Images: Remove NGINX v1.21. (#12058)
This commit is contained in:
Marco Ebert
GitHub
parent
f6398126da
commit
eef1aa0e46
65 changed files with 247 additions and 2547 deletions
|
|
@ -1,4 +1,4 @@
|
|||
# Copyright 2017 The Kubernetes Authors. All rights reserved.
|
||||
# Copyright 2024 The Kubernetes Authors. All rights reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
|
|
@ -22,7 +22,7 @@ INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh
|
|||
|
||||
# 0.0.0 shouldn't clobber any released builds
|
||||
SHORT_SHA ?=$(shell git rev-parse --short HEAD)
|
||||
TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA)
|
||||
TAG ?=$(shell cat TAG)
|
||||
|
||||
REGISTRY ?= gcr.io/k8s-staging-ingress-nginx
|
||||
|
||||
|
|
|
|||
|
|
@ -1,27 +1,47 @@
|
|||
NGINX base image using [alpine](https://www.alpinelinux.org/)
|
||||
NGINX base image
|
||||
|
||||
This custom image contains:
|
||||
### HTTP/3 Support
|
||||
|
||||
- [nginx-http-auth-digest](https://github.com/atomx/nginx-http-auth-digest)
|
||||
- [ngx_http_substitutions_filter_module](https://github.com/yaoweibin/ngx_http_substitutions_filter_module)
|
||||
- [OpenTelemetry-CPP](https://github.com/open-telemetry/opentelemetry-cpp)
|
||||
- [OpenTelemetry-CPP-Nginx](https://github.com/open-telemetry/opentelemetry-cpp-contrib/tree/main/instrumentation/nginx)
|
||||
- [nginx-opentracing](https://github.com/opentracing-contrib/nginx-opentracing)
|
||||
- [opentracing-cpp](https://github.com/opentracing/opentracing-cpp)
|
||||
- [zipkin-cpp-opentracing](https://github.com/rnburn/zipkin-cpp-opentracing)
|
||||
- [dd-opentracing-cpp](https://github.com/DataDog/dd-opentracing-cpp)
|
||||
- [ModSecurity-nginx](https://github.com/SpiderLabs/ModSecurity-nginx) (only supported in x86_64)
|
||||
- [brotli](https://github.com/google/brotli)
|
||||
- [geoip2](https://github.com/leev/ngx_http_geoip2_module)
|
||||
**HTTP/3 support is experimental and under development**
|
||||
|
||||
**How to use this image:**
|
||||
This image provides a default configuration file with no backend servers.
|
||||
[HTTP/3](https://datatracker.ietf.org/doc/html/rfc9114)\
|
||||
[QUIC](https://datatracker.ietf.org/doc/html/rfc9000)
|
||||
|
||||
_Using docker_
|
||||
[According to the documentation, NGINX 1.25.0 or higher supports HTTP/3:](https://nginx.org/en/docs/quic.html)
|
||||
|
||||
NGINX base image we use is defined in NGINX_BASE file at the root of the project
|
||||
> Support for QUIC and HTTP/3 protocols is available since 1.25.0.
|
||||
|
||||
```console
|
||||
docker run -v /some/nginx.conf:/etc/nginx/nginx.conf:ro $(cat ../../NGINX_BASE)
|
||||
```
|
||||
But this requires adding a new flag during the build:
|
||||
|
||||
> When configuring nginx, it is possible to enable QUIC and HTTP/3 using the --with-http_v3_module configuration parameter.
|
||||
|
||||
[We have added this flag](https://github.com/kubernetes/ingress-nginx/pull/11470), but it is not enough to use HTTP/3 in ingress-nginx, this is the first step.
|
||||
|
||||
The next steps will be:
|
||||
|
||||
1. **Waiting for OpenSSL 3.4.**\
|
||||
The main problem is, that we still use OpenSSL (3.x) and it does not support the important mechanism of TLS 1.3 - [early_data](https://datatracker.ietf.org/doc/html/rfc8446#section-2.3):
|
||||
|
||||
> Otherwise, the OpenSSL compatibility layer will be used that does not support early data.
|
||||
|
||||
[And although another part of the documentation says that the directive is supported with OpenSSL:](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data)
|
||||
|
||||
> The directive is supported when using OpenSSL 1.1.1 or higher.
|
||||
|
||||
But this is incomplete support, because OpenSSL does not support this feature, and [it has only client side support:](https://github.com/openssl/openssl)
|
||||
|
||||
> ... the QUIC (currently client side only) version 1 protocol
|
||||
|
||||
[And also there are some issues even with client side](https://github.com/openssl/openssl/discussions/23339)
|
||||
|
||||
Due to this, we currently have incomplete HTTP/3 support, without important security and performance features.\
|
||||
But the good news is that [OpenSSL plans to add server-side support in 3.4](https://github.com/openssl/web/blob/master/roadmap.md):
|
||||
|
||||
> Server-side QUIC support
|
||||
|
||||
[Overview of SSL libraries(HAProxy Documentation)](https://github.com/haproxy/wiki/wiki/SSL-Libraries-Support-Status#tldr)
|
||||
|
||||
2. **Adding [parameters](https://nginx.org/en/docs/http/ngx_http_v3_module.html) to the configmap to configure HTTP/3 and quic(enableHTTP3, enableHTTP/0.9, maxCurrentStream, and so on).**
|
||||
3. **Adding options to the nginx config template(`listen 443 quic` to server blocks and `add_header Alt-Svc 'h3=":8443"; ma=86400';` to location blocks).**
|
||||
4. **Opening the https port for UDP in the container(because QUIC uses UDP).**
|
||||
5. **Adding tests.**
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
v1.0.0
|
||||
v0.0.12
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Copyright 2015 The Kubernetes Authors. All rights reserved.
|
||||
# Copyright 2024 The Kubernetes Authors. All rights reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
|
|
@ -29,11 +29,10 @@ ENV LUA_PATH="/usr/local/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1
|
|||
ENV LUA_CPATH="/usr/local/lib/lua/?/?.so;/usr/local/lib/lua/?.so;;"
|
||||
|
||||
COPY --from=builder /usr/local /usr/local
|
||||
COPY --from=builder /usr/lib/libopentelemetry* /usr/local/lib
|
||||
COPY --from=builder /opt /opt
|
||||
COPY --from=builder /etc/nginx /etc/nginx
|
||||
|
||||
LABEL org.opencontainers.image.source=https://github.com/kubernetes/ingress-nginx
|
||||
|
||||
RUN apk update \
|
||||
&& apk upgrade \
|
||||
&& apk add -U --no-cache \
|
||||
|
|
@ -50,6 +49,8 @@ RUN apk update \
|
|||
yaml-cpp \
|
||||
dumb-init \
|
||||
tzdata \
|
||||
grpc-cpp \
|
||||
libprotobuf \
|
||||
&& ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \
|
||||
&& adduser -S -D -H -u 101 -h /usr/local/nginx \
|
||||
-s /sbin/nologin -G www-data -g www-data www-data \
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Copyright 2015 The Kubernetes Authors.
|
||||
# Copyright 2023 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
|
|
@ -18,139 +18,124 @@ set -o errexit
|
|||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
export NGINX_VERSION=1.21.6
|
||||
export NGINX_VERSION=1.25.5
|
||||
|
||||
# Check for recent changes: https://github.com/vision5/ngx_devel_kit/compare/v0.3.2...master
|
||||
export NDK_VERSION=0.3.2
|
||||
# Check for recent changes: https://github.com/vision5/ngx_devel_kit/compare/v0.3.3...master
|
||||
export NDK_VERSION=v0.3.3
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/set-misc-nginx-module/compare/v0.33...master
|
||||
export SETMISC_VERSION=0.33
|
||||
export SETMISC_VERSION=796f5a3e518748eb29a93bd450324e0ad45b704e
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/headers-more-nginx-module/compare/v0.37...master
|
||||
export MORE_HEADERS_VERSION=0.37
|
||||
export MORE_HEADERS_VERSION=v0.37
|
||||
|
||||
# Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...atomx:master
|
||||
export NGINX_DIGEST_AUTH=1.0.0
|
||||
export NGINX_DIGEST_AUTH=v1.0.0
|
||||
|
||||
# Check for recent changes: https://github.com/yaoweibin/ngx_http_substitutions_filter_module/compare/v0.6.4...master
|
||||
export NGINX_SUBSTITUTIONS=b8a71eacc7f986ba091282ab8b1bbbc6ae1807e0
|
||||
|
||||
# Check for recent changes: https://github.com/opentracing-contrib/nginx-opentracing/compare/v0.19.0...master
|
||||
export NGINX_OPENTRACING_VERSION=0.19.0
|
||||
|
||||
#Check for recent changes: https://github.com/opentracing/opentracing-cpp/compare/v1.6.0...master
|
||||
export OPENTRACING_CPP_VERSION=f86b33f3d9e7322b1298ba62d5ffa7a9519c4c41
|
||||
|
||||
# Check for recent changes: https://github.com/rnburn/zipkin-cpp-opentracing/compare/v0.5.2...master
|
||||
export ZIPKIN_CPP_VERSION=f69593138ff84ca2f6bc115992e18ca3d35f344a
|
||||
|
||||
# Check for recent changes: https://github.com/jbeder/yaml-cpp/compare/yaml-cpp-0.7.0...master
|
||||
export YAML_CPP_VERSION=yaml-cpp-0.7.0
|
||||
|
||||
# Check for recent changes: https://github.com/jaegertracing/jaeger-client-cpp/compare/v0.7.0...master
|
||||
export JAEGER_VERSION=0.7.0
|
||||
|
||||
# Check for recent changes: https://github.com/msgpack/msgpack-c/compare/cpp-3.3.0...master
|
||||
export MSGPACK_VERSION=3.3.0
|
||||
|
||||
# Check for recent changes: https://github.com/DataDog/dd-opentracing-cpp/compare/v1.3.7...master
|
||||
export DATADOG_CPP_VERSION=1.3.7
|
||||
export NGINX_SUBSTITUTIONS=e12e965ac1837ca709709f9a26f572a54d83430e
|
||||
|
||||
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.3...master
|
||||
export MODSECURITY_VERSION=1.0.3
|
||||
export MODSECURITY_VERSION=v1.0.3
|
||||
|
||||
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.11...v3/master
|
||||
export MODSECURITY_LIB_VERSION=bbde9381cbccb49ea73f6194b08b478adc53f3bc
|
||||
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.8...v3/master
|
||||
export MODSECURITY_LIB_VERSION=v3.0.12
|
||||
|
||||
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.2...v3.3/master
|
||||
export OWASP_MODSECURITY_CRS_VERSION=v3.3.5
|
||||
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.5...v4.0/main
|
||||
export OWASP_MODSECURITY_CRS_VERSION=v4.4.0
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.25...master
|
||||
export LUA_NGX_VERSION=0.10.25
|
||||
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.26``...master
|
||||
export LUA_NGX_VERSION=v0.10.26
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.13...master
|
||||
export LUA_STREAM_NGX_VERSION=0.0.13
|
||||
# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/bea8a0c0de94cede71554f53818ac0267d675d63...master
|
||||
export LUA_STREAM_NGX_VERSION=bea8a0c0de94cede71554f53818ac0267d675d63
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/8aa93ead98ba2060d4efd594ae33a35d153589bf...master
|
||||
export LUA_UPSTREAM_VERSION=8aa93ead98ba2060d4efd594ae33a35d153589bf
|
||||
export LUA_UPSTREAM_VERSION=542be0893543a4e42d89f6dd85372972f5ff2a36
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.11...openresty:master
|
||||
export LUA_CJSON_VERSION=2.1.0.11
|
||||
# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.13...openresty:master
|
||||
export LUA_CJSON_VERSION=2.1.0.13
|
||||
|
||||
# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.4...master
|
||||
# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/a607a41a8115fecfc05b5c283c81532a3d605425...master
|
||||
export GEOIP2_VERSION=a607a41a8115fecfc05b5c283c81532a3d605425
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20230410...v2.1-agentzh
|
||||
export LUAJIT_VERSION=2.1-20230410
|
||||
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20240314...v2.1-agentzh
|
||||
export LUAJIT_VERSION=v2.1-20240314
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/v0.04...master
|
||||
export LUA_RESTY_BALANCER=0.04
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/1cd4363c0a239afe4765ec607dcfbbb4e5900eea...master
|
||||
export LUA_RESTY_BALANCER=1cd4363c0a239afe4765ec607dcfbbb4e5900eea
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.13...master
|
||||
export LUA_RESTY_CACHE=0.13
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/99e7578465b40f36f596d099b82eab404f2b42ed...master
|
||||
export LUA_RESTY_CACHE=99e7578465b40f36f596d099b82eab404f2b42ed
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.27...master
|
||||
export LUA_RESTY_CORE=0.1.27
|
||||
export LUA_RESTY_CORE=v0.1.28
|
||||
|
||||
# Check for recent changes: https://github.com/utix/lua-resty-cookie/compare/9533f47...master
|
||||
export LUA_RESTY_COOKIE_VERSION=9533f479371663107b515590fc9daf00d61ebf11
|
||||
# Check for recent changes: https://github.com/cloudflare/lua-resty-cookie/compare/f418d77082eaef48331302e84330488fdc810ef4...master
|
||||
export LUA_RESTY_COOKIE_VERSION=f418d77082eaef48331302e84330488fdc810ef4
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-dns/compare/v0.22...master
|
||||
export LUA_RESTY_DNS=0.22
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-dns/compare/8bb53516e2933e61c317db740a9b7c2048847c2f...master
|
||||
export LUA_RESTY_DNS=8bb53516e2933e61c317db740a9b7c2048847c2f
|
||||
|
||||
# Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.16.1...master
|
||||
export LUA_RESTY_HTTP=0ce55d6d15da140ecc5966fa848204c6fd9074e8
|
||||
# Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.17.1...master
|
||||
export LUA_RESTY_HTTP=v0.17.1
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-lock/compare/v0.09...master
|
||||
export LUA_RESTY_LOCK=0.09
|
||||
export LUA_RESTY_LOCK=405d0bf4cbfa74d742c6ed3158d442221e6212a9
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-upload/compare/v0.11...master
|
||||
export LUA_RESTY_UPLOAD_VERSION=0.11
|
||||
export LUA_RESTY_UPLOAD_VERSION=979372cce011f3176af3c9aff53fd0e992c4bfd3
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-string/compare/v0.15...master
|
||||
export LUA_RESTY_STRING_VERSION=0.15
|
||||
export LUA_RESTY_STRING_VERSION=6f1bc21d86daef804df3cc34d6427ef68da26844
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-memcached/compare/v0.17...master
|
||||
export LUA_RESTY_MEMCACHED_VERSION=0.17
|
||||
export LUA_RESTY_MEMCACHED_VERSION=2f02b68bf65fa2332cce070674a93a69a6c7239b
|
||||
|
||||
# Check for recent changes: https://github.com/openresty/lua-resty-redis/compare/v0.30...master
|
||||
export LUA_RESTY_REDIS_VERSION=0.30
|
||||
export LUA_RESTY_REDIS_VERSION=8641b9f1b6f75cca50c90cf8ca5c502ad8950aa8
|
||||
|
||||
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/v0.6.1...master
|
||||
export LUA_RESTY_IPMATCHER_VERSION=0.6.1
|
||||
export LUA_RESTY_IPMATCHER_VERSION=3e93c53eb8c9884efe939ef070486a0e507cc5be
|
||||
|
||||
# Check for recent changes: https://github.com/ElvinEfendi/lua-resty-global-throttle/compare/v0.2.0...main
|
||||
export LUA_RESTY_GLOBAL_THROTTLE_VERSION=0.2.0
|
||||
export LUA_RESTY_GLOBAL_THROTTLE_VERSION=v0.2.0
|
||||
|
||||
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v1.7.6...master
|
||||
export MIMALOC_VERSION=1.7.6
|
||||
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.1.7...master
|
||||
export MIMALOC_VERSION=v2.1.7
|
||||
|
||||
# Check on https://github.com/open-telemetry/opentelemetry-cpp
|
||||
export OPENTELEMETRY_CPP_VERSION="v1.11.0"
|
||||
# Check on https://github.com/open-telemetry/opentelemetry-proto
|
||||
export OPENTELEMETRY_PROTO_VERSION="v1.1.0"
|
||||
|
||||
export BUILD_PATH=/tmp/build
|
||||
|
||||
ARCH=$(uname -m)
|
||||
|
||||
if [[ ${ARCH} == "s390x" ]]; then
|
||||
export LUAJIT_VERSION=9d5750d28478abfdcaefdfdc408f87752a21e431
|
||||
export LUA_RESTY_CORE=0.1.17
|
||||
export LUA_NGX_VERSION=0.10.15
|
||||
export LUA_STREAM_NGX_VERSION=0.0.7
|
||||
fi
|
||||
|
||||
get_src()
|
||||
{
|
||||
hash="$1"
|
||||
url="$2"
|
||||
dest="${3-}"
|
||||
ARGS=""
|
||||
f=$(basename "$url")
|
||||
|
||||
echo "Downloading $url"
|
||||
|
||||
curl -sSL "$url" -o "$f"
|
||||
echo "$hash $f" | sha256sum -c - || exit 10
|
||||
tar xzf "$f"
|
||||
# TODO: Reenable checksum verification but make it smarter
|
||||
# echo "$hash $f" | sha256sum -c - || exit 10
|
||||
if [ ! -z "$dest" ]; then
|
||||
mkdir ${BUILD_PATH}/${dest}
|
||||
ARGS="-C ${BUILD_PATH}/${dest} --strip-components=1"
|
||||
fi
|
||||
tar xvzf "$f" $ARGS
|
||||
rm -rf "$f"
|
||||
}
|
||||
|
||||
# install required packages to build
|
||||
# Dependencies from "ninja" and below are OTEL dependencies
|
||||
apk add \
|
||||
bash \
|
||||
gcc \
|
||||
|
|
@ -187,7 +172,22 @@ apk add \
|
|||
unzip \
|
||||
dos2unix \
|
||||
yaml-cpp \
|
||||
coreutils
|
||||
coreutils \
|
||||
ninja \
|
||||
gtest-dev \
|
||||
git \
|
||||
build-base \
|
||||
pkgconfig \
|
||||
c-ares-dev \
|
||||
re2-dev \
|
||||
grpc-dev \
|
||||
protobuf-dev
|
||||
|
||||
# apk add -X http://dl-cdn.alpinelinux.org/alpine/edge/testing opentelemetry-cpp-dev
|
||||
|
||||
# There is some bug with some platforms and git, so force HTTP/1.1
|
||||
git config --global http.version HTTP/1.1
|
||||
git config --global http.postBuffer 157286400
|
||||
|
||||
mkdir -p /etc/nginx
|
||||
|
||||
|
|
@ -199,274 +199,138 @@ get_src 66dc7081488811e9f925719e34d1b4504c2801c81dee2920e5452a86b11405ae \
|
|||
"https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz"
|
||||
|
||||
get_src aa961eafb8317e0eb8da37eb6e2c9ff42267edd18b56947384e719b85188f58b \
|
||||
"https://github.com/vision5/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz"
|
||||
"https://github.com/vision5/ngx_devel_kit/archive/$NDK_VERSION.tar.gz" "ngx_devel_kit"
|
||||
|
||||
get_src abc123 \
|
||||
"https://github.com/open-telemetry/opentelemetry-cpp/archive/$OPENTELEMETRY_CPP_VERSION.tar.gz" "opentelemetry-cpp"
|
||||
|
||||
get_src abc123 \
|
||||
"https://github.com/open-telemetry/opentelemetry-proto/archive/$OPENTELEMETRY_PROTO_VERSION.tar.gz" "opentelemetry-proto"
|
||||
|
||||
get_src cd5e2cc834bcfa30149e7511f2b5a2183baf0b70dc091af717a89a64e44a2985 \
|
||||
"https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz"
|
||||
"https://github.com/openresty/set-misc-nginx-module/archive/$SETMISC_VERSION.tar.gz" "set-misc-nginx-module"
|
||||
|
||||
get_src cf6e169d6b350c06d0c730b0eaf4973394026ad40094cddd3b3a5b346577019d \
|
||||
"https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz"
|
||||
get_src 0c0d2ced2ce895b3f45eb2b230cd90508ab2a773299f153de14a43e44c1209b3 \
|
||||
"https://github.com/openresty/headers-more-nginx-module/archive/$MORE_HEADERS_VERSION.tar.gz" "headers-more-nginx-module"
|
||||
|
||||
get_src f09851e6309560a8ff3e901548405066c83f1f6ff88aa7171e0763bd9514762b \
|
||||
"https://github.com/atomx/nginx-http-auth-digest/archive/v$NGINX_DIGEST_AUTH.tar.gz"
|
||||
"https://github.com/atomx/nginx-http-auth-digest/archive/$NGINX_DIGEST_AUTH.tar.gz" "nginx-http-auth-digest"
|
||||
|
||||
get_src a98b48947359166326d58700ccdc27256d2648218072da138ab6b47de47fbd8f \
|
||||
"https://github.com/yaoweibin/ngx_http_substitutions_filter_module/archive/$NGINX_SUBSTITUTIONS.tar.gz"
|
||||
|
||||
get_src 6f97776ebdf019b105a755c7736b70bdbd7e575c7f0d39db5fe127873c7abf17 \
|
||||
"https://github.com/opentracing-contrib/nginx-opentracing/archive/v$NGINX_OPENTRACING_VERSION.tar.gz"
|
||||
|
||||
get_src cbe625cba85291712253db5bc3870d60c709acfad9a8af5a302673d3d201e3ea \
|
||||
"https://github.com/opentracing/opentracing-cpp/archive/$OPENTRACING_CPP_VERSION.tar.gz"
|
||||
|
||||
get_src 71de3d0658935db7ccea20e006b35e58ddc7e4c18878b9523f2addc2371e9270 \
|
||||
"https://github.com/rnburn/zipkin-cpp-opentracing/archive/$ZIPKIN_CPP_VERSION.tar.gz"
|
||||
"https://github.com/yaoweibin/ngx_http_substitutions_filter_module/archive/$NGINX_SUBSTITUTIONS.tar.gz" "ngx_http_substitutions_filter_module"
|
||||
|
||||
get_src 32a42256616cc674dca24c8654397390adff15b888b77eb74e0687f023c8751b \
|
||||
"https://github.com/SpiderLabs/ModSecurity-nginx/archive/v$MODSECURITY_VERSION.tar.gz"
|
||||
"https://github.com/SpiderLabs/ModSecurity-nginx/archive/$MODSECURITY_VERSION.tar.gz" "ModSecurity-nginx"
|
||||
|
||||
get_src 43e6a9fcb146ad871515f0d0873947e5d497a1c9c60c58cb102a97b47208b7c3 \
|
||||
"https://github.com/jbeder/yaml-cpp/archive/$YAML_CPP_VERSION.tar.gz"
|
||||
|
||||
get_src 3a3a03060bf5e3fef52c9a2de02e6035cb557f389453d8f3b0c1d3d570636994 \
|
||||
"https://github.com/jaegertracing/jaeger-client-cpp/archive/v$JAEGER_VERSION.tar.gz"
|
||||
|
||||
get_src 754c3ace499a63e45b77ef4bcab4ee602c2c414f58403bce826b76ffc2f77d0b \
|
||||
"https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz"
|
||||
|
||||
if [[ ${ARCH} == "s390x" ]]; then
|
||||
get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \
|
||||
"https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
|
||||
get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \
|
||||
"https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
|
||||
else
|
||||
get_src bc764db42830aeaf74755754b900253c233ad57498debe7a441cee2c6f4b07c2 \
|
||||
"https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-nginx-module/archive/$LUA_NGX_VERSION.tar.gz" "lua-nginx-module"
|
||||
|
||||
get_src 01b715754a8248cc7228e0c8f97f7488ae429d90208de0481394e35d24cef32f \
|
||||
"https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
|
||||
|
||||
fi
|
||||
"https://github.com/openresty/stream-lua-nginx-module/archive/$LUA_STREAM_NGX_VERSION.tar.gz" "stream-lua-nginx-module"
|
||||
|
||||
get_src a92c9ee6682567605ece55d4eed5d1d54446ba6fba748cff0a2482aea5713d5f \
|
||||
"https://github.com/openresty/lua-upstream-nginx-module/archive/$LUA_UPSTREAM_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-upstream-nginx-module/archive/$LUA_UPSTREAM_VERSION.tar.gz" "lua-upstream-nginx-module"
|
||||
|
||||
if [[ ${ARCH} == "s390x" ]]; then
|
||||
get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \
|
||||
"https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz"
|
||||
else
|
||||
get_src 77bbcbb24c3c78f51560017288f3118d995fe71240aa379f5818ff6b166712ff \
|
||||
"https://github.com/openresty/luajit2/archive/v$LUAJIT_VERSION.tar.gz"
|
||||
fi
|
||||
|
||||
get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \
|
||||
"https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz"
|
||||
"https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz" "luajit2"
|
||||
|
||||
get_src b6c9c09fd43eb34a71e706ad780b2ead26549a9a9f59280fe558f5b7b980b7c6 \
|
||||
"https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz"
|
||||
"https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" "ngx_http_geoip2_module"
|
||||
|
||||
get_src deb4ab1ffb9f3d962c4b4a2c4bdff692b86a209e3835ae71ebdf3b97189e40a9 \
|
||||
"https://github.com/openresty/lua-resty-upload/archive/v$LUA_RESTY_UPLOAD_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-upload/archive/$LUA_RESTY_UPLOAD_VERSION.tar.gz" "lua-resty-upload"
|
||||
|
||||
get_src bdbf271003d95aa91cab0a92f24dca129e99b33f79c13ebfcdbbcbb558129491 \
|
||||
"https://github.com/openresty/lua-resty-string/archive/v$LUA_RESTY_STRING_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-string/archive/$LUA_RESTY_STRING_VERSION.tar.gz" "lua-resty-string"
|
||||
|
||||
get_src 16d72ed133f0c6df376a327386c3ef4e9406cf51003a700737c3805770ade7c5 \
|
||||
"https://github.com/openresty/lua-resty-balancer/archive/v$LUA_RESTY_BALANCER.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-balancer/archive/$LUA_RESTY_BALANCER.tar.gz" "lua-resty-balancer"
|
||||
|
||||
if [[ ${ARCH} == "s390x" ]]; then
|
||||
get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \
|
||||
"https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
|
||||
else
|
||||
get_src 39baab9e2b31cc48cecf896cea40ef6e80559054fd8a6e440cc804a858ea84d4 \
|
||||
"https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
|
||||
fi
|
||||
"https://github.com/openresty/lua-resty-core/archive/$LUA_RESTY_CORE.tar.gz" "lua-resty-core"
|
||||
|
||||
get_src a77b9de160d81712f2f442e1de8b78a5a7ef0d08f13430ff619f79235db974d4 \
|
||||
"https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz" "lua-cjson"
|
||||
|
||||
get_src a404c790553617424d743b82a9f01feccd0d2930b306b370c665ca3b7c09ccb6 \
|
||||
"https://github.com/utix/lua-resty-cookie/archive/$LUA_RESTY_COOKIE_VERSION.tar.gz"
|
||||
get_src 5ed48c36231e2622b001308622d46a0077525ac2f751e8cc0c9905914254baa4 \
|
||||
"https://github.com/cloudflare/lua-resty-cookie/archive/$LUA_RESTY_COOKIE_VERSION.tar.gz" "lua-resty-cookie"
|
||||
|
||||
get_src 573184006b98ccee2594b0d134fa4d05e5d2afd5141cbad315051ccf7e9b6403 \
|
||||
"https://github.com/openresty/lua-resty-lrucache/archive/v$LUA_RESTY_CACHE.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-lrucache/archive/$LUA_RESTY_CACHE.tar.gz" "lua-resty-lrucache"
|
||||
|
||||
get_src b4ddcd47db347e9adf5c1e1491a6279a6ae2a3aff3155ef77ea0a65c998a69c1 \
|
||||
"https://github.com/openresty/lua-resty-lock/archive/v$LUA_RESTY_LOCK.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-lock/archive/$LUA_RESTY_LOCK.tar.gz" "lua-resty-lock"
|
||||
|
||||
get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \
|
||||
"https://github.com/openresty/lua-resty-dns/archive/v$LUA_RESTY_DNS.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-dns/archive/$LUA_RESTY_DNS.tar.gz" "lua-resty-dns"
|
||||
|
||||
get_src 9fcb6db95bc37b6fce77d3b3dc740d593f9d90dce0369b405eb04844d56ac43f \
|
||||
"https://github.com/ledgetech/lua-resty-http/archive/$LUA_RESTY_HTTP.tar.gz"
|
||||
"https://github.com/ledgetech/lua-resty-http/archive/$LUA_RESTY_HTTP.tar.gz" "lua-resty-http"
|
||||
|
||||
get_src 02733575c4aed15f6cab662378e4b071c0a4a4d07940c4ef19a7319e9be943d4 \
|
||||
"https://github.com/openresty/lua-resty-memcached/archive/v$LUA_RESTY_MEMCACHED_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-memcached/archive/$LUA_RESTY_MEMCACHED_VERSION.tar.gz" "lua-resty-memcached"
|
||||
|
||||
get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \
|
||||
"https://github.com/openresty/lua-resty-redis/archive/v$LUA_RESTY_REDIS_VERSION.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-redis/archive/$LUA_RESTY_REDIS_VERSION.tar.gz" "lua-resty-redis"
|
||||
|
||||
get_src efb767487ea3f6031577b9b224467ddbda2ad51a41c5867a47582d4ad85d609e \
|
||||
"https://github.com/api7/lua-resty-ipmatcher/archive/v$LUA_RESTY_IPMATCHER_VERSION.tar.gz"
|
||||
"https://github.com/api7/lua-resty-ipmatcher/archive/$LUA_RESTY_IPMATCHER_VERSION.tar.gz" "lua-resty-ipmatcher"
|
||||
|
||||
get_src 0fb790e394510e73fdba1492e576aaec0b8ee9ef08e3e821ce253a07719cf7ea \
|
||||
"https://github.com/ElvinEfendi/lua-resty-global-throttle/archive/v$LUA_RESTY_GLOBAL_THROTTLE_VERSION.tar.gz"
|
||||
"https://github.com/ElvinEfendi/lua-resty-global-throttle/archive/$LUA_RESTY_GLOBAL_THROTTLE_VERSION.tar.gz" "lua-resty-global-throttle"
|
||||
|
||||
get_src d74f86ada2329016068bc5a243268f1f555edd620b6a7d6ce89295e7d6cf18da \
|
||||
"https://github.com/microsoft/mimalloc/archive/refs/tags/v${MIMALOC_VERSION}.tar.gz"
|
||||
"https://github.com/microsoft/mimalloc/archive/${MIMALOC_VERSION}.tar.gz" "mimalloc"
|
||||
|
||||
# improve compilation times
|
||||
CORES=$(($(grep -c ^processor /proc/cpuinfo) - 1))
|
||||
|
||||
export MAKEFLAGS=-j${CORES}
|
||||
export CTEST_BUILD_FLAGS=${MAKEFLAGS}
|
||||
export HUNTER_JOBS_NUMBER=${CORES}
|
||||
export HUNTER_USE_CACHE_SERVERS=true
|
||||
|
||||
# Install luajit from openresty fork
|
||||
export LUAJIT_LIB=/usr/local/lib
|
||||
export LUA_LIB_DIR="$LUAJIT_LIB/lua"
|
||||
export LUAJIT_INC=/usr/local/include/luajit-2.1
|
||||
|
||||
cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
|
||||
cd "$BUILD_PATH/luajit2"
|
||||
make CCDEBUG=-g
|
||||
make install
|
||||
|
||||
ln -s /usr/local/bin/luajit /usr/local/bin/lua
|
||||
ln -s "$LUAJIT_INC" /usr/local/include/lua
|
||||
|
||||
cd "$BUILD_PATH"
|
||||
cd "$BUILD_PATH/opentelemetry-cpp"
|
||||
export CXXFLAGS="-DBENCHMARK_HAS_NO_INLINE_ASSEMBLY"
|
||||
cmake -B build -G Ninja -Wno-dev \
|
||||
-DOTELCPP_PROTO_PATH="${BUILD_PATH}/opentelemetry-proto/" \
|
||||
-DCMAKE_INSTALL_PREFIX=/usr \
|
||||
-DBUILD_SHARED_LIBS=ON \
|
||||
-DBUILD_TESTING="OFF" \
|
||||
-DBUILD_W3CTRACECONTEXT_TEST="OFF" \
|
||||
-DCMAKE_BUILD_TYPE=None \
|
||||
-DWITH_ABSEIL=ON \
|
||||
-DWITH_STL=ON \
|
||||
-DWITH_EXAMPLES=OFF \
|
||||
-DWITH_ZPAGES=OFF \
|
||||
-DWITH_OTLP_GRPC=ON \
|
||||
-DWITH_OTLP_HTTP=ON \
|
||||
-DWITH_ZIPKIN=ON \
|
||||
-DWITH_PROMETHEUS=OFF \
|
||||
-DWITH_ASYNC_EXPORT_PREVIEW=OFF \
|
||||
-DWITH_METRICS_EXEMPLAR_PREVIEW=OFF
|
||||
cmake --build build
|
||||
cmake --install build
|
||||
|
||||
# Git tuning
|
||||
git config --global --add core.compression -1
|
||||
|
||||
# build opentracing lib
|
||||
cd "$BUILD_PATH/opentracing-cpp-$OPENTRACING_CPP_VERSION"
|
||||
mkdir .build
|
||||
cd .build
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DBUILD_TESTING=OFF \
|
||||
-DBUILD_SHARED_LIBS=OFF \
|
||||
-DBUILD_MOCKTRACER=OFF \
|
||||
-DBUILD_STATIC_LIBS=ON \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# build yaml-cpp
|
||||
# TODO @timmysilv: remove this and jaeger sed calls once it is fixed in jaeger-client-cpp
|
||||
cd "$BUILD_PATH/yaml-cpp-$YAML_CPP_VERSION"
|
||||
mkdir .build
|
||||
cd .build
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
-DYAML_BUILD_SHARED_LIBS=ON \
|
||||
-DYAML_CPP_BUILD_TESTS=OFF \
|
||||
-DYAML_CPP_BUILD_TOOLS=OFF \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# build jaeger lib
|
||||
cd "$BUILD_PATH/jaeger-client-cpp-$JAEGER_VERSION"
|
||||
sed -i 's/-Werror/-Wno-psabi/' CMakeLists.txt
|
||||
# use the above built yaml-cpp instead until a new version of jaeger-client-cpp fixes the yaml-cpp issue
|
||||
# tl;dr new hunter is needed for new yaml-cpp, but new hunter has a conflict with old Thrift and new Boost
|
||||
sed -i 's/hunter_add_package(yaml-cpp)/#hunter_add_package(yaml-cpp)/' CMakeLists.txt
|
||||
sed -i 's/yaml-cpp::yaml-cpp/yaml-cpp/' CMakeLists.txt
|
||||
|
||||
cat <<EOF > export.map
|
||||
{
|
||||
global:
|
||||
OpenTracingMakeTracerFactory;
|
||||
local: *;
|
||||
};
|
||||
EOF
|
||||
|
||||
mkdir .build
|
||||
cd .build
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DBUILD_TESTING=OFF \
|
||||
-DJAEGERTRACING_BUILD_EXAMPLES=OFF \
|
||||
-DJAEGERTRACING_BUILD_CROSSDOCK=OFF \
|
||||
-DJAEGERTRACING_COVERAGE=OFF \
|
||||
-DJAEGERTRACING_PLUGIN=ON \
|
||||
-DHUNTER_CONFIGURATION_TYPES=Release \
|
||||
-DBUILD_SHARED_LIBS=OFF \
|
||||
-DJAEGERTRACING_WITH_YAML_CPP=ON \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
export HUNTER_INSTALL_DIR=$(cat _3rdParty/Hunter/install-root-dir) \
|
||||
|
||||
mv libjaegertracing_plugin.so /usr/local/lib/libjaegertracing_plugin.so
|
||||
|
||||
|
||||
# build zipkin lib
|
||||
cd "$BUILD_PATH/zipkin-cpp-opentracing-$ZIPKIN_CPP_VERSION"
|
||||
|
||||
cat <<EOF > export.map
|
||||
{
|
||||
global:
|
||||
OpenTracingMakeTracerFactory;
|
||||
local: *;
|
||||
};
|
||||
EOF
|
||||
|
||||
mkdir .build
|
||||
cd .build
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DBUILD_SHARED_LIBS=OFF \
|
||||
-DBUILD_PLUGIN=ON \
|
||||
-DBUILD_TESTING=OFF \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# build msgpack lib
|
||||
cd "$BUILD_PATH/msgpack-c-cpp-$MSGPACK_VERSION"
|
||||
|
||||
mkdir .build
|
||||
cd .build
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DBUILD_SHARED_LIBS=OFF \
|
||||
-DMSGPACK_BUILD_EXAMPLES=OFF \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# build datadog lib
|
||||
cd "$BUILD_PATH/dd-opentracing-cpp-$DATADOG_CPP_VERSION"
|
||||
|
||||
mkdir .build
|
||||
cd .build
|
||||
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-DBUILD_TESTING=OFF \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE:BOOL=true \
|
||||
..
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# Get Brotli source and deps
|
||||
cd "$BUILD_PATH"
|
||||
git clone --depth=1 https://github.com/google/ngx_brotli.git
|
||||
git clone --depth=100 https://github.com/google/ngx_brotli.git
|
||||
cd ngx_brotli
|
||||
# https://github.com/google/ngx_brotli/issues/156
|
||||
git reset --hard 63ca02abdcf79c9e788d2eedcc388d2335902e52
|
||||
git submodule init
|
||||
git submodule update
|
||||
|
||||
|
|
@ -524,17 +388,13 @@ mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-E
|
|||
mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
|
||||
cd ..
|
||||
|
||||
# OWASP CRS v3 rules
|
||||
# OWASP CRS v4 rules
|
||||
echo "
|
||||
Include /etc/nginx/owasp-modsecurity-crs/crs-setup.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf
|
||||
|
|
@ -543,7 +403,7 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LF
|
|||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
|
||||
|
|
@ -554,6 +414,7 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.co
|
|||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-955-WEB-SHELLS.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
|
||||
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
|
||||
|
|
@ -583,6 +444,7 @@ WITH_FLAGS="--with-debug \
|
|||
--with-http_gzip_static_module \
|
||||
--with-http_sub_module \
|
||||
--with-http_v2_module \
|
||||
--with-http_v3_module \
|
||||
--with-stream \
|
||||
--with-stream_ssl_module \
|
||||
--with-stream_realip_module \
|
||||
|
|
@ -602,10 +464,9 @@ CC_OPT="-g -O2 -fPIE -fstack-protector-strong \
|
|||
--param=ssp-buffer-size=4 \
|
||||
-DTCP_FASTOPEN=23 \
|
||||
-fPIC \
|
||||
-I$HUNTER_INSTALL_DIR/include \
|
||||
-Wno-cast-function-type"
|
||||
|
||||
LD_OPT="-fPIE -fPIC -pie -Wl,-z,relro -Wl,-z,now -L$HUNTER_INSTALL_DIR/lib"
|
||||
LD_OPT="-fPIE -fPIC -pie -Wl,-z,relro -Wl,-z,now"
|
||||
|
||||
if [[ ${ARCH} != "aarch64" ]]; then
|
||||
WITH_FLAGS+=" --with-file-aio"
|
||||
|
|
@ -616,17 +477,16 @@ if [[ ${ARCH} == "x86_64" ]]; then
|
|||
fi
|
||||
|
||||
WITH_MODULES=" \
|
||||
--add-module=$BUILD_PATH/ngx_devel_kit-$NDK_VERSION \
|
||||
--add-module=$BUILD_PATH/set-misc-nginx-module-$SETMISC_VERSION \
|
||||
--add-module=$BUILD_PATH/headers-more-nginx-module-$MORE_HEADERS_VERSION \
|
||||
--add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \
|
||||
--add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \
|
||||
--add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \
|
||||
--add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \
|
||||
--add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
|
||||
--add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \
|
||||
--add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \
|
||||
--add-dynamic-module=$BUILD_PATH/ngx_http_geoip2_module-${GEOIP2_VERSION} \
|
||||
--add-module=$BUILD_PATH/ngx_devel_kit \
|
||||
--add-module=$BUILD_PATH/set-misc-nginx-module \
|
||||
--add-module=$BUILD_PATH/headers-more-nginx-module \
|
||||
--add-module=$BUILD_PATH/ngx_http_substitutions_filter_module \
|
||||
--add-module=$BUILD_PATH/lua-nginx-module \
|
||||
--add-module=$BUILD_PATH/stream-lua-nginx-module \
|
||||
--add-module=$BUILD_PATH/lua-upstream-nginx-module \
|
||||
--add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest \
|
||||
--add-dynamic-module=$BUILD_PATH/ModSecurity-nginx \
|
||||
--add-dynamic-module=$BUILD_PATH/ngx_http_geoip2_module \
|
||||
--add-dynamic-module=$BUILD_PATH/ngx_brotli"
|
||||
|
||||
./configure \
|
||||
|
|
@ -658,56 +518,83 @@ make
|
|||
make modules
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
|
||||
export OPENTELEMETRY_CONTRIB_COMMIT=e11348bb400d5472bf1da5d6128bead66fa111ff
|
||||
cd "$BUILD_PATH"
|
||||
|
||||
git clone https://github.com/open-telemetry/opentelemetry-cpp-contrib.git opentelemetry-cpp-contrib-${OPENTELEMETRY_CONTRIB_COMMIT}
|
||||
|
||||
cd ${BUILD_PATH}/opentelemetry-cpp-contrib-${OPENTELEMETRY_CONTRIB_COMMIT}
|
||||
git reset --hard ${OPENTELEMETRY_CONTRIB_COMMIT}
|
||||
|
||||
export OTEL_TEMP_INSTALL=/tmp/otel
|
||||
mkdir -p ${OTEL_TEMP_INSTALL}
|
||||
|
||||
cd ${BUILD_PATH}/opentelemetry-cpp-contrib-${OPENTELEMETRY_CONTRIB_COMMIT}/instrumentation/nginx
|
||||
mkdir -p build
|
||||
cd build
|
||||
cmake -DCMAKE_BUILD_TYPE=Release \
|
||||
-G Ninja \
|
||||
-DCMAKE_CXX_STANDARD=17 \
|
||||
-DCMAKE_INSTALL_PREFIX=${OTEL_TEMP_INSTALL} \
|
||||
-DBUILD_SHARED_LIBS=ON \
|
||||
-DNGINX_VERSION=${NGINX_VERSION} \
|
||||
..
|
||||
cmake --build . -j ${CORES} --target install
|
||||
|
||||
mkdir -p /etc/nginx/modules
|
||||
cp ${OTEL_TEMP_INSTALL}/otel_ngx_module.so /etc/nginx/modules/otel_ngx_module.so
|
||||
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-core"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER"
|
||||
cd "$BUILD_PATH/lua-resty-balancer"
|
||||
make all
|
||||
make install
|
||||
|
||||
export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
|
||||
ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
|
||||
|
||||
cd "$BUILD_PATH/lua-cjson-$LUA_CJSON_VERSION"
|
||||
cd "$BUILD_PATH/lua-cjson"
|
||||
make all
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-cookie-$LUA_RESTY_COOKIE_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-cookie"
|
||||
make all
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-lrucache-$LUA_RESTY_CACHE"
|
||||
cd "$BUILD_PATH/lua-resty-lrucache"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-dns-$LUA_RESTY_DNS"
|
||||
cd "$BUILD_PATH/lua-resty-dns"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-lock-$LUA_RESTY_LOCK"
|
||||
cd "$BUILD_PATH/lua-resty-lock"
|
||||
make install
|
||||
|
||||
# required for OCSP verification
|
||||
cd "$BUILD_PATH/lua-resty-http-$LUA_RESTY_HTTP"
|
||||
cd "$BUILD_PATH/lua-resty-http"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-upload-$LUA_RESTY_UPLOAD_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-upload"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-string-$LUA_RESTY_STRING_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-string"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-memcached-$LUA_RESTY_MEMCACHED_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-memcached"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-redis-$LUA_RESTY_REDIS_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-redis"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-ipmatcher-$LUA_RESTY_IPMATCHER_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-ipmatcher"
|
||||
INST_LUADIR=/usr/local/lib/lua make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-global-throttle-$LUA_RESTY_GLOBAL_THROTTLE_VERSION"
|
||||
cd "$BUILD_PATH/lua-resty-global-throttle"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/mimalloc-$MIMALOC_VERSION"
|
||||
cd "$BUILD_PATH/mimalloc"
|
||||
mkdir -p out/release
|
||||
cd out/release
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
diff --git a/src/os/win32/ngx_event_log.c b/src/os/win32/ngx_event_log.c
|
||||
index e11ed1e8..dce8eddd 100644
|
||||
--- a/src/os/win32/ngx_event_log.c
|
||||
+++ b/src/os/win32/ngx_event_log.c
|
||||
@@ -8,7 +8,9 @@
|
||||
#include <ngx_core.h>
|
||||
|
||||
|
||||
-#define NGX_MAX_ERROR_STR 2048
|
||||
+#ifndef NGX_MAX_ERROR_STR
|
||||
+#define NGX_MAX_ERROR_STR 4096
|
||||
+#endif
|
||||
|
||||
|
||||
void ngx_cdecl
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c
|
||||
index 526de3a..b531ce1 100644
|
||||
--- a/src/stream/ngx_stream_upstream_round_robin.c
|
||||
+++ b/src/stream/ngx_stream_upstream_round_robin.c
|
||||
@@ -21,10 +21,6 @@ static void ngx_stream_upstream_notify_round_robin_peer(
|
||||
|
||||
#if (NGX_STREAM_SSL)
|
||||
|
||||
-static ngx_int_t ngx_stream_upstream_set_round_robin_peer_session(
|
||||
- ngx_peer_connection_t *pc, void *data);
|
||||
-static void ngx_stream_upstream_save_round_robin_peer_session(
|
||||
- ngx_peer_connection_t *pc, void *data);
|
||||
static ngx_int_t ngx_stream_upstream_empty_set_session(
|
||||
ngx_peer_connection_t *pc, void *data);
|
||||
static void ngx_stream_upstream_empty_save_session(ngx_peer_connection_t *pc,
|
||||
@@ -690,7 +686,7 @@ ngx_stream_upstream_notify_round_robin_peer(ngx_peer_connection_t *pc,
|
||||
|
||||
#if (NGX_STREAM_SSL)
|
||||
|
||||
-static ngx_int_t
|
||||
+ngx_int_t
|
||||
ngx_stream_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
|
||||
void *data)
|
||||
{
|
||||
@@ -756,7 +752,7 @@ ngx_stream_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
|
||||
}
|
||||
|
||||
|
||||
-static void
|
||||
+void
|
||||
ngx_stream_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
|
||||
void *data)
|
||||
{
|
||||
diff --git a/src/stream/ngx_stream_upstream_round_robin.h b/src/stream/ngx_stream_upstream_round_robin.h
|
||||
index 35d9fce..75f3e31 100644
|
||||
--- a/src/stream/ngx_stream_upstream_round_robin.h
|
||||
+++ b/src/stream/ngx_stream_upstream_round_robin.h
|
||||
@@ -142,5 +142,15 @@ ngx_int_t ngx_stream_upstream_get_round_robin_peer(ngx_peer_connection_t *pc,
|
||||
void ngx_stream_upstream_free_round_robin_peer(ngx_peer_connection_t *pc,
|
||||
void *data, ngx_uint_t state);
|
||||
|
||||
+#if (NGX_STREAM_SSL)
|
||||
+ngx_int_t ngx_stream_upstream_set_round_robin_peer_session(
|
||||
+ ngx_peer_connection_t *pc, void *data);
|
||||
+void ngx_stream_upstream_save_round_robin_peer_session(
|
||||
+ ngx_peer_connection_t *pc, void *data);
|
||||
+#endif
|
||||
+
|
||||
+
|
||||
+#define HAVE_NGX_STREAM_BALANCER_EXPORT_PATCH 1
|
||||
+
|
||||
|
||||
#endif /* _NGX_STREAM_UPSTREAM_ROUND_ROBIN_H_INCLUDED_ */
|
||||
|
|
@ -0,0 +1,178 @@
|
|||
diff -u -r -p -Naur nginx-1.25.3/src/stream/ngx_stream.h nginx-1.25.3-patched/src/stream/ngx_stream.h
|
||||
--- nginx-1.25.3/src/stream/ngx_stream.h 2021-11-04 21:27:55.288708527 +0800
|
||||
+++ nginx-1.25.3-patched/src/stream/ngx_stream.h 2021-11-04 21:28:50.768035209 +0800
|
||||
@@ -254,6 +254,15 @@ typedef struct {
|
||||
} ngx_stream_module_t;
|
||||
|
||||
|
||||
+typedef struct {
|
||||
+ ngx_msec_t connect_timeout;
|
||||
+ ngx_msec_t timeout;
|
||||
+} ngx_stream_proxy_ctx_t;
|
||||
+
|
||||
+
|
||||
+#define NGX_STREAM_HAVE_PROXY_TIMEOUT_FIELDS_PATCH 1
|
||||
+
|
||||
+
|
||||
#define NGX_STREAM_MODULE 0x4d525453 /* "STRM" */
|
||||
|
||||
#define NGX_STREAM_MAIN_CONF 0x02000000
|
||||
@@ -307,6 +316,7 @@ void ngx_stream_finalize_session(ngx_str
|
||||
extern ngx_module_t ngx_stream_module;
|
||||
extern ngx_uint_t ngx_stream_max_module;
|
||||
extern ngx_module_t ngx_stream_core_module;
|
||||
+extern ngx_module_t ngx_stream_proxy_module;
|
||||
|
||||
|
||||
typedef ngx_int_t (*ngx_stream_filter_pt)(ngx_stream_session_t *s,
|
||||
diff -u -r -p -Naur nginx-1.25.3/src/stream/ngx_stream_proxy_module.c nginx-1.25.3-patched/src/stream/ngx_stream_proxy_module.c
|
||||
--- nginx-1.25.3/src/stream/ngx_stream_proxy_module.c 2021-11-04 21:27:55.289708533 +0800
|
||||
+++ nginx-1.25.3-patched/src/stream/ngx_stream_proxy_module.c 2021-11-04 21:37:03.578936990 +0800
|
||||
@@ -400,6 +400,7 @@ ngx_stream_proxy_handler(ngx_stream_sess
|
||||
ngx_stream_proxy_srv_conf_t *pscf;
|
||||
ngx_stream_upstream_srv_conf_t *uscf, **uscfp;
|
||||
ngx_stream_upstream_main_conf_t *umcf;
|
||||
+ ngx_stream_proxy_ctx_t *pctx;
|
||||
|
||||
c = s->connection;
|
||||
|
||||
@@ -408,6 +409,17 @@ ngx_stream_proxy_handler(ngx_stream_sess
|
||||
ngx_log_debug0(NGX_LOG_DEBUG_STREAM, c->log, 0,
|
||||
"proxy connection handler");
|
||||
|
||||
+ pctx = ngx_palloc(c->pool, sizeof(ngx_stream_proxy_ctx_t));
|
||||
+ if (pctx == NULL) {
|
||||
+ ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ pctx->connect_timeout = pscf->connect_timeout;
|
||||
+ pctx->timeout = pscf->timeout;
|
||||
+
|
||||
+ ngx_stream_set_ctx(s, pctx, ngx_stream_proxy_module);
|
||||
+
|
||||
u = ngx_pcalloc(c->pool, sizeof(ngx_stream_upstream_t));
|
||||
if (u == NULL) {
|
||||
ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
|
||||
@@ -699,6 +711,7 @@ ngx_stream_proxy_connect(ngx_stream_sess
|
||||
ngx_connection_t *c, *pc;
|
||||
ngx_stream_upstream_t *u;
|
||||
ngx_stream_proxy_srv_conf_t *pscf;
|
||||
+ ngx_stream_proxy_ctx_t *ctx;
|
||||
|
||||
c = s->connection;
|
||||
|
||||
@@ -706,6 +719,8 @@ ngx_stream_proxy_connect(ngx_stream_sess
|
||||
|
||||
pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
|
||||
|
||||
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
|
||||
+
|
||||
u = s->upstream;
|
||||
|
||||
u->connected = 0;
|
||||
@@ -774,7 +789,7 @@ ngx_stream_proxy_connect(ngx_stream_sess
|
||||
pc->read->handler = ngx_stream_proxy_connect_handler;
|
||||
pc->write->handler = ngx_stream_proxy_connect_handler;
|
||||
|
||||
- ngx_add_timer(pc->write, pscf->connect_timeout);
|
||||
+ ngx_add_timer(pc->write, ctx->connect_timeout);
|
||||
}
|
||||
|
||||
|
||||
@@ -957,12 +957,14 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
|
||||
static ngx_int_t
|
||||
ngx_stream_proxy_send_proxy_protocol(ngx_stream_session_t *s)
|
||||
{
|
||||
- u_char *p;
|
||||
- ssize_t n, size;
|
||||
- ngx_connection_t *c, *pc;
|
||||
- ngx_stream_upstream_t *u;
|
||||
- ngx_stream_proxy_srv_conf_t *pscf;
|
||||
- u_char buf[NGX_PROXY_PROTOCOL_V1_MAX_HEADER];
|
||||
+ u_char *p;
|
||||
+ u_char buf[NGX_PROXY_PROTOCOL_V1_MAX_HEADER];
|
||||
+ ssize_t n, size;
|
||||
+ ngx_connection_t *c, *pc;
|
||||
+ ngx_stream_upstream_t *u;
|
||||
+ ngx_stream_proxy_ctx_t *ctx;
|
||||
+
|
||||
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
|
||||
|
||||
c = s->connection;
|
||||
|
||||
@@ -976,9 +993,7 @@ ngx_stream_proxy_send_proxy_protocol(ngx
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
- pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
|
||||
-
|
||||
- ngx_add_timer(pc->write, pscf->timeout);
|
||||
+ ngx_add_timer(pc->write, ctx->timeout);
|
||||
|
||||
pc->write->handler = ngx_stream_proxy_connect_handler;
|
||||
|
||||
@@ -1053,6 +1068,9 @@ ngx_stream_proxy_ssl_init_connection(ngx
|
||||
ngx_connection_t *pc;
|
||||
ngx_stream_upstream_t *u;
|
||||
ngx_stream_proxy_srv_conf_t *pscf;
|
||||
+ ngx_stream_proxy_ctx_t *ctx;
|
||||
+
|
||||
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
|
||||
|
||||
u = s->upstream;
|
||||
|
||||
@@ -1099,7 +1117,7 @@ ngx_stream_proxy_ssl_init_connection(ngx
|
||||
if (rc == NGX_AGAIN) {
|
||||
|
||||
if (!pc->write->timer_set) {
|
||||
- ngx_add_timer(pc->write, pscf->connect_timeout);
|
||||
+ ngx_add_timer(pc->write, ctx->connect_timeout);
|
||||
}
|
||||
|
||||
pc->ssl->handler = ngx_stream_proxy_ssl_handshake;
|
||||
@@ -1408,6 +1426,7 @@ ngx_stream_proxy_process_connection(ngx_
|
||||
ngx_stream_session_t *s;
|
||||
ngx_stream_upstream_t *u;
|
||||
ngx_stream_proxy_srv_conf_t *pscf;
|
||||
+ ngx_stream_proxy_ctx_t *ctx;
|
||||
|
||||
c = ev->data;
|
||||
s = c->data;
|
||||
@@ -1419,6 +1438,8 @@ ngx_stream_proxy_process_connection(ngx_
|
||||
return;
|
||||
}
|
||||
|
||||
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
|
||||
+
|
||||
c = s->connection;
|
||||
pc = u->peer.connection;
|
||||
|
||||
@@ -1438,7 +1459,7 @@ ngx_stream_proxy_process_connection(ngx_
|
||||
}
|
||||
|
||||
if (u->connected && !c->read->delayed && !pc->read->delayed) {
|
||||
- ngx_add_timer(c->write, pscf->timeout);
|
||||
+ ngx_add_timer(c->write, ctx->timeout);
|
||||
}
|
||||
|
||||
return;
|
||||
@@ -1600,6 +1621,9 @@ ngx_stream_proxy_process(ngx_stream_sess
|
||||
ngx_log_handler_pt handler;
|
||||
ngx_stream_upstream_t *u;
|
||||
ngx_stream_proxy_srv_conf_t *pscf;
|
||||
+ ngx_stream_proxy_ctx_t *ctx;
|
||||
+
|
||||
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
|
||||
|
||||
u = s->upstream;
|
||||
|
||||
@@ -1807,7 +1831,7 @@ ngx_stream_proxy_process(ngx_stream_sess
|
||||
}
|
||||
|
||||
if (!c->read->delayed && !pc->read->delayed) {
|
||||
- ngx_add_timer(c->write, pscf->timeout);
|
||||
+ ngx_add_timer(c->write, ctx->timeout);
|
||||
|
||||
} else if (c->write->timer_set) {
|
||||
ngx_del_timer(c->write);
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c
|
||||
index ab672110..f259af31 100644
|
||||
--- a/src/os/unix/ngx_daemon.c
|
||||
+++ b/src/os/unix/ngx_daemon.c
|
||||
@@ -23,6 +23,8 @@ ngx_daemon(ngx_log_t *log)
|
||||
break;
|
||||
|
||||
default:
|
||||
+ /* just to make it ASAN or Valgrind clean */
|
||||
+ ngx_destroy_pool(ngx_cycle->pool);
|
||||
exit(0);
|
||||
}
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
diff -rup nginx-1.21.4/src/core/nginx.c nginx-1.21.4-patched/src/core/nginx.c
|
||||
--- nginx-1.21.4/src/core/nginx.c 2017-12-17 00:00:38.136470108 -0800
|
||||
+++ nginx-1.21.4-patched/src/core/nginx.c 2017-12-16 23:59:51.680958322 -0800
|
||||
diff -rup nginx-1.25.3/src/core/nginx.c nginx-1.25.3-patched/src/core/nginx.c
|
||||
--- nginx-1.25.3/src/core/nginx.c 2017-12-17 00:00:38.136470108 -0800
|
||||
+++ nginx-1.25.3-patched/src/core/nginx.c 2017-12-16 23:59:51.680958322 -0800
|
||||
@@ -186,6 +186,7 @@ static u_char *ngx_prefix;
|
||||
static u_char *ngx_conf_file;
|
||||
static u_char *ngx_conf_params;
|
||||
|
|
@ -18,9 +18,9 @@ diff -rup nginx-1.21.4/src/core/nginx.c nginx-1.21.4-patched/src/core/nginx.c
|
|||
if (ngx_save_argv(&init_cycle, argc, argv) != NGX_OK) {
|
||||
return 1;
|
||||
}
|
||||
diff -rup nginx-1.21.4/src/core/ngx_core.h nginx-1.21.4-patched/src/core/ngx_core.h
|
||||
--- nginx-1.21.4/src/core/ngx_core.h 2017-10-10 08:22:51.000000000 -0700
|
||||
+++ nginx-1.21.4-patched/src/core/ngx_core.h 2017-12-16 23:59:51.679958370 -0800
|
||||
diff -rup nginx-1.25.3/src/core/ngx_core.h nginx-1.25.3-patched/src/core/ngx_core.h
|
||||
--- nginx-1.25.3/src/core/ngx_core.h 2017-10-10 08:22:51.000000000 -0700
|
||||
+++ nginx-1.25.3-patched/src/core/ngx_core.h 2017-12-16 23:59:51.679958370 -0800
|
||||
@@ -108,4 +108,6 @@ void ngx_cpuinfo(void);
|
||||
#define NGX_DISABLE_SYMLINKS_NOTOWNER 2
|
||||
#endif
|
||||
|
|
@ -28,9 +28,9 @@ diff -rup nginx-1.21.4/src/core/ngx_core.h nginx-1.21.4-patched/src/core/ngx_cor
|
|||
+extern ngx_pool_t *saved_init_cycle_pool;
|
||||
+
|
||||
#endif /* _NGX_CORE_H_INCLUDED_ */
|
||||
diff -rup nginx-1.21.4/src/core/ngx_cycle.c nginx-1.21.4-patched/src/core/ngx_cycle.c
|
||||
--- nginx-1.21.4/src/core/ngx_cycle.c 2017-10-10 08:22:51.000000000 -0700
|
||||
+++ nginx-1.21.4-patched/src/core/ngx_cycle.c 2017-12-16 23:59:51.678958419 -0800
|
||||
diff -rup nginx-1.25.3/src/core/ngx_cycle.c nginx-1.25.3-patched/src/core/ngx_cycle.c
|
||||
--- nginx-1.25.3/src/core/ngx_cycle.c 2017-10-10 08:22:51.000000000 -0700
|
||||
+++ nginx-1.25.3-patched/src/core/ngx_cycle.c 2017-12-16 23:59:51.678958419 -0800
|
||||
@@ -748,6 +748,10 @@ old_shm_zone_done:
|
||||
|
||||
if (ngx_process == NGX_PROCESS_MASTER || ngx_is_init_cycle(old_cycle)) {
|
||||
|
|
@ -42,9 +42,9 @@ diff -rup nginx-1.21.4/src/core/ngx_cycle.c nginx-1.21.4-patched/src/core/ngx_cy
|
|||
ngx_destroy_pool(old_cycle->pool);
|
||||
cycle->old_cycle = NULL;
|
||||
|
||||
diff -rup nginx-1.21.4/src/os/unix/ngx_process_cycle.c nginx-1.21.4-patched/src/os/unix/ngx_process_cycle.c
|
||||
--- nginx-1.21.4/src/os/unix/ngx_process_cycle.c 2017-12-17 00:00:38.142469762 -0800
|
||||
+++ nginx-1.21.4-patched/src/os/unix/ngx_process_cycle.c 2017-12-16 23:59:51.691957791 -0800
|
||||
diff -rup nginx-1.25.3/src/os/unix/ngx_process_cycle.c nginx-1.25.3-patched/src/os/unix/ngx_process_cycle.c
|
||||
--- nginx-1.25.3/src/os/unix/ngx_process_cycle.c 2017-12-17 00:00:38.142469762 -0800
|
||||
+++ nginx-1.25.3-patched/src/os/unix/ngx_process_cycle.c 2017-12-16 23:59:51.691957791 -0800
|
||||
@@ -687,6 +692,11 @@ ngx_master_process_exit(ngx_cycle_t *cyc
|
||||
ngx_exit_cycle.files_n = ngx_cycle->files_n;
|
||||
ngx_cycle = &ngx_exit_cycle;
|
||||
|
|
@ -0,0 +1,203 @@
|
|||
diff --git a/src/core/nginx.c b/src/core/nginx.c
|
||||
index 60f8fe7..4bd244b 100644
|
||||
--- a/src/core/nginx.c
|
||||
+++ b/src/core/nginx.c
|
||||
@@ -981,6 +981,7 @@ ngx_core_module_create_conf(ngx_cycle_t *cycle)
|
||||
|
||||
ccf->daemon = NGX_CONF_UNSET;
|
||||
ccf->master = NGX_CONF_UNSET;
|
||||
+ ccf->privileged_agent = NGX_CONF_UNSET;
|
||||
ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
|
||||
|
||||
ccf->worker_processes = NGX_CONF_UNSET;
|
||||
@@ -1009,6 +1010,7 @@ ngx_core_module_init_conf(ngx_cycle_t *cycle, void *conf)
|
||||
|
||||
ngx_conf_init_value(ccf->daemon, 1);
|
||||
ngx_conf_init_value(ccf->master, 1);
|
||||
+ ngx_conf_init_value(ccf->privileged_agent, 0);
|
||||
ngx_conf_init_msec_value(ccf->timer_resolution, 0);
|
||||
|
||||
ngx_conf_init_value(ccf->worker_processes, 1);
|
||||
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
|
||||
index c51b7ff..3261f90 100644
|
||||
--- a/src/core/ngx_cycle.h
|
||||
+++ b/src/core/ngx_cycle.h
|
||||
@@ -22,6 +22,9 @@
|
||||
#define NGX_DEBUG_POINTS_ABORT 2
|
||||
|
||||
|
||||
+#define HAVE_PRIVILEGED_PROCESS_PATCH 1
|
||||
+
|
||||
+
|
||||
typedef struct ngx_shm_zone_s ngx_shm_zone_t;
|
||||
|
||||
typedef ngx_int_t (*ngx_shm_zone_init_pt) (ngx_shm_zone_t *zone, void *data);
|
||||
@@ -81,6 +84,7 @@ struct ngx_cycle_s {
|
||||
typedef struct {
|
||||
ngx_flag_t daemon;
|
||||
ngx_flag_t master;
|
||||
+ ngx_flag_t privileged_agent;
|
||||
|
||||
ngx_msec_t timer_resolution;
|
||||
|
||||
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
|
||||
index 7cee1c5..c4f70d6 100644
|
||||
--- a/src/os/unix/ngx_process_cycle.c
|
||||
+++ b/src/os/unix/ngx_process_cycle.c
|
||||
@@ -15,6 +15,8 @@ static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
|
||||
ngx_int_t type);
|
||||
static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
|
||||
ngx_uint_t respawn);
|
||||
+static void ngx_start_privileged_agent_processes(ngx_cycle_t *cycle,
|
||||
+ ngx_uint_t respawn);
|
||||
static void ngx_pass_open_channel(ngx_cycle_t *cycle);
|
||||
static void ngx_signal_worker_processes(ngx_cycle_t *cycle, int signo);
|
||||
static ngx_uint_t ngx_reap_children(ngx_cycle_t *cycle);
|
||||
@@ -24,6 +26,7 @@ static void ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker);
|
||||
static void ngx_worker_process_exit(ngx_cycle_t *cycle);
|
||||
static void ngx_channel_handler(ngx_event_t *ev);
|
||||
static void ngx_cache_manager_process_cycle(ngx_cycle_t *cycle, void *data);
|
||||
+static void ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data);
|
||||
static void ngx_cache_manager_process_handler(ngx_event_t *ev);
|
||||
static void ngx_cache_loader_process_handler(ngx_event_t *ev);
|
||||
|
||||
@@ -51,6 +54,8 @@ sig_atomic_t ngx_noaccept;
|
||||
ngx_uint_t ngx_noaccepting;
|
||||
ngx_uint_t ngx_restart;
|
||||
|
||||
+ngx_uint_t ngx_is_privileged_agent;
|
||||
+
|
||||
|
||||
static u_char master_process[] = "master process";
|
||||
|
||||
@@ -130,6 +135,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
|
||||
ngx_start_worker_processes(cycle, ccf->worker_processes,
|
||||
NGX_PROCESS_RESPAWN);
|
||||
ngx_start_cache_manager_processes(cycle, 0);
|
||||
+ ngx_start_privileged_agent_processes(cycle, 0);
|
||||
|
||||
ngx_new_binary = 0;
|
||||
delay = 0;
|
||||
@@ -215,6 +221,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
|
||||
ngx_start_worker_processes(cycle, ccf->worker_processes,
|
||||
NGX_PROCESS_RESPAWN);
|
||||
ngx_start_cache_manager_processes(cycle, 0);
|
||||
+ ngx_start_privileged_agent_processes(cycle, 0);
|
||||
ngx_noaccepting = 0;
|
||||
|
||||
continue;
|
||||
@@ -234,6 +241,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
|
||||
ngx_start_worker_processes(cycle, ccf->worker_processes,
|
||||
NGX_PROCESS_JUST_RESPAWN);
|
||||
ngx_start_cache_manager_processes(cycle, 1);
|
||||
+ ngx_start_privileged_agent_processes(cycle, 1);
|
||||
|
||||
/* allow new processes to start */
|
||||
ngx_msleep(100);
|
||||
@@ -248,6 +256,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
|
||||
ngx_start_worker_processes(cycle, ccf->worker_processes,
|
||||
NGX_PROCESS_RESPAWN);
|
||||
ngx_start_cache_manager_processes(cycle, 0);
|
||||
+ ngx_start_privileged_agent_processes(cycle, 0);
|
||||
live = 1;
|
||||
}
|
||||
|
||||
@@ -393,6 +431,26 @@ ngx_start_cache_manager_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
|
||||
|
||||
|
||||
static void
|
||||
+ngx_start_privileged_agent_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
|
||||
+{
|
||||
+ ngx_core_conf_t *ccf;
|
||||
+
|
||||
+ ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx,
|
||||
+ ngx_core_module);
|
||||
+
|
||||
+ if (!ccf->privileged_agent) {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ ngx_spawn_process(cycle, ngx_privileged_agent_process_cycle,
|
||||
+ "privileged agent process", "privileged agent process",
|
||||
+ respawn ? NGX_PROCESS_JUST_RESPAWN : NGX_PROCESS_RESPAWN);
|
||||
+
|
||||
+ ngx_pass_open_channel(cycle);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+static void
|
||||
ngx_pass_open_channel(ngx_cycle_t *cycle)
|
||||
{
|
||||
ngx_int_t i;
|
||||
@@ -794,7 +860,10 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
|
||||
}
|
||||
}
|
||||
|
||||
- if (geteuid() == 0) {
|
||||
+ /*
|
||||
+ * privileged agent process has the same permission as master process
|
||||
+ */
|
||||
+ if (!ngx_is_privileged_agent && geteuid() == 0) {
|
||||
if (setgid(ccf->group) == -1) {
|
||||
ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
|
||||
"setgid(%d) failed", ccf->group);
|
||||
@@ -1149,6 +1216,47 @@ ngx_cache_manager_process_cycle(ngx_cycle_t *cycle, void *data)
|
||||
|
||||
|
||||
static void
|
||||
+ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
|
||||
+{
|
||||
+ char *name = data;
|
||||
+
|
||||
+ /*
|
||||
+ * Set correct process type since closing listening Unix domain socket
|
||||
+ * in a master process also removes the Unix domain socket file.
|
||||
+ */
|
||||
+ ngx_process = NGX_PROCESS_HELPER;
|
||||
+ ngx_is_privileged_agent = 1;
|
||||
+
|
||||
+ ngx_close_listening_sockets(cycle);
|
||||
+
|
||||
+ /* Set a moderate number of connections for a helper process. */
|
||||
+ cycle->connection_n = 512;
|
||||
+
|
||||
+ ngx_worker_process_init(cycle, -1);
|
||||
+
|
||||
+ ngx_use_accept_mutex = 0;
|
||||
+
|
||||
+ ngx_setproctitle(name);
|
||||
+
|
||||
+ for ( ;; ) {
|
||||
+
|
||||
+ if (ngx_terminate || ngx_quit) {
|
||||
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
|
||||
+ ngx_worker_process_exit(cycle);
|
||||
+ }
|
||||
+
|
||||
+ if (ngx_reopen) {
|
||||
+ ngx_reopen = 0;
|
||||
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "reopening logs");
|
||||
+ ngx_reopen_files(cycle, -1);
|
||||
+ }
|
||||
+
|
||||
+ ngx_process_events_and_timers(cycle);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+
|
||||
+static void
|
||||
ngx_cache_manager_process_handler(ngx_event_t *ev)
|
||||
{
|
||||
time_t next, n;
|
||||
diff --git a/src/os/unix/ngx_process_cycle.h b/src/os/unix/ngx_process_cycle.h
|
||||
index 69495d5..5149396 100644
|
||||
--- a/src/os/unix/ngx_process_cycle.h
|
||||
+++ b/src/os/unix/ngx_process_cycle.h
|
||||
@@ -45,6 +45,7 @@ extern ngx_pid_t ngx_new_binary;
|
||||
extern ngx_uint_t ngx_inherited;
|
||||
extern ngx_uint_t ngx_daemonized;
|
||||
extern ngx_uint_t ngx_exiting;
|
||||
+extern ngx_uint_t ngx_is_privileged_agent;
|
||||
|
||||
extern sig_atomic_t ngx_reap;
|
||||
extern sig_atomic_t ngx_sigio;
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
diff --git a/src/core/nginx.c b/src/core/nginx.c
|
||||
index 269ff84..48329bd 100644
|
||||
--- a/src/core/nginx.c
|
||||
+++ b/src/core/nginx.c
|
||||
@@ -1062,6 +1062,7 @@ ngx_core_module_create_conf(ngx_cycle_t *cycle)
|
||||
ccf->daemon = NGX_CONF_UNSET;
|
||||
ccf->master = NGX_CONF_UNSET;
|
||||
ccf->privileged_agent = NGX_CONF_UNSET;
|
||||
+ ccf->privileged_agent_connections = NGX_CONF_UNSET_UINT;
|
||||
ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
|
||||
ccf->shutdown_timeout = NGX_CONF_UNSET_MSEC;
|
||||
|
||||
@@ -1092,6 +1093,7 @@ ngx_core_module_init_conf(ngx_cycle_t *cycle, void *conf)
|
||||
ngx_conf_init_value(ccf->daemon, 1);
|
||||
ngx_conf_init_value(ccf->master, 1);
|
||||
ngx_conf_init_value(ccf->privileged_agent, 0);
|
||||
+ ngx_conf_init_uint_value(ccf->privileged_agent_connections, 512);
|
||||
ngx_conf_init_msec_value(ccf->timer_resolution, 0);
|
||||
ngx_conf_init_msec_value(ccf->shutdown_timeout, 0);
|
||||
|
||||
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
|
||||
index 6a9583e..4469390 100644
|
||||
--- a/src/core/ngx_cycle.h
|
||||
+++ b/src/core/ngx_cycle.h
|
||||
@@ -93,6 +93,7 @@ typedef struct {
|
||||
ngx_flag_t daemon;
|
||||
ngx_flag_t master;
|
||||
ngx_flag_t privileged_agent;
|
||||
+ ngx_uint_t privileged_agent_connections;
|
||||
|
||||
ngx_msec_t timer_resolution;
|
||||
ngx_msec_t shutdown_timeout;
|
||||
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
|
||||
index df25f9d..bd259c1 100644
|
||||
--- a/src/os/unix/ngx_process_cycle.c
|
||||
+++ b/src/os/unix/ngx_process_cycle.c
|
||||
@@ -1179,6 +1179,7 @@ static void
|
||||
ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
|
||||
{
|
||||
char *name = data;
|
||||
+ ngx_core_conf_t *ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
|
||||
|
||||
/*
|
||||
* Set correct process type since closing listening Unix domain socket
|
||||
@@ -1190,7 +1191,7 @@ ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
|
||||
ngx_close_listening_sockets(cycle);
|
||||
|
||||
/* Set a moderate number of connections for a helper process. */
|
||||
- cycle->connection_n = 512;
|
||||
+ cycle->connection_n = ccf->privileged_agent_connections;
|
||||
|
||||
ngx_worker_process_init(cycle, -1);
|
||||
|
||||
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
|
||||
index df25f9d..bd259c1 100644
|
||||
--- a/src/os/unix/ngx_process_cycle.c
|
||||
+++ b/src/os/unix/ngx_process_cycle.c
|
||||
@@ -442,6 +442,15 @@
|
||||
return;
|
||||
}
|
||||
|
||||
+ /* 0 is an illegal value and may result in a core dump later */
|
||||
+ if (ccf->privileged_agent_connections == 0) {
|
||||
+ ngx_log_error(NGX_LOG_ALERT, cycle->log, 0,
|
||||
+ "%ui worker_connection is not enough, "
|
||||
+ "privileged agent process cannot be spawned",
|
||||
+ ccf->privileged_agent_connections);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
ngx_spawn_process(cycle, ngx_privileged_agent_process_cycle,
|
||||
"privileged agent process", "privileged agent process",
|
||||
respawn ? NGX_PROCESS_JUST_RESPAWN : NGX_PROCESS_RESPAWN);
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
--- a/src/core/ngx_thread_pool.c
|
||||
+++ b/src/core/ngx_thread_pool.c
|
||||
@@ -587,7 +587,8 @@
|
||||
ngx_thread_pool_conf_t *tcf;
|
||||
|
||||
if (ngx_process != NGX_PROCESS_WORKER
|
||||
- && ngx_process != NGX_PROCESS_SINGLE)
|
||||
+ && ngx_process != NGX_PROCESS_SINGLE
|
||||
+ && !ngx_is_privileged_agent)
|
||||
{
|
||||
return NGX_OK;
|
||||
}
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
|
||||
index c51b7ff..4c335b9 100644
|
||||
--- a/src/core/ngx_cycle.h
|
||||
+++ b/src/core/ngx_cycle.h
|
||||
@@ -22,9 +22,14 @@
|
||||
#define NGX_DEBUG_POINTS_ABORT 2
|
||||
|
||||
|
||||
+#define HAVE_INTERCEPT_ERROR_LOG_PATCH
|
||||
+
|
||||
+
|
||||
typedef struct ngx_shm_zone_s ngx_shm_zone_t;
|
||||
|
||||
typedef ngx_int_t (*ngx_shm_zone_init_pt) (ngx_shm_zone_t *zone, void *data);
|
||||
+typedef ngx_int_t (*ngx_log_intercept_pt) (ngx_log_t *log, ngx_uint_t level,
|
||||
+ u_char *buf, size_t len);
|
||||
|
||||
struct ngx_shm_zone_s {
|
||||
void *data;
|
||||
@@ -75,6 +80,10 @@ struct ngx_cycle_s {
|
||||
ngx_str_t prefix;
|
||||
ngx_str_t lock_file;
|
||||
ngx_str_t hostname;
|
||||
+
|
||||
+ ngx_log_intercept_pt intercept_error_log_handler;
|
||||
+ void *intercept_error_log_data;
|
||||
+ unsigned entered_logger; /* :1 */
|
||||
};
|
||||
|
||||
|
||||
diff --git a/src/core/ngx_log.c b/src/core/ngx_log.c
|
||||
index 8e9408d..ed9b11b 100644
|
||||
--- a/src/core/ngx_log.c
|
||||
+++ b/src/core/ngx_log.c
|
||||
@@ -112,6 +112,8 @@ ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
|
||||
ngx_uint_t wrote_stderr, debug_connection;
|
||||
u_char errstr[NGX_MAX_ERROR_STR];
|
||||
|
||||
+ ngx_log_intercept_pt log_intercept = NULL;
|
||||
+
|
||||
last = errstr + NGX_MAX_ERROR_STR;
|
||||
|
||||
p = ngx_cpymem(errstr, ngx_cached_err_log_time.data,
|
||||
@@ -153,6 +155,16 @@ ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
|
||||
p = last - NGX_LINEFEED_SIZE;
|
||||
}
|
||||
|
||||
+ if (ngx_cycle) {
|
||||
+ log_intercept = ngx_cycle->intercept_error_log_handler;
|
||||
+ }
|
||||
+
|
||||
+ if (log_intercept && !ngx_cycle->entered_logger) {
|
||||
+ ngx_cycle->entered_logger = 1;
|
||||
+ log_intercept(log, level, errstr, p - errstr);
|
||||
+ ngx_cycle->entered_logger = 0;
|
||||
+ }
|
||||
+
|
||||
ngx_linefeed(p);
|
||||
|
||||
wrote_stderr = 0;
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
diff -upr nginx-1.25.3/src/http/ngx_http_core_module.c nginx-1.25.3-patched/src/http/ngx_http_core_module.c
|
||||
--- nginx-1.25.3/src/http/ngx_http_core_module.c 2017-08-31 18:14:41.000000000 -0700
|
||||
+++ nginx-1.25.3-patched/src/http/ngx_http_core_module.c 2017-08-31 18:21:31.638098196 -0700
|
||||
@@ -64,6 +64,8 @@ static char *ngx_http_core_directio(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
void *conf);
|
||||
static char *ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
void *conf);
|
||||
+static char *ngx_http_core_no_error_pages(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
+ void *conf);
|
||||
static char *ngx_http_core_open_file_cache(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
void *conf);
|
||||
static char *ngx_http_core_error_log(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
@@ -671,6 +673,14 @@ static ngx_command_t ngx_http_core_commands[] = {
|
||||
0,
|
||||
NULL },
|
||||
|
||||
+ { ngx_string("no_error_pages"),
|
||||
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
|
||||
+ |NGX_CONF_NOARGS,
|
||||
+ ngx_http_core_no_error_pages,
|
||||
+ NGX_HTTP_LOC_CONF_OFFSET,
|
||||
+ 0,
|
||||
+ NULL },
|
||||
+
|
||||
{ ngx_string("post_action"),
|
||||
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
|
||||
|NGX_CONF_TAKE1,
|
||||
@@ -3564,7 +3574,6 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
|
||||
* clcf->types = NULL;
|
||||
* clcf->default_type = { 0, NULL };
|
||||
* clcf->error_log = NULL;
|
||||
- * clcf->error_pages = NULL;
|
||||
* clcf->client_body_path = NULL;
|
||||
* clcf->regex = NULL;
|
||||
* clcf->exact_match = 0;
|
||||
@@ -3574,6 +3583,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
|
||||
* clcf->keepalive_disable = 0;
|
||||
*/
|
||||
|
||||
+ clcf->error_pages = NGX_CONF_UNSET_PTR;
|
||||
clcf->client_max_body_size = NGX_CONF_UNSET;
|
||||
clcf->client_body_buffer_size = NGX_CONF_UNSET_SIZE;
|
||||
clcf->client_body_timeout = NGX_CONF_UNSET_MSEC;
|
||||
@@ -3776,9 +3786,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
}
|
||||
}
|
||||
|
||||
- if (conf->error_pages == NULL && prev->error_pages) {
|
||||
- conf->error_pages = prev->error_pages;
|
||||
- }
|
||||
+ ngx_conf_merge_ptr_value(conf->error_pages, prev->error_pages, NULL);
|
||||
|
||||
ngx_conf_merge_str_value(conf->default_type,
|
||||
prev->default_type, "text/plain");
|
||||
@@ -4815,6 +4823,10 @@ ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
ngx_http_compile_complex_value_t ccv;
|
||||
|
||||
if (clcf->error_pages == NULL) {
|
||||
+ return "conflicts with \"no_error_pages\"";
|
||||
+ }
|
||||
+
|
||||
+ if (clcf->error_pages == NGX_CONF_UNSET_PTR) {
|
||||
clcf->error_pages = ngx_array_create(cf->pool, 4,
|
||||
sizeof(ngx_http_err_page_t));
|
||||
if (clcf->error_pages == NULL) {
|
||||
@@ -4920,6 +4932,25 @@ ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
}
|
||||
|
||||
|
||||
+static char *
|
||||
+ngx_http_core_no_error_pages(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
+{
|
||||
+ ngx_http_core_loc_conf_t *clcf = conf;
|
||||
+
|
||||
+ if (clcf->error_pages == NULL) {
|
||||
+ return "is duplicate";
|
||||
+ }
|
||||
+
|
||||
+ if (clcf->error_pages != NGX_CONF_UNSET_PTR) {
|
||||
+ return "conflicts with \"error_page\"";
|
||||
+ }
|
||||
+
|
||||
+ clcf->error_pages = NULL;
|
||||
+
|
||||
+ return NGX_CONF_OK;
|
||||
+}
|
||||
+
|
||||
+
|
||||
static char *
|
||||
ngx_http_core_open_file_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
{
|
||||
36
images/nginx/rootfs/patches/18_nginx-1.25.3-no_Werror.patch
Normal file
36
images/nginx/rootfs/patches/18_nginx-1.25.3-no_Werror.patch
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
diff -urp nginx-1.25.3/auto/cc/clang nginx-1.25.3-patched/auto/cc/clang
|
||||
--- nginx-1.25.3/auto/cc/clang 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.25.3-patched/auto/cc/clang 2014-03-13 20:54:26.241413360 -0700
|
||||
@@ -89,7 +89,7 @@ CFLAGS="$CFLAGS -Wconditional-uninitiali
|
||||
CFLAGS="$CFLAGS -Wno-unused-parameter"
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
diff -urp nginx-1.25.3/auto/cc/gcc nginx-1.25.3-patched/auto/cc/gcc
|
||||
--- nginx-1.25.3/auto/cc/gcc 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.25.3-patched/auto/cc/gcc 2014-03-13 20:54:13.301355329 -0700
|
||||
@@ -168,7 +168,7 @@ esac
|
||||
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
diff -urp nginx-1.25.3/auto/cc/icc nginx-1.25.3-patched/auto/cc/icc
|
||||
--- nginx-1.25.3/auto/cc/icc 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.25.3-patched/auto/cc/icc 2014-03-13 20:54:13.301355329 -0700
|
||||
@@ -115,7 +115,7 @@ case "$NGX_ICC_VER" in
|
||||
esac
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
|
|
@ -0,0 +1,117 @@
|
|||
diff --git a/src/http/modules/ngx_http_log_module.c b/src/http/modules/ngx_http_log_module.c
|
||||
index 917ed55f..b769dfd3 100644
|
||||
--- a/src/http/modules/ngx_http_log_module.c
|
||||
+++ b/src/http/modules/ngx_http_log_module.c
|
||||
@@ -79,6 +79,8 @@ typedef struct {
|
||||
time_t open_file_cache_valid;
|
||||
ngx_uint_t open_file_cache_min_uses;
|
||||
|
||||
+ ngx_flag_t escape_non_ascii;
|
||||
+
|
||||
ngx_uint_t off; /* unsigned off:1 */
|
||||
} ngx_http_log_loc_conf_t;
|
||||
|
||||
@@ -131,7 +133,8 @@ static size_t ngx_http_log_variable_getlen(ngx_http_request_t *r,
|
||||
uintptr_t data);
|
||||
static u_char *ngx_http_log_variable(ngx_http_request_t *r, u_char *buf,
|
||||
ngx_http_log_op_t *op);
|
||||
-static uintptr_t ngx_http_log_escape(u_char *dst, u_char *src, size_t size);
|
||||
+static uintptr_t ngx_http_log_escape(ngx_http_log_loc_conf_t *lcf, u_char *dst,
|
||||
+ u_char *src, size_t size);
|
||||
static size_t ngx_http_log_json_variable_getlen(ngx_http_request_t *r,
|
||||
uintptr_t data);
|
||||
static u_char *ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf,
|
||||
@@ -177,6 +180,13 @@ static ngx_command_t ngx_http_log_commands[] = {
|
||||
0,
|
||||
NULL },
|
||||
|
||||
+ { ngx_string("log_escape_non_ascii"),
|
||||
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
|
||||
+ ngx_conf_set_flag_slot,
|
||||
+ NGX_HTTP_LOC_CONF_OFFSET,
|
||||
+ offsetof(ngx_http_log_loc_conf_t, escape_non_ascii),
|
||||
+ NULL },
|
||||
+
|
||||
ngx_null_command
|
||||
};
|
||||
|
||||
@@ -935,6 +945,7 @@ static size_t
|
||||
ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
|
||||
{
|
||||
uintptr_t len;
|
||||
+ ngx_http_log_loc_conf_t *lcf;
|
||||
ngx_http_variable_value_t *value;
|
||||
|
||||
value = ngx_http_get_indexed_variable(r, data);
|
||||
@@ -943,7 +954,9 @@ ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
|
||||
return 1;
|
||||
}
|
||||
|
||||
- len = ngx_http_log_escape(NULL, value->data, value->len);
|
||||
+ lcf = ngx_http_get_module_loc_conf(r, ngx_http_log_module);
|
||||
+
|
||||
+ len = ngx_http_log_escape(lcf, NULL, value->data, value->len);
|
||||
|
||||
value->escape = len ? 1 : 0;
|
||||
|
||||
@@ -954,6 +967,7 @@ ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
|
||||
static u_char *
|
||||
ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op)
|
||||
{
|
||||
+ ngx_http_log_loc_conf_t *lcf;
|
||||
ngx_http_variable_value_t *value;
|
||||
|
||||
value = ngx_http_get_indexed_variable(r, op->data);
|
||||
@@ -967,16 +981,18 @@ ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op)
|
||||
return ngx_cpymem(buf, value->data, value->len);
|
||||
|
||||
} else {
|
||||
- return (u_char *) ngx_http_log_escape(buf, value->data, value->len);
|
||||
+ lcf = ngx_http_get_module_loc_conf(r, ngx_http_log_module);
|
||||
+ return (u_char *) ngx_http_log_escape(lcf, buf, value->data, value->len);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static uintptr_t
|
||||
-ngx_http_log_escape(u_char *dst, u_char *src, size_t size)
|
||||
+ngx_http_log_escape(ngx_http_log_loc_conf_t *lcf, u_char *dst, u_char *src,
|
||||
+ size_t size)
|
||||
{
|
||||
- ngx_uint_t n;
|
||||
- static u_char hex[] = "0123456789ABCDEF";
|
||||
+ ngx_uint_t n;
|
||||
+ static u_char hex[] = "0123456789ABCDEF";
|
||||
|
||||
static uint32_t escape[] = {
|
||||
0xffffffff, /* 1111 1111 1111 1111 1111 1111 1111 1111 */
|
||||
@@ -996,6 +1012,12 @@ ngx_http_log_escape(u_char *dst, u_char *src, size_t size)
|
||||
0xffffffff, /* 1111 1111 1111 1111 1111 1111 1111 1111 */
|
||||
};
|
||||
|
||||
+ if (lcf->escape_non_ascii) {
|
||||
+ ngx_memset(&escape[4], 0xff, sizeof(uint32_t) * 4);
|
||||
+
|
||||
+ } else {
|
||||
+ ngx_memzero(&escape[4], sizeof(uint32_t) * 4);
|
||||
+ }
|
||||
|
||||
if (dst == NULL) {
|
||||
|
||||
@@ -1120,6 +1142,7 @@ ngx_http_log_create_loc_conf(ngx_conf_t *cf)
|
||||
}
|
||||
|
||||
conf->open_file_cache = NGX_CONF_UNSET_PTR;
|
||||
+ conf->escape_non_ascii = NGX_CONF_UNSET;
|
||||
|
||||
return conf;
|
||||
}
|
||||
@@ -1135,6 +1158,8 @@ ngx_http_log_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
ngx_http_log_fmt_t *fmt;
|
||||
ngx_http_log_main_conf_t *lmcf;
|
||||
|
||||
+ ngx_conf_merge_value(conf->escape_non_ascii, prev->escape_non_ascii, 1);
|
||||
+
|
||||
if (conf->open_file_cache == NGX_CONF_UNSET_PTR) {
|
||||
|
||||
conf->open_file_cache = prev->open_file_cache;
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
--- nginx-1.21.4/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
|
||||
+++ nginx-1.21.4-patched/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
|
||||
--- nginx-1.25.3/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
|
||||
+++ nginx-1.25.3-patched/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
|
||||
@@ -793,13 +793,13 @@ static ngx_keyval_t ngx_http_proxy_cach
|
||||
static ngx_http_variable_t ngx_http_proxy_vars[] = {
|
||||
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
--- nginx-1.21.4/src/core/ngx_log.h 2013-10-08 05:07:14.000000000 -0700
|
||||
+++ nginx-1.21.4-patched/src/core/ngx_log.h 2013-12-05 20:35:35.996236720 -0800
|
||||
--- nginx-1.25.3/src/core/ngx_log.h 2013-10-08 05:07:14.000000000 -0700
|
||||
+++ nginx-1.25.3-patched/src/core/ngx_log.h 2013-12-05 20:35:35.996236720 -0800
|
||||
@@ -64,7 +64,9 @@ struct ngx_log_s {
|
||||
};
|
||||
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# HG changeset patch
|
||||
# User Yichun Zhang <agentzh@gmail.com>
|
||||
# Date 1386694955 28800
|
||||
# Node ID 9ba6b149669f1f02eeb4cdc0ebd364a949b5c469
|
||||
# Parent 30e806b8636af5fd3f03ec17df24801f390f7511
|
||||
Configure: added new option --with-pcre-conf-opt=OPTIONS.
|
||||
|
||||
diff -r 30e806b8636a -r 9ba6b149669f auto/options
|
||||
--- a/auto/options Mon Dec 09 10:16:44 2013 +0400
|
||||
+++ b/auto/options Tue Dec 10 09:02:35 2013 -0800
|
||||
@@ -286,6 +286,7 @@
|
||||
--with-pcre) USE_PCRE=YES ;;
|
||||
--with-pcre=*) PCRE="$value" ;;
|
||||
--with-pcre-opt=*) PCRE_OPT="$value" ;;
|
||||
+ --with-pcre-conf-opt=*) PCRE_CONF_OPT="$value" ;;
|
||||
--with-pcre-jit) PCRE_JIT=YES ;;
|
||||
|
||||
--with-openssl=*) OPENSSL="$value" ;;
|
||||
@@ -441,6 +442,7 @@
|
||||
--with-pcre force PCRE library usage
|
||||
--with-pcre=DIR set path to PCRE library sources
|
||||
--with-pcre-opt=OPTIONS set additional build options for PCRE
|
||||
+ --with-pcre-conf-opt=OPTIONS set additional configure options for PCRE
|
||||
--with-pcre-jit build PCRE with JIT compilation support
|
||||
|
||||
--with-md5=DIR set path to md5 library sources
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
--- nginx-1.25.3/auto/cc/conf 2015-10-30 22:47:50.000000000 +0800
|
||||
+++ nginx-1.25.3-patched/auto/cc/conf 2015-11-02 12:23:05.385156987 +0800
|
||||
@@ -144,7 +144,7 @@ fi
|
||||
CFLAGS="$CFLAGS $NGX_CC_OPT"
|
||||
NGX_TEST_LD_OPT="$NGX_LD_OPT"
|
||||
|
||||
-if [ "$NGX_PLATFORM" != win32 ]; then
|
||||
+if [ 1 ]; then
|
||||
|
||||
if test -n "$NGX_LD_OPT"; then
|
||||
ngx_feature=--with-ld-opt=\"$NGX_LD_OPT\"
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index 8ba30e58..2b2db95c 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -1712,6 +1712,9 @@ ngx_ssl_handshake(ngx_connection_t *c)
|
||||
if (sslerr == SSL_ERROR_WANT_X509_LOOKUP
|
||||
# ifdef SSL_ERROR_PENDING_SESSION
|
||||
|| sslerr == SSL_ERROR_PENDING_SESSION
|
||||
+# endif
|
||||
+# ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
|
||||
+ || sslerr == SSL_ERROR_WANT_CLIENT_HELLO_CB
|
||||
# endif
|
||||
)
|
||||
{
|
||||
@@ -1889,6 +1892,23 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
|
||||
}
|
||||
#endif
|
||||
|
||||
+#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
|
||||
+ if (sslerr == SSL_ERROR_WANT_CLIENT_HELLO_CB) {
|
||||
+ c->read->handler = ngx_ssl_handshake_handler;
|
||||
+ c->write->handler = ngx_ssl_handshake_handler;
|
||||
+
|
||||
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_AGAIN;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
|
||||
|
||||
c->ssl->no_wait_shutdown = 1;
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
# HG changeset patch
|
||||
# User Thibault Charbonnier <thibaultcha@fastmail.com>
|
||||
# Date 1481847421 28800
|
||||
# Thu Dec 15 16:17:01 2016 -0800
|
||||
# Node ID 8bf038fe006fd8ae253d6b41fc6cf109a8912d3e
|
||||
# Parent a3dc657f4e9530623683e6b85bd7492662e4dc47
|
||||
Resolver: ignore ipv6=off resolver option when no ipv6 support
|
||||
|
||||
Makes the resolver directive more robust: we only error out when ipv6
|
||||
resolution is desired but not supported (ipv6=on).
|
||||
|
||||
use case 1: some configurations are sometimes re-used between builds with and
|
||||
without ipv6 support. This patch avoids the need to remove the "ipv6=off" flag.
|
||||
|
||||
use case 2: currently, some tools rely on the --with-ipv6 configure option from
|
||||
"nginx -V" to determine if ipv6 resolution should be disabled in some cases.
|
||||
With this option disappearing in Nginx 1.11.5, this patch would allow such tools
|
||||
to assume "ipv6=off" to be safe regardless of ipv6 support in the current
|
||||
build.
|
||||
|
||||
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
|
||||
index dade1846..5a3f0aa4 100644
|
||||
--- a/src/core/ngx_resolver.c
|
||||
+++ b/src/core/ngx_resolver.c
|
||||
@@ -425,7 +425,6 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
|
||||
continue;
|
||||
}
|
||||
|
||||
-#if (NGX_HAVE_INET6)
|
||||
if (ngx_strncmp(names[i].data, "ipv4=", 5) == 0) {
|
||||
|
||||
if (ngx_strcmp(&names[i].data[5], "on") == 0) {
|
||||
@@ -446,10 +445,19 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
|
||||
if (ngx_strncmp(names[i].data, "ipv6=", 5) == 0) {
|
||||
|
||||
if (ngx_strcmp(&names[i].data[5], "on") == 0) {
|
||||
+#if (NGX_HAVE_INET6)
|
||||
r->ipv6 = 1;
|
||||
+#else
|
||||
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
|
||||
+ "no ipv6 support but \"%V\" in resolver",
|
||||
+ &names[i]);
|
||||
+ return NULL;
|
||||
+#endif
|
||||
|
||||
} else if (ngx_strcmp(&names[i].data[5], "off") == 0) {
|
||||
+#if (NGX_HAVE_INET6)
|
||||
r->ipv6 = 0;
|
||||
+#endif
|
||||
|
||||
} else {
|
||||
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
|
||||
@@ -459,7 +467,6 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
|
||||
|
||||
continue;
|
||||
}
|
||||
-#endif
|
||||
|
||||
#if !(NGX_WIN32)
|
||||
if (ngx_strncmp(names[i].data, "local=", 6) == 0) {
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# HG changeset patch
|
||||
# User Yichun Zhang <agentzh@gmail.com>
|
||||
# Date 1412276417 25200
|
||||
# Thu Oct 02 12:00:17 2014 -0700
|
||||
# Node ID 4032b992f23b054c1a2cfb0be879330d2c6708e5
|
||||
# Parent 1ff0f68d9376e3d184d65814a6372856bf65cfcd
|
||||
Hash: buffer overflow might happen when exceeding the pre-configured limits.
|
||||
|
||||
diff -r 1ff0f68d9376 -r 4032b992f23b src/core/ngx_hash.c
|
||||
--- a/src/core/ngx_hash.c Tue Sep 30 15:50:28 2014 -0700
|
||||
+++ b/src/core/ngx_hash.c Thu Oct 02 12:00:17 2014 -0700
|
||||
@@ -312,6 +312,8 @@ ngx_hash_init(ngx_hash_init_t *hinit, ng
|
||||
continue;
|
||||
}
|
||||
|
||||
+ size--;
|
||||
+
|
||||
ngx_log_error(NGX_LOG_WARN, hinit->pool->log, 0,
|
||||
"could not build optimal %s, you should increase "
|
||||
"either %s_max_size: %i or %s_bucket_size: %i; "
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
#commit 6ceef192e7af1c507826ac38a2d43f08bf265fb9
|
||||
#repository: https://github.com/nginx/nginx
|
||||
#Author: Maxim Dounin <mdounin@mdounin.ru>
|
||||
#Date: Tue Oct 10 15:13:39 2023 +0300
|
||||
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
|
||||
index 7c05ff1e7..410a8be24 100644
|
||||
--- a/src/http/v2/ngx_http_v2.c
|
||||
+++ b/src/http/v2/ngx_http_v2.c
|
||||
@@ -347,6 +347,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
|
||||
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
|
||||
|
||||
h2c->blocked = 1;
|
||||
+ h2c->new_streams = 0;
|
||||
|
||||
if (c->close) {
|
||||
c->close = 0;
|
||||
@@ -1284,6 +1285,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||
goto rst_stream;
|
||||
}
|
||||
|
||||
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
|
||||
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||
+ "client sent too many streams at once");
|
||||
+
|
||||
+ status = NGX_HTTP_V2_REFUSED_STREAM;
|
||||
+ goto rst_stream;
|
||||
+ }
|
||||
+
|
||||
if (!h2c->settings_ack
|
||||
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
|
||||
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
|
||||
@@ -1349,6 +1358,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||
|
||||
rst_stream:
|
||||
|
||||
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
|
||||
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||
+ "client sent too many refused streams");
|
||||
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
|
||||
+ }
|
||||
+
|
||||
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
|
||||
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
|
||||
}
|
||||
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
|
||||
index cb9014ccf..6751b3026 100644
|
||||
--- a/src/http/v2/ngx_http_v2.h
|
||||
+++ b/src/http/v2/ngx_http_v2.h
|
||||
@@ -131,6 +131,8 @@ struct ngx_http_v2_connection_s {
|
||||
ngx_uint_t processing;
|
||||
ngx_uint_t frames;
|
||||
ngx_uint_t idle;
|
||||
+ ngx_uint_t new_streams;
|
||||
+ ngx_uint_t refused_streams;
|
||||
ngx_uint_t priority_limit;
|
||||
|
||||
size_t send_window;
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
diff -urp nginx-1.21.4/auto/cc/clang nginx-1.21.4-patched/auto/cc/clang
|
||||
--- nginx-1.21.4/auto/cc/clang 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.21.4-patched/auto/cc/clang 2014-03-13 20:54:26.241413360 -0700
|
||||
@@ -89,7 +89,7 @@ CFLAGS="$CFLAGS -Wconditional-uninitiali
|
||||
CFLAGS="$CFLAGS -Wno-unused-parameter"
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
diff -urp nginx-1.21.4/auto/cc/gcc nginx-1.21.4-patched/auto/cc/gcc
|
||||
--- nginx-1.21.4/auto/cc/gcc 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.21.4-patched/auto/cc/gcc 2014-03-13 20:54:13.301355329 -0700
|
||||
@@ -168,7 +168,7 @@ esac
|
||||
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
diff -urp nginx-1.21.4/auto/cc/icc nginx-1.21.4-patched/auto/cc/icc
|
||||
--- nginx-1.21.4/auto/cc/icc 2014-03-04 03:39:24.000000000 -0800
|
||||
+++ nginx-1.21.4-patched/auto/cc/icc 2014-03-13 20:54:13.301355329 -0700
|
||||
@@ -115,7 +115,7 @@ case "$NGX_ICC_VER" in
|
||||
esac
|
||||
|
||||
# stop on warning
|
||||
-CFLAGS="$CFLAGS -Werror"
|
||||
+#CFLAGS="$CFLAGS -Werror"
|
||||
|
||||
# debug
|
||||
CFLAGS="$CFLAGS -g"
|
||||
Loading…
Add table
Add a link
Reference in a new issue