Merge branch 'nginx' (nginx-1.15.3). Change-Id: Ie2e2a24563cd4407d35089fc03d44b635dd37695 Signed-off-by: Piotr Sikora <piotrsikora@google.com>
diff --git a/.hgtags b/.hgtags index 9b86365..a4f1a21 100644 --- a/.hgtags +++ b/.hgtags
@@ -428,3 +428,4 @@ 990b3e885636d763b97ed02d0d2cfc161a4e0c09 release-1.15.0 4189160cb946bb38d0bc0a452b5eb4cdd8979fb5 release-1.15.1 b234199c7ed8a156a6bb98f7ff58302c857c954f release-1.15.2 +28b3e17ca7eba1e6a0891afde0e4bc5bcc99c861 release-1.15.3
diff --git a/BUILD b/BUILD index e4da9ec..9253e79 100644 --- a/BUILD +++ b/BUILD
@@ -1535,5 +1535,5 @@ preinst = "@nginx_pkgoss//:debian_preinst", prerm = "@nginx_pkgoss//:debian_prerm", section = "httpd", - version = "1.15.2", + version = "1.15.3", )
diff --git a/auto/lib/google-perftools/conf b/auto/lib/google-perftools/conf index 7c350dc..ec03662 100644 --- a/auto/lib/google-perftools/conf +++ b/auto/lib/google-perftools/conf
@@ -9,7 +9,8 @@ ngx_feature_incs= ngx_feature_path= ngx_feature_libs="-lprofiler" - ngx_feature_test="ProfilerStop()" + ngx_feature_test="void ProfilerStop(void); + ProfilerStop()" . $NGX_AUTO/feature
diff --git a/auto/lib/libgd/conf b/auto/lib/libgd/conf index 2025396..7e6ceb3 100644 --- a/auto/lib/libgd/conf +++ b/auto/lib/libgd/conf
@@ -9,7 +9,8 @@ ngx_feature_incs="#include <gd.h>" ngx_feature_path= ngx_feature_libs="-lgd" - ngx_feature_test="gdImagePtr img = gdImageCreateFromGifPtr(1, NULL);" + ngx_feature_test="gdImagePtr img = gdImageCreateFromGifPtr(1, NULL); + (void) img" . $NGX_AUTO/feature @@ -76,8 +77,9 @@ ngx_feature="GD WebP support" ngx_feature_name="NGX_HAVE_GD_WEBP" - ngx_feature_test="gdImagePtr img = gdImageCreateFromWebpPtr(1, NULL);" - . auto/feature + ngx_feature_test="gdImagePtr img = gdImageCreateFromWebpPtr(1, NULL); + (void) img" + . $NGX_AUTO/feature else
diff --git a/auto/lib/libxslt/conf b/auto/lib/libxslt/conf index db033d0..f625d01 100644 --- a/auto/lib/libxslt/conf +++ b/auto/lib/libxslt/conf
@@ -16,8 +16,8 @@ ngx_feature_libs="-lxml2 -lxslt" ngx_feature_test="xmlParserCtxtPtr ctxt = NULL; xsltStylesheetPtr sheet = NULL; - xmlDocPtr doc; - doc = xmlParseChunk(ctxt, NULL, 0, 0); + xmlDocPtr doc = NULL; + xmlParseChunk(ctxt, NULL, 0, 0); xsltApplyStylesheet(sheet, doc, NULL);" . $NGX_AUTO/feature
diff --git a/auto/os/linux b/auto/os/linux index c636907..53c03d1 100644 --- a/auto/os/linux +++ b/auto/os/linux
@@ -185,6 +185,8 @@ data.effective = CAP_TO_MASK(CAP_NET_RAW); data.permitted = 0; + (void) header; + (void) data; (void) SYS_capset" . $NGX_AUTO/feature
diff --git a/build.bzl b/build.bzl index df5582b..79f36a8 100644 --- a/build.bzl +++ b/build.bzl
@@ -663,7 +663,7 @@ name = "nginx_pkgoss", build_file_content = _PKGOSS_BUILD_FILE.format(nginx = nginx) + _PKGOSS_BUILD_FILE_TAIL, - commit = "ab499ede5c83dd70d664b01ad1db58b6f3fd22bf", # nginx-1.15.2 + commit = "7f82ec785633480de508d4e61f47f4b62e93760c", # nginx-1.15.3 remote = "https://nginx.googlesource.com/nginx-pkgoss", )
diff --git a/docs/html/50x.html b/docs/html/50x.html index f60f5e7..9071e0a 100644 --- a/docs/html/50x.html +++ b/docs/html/50x.html
@@ -15,7 +15,7 @@ <p>Sorry, the page you are looking for is currently unavailable.<br/> Please try again later.</p> <p>If you are the system administrator of this resource then you should check -the <a href="http://nginx.org/r/error_log">error log</a> for details.</p> +the error log for details.</p> <p><em>Faithfully yours, nginx.</em></p> </body> </html>
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml index bb8948d..d1e37e8 100644 --- a/docs/xml/nginx/changes.xml +++ b/docs/xml/nginx/changes.xml
@@ -5,6 +5,103 @@ <change_log title="nginx"> +<changes ver="1.15.3" date="2018-08-28"> + +<change type="feature"> +<para lang="ru"> +теперь TLSv1.3 можно использовать с BoringSSL. +</para> +<para lang="en"> +now TLSv1.3 can be used with BoringSSL. +</para> +</change> + +<change type="feature"> +<para lang="ru"> +директива ssl_early_data, +сейчас доступна при использовании BoringSSL. +</para> +<para lang="en"> +the "ssl_early_data" directive, +currently available with BoringSSL. +</para> +</change> + +<change type="feature"> +<para lang="ru"> +директивы keepalive_timeout и keepalive_requests +в блоке upstream. +</para> +<para lang="en"> +the "keepalive_timeout" and "keepalive_requests" directives +in the "upstream" block. +</para> +</change> + +<change type="bugfix"> +<para lang="ru"> +модуль ngx_http_dav_module +при копировании файла поверх существующего файла с помощью метода COPY +не обнулял целевой файл. +</para> +<para lang="en"> +the ngx_http_dav_module +did not truncate destination file when copying a file over an existing one +with the COPY method. +</para> +</change> + +<change type="bugfix"> +<para lang="ru"> +модуль ngx_http_dav_module +при перемещении файла между файловыми системами с помощью метода MOVE +устанавливал нулевые права доступа на результирующий файл +и не сохранял время изменения файла. +</para> +<para lang="en"> +the ngx_http_dav_module +used zero access rights on the destination file +and did not preserve file modification time +when moving a file between different file systems with the MOVE method. +</para> +</change> + +<change type="bugfix"> +<para lang="ru"> +модуль ngx_http_dav_module +при копировании файла с помощью метода COPY +для результирующего файла использовал права доступа по умолчанию. +</para> +<para lang="en"> +the ngx_http_dav_module +used default access rights +when copying a file with the COPY method. +</para> +</change> + +<change type="workaround"> +<para lang="ru"> +некоторые клиенты могли не работать при использовании HTTP/2; +ошибка появилась в 1.13.5. +</para> +<para lang="en"> +some clients might not work when using HTTP/2; +the bug had appeared in 1.13.5. +</para> +</change> + +<change type="bugfix"> +<para lang="ru"> +nginx не собирался с LibreSSL 2.8.0. +</para> +<para lang="en"> +nginx could not be built with LibreSSL 2.8.0. +</para> +</change> + +</changes> + + <changes ver="1.15.2" date="2018-07-24"> <change type="feature">
diff --git a/misc/GNUmakefile b/misc/GNUmakefile index 243a18e..73d8bd9 100644 --- a/misc/GNUmakefile +++ b/misc/GNUmakefile
@@ -6,7 +6,7 @@ CC = cl OBJS = objs.msvc8 -OPENSSL = openssl-1.0.2o +OPENSSL = openssl-1.0.2p ZLIB = zlib-1.2.11 PCRE = pcre-8.42
diff --git a/src/core/nginx.h b/src/core/nginx.h index 5433cbd..dadcda6 100644 --- a/src/core/nginx.h +++ b/src/core/nginx.h
@@ -13,8 +13,8 @@ #define NGINX_NAME "nginx" #endif -#define nginx_version 1015002 -#define NGINX_VERSION "1.15.2" +#define nginx_version 1015003 +#define NGINX_VERSION "1.15.3" #define NGINX_VER NGINX_NAME "/" NGINX_VERSION #ifdef NGX_BUILD
diff --git a/src/core/ngx_conf_file.c b/src/core/ngx_conf_file.c index ba454de..e92cd33 100644 --- a/src/core/ngx_conf_file.c +++ b/src/core/ngx_conf_file.c
@@ -656,13 +656,14 @@ } if (last_space) { - if (ch == ' ' || ch == '\t' || ch == CR || ch == LF) { - continue; - } start = b->pos - 1; start_line = cf->conf_file->line; + if (ch == ' ' || ch == '\t' || ch == CR || ch == LF) { + continue; + } + switch (ch) { case ';':
diff --git a/src/core/ngx_file.c b/src/core/ngx_file.c index 3a94089..5678030 100644 --- a/src/core/ngx_file.c +++ b/src/core/ngx_file.c
@@ -796,10 +796,12 @@ { char *buf; off_t size; + time_t time; size_t len; ssize_t n; ngx_fd_t fd, nfd; ngx_int_t rc; + ngx_uint_t access; ngx_file_info_t fi; rc = NGX_ERROR; @@ -814,8 +816,10 @@ goto failed; } - if (cf->size != -1) { + if (cf->size != -1 && cf->access != 0 && cf->time != -1) { size = cf->size; + access = cf->access; + time = cf->time; } else { if (ngx_fd_info(fd, &fi) == NGX_FILE_ERROR) { @@ -825,7 +829,9 @@ goto failed; } - size = ngx_file_size(&fi); + size = (cf->size != -1) ? cf->size : ngx_file_size(&fi); + access = cf->access ? cf->access : ngx_file_access(&fi); + time = (cf->time != -1) ? cf->time : ngx_file_mtime(&fi); } len = cf->buf_size ? cf->buf_size : 65536; @@ -839,8 +845,7 @@ goto failed; } - nfd = ngx_open_file(to, NGX_FILE_WRONLY, NGX_FILE_CREATE_OR_OPEN, - cf->access); + nfd = ngx_open_file(to, NGX_FILE_WRONLY, NGX_FILE_TRUNCATE, access); if (nfd == NGX_INVALID_FILE) { ngx_log_error(NGX_LOG_CRIT, cf->log, ngx_errno, @@ -887,12 +892,10 @@ size -= n; } - if (cf->time != -1) { - if (ngx_set_file_time(to, nfd, cf->time) != NGX_OK) { - ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno, - ngx_set_file_time_n " \"%s\" failed", to); - goto failed; - } + if (ngx_set_file_time(to, nfd, time) != NGX_OK) { + ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno, + ngx_set_file_time_n " \"%s\" failed", to); + goto failed; } rc = NGX_OK;
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index fd9d5bd..9525c36 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c
@@ -331,6 +331,11 @@ } #endif +#ifdef TLS1_3_VERSION + SSL_CTX_set_min_proto_version(ssl->ctx, 0); + SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); +#endif + #ifdef SSL_OP_NO_COMPRESSION SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); #endif @@ -1187,6 +1192,29 @@ ngx_int_t +ngx_ssl_early_data(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable) +{ + if (!enable) { + return NGX_OK; + } + +#ifdef SSL_ERROR_EARLY_DATA_REJECTED + + /* BoringSSL */ + + SSL_CTX_set_early_data_enabled(ssl->ctx, 1); + +#else + ngx_log_error(NGX_LOG_WARN, ssl->log, 0, + "\"ssl_early_data\" is not supported on this platform, " + "ignored"); +#endif + + return NGX_OK; +} + + +ngx_int_t ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable) { if (!enable) { @@ -3645,6 +3673,21 @@ ngx_int_t +ngx_ssl_get_early_data(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) +{ + s->len = 0; + +#ifdef SSL_ERROR_EARLY_DATA_REJECTED + if (SSL_in_early_data(c->ssl->connection)) { + ngx_str_set(s, "1"); + } +#endif + + return NGX_OK; +} + + +ngx_int_t ngx_ssl_get_server_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) { #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h index 3e30905..c9524ad 100644 --- a/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h
@@ -36,8 +36,12 @@ #if (defined LIBRESSL_VERSION_NUMBER && OPENSSL_VERSION_NUMBER == 0x20000000L) #undef OPENSSL_VERSION_NUMBER +#if (LIBRESSL_VERSION_NUMBER >= 0x2080000fL) +#define OPENSSL_VERSION_NUMBER 0x1010000fL +#else #define OPENSSL_VERSION_NUMBER 0x1000107fL #endif +#endif #if (OPENSSL_VERSION_NUMBER >= 0x10100001L) @@ -173,6 +177,8 @@ ngx_array_t *ngx_ssl_read_password_file(ngx_conf_t *cf, ngx_str_t *file); ngx_int_t ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file); ngx_int_t ngx_ssl_ecdh_curve(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *name); +ngx_int_t ngx_ssl_early_data(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_uint_t enable); ngx_int_t ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable); ngx_int_t ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx, @@ -215,6 +221,8 @@ ngx_str_t *s); ngx_int_t ngx_ssl_get_session_reused(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); +ngx_int_t ngx_ssl_get_early_data(ngx_connection_t *c, ngx_pool_t *pool, + ngx_str_t *s); ngx_int_t ngx_ssl_get_server_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); ngx_int_t ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool,
diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c index 55ad9eb..95c7b32 100644 --- a/src/http/modules/ngx_http_dav_module.c +++ b/src/http/modules/ngx_http_dav_module.c
@@ -841,11 +841,9 @@ return NGX_HTTP_INTERNAL_SERVER_ERROR; } - dlcf = ngx_http_get_module_loc_conf(r, ngx_http_dav_module); - cf.size = ngx_file_size(&fi); cf.buf_size = 0; - cf.access = dlcf->access; + cf.access = ngx_file_access(&fi); cf.time = ngx_file_mtime(&fi); cf.log = r->connection->log;
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index 8ea3546..dfff2b8 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c
@@ -237,6 +237,13 @@ offsetof(ngx_http_ssl_srv_conf_t, stapling_verify), NULL }, + { ngx_string("ssl_early_data"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_ssl_srv_conf_t, early_data), + NULL }, + ngx_null_command }; @@ -292,6 +299,10 @@ { ngx_string("ssl_session_reused"), NULL, ngx_http_ssl_variable, (uintptr_t) ngx_ssl_get_session_reused, NGX_HTTP_VAR_CHANGEABLE, 0 }, + { ngx_string("ssl_early_data"), NULL, ngx_http_ssl_variable, + (uintptr_t) ngx_ssl_get_early_data, + NGX_HTTP_VAR_CHANGEABLE|NGX_HTTP_VAR_NOCACHEABLE, 0 }, + { ngx_string("ssl_server_name"), NULL, ngx_http_ssl_variable, (uintptr_t) ngx_ssl_get_server_name, NGX_HTTP_VAR_CHANGEABLE, 0 }, @@ -550,6 +561,7 @@ sscf->enable = NGX_CONF_UNSET; sscf->prefer_server_ciphers = NGX_CONF_UNSET; + sscf->early_data = NGX_CONF_UNSET; sscf->buffer_size = NGX_CONF_UNSET_SIZE; sscf->verify = NGX_CONF_UNSET_UINT; sscf->verify_depth = NGX_CONF_UNSET_UINT; @@ -592,6 +604,8 @@ ngx_conf_merge_value(conf->prefer_server_ciphers, prev->prefer_server_ciphers, 0); + ngx_conf_merge_value(conf->early_data, prev->early_data, 0); + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); @@ -822,6 +836,10 @@ } + if (ngx_ssl_early_data(cf, &conf->ssl, conf->early_data) != NGX_OK) { + return NGX_CONF_ERROR; + } + return NGX_CONF_OK; }
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h index 57f5941..fb3219b 100644 --- a/src/http/modules/ngx_http_ssl_module.h +++ b/src/http/modules/ngx_http_ssl_module.h
@@ -20,6 +20,7 @@ ngx_ssl_t ssl; ngx_flag_t prefer_server_ciphers; + ngx_flag_t early_data; ngx_uint_t protocols;
diff --git a/src/http/modules/ngx_http_upstream_keepalive_module.c b/src/http/modules/ngx_http_upstream_keepalive_module.c index 90a226d..bdc4ae5 100644 --- a/src/http/modules/ngx_http_upstream_keepalive_module.c +++ b/src/http/modules/ngx_http_upstream_keepalive_module.c
@@ -12,6 +12,8 @@ typedef struct { ngx_uint_t max_cached; + ngx_uint_t requests; + ngx_msec_t timeout; ngx_queue_t cache; ngx_queue_t free; @@ -84,6 +86,20 @@ 0, NULL }, + { ngx_string("keepalive_timeout"), + NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1, + ngx_conf_set_msec_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_upstream_keepalive_srv_conf_t, timeout), + NULL }, + + { ngx_string("keepalive_requests"), + NGX_HTTP_UPS_CONF|NGX_CONF_TAKE1, + ngx_conf_set_num_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_upstream_keepalive_srv_conf_t, requests), + NULL }, + ngx_null_command }; @@ -133,6 +149,9 @@ kcf = ngx_http_conf_upstream_srv_conf(us, ngx_http_upstream_keepalive_module); + ngx_conf_init_msec_value(kcf->timeout, 60000); + ngx_conf_init_uint_value(kcf->requests, 100); + if (kcf->original_init_upstream(cf, us) != NGX_OK) { return NGX_ERROR; } @@ -261,6 +280,10 @@ c->write->log = pc->log; c->pool->log = pc->log; + if (c->read->timer_set) { + ngx_del_timer(c->read); + } + pc->connection = c; pc->cached = 1; @@ -298,6 +321,10 @@ goto invalid; } + if (c->requests >= kp->conf->requests) { + goto invalid; + } + if (!u->keepalive) { goto invalid; } @@ -339,10 +366,9 @@ pc->connection = NULL; - if (c->read->timer_set) { - c->read->delayed = 0; - ngx_del_timer(c->read); - } + c->read->delayed = 0; + ngx_add_timer(c->read, kp->conf->timeout); + if (c->write->timer_set) { ngx_del_timer(c->write); } @@ -393,7 +419,7 @@ c = ev->data; - if (c->close) { + if (c->close || c->read->timedout) { goto close; } @@ -486,6 +512,9 @@ * conf->max_cached = 0; */ + conf->timeout = NGX_CONF_UNSET_MSEC; + conf->requests = NGX_CONF_UNSET_UINT; + return conf; } @@ -518,6 +547,8 @@ kcf->max_cached = n; + /* init upstream handler */ + uscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_upstream_module); kcf->original_init_upstream = uscf->peer.init_upstream
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c index 41b4e5e..4fc41de 100644 --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c
@@ -1550,6 +1550,8 @@ c = u->peer.connection; + c->requests++; + c->data = r; c->write->handler = ngx_http_upstream_handler; @@ -2137,7 +2139,7 @@ out = u->request_bufs; if (r->request_body->bufs) { - for (cl = out; cl->next; cl = out->next) { /* void */ } + for (cl = out; cl->next; cl = cl->next) { /* void */ } cl->next = r->request_body->bufs; r->request_body->bufs = NULL; }
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c index e2be480..7b0b6e1 100644 --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c
@@ -271,8 +271,6 @@ h2c->frame_size = NGX_HTTP_V2_DEFAULT_FRAME_SIZE; - h2c->table_update = 1; - h2scf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_v2_module); h2c->concurrent_pushes = h2scf->concurrent_pushes; @@ -2033,13 +2031,6 @@ switch (id) { - case NGX_HTTP_V2_HEADER_TABLE_SIZE_SETTING: - - ngx_log_debug1(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0, - "http2 SETTINGS param HEADER_TABLE_SIZE:%ui " - "(ignored)", value); - break; - case NGX_HTTP_V2_INIT_WINDOW_SIZE_SETTING: if (value > NGX_HTTP_V2_MAX_WINDOW) { @@ -2099,6 +2090,11 @@ h2c->concurrent_pushes = ngx_min(value, h2scf->concurrent_pushes); break; + case NGX_HTTP_V2_HEADER_TABLE_SIZE_SETTING: + + h2c->table_update = 1; + break; + case NGX_HTTP_V2_HEADER_LIST_SIZE_SETTING: ngx_log_debug1(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,