Re: nginx not returning updated headers from origin server on conditional GET

2016-09-13 Thread jchannon
NGINX authors might want to read this thread. Essentially Mark is saying that this is a bug https://twitter.com/darrel_miller/status/775684549858697216 Posted at Nginx Forum: https://forum.nginx.org/read.php?2,269457,269556#msg-269556 ___ nginx mailing

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread Igor Sysoev
On 14 Sep 2016, at 05:35, George wrote: > and examples in wiki for nginxScript for js_run > https://www.nginx.com/resources/wiki/nginScript/#section-1-overview The examples are obsolete, we will update them soon. -- Igor Sysoev http://nginx.com ___

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread Igor Sysoev
On 14 Sep 2016, at 05:32, George wrote: > even > > > location /njs { >js_run " >var res; >res = $r.response; >res.status = 200; >res.send('Hello World!'); >res.finish(); >"; > } > > gives an error > > nginx -t > nginx: [emerg] unknown directive

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread itpp2012
c0nw0nk Wrote: --- > I take it the module is a part of the Nginx.exe build and not > Nginx_basic.exe If its part of stock its also part of the basic version. Posted at Nginx Forum: https://forum.nginx.org/read.php?2,269502,269553#msg-269553 __

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread George
and examples in wiki for nginxScript for js_run https://www.nginx.com/resources/wiki/nginScript/#section-1-overview Posted at Nginx Forum: https://forum.nginx.org/read.php?2,269548,269552#msg-269552 ___ nginx mailing list nginx@nginx.org http://mailman

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread George
even location /njs { js_run " var res; res = $r.response; res.status = 200; res.send('Hello World!'); res.finish(); "; } gives an error nginx -t nginx: [emerg] unknown directive "js_run" in /usr/local/nginx/conf/conf.d/virtual.conf:36 nginx: conf

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread George
sorry i meant from old example readme at http://hg.nginx.org/njs/file/11d4d66851ed/README Posted at Nginx Forum: https://forum.nginx.org/read.php?2,269548,269550#msg-269550 ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinf

Re: nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread Valentin V. Bartenev
On Tuesday 13 September 2016 22:14:32 George wrote: > Tried compiling nginScript with nginx 1.11.4 as a dynamic module and the > README github example at https://github.com/nginx/njs/blob/master/README > gives me js_run unknown directive so looks like maybe didn't install > correctly ? [..] There'

nginScript + nginx 1.11.4, js_run unknown directive ?

2016-09-13 Thread George
Tried compiling nginScript with nginx 1.11.4 as a dynamic module and the README github example at https://github.com/nginx/njs/blob/master/README gives me js_run unknown directive so looks like maybe didn't install correctly ? CentOS 7.2 64bit nginx -V nginx version: nginx/1.11.4 built by gcc 4.8

Re: Cache always in "UPDATING"

2016-09-13 Thread Maxim Dounin
Hello! On Tue, Sep 13, 2016 at 07:52:59PM -0400, vlad0 wrote: > I'm having a problem that comes on goes the past months: > The cache does not get updated as it seems to stay in "UPDATING" state. This > issue comes at random times/days. [...] > We use epoll and aio threads. There is a subs_filte

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
itpp2012 Wrote: --- > c0nw0nk Wrote: > > Yes I can't test it at the moment unfortunately with the realip > module > > due to the fact i use "itpp2012" Nginx builds > > http://nginx-win.ecsds.eu/ They do not come compiled with the > realip > > modu

Cache always in "UPDATING"

2016-09-13 Thread vlad0
Dear list, I'm having a problem that comes on goes the past months: The cache does not get updated as it seems to stay in "UPDATING" state. This issue comes at random times/days. Here's what i got in strace: accept4(12, {sa_family=AF_INET, sin_port=htons(58777), sin_addr=inet_addr("127.0.0.2")},

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread Francis Daly
On Tue, Sep 13, 2016 at 04:07:51PM -0400, c0nw0nk wrote: Hi there, > Oh in that case then in didn't work when i tried it with the following > configuration. It looks like configuration like this should probably work; but perhaps some parts were lost in the copy-paste. However, if you have the c

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
itpp2012 Wrote: --- > c0nw0nk Wrote: > > Yes I can't test it at the moment unfortunately with the realip > module > > due to the fact i use "itpp2012" Nginx builds > > http://nginx-win.ecsds.eu/ They do not come compiled with the > realip > > modu

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread itpp2012
c0nw0nk Wrote: > Yes I can't test it at the moment unfortunately with the realip module > due to the fact i use "itpp2012" Nginx builds > http://nginx-win.ecsds.eu/ They do not come compiled with the realip > module (for now ?) Of course this module is compiled in. Posted at Nginx Forum: https:/

Re: [nginx-announce] nginx-1.11.4

2016-09-13 Thread Kevin Worthington
Hello Nginx users, Now available: Nginx 1.11.4 for Windows https://kevinworthington.com/nginxwin1114 (32-bit and 64-bit versions) These versions are to support legacy users who are already using Cygwin based builds of Nginx. Officially supported native Windows binaries are at nginx.org. Announce

Re: limit-req and greedy UAs

2016-09-13 Thread Grant
> limit_req works with multiple connections, it is usually configured per IP > using $binary_remote_addr. See > http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone > - you can use variables to set the key to whatever you like. > > limit_req generally helps protect eg your ba

Re: limit-req and greedy UAs

2016-09-13 Thread Grant
> ‎Re-reading the original post, it was concluded that multiple connection > don't effect the rate limiting. I interpreted this incorrectly the first time: > ‎ > "Nginx's limit_rate > function limits the data transfer rate of a single connection.‎" > > But I'm certain a few posts, perhaps not on

nginx-1.11.4

2016-09-13 Thread Maxim Dounin
Changes with nginx 1.11.413 Sep 2016 *) Feature: the $upstream_bytes_received variable. *) Feature: the $bytes_received, $session_time, $protocol, $status, $upstream_addr, $upstream_bytes_sent, $upstream_bytes_received, $upstream_conne

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
B.R. Wrote: --- > You were just told the best way to get a meaningful > $binary_remote_addr > variable using CloudFlare, with the added bonus of a list of network > ranges > to use with set_real_ip_from to only filter out CloudFlare's IP > address

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread B.R.
You were just told the best way to get a meaningful $binary_remote_addr variable using CloudFlare, with the added bonus of a list of network ranges to use with set_real_ip_from to only filter out CloudFlare's IP addresses as sources to be repalced and avoid false positives. Using the $binary_remot

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
Reinis Rozitis Wrote: --- > > But that book says it is to reduce the memory footprint ? > > Correct, but that is for that specific varible. > > You can't take $http_cf_connecting_ip which is a HTTP header comming > from > Cloudflare and prepe

Re: Websockets - recommended settings question

2016-09-13 Thread Maxim Dounin
Hello! On Tue, Sep 13, 2016 at 04:29:21PM +1200, Cain wrote: > In the nginx documentation (https://www.nginx.com/blog/websocket-nginx), it > is recommended to set the 'Connection' header to 'close' (if there is no > upgrade header) - from my understanding, this disables keep alive from > nginx to

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread Reinis Rozitis
But that book says it is to reduce the memory footprint ? Correct, but that is for that specific varible. You can't take $http_cf_connecting_ip which is a HTTP header comming from Cloudflare and prepend $binary_ just to "lower memory footprint". There is no such functionality. What you mi

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
Reinis Rozitis Wrote: --- > > I just found the following : > > > https://books.google.co.uk/books?id=ZO09CgAAQBAJ&pg=PA96&lpg=PA96&dq=$ > binary_ > > > limit_req_zone $binary_http_cf_connecting_ip zone=one:10m > rate=30r/m; > > limit_conn_zone $b

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
Reinis Rozitis Wrote: --- > > I just found the following : > > > https://books.google.co.uk/books?id=ZO09CgAAQBAJ&pg=PA96&lpg=PA96&dq=$ > binary_ > > > limit_req_zone $binary_http_cf_connecting_ip zone=one:10m > rate=30r/m; > > limit_conn_zone $b

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread Reinis Rozitis
I just found the following : https://books.google.co.uk/books?id=ZO09CgAAQBAJ&pg=PA96&lpg=PA96&dq=$binary_ limit_req_zone $binary_http_cf_connecting_ip zone=one:10m rate=30r/m; limit_conn_zone $binary_http_cf_connecting_ip zone=addr:10m; There is no such concept of prepending $binary_* to an

Re: "502 Bad Gateway" on first request in a setup with Apache 2.4-servers as upstreams

2016-09-13 Thread hheiko
I've played with proxy timeout settings, no luck. And nothing was logged on the backend-server. Finally I've found something in the firewall log: May 27 10:25:06 APZRP01 kernel: DROP: IN=APZRP01 OUT= MAC=c4:34:6b:af:19:64:e8:65:49:28:08:77:08:00 SRC=10.59.55.245 DST=192.168.57.14 LEN=40 TOS=0x00

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
I just found the following : https://books.google.co.uk/books?id=ZO09CgAAQBAJ&pg=PA96&lpg=PA96&dq=$binary_ To conserve the space occupied by the key we use $binary_remote_addr It evaluates into a binary value of the remote IP address So it seems I should be doing this instead to keep the key in m

Re: "502 Bad Gateway" on first request in a setup with Apache 2.4-servers as upstreams

2016-09-13 Thread Anoop Alias
Check the logs of the apache server. You might need to tweak the proxy_*_timeout settings in nginx , but usually its the problem with the upstream server that is causing this. try connecting to the upstream via http://domain:port directly and you should face the error. On Tue, Sep 13, 2016 at 3

Re: "502 Bad Gateway" on first request in a setup with Apache 2.4-servers as upstreams

2016-09-13 Thread hheiko
I don't think there is an OS relation on the frontend, the same problem occurs with an Centos Nginx as Reverse proxy in front of 3 Apache backends on Centos - but it never occurs on windows based Apache backends... But we´re on version 1.11.4.1 Lion (http://nginx-win.ecsds.eu) Posted at Nginx For

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
gariac Wrote: --- > ‎I'm assuming at this point if cookies are too much, then logins or > captcha aren't going to happen.  > > How about just blocking the offending websites at the firewall? I'm > assuming you see the proxy and not the eyeballs a

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
> gariac Wrote: > --- > > ‎What about Roboo? It requires a cookie on the website before the > > download takes place. (My usual warning this is my understanding of > > how it works, but I have no first hand knowledge.) I presume the > hot > > link

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread lists
‎I'm assuming at this point if cookies are too much, then logins or captcha aren't going to happen.  How about just blocking the offending websites at the firewall? I'm assuming you see the proxy and not the eyeballs at the ISP.  I have my hacker detection schemes in nginx. I flag the clowns, y

Re: "502 Bad Gateway" on first request in a setup with Apache 2.4-servers as upstreams

2016-09-13 Thread maltris
hheiko Wrote: --- > I've noticed the same problem between Nginx Proxy (Win) and CentOS > based Apache 2.4 Backends. So I finally changed all backends to > nginx+php-fpm... What version of nginx are you running on Windows? (Asking because I am ju

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
I was going to do a cookie method but its bad because on browsers with no cookies that make legitimate requests (first time visitors maybe that don't have a cookie set) or browsers on legitimate users who disable cookies or use extensions / add-ons to only whitelist cookies from sites they specific

Re: Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread lists
‎What about Roboo? It requires a cookie on the website before the download takes place. (My usual warning this is my understanding of how it works, but I have no first hand knowledge.) I presume the hot linkers won't have the cookie. https://github.com/yuri-gushin/Roboo   Original Message   Fro

upstream prematurely closed connection while reading response header from upstream

2016-09-13 Thread sosogh
Hi list My topology is : client ---> nginx 1.6.2 (port 80) ---> nginx 0.7.69 with mogilefs module (port 2080) ---> mogilefs . I want to upload a 8G file to mogilefs , the uploading URL is http://dfs.myclouds.com/upload/glance_prod_env/d29a0a4a-7888-487e-91b5-57e9bbf351e7 There are errors ,

Re: limit-req and greedy UAs

2016-09-13 Thread lists
‎Re-reading the  original post, it was concluded that multiple connection don't effect the rate limiting. I interpreted this incorrectly the first time: ‎ "Nginx's limit_rate function limits the data transfer rate of a single connection.‎" But I'm certain a few posts, perhaps not on the nginx for

Keeping your Nginx limit_* Anti-DDoS behind CloudFlare's servers

2016-09-13 Thread c0nw0nk
So I noticed some unusual stuff going on lately mostly to do with people using proxies to spoof / fake that files from my sites are hosted of their sites. Sitting behind CloudFlare the only decent way I can come up with to prevent these websites who use proxy_pass and proxy_set_header to pretend t

Re: "502 Bad Gateway" on first request in a setup with Apache 2.4-servers as upstreams

2016-09-13 Thread hheiko
I've noticed the same problem between Nginx Proxy (Win) and CentOS based Apache 2.4 Backends. So I finally changed all backends to nginx+php-fpm... Posted at Nginx Forum: https://forum.nginx.org/read.php?2,268306,269500#msg-269500 ___ nginx mailing lis