Homutov <vl@nginx.com>
parents:
6607
diff
changeset
|
163 s->start_sec = tp->sec; |
164a0824ce20
Stream: the $session_time variable.
Vladimir Homutov <vl@nginx.com>
parents:
6607
diff
changeset
|
164 s->start_msec = tp->msec; |
164a0824ce20
Stream: the $session_time variable.
Vladimir Homutov <vl@nginx.com>
parents:
6607
diff
changeset
|
165 |
6197
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
166 if (cmcf->limit_conn_handler) { |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
167 rc = cmcf->limit_conn_handler(s); |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
168 |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
169 if (rc != NGX_DECLINED) { |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
170 ngx_stream_close_connection(c); |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
171 return; |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
172 } |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
173 } |
0dcef374b8bb
Stream: connection limiting module.
Vladimir Homutov <vl@nginx.com>
parents:
6175
diff
changeset
|
174 |
6175 | 175 if (cmcf->access_handler) { |
176 rc = cmcf->access_handler(s); | |
177 | |
178 if (rc != NGX_OK && rc != NGX_DECLINED) { | |
179 ngx_stream_close_connection(c); | |
180 return; | |
181 } | |
182 } | |
183 | |
6436 | 184 if (c->type == SOCK_STREAM |
185 && cscf->tcp_nodelay | |
186 && c->tcp_nodelay == NGX_TCP_NODELAY_UNSET) | |
187 { | |
6221
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
188 ngx_log_debug0(NGX_LOG_DEBUG_STREAM, c->log, 0, "tcp_nodelay"); |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
189 |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
190 tcp_nodelay = 1; |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
191 |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
192 if (setsockopt(c->fd, IPPROTO_TCP, TCP_NODELAY, |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
193 (const void *) &tcp_nodelay, sizeof(int)) == -1) |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
194 { |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
195 ngx_connection_error(c, ngx_socket_errno, |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
196 "setsockopt(TCP_NODELAY) failed"); |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
197 ngx_stream_close_connection(c); |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
198 return; |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
199 } |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
200 |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
201 c->tcp_nodelay = NGX_TCP_NODELAY_SET; |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
202 } |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
203 |
7565e056fad6
Stream: the "tcp_nodelay" directive.
Vladimir Homutov <vl@nginx.com>
parents:
6197
diff
changeset
|
204 |
6115 | 205 #if (NGX_STREAM_SSL) |
206 { | |
207 ngx_stream_ssl_conf_t *sslcf; | |
208 | |
209 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module); | |
210 | |
211 if (addr_conf->ssl) { | |
212 c->log->action = "SSL handshaking"; | |
213 | |
214 if (sslcf->ssl.ctx == NULL) { | |
215 ngx_log_error(NGX_LOG_ERR, c->log, 0, | |
216 "no \"ssl_certificate\" is defined " | |
217 "in server listening on SSL port"); | |
218 ngx_stream_close_connection(c); | |
219 return; | |
220 } | |
221 | |
222 ngx_stream_ssl_init_connection(&sslcf->ssl, c); | |
223 return; | |
224 } | |
225 } | |
226 #endif | |
227 | |
228 ngx_stream_init_session(c); | |
229 } | |
230 | |
231 | |
232 static void | |
233 ngx_stream_init_session(ngx_connection_t *c) | |
234 { | |
235 ngx_stream_session_t *s; | |
236 ngx_stream_core_srv_conf_t *cscf; | |
237 | |
238 s = c->data; | |
239 c->log->action = "handling client connection"; | |
240 | |
241 cscf = ngx_stream_get_module_srv_conf(s, ngx_stream_core_module); | |
242 | |
243 s->ctx = ngx_pcalloc(c->pool, sizeof(void *) * ngx_stream_max_module); | |
244 if (s->ctx == NULL) { | |
245 ngx_stream_close_connection(c); | |
246 return; | |
247 } | |
248 | |
249 cscf->handler(s); | |
250 } | |
251 | |
252 | |
253 #if (NGX_STREAM_SSL) | |
254 | |
255 static void | |
256 ngx_stream_ssl_init_connection(ngx_ssl_t *ssl, ngx_connection_t *c) | |
257 { | |
258 ngx_stream_session_t *s; | |
259 ngx_stream_ssl_conf_t *sslcf; | |
260 | |
261 if (ngx_ssl_create_connection(ssl, c, 0) == NGX_ERROR) { | |
262 ngx_stream_close_connection(c); | |
263 return; | |
264 } | |
265 | |
266 if (ngx_ssl_handshake(c) == NGX_AGAIN) { | |
267 | |
268 s = c->data; | |
269 | |
270 sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module); | |
271 | |
272 ngx_add_timer(c->read, sslcf->handshake_timeout); | |
273 | |
274 c->ssl->handler = ngx_stream_ssl_handshake_handler; | |
275 | |
276 return; | |
277 } | |
278 | |
279 ngx_stream_ssl_handshake_handler(c); | |
280 } | |
281 | |
282 | |
283 static void | |
284 ngx_stream_ssl_handshake_handler(ngx_connection_t *c) | |
285 { | |
286 if (!c->ssl->handshaked) { | |
287 ngx_stream_close_connection(c); | |
288 return; | |
289 } | |
290 | |
291 if (c->read->timer_set) { | |
292 ngx_del_timer(c->read); | |
293 } | |
294 | |
295 ngx_stream_init_session(c); | |
296 } | |
297 | |
298 #endif | |
299 | |
300 | |
301 void | |
302 ngx_stream_close_connection(ngx_connection_t *c) | |
303 { | |
304 ngx_pool_t *pool; | |
305 | |
306 ngx_log_debug1(NGX_LOG_DEBUG_STREAM, c->log, 0, | |
307 "close stream connection: %d", c->fd); | |
308 | |
309 #if (NGX_STREAM_SSL) | |
310 | |
311 if (c->ssl) { | |
312 if (ngx_ssl_shutdown(c) == NGX_AGAIN) { | |
313 c->ssl->handler = ngx_stream_close_connection; | |
314 return; | |
315 } | |
316 } | |
317 | |
318 #endif | |
319 | |
320 #if (NGX_STAT_STUB) | |
321 (void) ngx_atomic_fetch_add(ngx_stat_active, -1); | |
322 #endif | |
323 | |
324 pool = c->pool; | |
325 | |
326 ngx_close_connection(c); | |
327 | |
328 ngx_destroy_pool(pool); | |
329 } | |
330 | |
331 | |
332 static u_char * | |
333 ngx_stream_log_error(ngx_log_t *log, u_char *buf, size_t len) | |
334 { | |
335 u_char *p; | |
336 ngx_stream_session_t *s; | |
337 | |
338 if (log->action) { | |
339 p = ngx_snprintf(buf, len, " while %s", log->action); | |
340 len -= p - buf; | |
341 buf = p; | |
342 } | |
343 | |
344 s = log->data; | |
345 | |
6461
a01e315b3a78
Stream: additional logging for UDP.
Vladimir Homutov <vl@nginx.com>
parents:
6436
diff
changeset
|
346 p = ngx_snprintf(buf, len, ", %sclient: %V, server: %V", |
a01e315b3a78
Stream: additional logging for UDP.
Vladimir Homutov <vl@nginx.com>
parents:
6436
diff
changeset
|
347 s->connection->type == SOCK_DGRAM ? "udp " : "", |
6115 | 348 &s->connection->addr_text, |
349 &s->connection->listening->addr_text); | |
6223
d1f94042c29c
Stream: fixed potential error log buffer overrun.
Vladimir Homutov <vl@nginx.com>
parents:
6221
diff
changeset
|
350 len -= p - buf; |
d1f94042c29c
Stream: fixed potential error log buffer overrun.
Vladimir Homutov <vl@nginx.com>
parents:
6221
diff
changeset
|
351 buf = p; |
6115 | 352 |
353 if (s->log_handler) { | |
6223
d1f94042c29c
Stream: fixed potential error log buffer overrun.
Vladimir Homutov <vl@nginx.com>
parents:
6221
diff
changeset
|
354 p = s->log_handler(log, buf, len); |
6115 | 355 } |
356 | |
357 return p; | |
358 } |