auth_request sub requests not using upstream keepalive

2022-01-28 Thread Zach Rait
Hi-- I was exploring using auth_request from the ngx_http_auth_request_module, and I have encountered some unexpected behavior with regard to HTTP keepalive/connection reuse. I have some configuration that looks roughly like this: location = /auth_check { proxy_pass_request_body off; proxy_se

Re: "ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread Sergey A. Osokin
Hi, let me add 2 cents to the topic. On Fri, Jan 28, 2022 at 09:29:54PM -0500, hablutzel1 wrote: > Hi Maxim, I'm not really familiar with NGINX source code or with the C > language for that matter, so could you please provide more detail on why > does NGING require a non-blocking DNS resolver? Co

Re: "ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread hablutzel1
Hi Maxim, I'm not really familiar with NGINX source code or with the C language for that matter, so could you please provide more detail on why does NGING require a non-blocking DNS resolver? Couldn't it rely on child processes or threads to not block? Posted at Nginx Forum: https://forum.nginx.o

Re: "ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread Maxim Dounin
Hello! On Fri, Jan 28, 2022 at 01:17:34PM -0500, hablutzel1 wrote: > Hi, while testing the latest NGINX source code around ~1.21.7, I’ve observed > that enabling "ssl_stapling" without configuring a “resolver”, makes NGINX > cache the OCSP responder IP indefinitely, so, if the CA later changes th

"ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread hablutzel1
Hi, while testing the latest NGINX source code around ~1.21.7, I’ve observed that enabling "ssl_stapling" without configuring a “resolver”, makes NGINX cache the OCSP responder IP indefinitely, so, if the CA later changes the OCSP responder IP, NGINX is still going to try to get OCSP queries from t

SSL passtrough

2022-01-28 Thread Daniel Armando Rodriguez via nginx
Hi there I have a RP in front of several services and now need to add SSL passtrough for some of them. So, with this goal set up this config stream { map $ssl_preread_server_name $name { sub1.DOMAIN sub1; sub2.DOMAIN sub2; sub3.DOMAIN sub3; sub4.DOMAIN sub4; } up