annotate conf/scgi_params @ 7145:83600ce25995 stable-1.12

Fixed buffer overread with unix sockets after accept(). Some OSes (notably macOS, NetBSD, and Solaris) allow unix socket addresses larger than struct sockaddr_un. Moreover, some of them (macOS, Solaris) return socklen of the socket address before it was truncated to fit the buffer provided. As such, on these systems socklen must not be used without additional check that it is within the buffer provided. Appropriate checks added to ngx_event_accept() (after accept()), ngx_event_recvmsg() (after recvmsg()), and ngx_set_inherited_sockets() (after getsockname()). We also obtain socket addresses via getsockname() in ngx_connection_local_sockaddr(), but it does not need any checks as it is only used for INET and INET6 sockets (as there can be no wildcard unix sockets).
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 04 Oct 2017 21:19:33 +0300
parents 62869a9b2e7d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3637
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2 scgi_param REQUEST_METHOD $request_method;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3 scgi_param REQUEST_URI $request_uri;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
4 scgi_param QUERY_STRING $query_string;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
5 scgi_param CONTENT_TYPE $content_type;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
6
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
7 scgi_param DOCUMENT_URI $document_uri;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 scgi_param DOCUMENT_ROOT $document_root;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 scgi_param SCGI 1;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10 scgi_param SERVER_PROTOCOL $server_protocol;
6168
62869a9b2e7d Added the REQUEST_SCHEME parameter.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4333
diff changeset
11 scgi_param REQUEST_SCHEME $scheme;
4333
352a7b025f2e Added HTTPS param with Apache-like behaviour to fastcgi/scgi/uwsgi_params (fixes #38).
Valentin Bartenev <vbart@nginx.com>
parents: 3637
diff changeset
12 scgi_param HTTPS $https if_not_empty;
3637
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
13
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
14 scgi_param REMOTE_ADDR $remote_addr;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
15 scgi_param REMOTE_PORT $remote_port;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
16 scgi_param SERVER_PORT $server_port;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
17 scgi_param SERVER_NAME $server_name;