Re: [PATCH] SSL: make ssl_password_file work with recent OpenSSL releases

2014-10-30 Thread Piotr Sikora
Hey Sergey, > n is being used to print the final error, after the use of the last > password fails, so you cannot completely remove it. You should > probably just move it after the if loop. Nevermind, that n is being used only in the code I used when debugging this issue. Sorry for the noise. Be

[PATCH] Upstream: add "proxy_ssl_certificate" and friends

2014-10-30 Thread Piotr Sikora
# HG changeset patch # User Piotr Sikora # Date 1414668641 25200 # Thu Oct 30 04:30:41 2014 -0700 # Node ID bb14c7659efb32d1d1f651bdf54a8c8157ef67f9 # Parent 87ada3ba1392fadaf4d9193b5d345c248be32f77 Upstream: add "proxy_ssl_certificate" and friends. Signed-off-by: Piotr Sikora diff -r 87a

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Maxim Dounin
Hello! On Wed, Oct 29, 2014 at 09:17:04PM -0700, Piotr Sikora wrote: > # HG changeset patch > # User Piotr Sikora > # Date 1414642398 25200 > # Wed Oct 29 21:13:18 2014 -0700 > # Node ID bf17486e5d30574b870926b76c1d6f421e4def75 > # Parent 87ada3ba1392fadaf4d9193b5d345c248be32f77 > SSL: don

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Richard Fussenegger
The rationale may make sense depending on the priorities, but shouldn't the default configuration target generic applications? Generic applications don't need compatibility with ancient software (only IE6 on XP actually /needs/ SSLv3, don't know about libraries though). Administrators who need

Re: [PATCH] SSL: make ssl_password_file work with recent OpenSSL releases

2014-10-30 Thread Sergey Kandaurov
On Oct 29, 2014, at 10:27 PM, Piotr Sikora wrote: > Hey Sergey, > >> Alternatively, remove error collection that doesn’t really make much sense. >> It’s an open set and we cannot predict for sure all of them enumerated. > > That's also a valid approach, but the commit is wrong. > So that the i

[nginx] SSL: simplified ssl_password_file error handling.

2014-10-30 Thread Sergey Kandaurov
details: http://hg.nginx.org/nginx/rev/42520df85ebb branches: changeset: 5892:42520df85ebb user: Sergey Kandaurov date: Fri Oct 24 04:28:00 2014 -0700 description: SSL: simplified ssl_password_file error handling. Instead of collecting a number of the possible SSL_CTX_use_PrivateKey

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Maxim Dounin
Hello! On Thu, Oct 30, 2014 at 03:05:18PM +0100, Richard Fussenegger wrote: > The rationale may make sense depending on the priorities, but shouldn't the > default configuration target generic applications? Generic applications > don't need compatibility with ancient software (only IE6 on XP actu

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Richard Fussenegger
On 10/30/2014 4:26 PM, Maxim Dounin wrote: And there are various clients which don't support anything better, including IE6 on XP. [...] Talking about not updated versions from security point of view is mostly pointless, as there are multiple security problems fixed on a regular basis, and not up

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Maxim Dounin
Hello! On Thu, Oct 30, 2014 at 04:30:46PM +0100, Richard Fussenegger wrote: > On 10/30/2014 4:26 PM, Maxim Dounin wrote: > >And there are various clients which > >don't support anything better, including IE6 on XP. > >[...] > >Talking about not updated versions from security point of > >view is m

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Richard Fussenegger
On 10/30/2014 4:47 PM, Maxim Dounin wrote: Hello! There is still compatibility point of view, and from this point of view it's important to be able to talk to old versions of browsers. To be able to show a message like "update your browser, it's too old", to deliver updates to them, or whatever

[nginx] Contrib: add more directives to vim syntax.

2014-10-30 Thread Maxim Dounin
details: http://hg.nginx.org/nginx/rev/fa4161fe8254 branches: changeset: 5893:fa4161fe8254 user: Peter Wu date: Wed Oct 22 15:31:19 2014 +0200 description: Contrib: add more directives to vim syntax. uwsgi is not a third-party module anymore. 'split_clients' is a new block directive

Re: [PATCH] Contrib: add more directives to vim syntax

2014-10-30 Thread Maxim Dounin
Hello! On Wed, Oct 22, 2014 at 03:39:31PM +0200, Peter Wu wrote: [...] > # HG changeset patch > # User Peter Wu > # Date 1413984679 -7200 > # Wed Oct 22 15:31:19 2014 +0200 > # Node ID 9c2253baa56b8f9a22f24b8650ca0861d99f24fa > # Parent 973fded4f461f3a397779b3a1dc80881b1b34974 > Contrib:

Re: [PATCH] SSL support for the mail proxy module

2014-10-30 Thread Kunal Pariani
Hello, Any reason for this patch not being committed upstream yet ? Thanks -Kunal From: "Franck Levionnois" To: "nginx-devel" , "Kunal Pariani" Sent: Tuesday, October 21, 2014 12:59:04 AM Subject: Re: [PATCH] SSL support for the mail proxy module Hello, The patch below has been sub

Re: [PATCH] Clarify meaning of limit_conn in SPDY connections

2014-10-30 Thread Yaroslav Zhuravlev
On 14 Oct 2014, at 20:58, Gunnlaugur Thor Briem wrote: > # HG changeset patch > # User Gunnlaugur Thor Briem > # Date 1413305660 0 > # Tue Oct 14 16:54:20 2014 + > # Node ID 3674e10a9e22a622998b65badfe01da34579bb65 > # Parent 2096ecf6de02bc9e8ae920c45c59bf6a4e2e38fb > Clarify meaning

RE: [Patch] SO_REUSEPORT support from master process

2014-10-30 Thread Lu, Yingqi
Hi All, We tested the dragonfly approach on Linux (RHEL 6.5 with kernel 3.13.9). We used the same testing environment for both our patch and the dragonfly patch. Here is what we found: 1. Our patch has 36% better performance (operations/sec) comparing to dragonfly patch. 2. Our patch has 53% l

[nginx] Events: introduced cancelable timers.

2014-10-30 Thread Valentin Bartenev
details: http://hg.nginx.org/nginx/rev/3efdd7788bb0 branches: changeset: 5896:3efdd7788bb0 user: Valentin Bartenev date: Wed Aug 13 22:45:04 2014 +0400 description: Events: introduced cancelable timers. diffstat: src/event/ngx_event.h| 2 + src/event/ngx_event_timer.

[nginx] Events: simplified cycle in ngx_event_expire_timers().

2014-10-30 Thread Valentin Bartenev
details: http://hg.nginx.org/nginx/rev/0f53e5fb7205 branches: changeset: 5895:0f53e5fb7205 user: Valentin Bartenev date: Mon Aug 25 13:37:06 2014 +0400 description: Events: simplified cycle in ngx_event_expire_timers(). diffstat: src/event/ngx_event_timer.c | 34 -

[nginx] Events: removed broken thread support from event timers.

2014-10-30 Thread Valentin Bartenev
details: http://hg.nginx.org/nginx/rev/1f513d7f1b45 branches: changeset: 5894:1f513d7f1b45 user: Valentin Bartenev date: Mon Aug 25 13:34:39 2014 +0400 description: Events: removed broken thread support from event timers. It's mostly dead code. And the idea of thread support for th

[nginx] Access log: cancel the flush timer on graceful shutdown.

2014-10-30 Thread Valentin Bartenev
details: http://hg.nginx.org/nginx/rev/dff86e2246a5 branches: changeset: 5897:dff86e2246a5 user: Valentin Bartenev date: Mon Aug 25 13:41:31 2014 +0400 description: Access log: cancel the flush timer on graceful shutdown. Previously, it could prevent a worker process from exiting fo

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Piotr Sikora
Hey Maxim, > - SSLv3 is still important from compatibility point of view, there > are various clients which doesn't support (or enable by default) > anything better; But is it, really? All major browsers (Chrome [1], Firefox [2], IE [3], Opera [4]) either already disabled SSLv3 or are about

Re: [PATCH] SSL: don't enable SSLv3 by default

2014-10-30 Thread Maxim Dounin
Hello! On Thu, Oct 30, 2014 at 04:33:09PM -0700, Piotr Sikora wrote: > Hey Maxim, > > > - SSLv3 is still important from compatibility point of view, there > > are various clients which doesn't support (or enable by default) > > anything better; > > But is it, really? > > All major browsers