DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Images: Remove NGINX v1.21. (#12058)

Browse source
This commit is contained in:
Marco Ebert 2024-10-01 12:42:53 +02:00 • committed by GitHub
parent f6398126da
commit eef1aa0e46
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
65 changed files with 247 additions and 2547 deletions
Download patch file Download diff file Expand all files Collapse all files

0
images/nginx/rootfs/patches/drop-alias-root.patch → images/nginx/rootfs/patches/00_drop-alias-root.patch
View file

15
images/nginx/rootfs/patches/01_nginx-1.25.3-win32_max_err_str.patch Normal file
View file

@ -0,0 +1,15 @@
diff --git a/src/os/win32/ngx_event_log.c b/src/os/win32/ngx_event_log.c
index e11ed1e8..dce8eddd 100644
--- a/src/os/win32/ngx_event_log.c
+++ b/src/os/win32/ngx_event_log.c
@@ -8,7 +8,9 @@
#include <ngx_core.h>
-#define NGX_MAX_ERROR_STR 2048
+#ifndef NGX_MAX_ERROR_STR
+#define NGX_MAX_ERROR_STR 4096
+#endif
void ngx_cdecl

53
images/nginx/rootfs/patches/02_nginx-1.25.3-stream_balancer_export.patch Normal file
View file

@ -0,0 +1,53 @@
diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c
index 526de3a..b531ce1 100644
--- a/src/stream/ngx_stream_upstream_round_robin.c
+++ b/src/stream/ngx_stream_upstream_round_robin.c
@@ -21,10 +21,6 @@ static void ngx_stream_upstream_notify_round_robin_peer(
#if (NGX_STREAM_SSL)
-static ngx_int_t ngx_stream_upstream_set_round_robin_peer_session(
- ngx_peer_connection_t *pc, void *data);
-static void ngx_stream_upstream_save_round_robin_peer_session(
- ngx_peer_connection_t *pc, void *data);
static ngx_int_t ngx_stream_upstream_empty_set_session(
ngx_peer_connection_t *pc, void *data);
static void ngx_stream_upstream_empty_save_session(ngx_peer_connection_t *pc,
@@ -690,7 +686,7 @@ ngx_stream_upstream_notify_round_robin_peer(ngx_peer_connection_t *pc,
#if (NGX_STREAM_SSL)
-static ngx_int_t
+ngx_int_t
ngx_stream_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
void *data)
{
@@ -756,7 +752,7 @@ ngx_stream_upstream_set_round_robin_peer_session(ngx_peer_connection_t *pc,
}
-static void
+void
ngx_stream_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
void *data)
{
diff --git a/src/stream/ngx_stream_upstream_round_robin.h b/src/stream/ngx_stream_upstream_round_robin.h
index 35d9fce..75f3e31 100644
--- a/src/stream/ngx_stream_upstream_round_robin.h
+++ b/src/stream/ngx_stream_upstream_round_robin.h
@@ -142,5 +142,15 @@ ngx_int_t ngx_stream_upstream_get_round_robin_peer(ngx_peer_connection_t *pc,
void ngx_stream_upstream_free_round_robin_peer(ngx_peer_connection_t *pc,
void *data, ngx_uint_t state);
+#if (NGX_STREAM_SSL)
+ngx_int_t ngx_stream_upstream_set_round_robin_peer_session(
+ ngx_peer_connection_t *pc, void *data);
+void ngx_stream_upstream_save_round_robin_peer_session(
+ ngx_peer_connection_t *pc, void *data);
+#endif
+
+
+#define HAVE_NGX_STREAM_BALANCER_EXPORT_PATCH 1
+
#endif /* _NGX_STREAM_UPSTREAM_ROUND_ROBIN_H_INCLUDED_ */

0
images/nginx/rootfs/patches/nginx-1.21.4-stream_proxy_get_next_upstream_tries.patch → images/nginx/rootfs/patches/03_nginx-1.25.3-stream_proxy_get_next_upstream_tries.patch
View file

178
images/nginx/rootfs/patches/04_nginx-1.25.3-stream_proxy_timeout_fields.patch Normal file
View file

@ -0,0 +1,178 @@
diff -u -r -p -Naur nginx-1.25.3/src/stream/ngx_stream.h nginx-1.25.3-patched/src/stream/ngx_stream.h
--- nginx-1.25.3/src/stream/ngx_stream.h 2021-11-04 21:27:55.288708527 +0800
+++ nginx-1.25.3-patched/src/stream/ngx_stream.h 2021-11-04 21:28:50.768035209 +0800
@@ -254,6 +254,15 @@ typedef struct {
} ngx_stream_module_t;
+typedef struct {
+ ngx_msec_t connect_timeout;
+ ngx_msec_t timeout;
+} ngx_stream_proxy_ctx_t;
+
+
+#define NGX_STREAM_HAVE_PROXY_TIMEOUT_FIELDS_PATCH 1
+
+
#define NGX_STREAM_MODULE 0x4d525453 /* "STRM" */
#define NGX_STREAM_MAIN_CONF 0x02000000
@@ -307,6 +316,7 @@ void ngx_stream_finalize_session(ngx_str
extern ngx_module_t ngx_stream_module;
extern ngx_uint_t ngx_stream_max_module;
extern ngx_module_t ngx_stream_core_module;
+extern ngx_module_t ngx_stream_proxy_module;
typedef ngx_int_t (*ngx_stream_filter_pt)(ngx_stream_session_t *s,
diff -u -r -p -Naur nginx-1.25.3/src/stream/ngx_stream_proxy_module.c nginx-1.25.3-patched/src/stream/ngx_stream_proxy_module.c
--- nginx-1.25.3/src/stream/ngx_stream_proxy_module.c 2021-11-04 21:27:55.289708533 +0800
+++ nginx-1.25.3-patched/src/stream/ngx_stream_proxy_module.c 2021-11-04 21:37:03.578936990 +0800
@@ -400,6 +400,7 @@ ngx_stream_proxy_handler(ngx_stream_sess
ngx_stream_proxy_srv_conf_t *pscf;
ngx_stream_upstream_srv_conf_t *uscf, **uscfp;
ngx_stream_upstream_main_conf_t *umcf;
+ ngx_stream_proxy_ctx_t *pctx;
c = s->connection;
@@ -408,6 +409,17 @@ ngx_stream_proxy_handler(ngx_stream_sess
ngx_log_debug0(NGX_LOG_DEBUG_STREAM, c->log, 0,
"proxy connection handler");
+ pctx = ngx_palloc(c->pool, sizeof(ngx_stream_proxy_ctx_t));
+ if (pctx == NULL) {
+ ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
+ return;
+ }
+
+ pctx->connect_timeout = pscf->connect_timeout;
+ pctx->timeout = pscf->timeout;
+
+ ngx_stream_set_ctx(s, pctx, ngx_stream_proxy_module);
+
u = ngx_pcalloc(c->pool, sizeof(ngx_stream_upstream_t));
if (u == NULL) {
ngx_stream_proxy_finalize(s, NGX_STREAM_INTERNAL_SERVER_ERROR);
@@ -699,6 +711,7 @@ ngx_stream_proxy_connect(ngx_stream_sess
ngx_connection_t *c, *pc;
ngx_stream_upstream_t *u;
ngx_stream_proxy_srv_conf_t *pscf;
+ ngx_stream_proxy_ctx_t *ctx;
c = s->connection;
@@ -706,6 +719,8 @@ ngx_stream_proxy_connect(ngx_stream_sess
pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
+
u = s->upstream;
u->connected = 0;
@@ -774,7 +789,7 @@ ngx_stream_proxy_connect(ngx_stream_sess
pc->read->handler = ngx_stream_proxy_connect_handler;
pc->write->handler = ngx_stream_proxy_connect_handler;
- ngx_add_timer(pc->write, pscf->connect_timeout);
+ ngx_add_timer(pc->write, ctx->connect_timeout);
}
@@ -957,12 +957,14 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
static ngx_int_t
ngx_stream_proxy_send_proxy_protocol(ngx_stream_session_t *s)
{
- u_char *p;
- ssize_t n, size;
- ngx_connection_t *c, *pc;
- ngx_stream_upstream_t *u;
- ngx_stream_proxy_srv_conf_t *pscf;
- u_char buf[NGX_PROXY_PROTOCOL_V1_MAX_HEADER];
+ u_char *p;
+ u_char buf[NGX_PROXY_PROTOCOL_V1_MAX_HEADER];
+ ssize_t n, size;
+ ngx_connection_t *c, *pc;
+ ngx_stream_upstream_t *u;
+ ngx_stream_proxy_ctx_t *ctx;
+
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
c = s->connection;
@@ -976,9 +993,7 @@ ngx_stream_proxy_send_proxy_protocol(ngx
return NGX_ERROR;
}
- pscf = ngx_stream_get_module_srv_conf(s, ngx_stream_proxy_module);
-
- ngx_add_timer(pc->write, pscf->timeout);
+ ngx_add_timer(pc->write, ctx->timeout);
pc->write->handler = ngx_stream_proxy_connect_handler;
@@ -1053,6 +1068,9 @@ ngx_stream_proxy_ssl_init_connection(ngx
ngx_connection_t *pc;
ngx_stream_upstream_t *u;
ngx_stream_proxy_srv_conf_t *pscf;
+ ngx_stream_proxy_ctx_t *ctx;
+
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
u = s->upstream;
@@ -1099,7 +1117,7 @@ ngx_stream_proxy_ssl_init_connection(ngx
if (rc == NGX_AGAIN) {
if (!pc->write->timer_set) {
- ngx_add_timer(pc->write, pscf->connect_timeout);
+ ngx_add_timer(pc->write, ctx->connect_timeout);
}
pc->ssl->handler = ngx_stream_proxy_ssl_handshake;
@@ -1408,6 +1426,7 @@ ngx_stream_proxy_process_connection(ngx_
ngx_stream_session_t *s;
ngx_stream_upstream_t *u;
ngx_stream_proxy_srv_conf_t *pscf;
+ ngx_stream_proxy_ctx_t *ctx;
c = ev->data;
s = c->data;
@@ -1419,6 +1438,8 @@ ngx_stream_proxy_process_connection(ngx_
return;
}
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
+
c = s->connection;
pc = u->peer.connection;
@@ -1438,7 +1459,7 @@ ngx_stream_proxy_process_connection(ngx_
}
if (u->connected && !c->read->delayed && !pc->read->delayed) {
- ngx_add_timer(c->write, pscf->timeout);
+ ngx_add_timer(c->write, ctx->timeout);
}
return;
@@ -1600,6 +1621,9 @@ ngx_stream_proxy_process(ngx_stream_sess
ngx_log_handler_pt handler;
ngx_stream_upstream_t *u;
ngx_stream_proxy_srv_conf_t *pscf;
+ ngx_stream_proxy_ctx_t *ctx;
+
+ ctx = ngx_stream_get_module_ctx(s, ngx_stream_proxy_module);
u = s->upstream;
@@ -1807,7 +1831,7 @@ ngx_stream_proxy_process(ngx_stream_sess
}
if (!c->read->delayed && !pc->read->delayed) {
- ngx_add_timer(c->write, pscf->timeout);
+ ngx_add_timer(c->write, ctx->timeout);
} else if (c->write->timer_set) {
ngx_del_timer(c->write);

0
images/nginx/rootfs/patches/nginx-1.21.4-stream_ssl_preread_no_skip.patch → images/nginx/rootfs/patches/05_nginx-1.25.3-stream_ssl_preread_no_skip.patch
View file

0
images/nginx/rootfs/patches/nginx-1.21.4-resolver_conf_parsing.patch → images/nginx/rootfs/patches/06_nginx-1.25.3-resolver_conf_parsing.patch
View file

12
images/nginx/rootfs/patches/07_nginx-1.25.3-daemon_destroy_pool.patch Normal file
View file

@ -0,0 +1,12 @@
diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c
index ab672110..f259af31 100644
--- a/src/os/unix/ngx_daemon.c
+++ b/src/os/unix/ngx_daemon.c
@@ -23,6 +23,8 @@ ngx_daemon(ngx_log_t *log)
break;
default:
+ /* just to make it ASAN or Valgrind clean */
+ ngx_destroy_pool(ngx_cycle->pool);
exit(0);
}

24
images/nginx/rootfs/patches/nginx-1.21.4-init_cycle_pool_release.patch → images/nginx/rootfs/patches/08_nginx-1.25.3-init_cycle_pool_release.patch
View file

@ -1,6 +1,6 @@
diff -rup nginx-1.21.4/src/core/nginx.c nginx-1.21.4-patched/src/core/nginx.c
--- nginx-1.21.4/src/core/nginx.c 2017-12-17 00:00:38.136470108 -0800
+++ nginx-1.21.4-patched/src/core/nginx.c 2017-12-16 23:59:51.680958322 -0800
diff -rup nginx-1.25.3/src/core/nginx.c nginx-1.25.3-patched/src/core/nginx.c
--- nginx-1.25.3/src/core/nginx.c 2017-12-17 00:00:38.136470108 -0800
+++ nginx-1.25.3-patched/src/core/nginx.c 2017-12-16 23:59:51.680958322 -0800
@@ -186,6 +186,7 @@ static u_char *ngx_prefix;
static u_char *ngx_conf_file;
static u_char *ngx_conf_params;
@ -18,9 +18,9 @@ diff -rup nginx-1.21.4/src/core/nginx.c nginx-1.21.4-patched/src/core/nginx.c
if (ngx_save_argv(&init_cycle, argc, argv) != NGX_OK) {
return 1;
}
diff -rup nginx-1.21.4/src/core/ngx_core.h nginx-1.21.4-patched/src/core/ngx_core.h
--- nginx-1.21.4/src/core/ngx_core.h 2017-10-10 08:22:51.000000000 -0700
+++ nginx-1.21.4-patched/src/core/ngx_core.h 2017-12-16 23:59:51.679958370 -0800
diff -rup nginx-1.25.3/src/core/ngx_core.h nginx-1.25.3-patched/src/core/ngx_core.h
--- nginx-1.25.3/src/core/ngx_core.h 2017-10-10 08:22:51.000000000 -0700
+++ nginx-1.25.3-patched/src/core/ngx_core.h 2017-12-16 23:59:51.679958370 -0800
@@ -108,4 +108,6 @@ void ngx_cpuinfo(void);
#define NGX_DISABLE_SYMLINKS_NOTOWNER 2
#endif
@ -28,9 +28,9 @@ diff -rup nginx-1.21.4/src/core/ngx_core.h nginx-1.21.4-patched/src/core/ngx_cor
+extern ngx_pool_t *saved_init_cycle_pool;
+
#endif /* _NGX_CORE_H_INCLUDED_ */
diff -rup nginx-1.21.4/src/core/ngx_cycle.c nginx-1.21.4-patched/src/core/ngx_cycle.c
--- nginx-1.21.4/src/core/ngx_cycle.c 2017-10-10 08:22:51.000000000 -0700
+++ nginx-1.21.4-patched/src/core/ngx_cycle.c 2017-12-16 23:59:51.678958419 -0800
diff -rup nginx-1.25.3/src/core/ngx_cycle.c nginx-1.25.3-patched/src/core/ngx_cycle.c
--- nginx-1.25.3/src/core/ngx_cycle.c 2017-10-10 08:22:51.000000000 -0700
+++ nginx-1.25.3-patched/src/core/ngx_cycle.c 2017-12-16 23:59:51.678958419 -0800
@@ -748,6 +748,10 @@ old_shm_zone_done:
if (ngx_process == NGX_PROCESS_MASTER || ngx_is_init_cycle(old_cycle)) {
@ -42,9 +42,9 @@ diff -rup nginx-1.21.4/src/core/ngx_cycle.c nginx-1.21.4-patched/src/core/ngx_cy
ngx_destroy_pool(old_cycle->pool);
cycle->old_cycle = NULL;
diff -rup nginx-1.21.4/src/os/unix/ngx_process_cycle.c nginx-1.21.4-patched/src/os/unix/ngx_process_cycle.c
--- nginx-1.21.4/src/os/unix/ngx_process_cycle.c 2017-12-17 00:00:38.142469762 -0800
+++ nginx-1.21.4-patched/src/os/unix/ngx_process_cycle.c 2017-12-16 23:59:51.691957791 -0800
diff -rup nginx-1.25.3/src/os/unix/ngx_process_cycle.c nginx-1.25.3-patched/src/os/unix/ngx_process_cycle.c
--- nginx-1.25.3/src/os/unix/ngx_process_cycle.c 2017-12-17 00:00:38.142469762 -0800
+++ nginx-1.25.3-patched/src/os/unix/ngx_process_cycle.c 2017-12-16 23:59:51.691957791 -0800
@@ -687,6 +692,11 @@ ngx_master_process_exit(ngx_cycle_t *cyc
ngx_exit_cycle.files_n = ngx_cycle->files_n;
ngx_cycle = &ngx_exit_cycle;

0
images/nginx/rootfs/patches/nginx-1.21.4-balancer_status_code.patch → images/nginx/rootfs/patches/09_nginx-1.25.3-balancer_status_code.patch
View file

0
images/nginx/rootfs/patches/nginx-1.21.4-delayed_posted_events.patch → images/nginx/rootfs/patches/10_nginx-1.25.3-delayed_posted_events.patch
View file

203
images/nginx/rootfs/patches/11_nginx-1.25.3-privileged_agent_process.patch Normal file
View file

@ -0,0 +1,203 @@
diff --git a/src/core/nginx.c b/src/core/nginx.c
index 60f8fe7..4bd244b 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -981,6 +981,7 @@ ngx_core_module_create_conf(ngx_cycle_t *cycle)
ccf->daemon = NGX_CONF_UNSET;
ccf->master = NGX_CONF_UNSET;
+ ccf->privileged_agent = NGX_CONF_UNSET;
ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
ccf->worker_processes = NGX_CONF_UNSET;
@@ -1009,6 +1010,7 @@ ngx_core_module_init_conf(ngx_cycle_t *cycle, void *conf)
ngx_conf_init_value(ccf->daemon, 1);
ngx_conf_init_value(ccf->master, 1);
+ ngx_conf_init_value(ccf->privileged_agent, 0);
ngx_conf_init_msec_value(ccf->timer_resolution, 0);
ngx_conf_init_value(ccf->worker_processes, 1);
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
index c51b7ff..3261f90 100644
--- a/src/core/ngx_cycle.h
+++ b/src/core/ngx_cycle.h
@@ -22,6 +22,9 @@
#define NGX_DEBUG_POINTS_ABORT 2
+#define HAVE_PRIVILEGED_PROCESS_PATCH 1
+
+
typedef struct ngx_shm_zone_s ngx_shm_zone_t;
typedef ngx_int_t (*ngx_shm_zone_init_pt) (ngx_shm_zone_t *zone, void *data);
@@ -81,6 +84,7 @@ struct ngx_cycle_s {
typedef struct {
ngx_flag_t daemon;
ngx_flag_t master;
+ ngx_flag_t privileged_agent;
ngx_msec_t timer_resolution;
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index 7cee1c5..c4f70d6 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -15,6 +15,8 @@ static void ngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n,
ngx_int_t type);
static void ngx_start_cache_manager_processes(ngx_cycle_t *cycle,
ngx_uint_t respawn);
+static void ngx_start_privileged_agent_processes(ngx_cycle_t *cycle,
+ ngx_uint_t respawn);
static void ngx_pass_open_channel(ngx_cycle_t *cycle);
static void ngx_signal_worker_processes(ngx_cycle_t *cycle, int signo);
static ngx_uint_t ngx_reap_children(ngx_cycle_t *cycle);
@@ -24,6 +26,7 @@ static void ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker);
static void ngx_worker_process_exit(ngx_cycle_t *cycle);
static void ngx_channel_handler(ngx_event_t *ev);
static void ngx_cache_manager_process_cycle(ngx_cycle_t *cycle, void *data);
+static void ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data);
static void ngx_cache_manager_process_handler(ngx_event_t *ev);
static void ngx_cache_loader_process_handler(ngx_event_t *ev);
@@ -51,6 +54,8 @@ sig_atomic_t ngx_noaccept;
ngx_uint_t ngx_noaccepting;
ngx_uint_t ngx_restart;
+ngx_uint_t ngx_is_privileged_agent;
+
static u_char master_process[] = "master process";
@@ -130,6 +135,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
ngx_start_worker_processes(cycle, ccf->worker_processes,
NGX_PROCESS_RESPAWN);
ngx_start_cache_manager_processes(cycle, 0);
+ ngx_start_privileged_agent_processes(cycle, 0);
ngx_new_binary = 0;
delay = 0;
@@ -215,6 +221,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
ngx_start_worker_processes(cycle, ccf->worker_processes,
NGX_PROCESS_RESPAWN);
ngx_start_cache_manager_processes(cycle, 0);
+ ngx_start_privileged_agent_processes(cycle, 0);
ngx_noaccepting = 0;
continue;
@@ -234,6 +241,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
ngx_start_worker_processes(cycle, ccf->worker_processes,
NGX_PROCESS_JUST_RESPAWN);
ngx_start_cache_manager_processes(cycle, 1);
+ ngx_start_privileged_agent_processes(cycle, 1);
/* allow new processes to start */
ngx_msleep(100);
@@ -248,6 +256,7 @@ ngx_master_process_cycle(ngx_cycle_t *cycle)
ngx_start_worker_processes(cycle, ccf->worker_processes,
NGX_PROCESS_RESPAWN);
ngx_start_cache_manager_processes(cycle, 0);
+ ngx_start_privileged_agent_processes(cycle, 0);
live = 1;
}
@@ -393,6 +431,26 @@ ngx_start_cache_manager_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
static void
+ngx_start_privileged_agent_processes(ngx_cycle_t *cycle, ngx_uint_t respawn)
+{
+ ngx_core_conf_t *ccf;
+
+ ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx,
+ ngx_core_module);
+
+ if (!ccf->privileged_agent) {
+ return;
+ }
+
+ ngx_spawn_process(cycle, ngx_privileged_agent_process_cycle,
+ "privileged agent process", "privileged agent process",
+ respawn ? NGX_PROCESS_JUST_RESPAWN : NGX_PROCESS_RESPAWN);
+
+ ngx_pass_open_channel(cycle);
+}
+
+
+static void
ngx_pass_open_channel(ngx_cycle_t *cycle)
{
ngx_int_t i;
@@ -794,7 +860,10 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
}
}
- if (geteuid() == 0) {
+ /*
+ * privileged agent process has the same permission as master process
+ */
+ if (!ngx_is_privileged_agent && geteuid() == 0) {
if (setgid(ccf->group) == -1) {
ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
"setgid(%d) failed", ccf->group);
@@ -1149,6 +1216,47 @@ ngx_cache_manager_process_cycle(ngx_cycle_t *cycle, void *data)
static void
+ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
+{
+ char *name = data;
+
+ /*
+ * Set correct process type since closing listening Unix domain socket
+ * in a master process also removes the Unix domain socket file.
+ */
+ ngx_process = NGX_PROCESS_HELPER;
+ ngx_is_privileged_agent = 1;
+
+ ngx_close_listening_sockets(cycle);
+
+ /* Set a moderate number of connections for a helper process. */
+ cycle->connection_n = 512;
+
+ ngx_worker_process_init(cycle, -1);
+
+ ngx_use_accept_mutex = 0;
+
+ ngx_setproctitle(name);
+
+ for ( ;; ) {
+
+ if (ngx_terminate || ngx_quit) {
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
+ ngx_worker_process_exit(cycle);
+ }
+
+ if (ngx_reopen) {
+ ngx_reopen = 0;
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "reopening logs");
+ ngx_reopen_files(cycle, -1);
+ }
+
+ ngx_process_events_and_timers(cycle);
+ }
+}
+
+
+static void
ngx_cache_manager_process_handler(ngx_event_t *ev)
{
time_t next, n;
diff --git a/src/os/unix/ngx_process_cycle.h b/src/os/unix/ngx_process_cycle.h
index 69495d5..5149396 100644
--- a/src/os/unix/ngx_process_cycle.h
+++ b/src/os/unix/ngx_process_cycle.h
@@ -45,6 +45,7 @@ extern ngx_pid_t ngx_new_binary;
extern ngx_uint_t ngx_inherited;
extern ngx_uint_t ngx_daemonized;
extern ngx_uint_t ngx_exiting;
+extern ngx_uint_t ngx_is_privileged_agent;
extern sig_atomic_t ngx_reap;
extern sig_atomic_t ngx_sigio;

73
images/nginx/rootfs/patches/12_nginx-1.25.3-privileged_agent_process_connections.patch Normal file
View file

@ -0,0 +1,73 @@
diff --git a/src/core/nginx.c b/src/core/nginx.c
index 269ff84..48329bd 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -1062,6 +1062,7 @@ ngx_core_module_create_conf(ngx_cycle_t *cycle)
ccf->daemon = NGX_CONF_UNSET;
ccf->master = NGX_CONF_UNSET;
ccf->privileged_agent = NGX_CONF_UNSET;
+ ccf->privileged_agent_connections = NGX_CONF_UNSET_UINT;
ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
ccf->shutdown_timeout = NGX_CONF_UNSET_MSEC;
@@ -1092,6 +1093,7 @@ ngx_core_module_init_conf(ngx_cycle_t *cycle, void *conf)
ngx_conf_init_value(ccf->daemon, 1);
ngx_conf_init_value(ccf->master, 1);
ngx_conf_init_value(ccf->privileged_agent, 0);
+ ngx_conf_init_uint_value(ccf->privileged_agent_connections, 512);
ngx_conf_init_msec_value(ccf->timer_resolution, 0);
ngx_conf_init_msec_value(ccf->shutdown_timeout, 0);
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
index 6a9583e..4469390 100644
--- a/src/core/ngx_cycle.h
+++ b/src/core/ngx_cycle.h
@@ -93,6 +93,7 @@ typedef struct {
ngx_flag_t daemon;
ngx_flag_t master;
ngx_flag_t privileged_agent;
+ ngx_uint_t privileged_agent_connections;
ngx_msec_t timer_resolution;
ngx_msec_t shutdown_timeout;
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index df25f9d..bd259c1 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -1179,6 +1179,7 @@ static void
ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
{
char *name = data;
+ ngx_core_conf_t *ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
/*
* Set correct process type since closing listening Unix domain socket
@@ -1190,7 +1191,7 @@ ngx_privileged_agent_process_cycle(ngx_cycle_t *cycle, void *data)
ngx_close_listening_sockets(cycle);
/* Set a moderate number of connections for a helper process. */
- cycle->connection_n = 512;
+ cycle->connection_n = ccf->privileged_agent_connections;
ngx_worker_process_init(cycle, -1);
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index df25f9d..bd259c1 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -442,6 +442,15 @@
return;
}
+ /* 0 is an illegal value and may result in a core dump later */
+ if (ccf->privileged_agent_connections == 0) {
+ ngx_log_error(NGX_LOG_ALERT, cycle->log, 0,
+ "%ui worker_connection is not enough, "
+ "privileged agent process cannot be spawned",
+ ccf->privileged_agent_connections);
+ return;
+ }
+
ngx_spawn_process(cycle, ngx_privileged_agent_process_cycle,
"privileged agent process", "privileged agent process",
respawn ? NGX_PROCESS_JUST_RESPAWN : NGX_PROCESS_RESPAWN);

12
images/nginx/rootfs/patches/13_nginx-1.25.3-privileged_agent_process_thread_pool.patch Normal file
View file

@ -0,0 +1,12 @@
--- a/src/core/ngx_thread_pool.c
+++ b/src/core/ngx_thread_pool.c
@@ -587,7 +587,8 @@
ngx_thread_pool_conf_t *tcf;
if (ngx_process != NGX_PROCESS_WORKER
- && ngx_process != NGX_PROCESS_SINGLE)
+ && ngx_process != NGX_PROCESS_SINGLE
+ && !ngx_is_privileged_agent)
{
return NGX_OK;
}

0
images/nginx/rootfs/patches/nginx-1.21.4-single_process_graceful_exit.patch → images/nginx/rootfs/patches/14_nginx-1.25.3-single_process_graceful_exit.patch
View file

60
images/nginx/rootfs/patches/15_nginx-1.25.3-intercept_error_log.patch Normal file
View file

@ -0,0 +1,60 @@
diff --git a/src/core/ngx_cycle.h b/src/core/ngx_cycle.h
index c51b7ff..4c335b9 100644
--- a/src/core/ngx_cycle.h
+++ b/src/core/ngx_cycle.h
@@ -22,9 +22,14 @@
#define NGX_DEBUG_POINTS_ABORT 2
+#define HAVE_INTERCEPT_ERROR_LOG_PATCH
+
+
typedef struct ngx_shm_zone_s ngx_shm_zone_t;
typedef ngx_int_t (*ngx_shm_zone_init_pt) (ngx_shm_zone_t *zone, void *data);
+typedef ngx_int_t (*ngx_log_intercept_pt) (ngx_log_t *log, ngx_uint_t level,
+ u_char *buf, size_t len);
struct ngx_shm_zone_s {
void *data;
@@ -75,6 +80,10 @@ struct ngx_cycle_s {
ngx_str_t prefix;
ngx_str_t lock_file;
ngx_str_t hostname;
+
+ ngx_log_intercept_pt intercept_error_log_handler;
+ void *intercept_error_log_data;
+ unsigned entered_logger; /* :1 */
};
diff --git a/src/core/ngx_log.c b/src/core/ngx_log.c
index 8e9408d..ed9b11b 100644
--- a/src/core/ngx_log.c
+++ b/src/core/ngx_log.c
@@ -112,6 +112,8 @@ ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
ngx_uint_t wrote_stderr, debug_connection;
u_char errstr[NGX_MAX_ERROR_STR];
+ ngx_log_intercept_pt log_intercept = NULL;
+
last = errstr + NGX_MAX_ERROR_STR;
p = ngx_cpymem(errstr, ngx_cached_err_log_time.data,
@@ -153,6 +155,16 @@ ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
p = last - NGX_LINEFEED_SIZE;
}
+ if (ngx_cycle) {
+ log_intercept = ngx_cycle->intercept_error_log_handler;
+ }
+
+ if (log_intercept && !ngx_cycle->entered_logger) {
+ ngx_cycle->entered_logger = 1;
+ log_intercept(log, level, errstr, p - errstr);
+ ngx_cycle->entered_logger = 0;
+ }
+
ngx_linefeed(p);
wrote_stderr = 0;

0
images/nginx/rootfs/patches/nginx-1.21.4-upstream_pipelining.patch → images/nginx/rootfs/patches/16_nginx-1.25.3-upstream_pipelining.patch
View file

91
images/nginx/rootfs/patches/17_nginx-1.25.3-no_error_pages.patch Normal file
View file

@ -0,0 +1,91 @@
diff -upr nginx-1.25.3/src/http/ngx_http_core_module.c nginx-1.25.3-patched/src/http/ngx_http_core_module.c
--- nginx-1.25.3/src/http/ngx_http_core_module.c 2017-08-31 18:14:41.000000000 -0700
+++ nginx-1.25.3-patched/src/http/ngx_http_core_module.c 2017-08-31 18:21:31.638098196 -0700
@@ -64,6 +64,8 @@ static char *ngx_http_core_directio(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
static char *ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
+static char *ngx_http_core_no_error_pages(ngx_conf_t *cf, ngx_command_t *cmd,
+ void *conf);
static char *ngx_http_core_open_file_cache(ngx_conf_t *cf, ngx_command_t *cmd,
void *conf);
static char *ngx_http_core_error_log(ngx_conf_t *cf, ngx_command_t *cmd,
@@ -671,6 +673,14 @@ static ngx_command_t ngx_http_core_commands[] = {
0,
NULL },
+ { ngx_string("no_error_pages"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
+ |NGX_CONF_NOARGS,
+ ngx_http_core_no_error_pages,
+ NGX_HTTP_LOC_CONF_OFFSET,
+ 0,
+ NULL },
+
{ ngx_string("post_action"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF
|NGX_CONF_TAKE1,
@@ -3564,7 +3574,6 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
* clcf->types = NULL;
* clcf->default_type = { 0, NULL };
* clcf->error_log = NULL;
- * clcf->error_pages = NULL;
* clcf->client_body_path = NULL;
* clcf->regex = NULL;
* clcf->exact_match = 0;
@@ -3574,6 +3583,7 @@ ngx_http_core_create_loc_conf(ngx_conf_t *cf)
* clcf->keepalive_disable = 0;
*/
+ clcf->error_pages = NGX_CONF_UNSET_PTR;
clcf->client_max_body_size = NGX_CONF_UNSET;
clcf->client_body_buffer_size = NGX_CONF_UNSET_SIZE;
clcf->client_body_timeout = NGX_CONF_UNSET_MSEC;
@@ -3776,9 +3786,7 @@ ngx_http_core_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
}
}
- if (conf->error_pages == NULL && prev->error_pages) {
- conf->error_pages = prev->error_pages;
- }
+ ngx_conf_merge_ptr_value(conf->error_pages, prev->error_pages, NULL);
ngx_conf_merge_str_value(conf->default_type,
prev->default_type, "text/plain");
@@ -4815,6 +4823,10 @@ ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
ngx_http_compile_complex_value_t ccv;
if (clcf->error_pages == NULL) {
+ return "conflicts with \"no_error_pages\"";
+ }
+
+ if (clcf->error_pages == NGX_CONF_UNSET_PTR) {
clcf->error_pages = ngx_array_create(cf->pool, 4,
sizeof(ngx_http_err_page_t));
if (clcf->error_pages == NULL) {
@@ -4920,6 +4932,25 @@ ngx_http_core_error_page(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
}
+static char *
+ngx_http_core_no_error_pages(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
+{
+ ngx_http_core_loc_conf_t *clcf = conf;
+
+ if (clcf->error_pages == NULL) {
+ return "is duplicate";
+ }
+
+ if (clcf->error_pages != NGX_CONF_UNSET_PTR) {
+ return "conflicts with \"error_page\"";
+ }
+
+ clcf->error_pages = NULL;
+
+ return NGX_CONF_OK;
+}
+
+
static char *
ngx_http_core_open_file_cache(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{

36
images/nginx/rootfs/patches/18_nginx-1.25.3-no_Werror.patch Normal file
View file

@ -0,0 +1,36 @@
diff -urp nginx-1.25.3/auto/cc/clang nginx-1.25.3-patched/auto/cc/clang
--- nginx-1.25.3/auto/cc/clang 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.25.3-patched/auto/cc/clang 2014-03-13 20:54:26.241413360 -0700
@@ -89,7 +89,7 @@ CFLAGS="$CFLAGS -Wconditional-uninitiali
CFLAGS="$CFLAGS -Wno-unused-parameter"
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"
diff -urp nginx-1.25.3/auto/cc/gcc nginx-1.25.3-patched/auto/cc/gcc
--- nginx-1.25.3/auto/cc/gcc 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.25.3-patched/auto/cc/gcc 2014-03-13 20:54:13.301355329 -0700
@@ -168,7 +168,7 @@ esac
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"
diff -urp nginx-1.25.3/auto/cc/icc nginx-1.25.3-patched/auto/cc/icc
--- nginx-1.25.3/auto/cc/icc 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.25.3-patched/auto/cc/icc 2014-03-13 20:54:13.301355329 -0700
@@ -115,7 +115,7 @@ case "$NGX_ICC_VER" in
esac
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"

117
images/nginx/rootfs/patches/19_nginx-1.25.3-log_escape_non_ascii.patch Normal file
View file

@ -0,0 +1,117 @@
diff --git a/src/http/modules/ngx_http_log_module.c b/src/http/modules/ngx_http_log_module.c
index 917ed55f..b769dfd3 100644
--- a/src/http/modules/ngx_http_log_module.c
+++ b/src/http/modules/ngx_http_log_module.c
@@ -79,6 +79,8 @@ typedef struct {
time_t open_file_cache_valid;
ngx_uint_t open_file_cache_min_uses;
+ ngx_flag_t escape_non_ascii;
+
ngx_uint_t off; /* unsigned off:1 */
} ngx_http_log_loc_conf_t;
@@ -131,7 +133,8 @@ static size_t ngx_http_log_variable_getlen(ngx_http_request_t *r,
uintptr_t data);
static u_char *ngx_http_log_variable(ngx_http_request_t *r, u_char *buf,
ngx_http_log_op_t *op);
-static uintptr_t ngx_http_log_escape(u_char *dst, u_char *src, size_t size);
+static uintptr_t ngx_http_log_escape(ngx_http_log_loc_conf_t *lcf, u_char *dst,
+ u_char *src, size_t size);
static size_t ngx_http_log_json_variable_getlen(ngx_http_request_t *r,
uintptr_t data);
static u_char *ngx_http_log_json_variable(ngx_http_request_t *r, u_char *buf,
@@ -177,6 +180,13 @@ static ngx_command_t ngx_http_log_commands[] = {
0,
NULL },
+ { ngx_string("log_escape_non_ascii"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_LOC_CONF_OFFSET,
+ offsetof(ngx_http_log_loc_conf_t, escape_non_ascii),
+ NULL },
+
ngx_null_command
};
@@ -935,6 +945,7 @@ static size_t
ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
{
uintptr_t len;
+ ngx_http_log_loc_conf_t *lcf;
ngx_http_variable_value_t *value;
value = ngx_http_get_indexed_variable(r, data);
@@ -943,7 +954,9 @@ ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
return 1;
}
- len = ngx_http_log_escape(NULL, value->data, value->len);
+ lcf = ngx_http_get_module_loc_conf(r, ngx_http_log_module);
+
+ len = ngx_http_log_escape(lcf, NULL, value->data, value->len);
value->escape = len ? 1 : 0;
@@ -954,6 +967,7 @@ ngx_http_log_variable_getlen(ngx_http_request_t *r, uintptr_t data)
static u_char *
ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op)
{
+ ngx_http_log_loc_conf_t *lcf;
ngx_http_variable_value_t *value;
value = ngx_http_get_indexed_variable(r, op->data);
@@ -967,16 +981,18 @@ ngx_http_log_variable(ngx_http_request_t *r, u_char *buf, ngx_http_log_op_t *op)
return ngx_cpymem(buf, value->data, value->len);
} else {
- return (u_char *) ngx_http_log_escape(buf, value->data, value->len);
+ lcf = ngx_http_get_module_loc_conf(r, ngx_http_log_module);
+ return (u_char *) ngx_http_log_escape(lcf, buf, value->data, value->len);
}
}
static uintptr_t
-ngx_http_log_escape(u_char *dst, u_char *src, size_t size)
+ngx_http_log_escape(ngx_http_log_loc_conf_t *lcf, u_char *dst, u_char *src,
+ size_t size)
{
- ngx_uint_t n;
- static u_char hex[] = "0123456789ABCDEF";
+ ngx_uint_t n;
+ static u_char hex[] = "0123456789ABCDEF";
static uint32_t escape[] = {
0xffffffff, /* 1111 1111 1111 1111 1111 1111 1111 1111 */
@@ -996,6 +1012,12 @@ ngx_http_log_escape(u_char *dst, u_char *src, size_t size)
0xffffffff, /* 1111 1111 1111 1111 1111 1111 1111 1111 */
};
+ if (lcf->escape_non_ascii) {
+ ngx_memset(&escape[4], 0xff, sizeof(uint32_t) * 4);
+
+ } else {
+ ngx_memzero(&escape[4], sizeof(uint32_t) * 4);
+ }
if (dst == NULL) {
@@ -1120,6 +1142,7 @@ ngx_http_log_create_loc_conf(ngx_conf_t *cf)
}
conf->open_file_cache = NGX_CONF_UNSET_PTR;
+ conf->escape_non_ascii = NGX_CONF_UNSET;
return conf;
}
@@ -1135,6 +1158,8 @@ ngx_http_log_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_http_log_fmt_t *fmt;
ngx_http_log_main_conf_t *lmcf;
+ ngx_conf_merge_value(conf->escape_non_ascii, prev->escape_non_ascii, 1);
+
if (conf->open_file_cache == NGX_CONF_UNSET_PTR) {
conf->open_file_cache = prev->open_file_cache;

4
images/nginx/rootfs/patches/nginx-1.21.4-proxy_host_port_vars.patch → images/nginx/rootfs/patches/20_nginx-1.25.3-proxy_host_port_vars.patch
View file

@ -1,5 +1,5 @@
--- nginx-1.21.4/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
+++ nginx-1.21.4-patched/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
--- nginx-1.25.3/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
+++ nginx-1.25.3-patched/src/http/modules/ngx_http_proxy_module.c 2017-07-16 14:02:51.000000000 +0800
@@ -793,13 +793,13 @@ static ngx_keyval_t ngx_http_proxy_cach
static ngx_http_variable_t ngx_http_proxy_vars[] = {

0
images/nginx/rootfs/patches/nginx-1.21.4-cache_manager_exit.patch → images/nginx/rootfs/patches/21_nginx-1.25.3-cache_manager_exit.patch
View file

4
images/nginx/rootfs/patches/nginx-1.21.4-larger_max_error_str.patch → images/nginx/rootfs/patches/22_nginx-1.25.3-larger_max_error_str.patch
View file

@ -1,5 +1,5 @@
--- nginx-1.21.4/src/core/ngx_log.h 2013-10-08 05:07:14.000000000 -0700
+++ nginx-1.21.4-patched/src/core/ngx_log.h 2013-12-05 20:35:35.996236720 -0800
--- nginx-1.25.3/src/core/ngx_log.h 2013-10-08 05:07:14.000000000 -0700
+++ nginx-1.25.3-patched/src/core/ngx_log.h 2013-12-05 20:35:35.996236720 -0800
@@ -64,7 +64,9 @@ struct ngx_log_s {
};

26
images/nginx/rootfs/patches/23_nginx-1.25.3-pcre_conf_opt.patch Normal file
View file

@ -0,0 +1,26 @@
# HG changeset patch
# User Yichun Zhang <agentzh@gmail.com>
# Date 1386694955 28800
# Node ID 9ba6b149669f1f02eeb4cdc0ebd364a949b5c469
# Parent 30e806b8636af5fd3f03ec17df24801f390f7511
Configure: added new option --with-pcre-conf-opt=OPTIONS.
diff -r 30e806b8636a -r 9ba6b149669f auto/options
--- a/auto/options Mon Dec 09 10:16:44 2013 +0400
+++ b/auto/options Tue Dec 10 09:02:35 2013 -0800
@@ -286,6 +286,7 @@
--with-pcre) USE_PCRE=YES ;;
--with-pcre=*) PCRE="$value" ;;
--with-pcre-opt=*) PCRE_OPT="$value" ;;
+ --with-pcre-conf-opt=*) PCRE_CONF_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
--with-openssl=*) OPENSSL="$value" ;;
@@ -441,6 +442,7 @@
--with-pcre force PCRE library usage
--with-pcre=DIR set path to PCRE library sources
--with-pcre-opt=OPTIONS set additional build options for PCRE
+ --with-pcre-conf-opt=OPTIONS set additional configure options for PCRE
--with-pcre-jit build PCRE with JIT compilation support
--with-md5=DIR set path to md5 library sources

11
images/nginx/rootfs/patches/24_nginx-1.25.3-always_enable_cc_feature_tests.patch Normal file
View file

@ -0,0 +1,11 @@
--- nginx-1.25.3/auto/cc/conf 2015-10-30 22:47:50.000000000 +0800
+++ nginx-1.25.3-patched/auto/cc/conf 2015-11-02 12:23:05.385156987 +0800
@@ -144,7 +144,7 @@ fi
CFLAGS="$CFLAGS $NGX_CC_OPT"
NGX_TEST_LD_OPT="$NGX_LD_OPT"
-if [ "$NGX_PLATFORM" != win32 ]; then
+if [ 1 ]; then
if test -n "$NGX_LD_OPT"; then
ngx_feature=--with-ld-opt=\"$NGX_LD_OPT\"

0
images/nginx/rootfs/patches/nginx-1.21.4-ssl_cert_cb_yield.patch → images/nginx/rootfs/patches/25_nginx-1.25.3-ssl_cert_cb_yield.patch
View file

0
images/nginx/rootfs/patches/nginx-1.21.4-ssl_sess_cb_yield.patch → images/nginx/rootfs/patches/26_nginx-1.25.3-ssl_sess_cb_yield.patch
View file

38
images/nginx/rootfs/patches/27_nginx-1.25.3-ssl_client_hello_cb_yield.patch Normal file
View file

@ -0,0 +1,38 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 8ba30e58..2b2db95c 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1712,6 +1712,9 @@ ngx_ssl_handshake(ngx_connection_t *c)
if (sslerr == SSL_ERROR_WANT_X509_LOOKUP
# ifdef SSL_ERROR_PENDING_SESSION
|| sslerr == SSL_ERROR_PENDING_SESSION
+# endif
+# ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
+ || sslerr == SSL_ERROR_WANT_CLIENT_HELLO_CB
# endif
)
{
@@ -1889,6 +1892,23 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
}
#endif
+#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
+ if (sslerr == SSL_ERROR_WANT_CLIENT_HELLO_CB) {
+ c->read->handler = ngx_ssl_handshake_handler;
+ c->write->handler = ngx_ssl_handshake_handler;
+
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ return NGX_AGAIN;
+ }
+#endif
+
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
c->ssl->no_wait_shutdown = 1;

0
images/nginx/rootfs/patches/nginx-1.21.4-upstream_timeout_fields.patch → images/nginx/rootfs/patches/28_nginx-1.25.3-upstream_timeout_fields.patch
View file

60
images/nginx/rootfs/patches/29_nginx-1.25.3-safe_resolver_ipv6_option.patch Normal file
View file

@ -0,0 +1,60 @@
# HG changeset patch
# User Thibault Charbonnier <thibaultcha@fastmail.com>
# Date 1481847421 28800
# Thu Dec 15 16:17:01 2016 -0800
# Node ID 8bf038fe006fd8ae253d6b41fc6cf109a8912d3e
# Parent a3dc657f4e9530623683e6b85bd7492662e4dc47
Resolver: ignore ipv6=off resolver option when no ipv6 support
Makes the resolver directive more robust: we only error out when ipv6
resolution is desired but not supported (ipv6=on).
use case 1: some configurations are sometimes re-used between builds with and
without ipv6 support. This patch avoids the need to remove the "ipv6=off" flag.
use case 2: currently, some tools rely on the --with-ipv6 configure option from
"nginx -V" to determine if ipv6 resolution should be disabled in some cases.
With this option disappearing in Nginx 1.11.5, this patch would allow such tools
to assume "ipv6=off" to be safe regardless of ipv6 support in the current
build.
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index dade1846..5a3f0aa4 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -425,7 +425,6 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
continue;
}
-#if (NGX_HAVE_INET6)
if (ngx_strncmp(names[i].data, "ipv4=", 5) == 0) {
if (ngx_strcmp(&names[i].data[5], "on") == 0) {
@@ -446,10 +445,19 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
if (ngx_strncmp(names[i].data, "ipv6=", 5) == 0) {
if (ngx_strcmp(&names[i].data[5], "on") == 0) {
+#if (NGX_HAVE_INET6)
r->ipv6 = 1;
+#else
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "no ipv6 support but \"%V\" in resolver",
+ &names[i]);
+ return NULL;
+#endif
} else if (ngx_strcmp(&names[i].data[5], "off") == 0) {
+#if (NGX_HAVE_INET6)
r->ipv6 = 0;
+#endif
} else {
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
@@ -459,7 +467,6 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_str_t *names, ngx_uint_t n)
continue;
}
-#endif
#if !(NGX_WIN32)
if (ngx_strncmp(names[i].data, "local=", 6) == 0) {

0
images/nginx/rootfs/patches/nginx-1.21.4-socket_cloexec.patch → images/nginx/rootfs/patches/30_nginx-1.25.3-socket_cloexec.patch
View file

0
images/nginx/rootfs/patches/nginx-1.21.4-reuseport_close_unused_fds.patch → images/nginx/rootfs/patches/31_nginx-1.25.3-reuseport_close_unused_fds.patch
View file

20
images/nginx/rootfs/patches/nginx-1.21.4-hash_overflow.patch
View file

@ -1,20 +0,0 @@
# HG changeset patch
# User Yichun Zhang <agentzh@gmail.com>
# Date 1412276417 25200
# Thu Oct 02 12:00:17 2014 -0700
# Node ID 4032b992f23b054c1a2cfb0be879330d2c6708e5
# Parent 1ff0f68d9376e3d184d65814a6372856bf65cfcd
Hash: buffer overflow might happen when exceeding the pre-configured limits.
diff -r 1ff0f68d9376 -r 4032b992f23b src/core/ngx_hash.c
--- a/src/core/ngx_hash.c Tue Sep 30 15:50:28 2014 -0700
+++ b/src/core/ngx_hash.c Thu Oct 02 12:00:17 2014 -0700
@@ -312,6 +312,8 @@ ngx_hash_init(ngx_hash_init_t *hinit, ng
continue;
}
+ size--;
+
ngx_log_error(NGX_LOG_WARN, hinit->pool->log, 0,
"could not build optimal %s, you should increase "
"either %s_max_size: %i or %s_bucket_size: %i; "

57
images/nginx/rootfs/patches/nginx-1.21.4-http2.patch
View file

@ -1,57 +0,0 @@
#commit 6ceef192e7af1c507826ac38a2d43f08bf265fb9
#repository: https://github.com/nginx/nginx
#Author: Maxim Dounin <mdounin@mdounin.ru>
#Date: Tue Oct 10 15:13:39 2023 +0300
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 7c05ff1e7..410a8be24 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -347,6 +347,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
h2c->blocked = 1;
+ h2c->new_streams = 0;
if (c->close) {
c->close = 0;
@@ -1284,6 +1285,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
goto rst_stream;
}
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many streams at once");
+
+ status = NGX_HTTP_V2_REFUSED_STREAM;
+ goto rst_stream;
+ }
+
if (!h2c->settings_ack
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
@@ -1349,6 +1358,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
rst_stream:
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many refused streams");
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
+ }
+
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
}
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
index cb9014ccf..6751b3026 100644
--- a/src/http/v2/ngx_http_v2.h
+++ b/src/http/v2/ngx_http_v2.h
@@ -131,6 +131,8 @@ struct ngx_http_v2_connection_s {
ngx_uint_t processing;
ngx_uint_t frames;
ngx_uint_t idle;
+ ngx_uint_t new_streams;
+ ngx_uint_t refused_streams;
ngx_uint_t priority_limit;
size_t send_window;

36
images/nginx/rootfs/patches/nginx-1.21.4-no_Werror.patch
View file

@ -1,36 +0,0 @@
diff -urp nginx-1.21.4/auto/cc/clang nginx-1.21.4-patched/auto/cc/clang
--- nginx-1.21.4/auto/cc/clang 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.21.4-patched/auto/cc/clang 2014-03-13 20:54:26.241413360 -0700
@@ -89,7 +89,7 @@ CFLAGS="$CFLAGS -Wconditional-uninitiali
CFLAGS="$CFLAGS -Wno-unused-parameter"
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"
diff -urp nginx-1.21.4/auto/cc/gcc nginx-1.21.4-patched/auto/cc/gcc
--- nginx-1.21.4/auto/cc/gcc 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.21.4-patched/auto/cc/gcc 2014-03-13 20:54:13.301355329 -0700
@@ -168,7 +168,7 @@ esac
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"
diff -urp nginx-1.21.4/auto/cc/icc nginx-1.21.4-patched/auto/cc/icc
--- nginx-1.21.4/auto/cc/icc 2014-03-04 03:39:24.000000000 -0800
+++ nginx-1.21.4-patched/auto/cc/icc 2014-03-13 20:54:13.301355329 -0700
@@ -115,7 +115,7 @@ case "$NGX_ICC_VER" in
esac
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"