c8-beta-stream-1.24
imports/c8-beta-stream-1.24/nginx-1.24.0-1.module+el8.10.0+21149+ae7d62bd
MSVSphere Packaging Team
7 months ago
commit
4bd7da4e23
@ -0,0 +1,2 @@
|
|||||||
|
SOURCES/nginx-1.24.0.tar.gz
|
||||||
|
SOURCES/nginx-logo.png
|
||||||
@ -0,0 +1,2 @@
|
|||||||
|
fec561c95c0320f1860c0d55a8724cd45e5cc238 SOURCES/nginx-1.24.0.tar.gz
|
||||||
|
e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png
|
||||||
@ -0,0 +1,120 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||||
|
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||||
|
<head>
|
||||||
|
<title>The page is not found</title>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||||
|
<style type="text/css">
|
||||||
|
/*<![CDATA[*/
|
||||||
|
body {
|
||||||
|
background-color: #fff;
|
||||||
|
color: #000;
|
||||||
|
font-size: 0.9em;
|
||||||
|
font-family: sans-serif,helvetica;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
:link {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
:visited {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
a:hover {
|
||||||
|
color: #f50;
|
||||||
|
}
|
||||||
|
h1 {
|
||||||
|
text-align: center;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.6em 2em 0.4em;
|
||||||
|
background-color: #900;
|
||||||
|
color: #fff;
|
||||||
|
font-weight: normal;
|
||||||
|
font-size: 1.75em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h1 strong {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.5em;
|
||||||
|
}
|
||||||
|
h2 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #900;
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-weight: bold;
|
||||||
|
color: #fff;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.5em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h3 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #ff0000;
|
||||||
|
padding: 0.5em;
|
||||||
|
color: #fff;
|
||||||
|
}
|
||||||
|
hr {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
.content {
|
||||||
|
padding: 1em 5em;
|
||||||
|
}
|
||||||
|
.alert {
|
||||||
|
border: 2px solid #000;
|
||||||
|
}
|
||||||
|
|
||||||
|
img {
|
||||||
|
border: 2px solid #fff;
|
||||||
|
padding: 2px;
|
||||||
|
margin: 2px;
|
||||||
|
}
|
||||||
|
a:hover img {
|
||||||
|
border: 2px solid #294172;
|
||||||
|
}
|
||||||
|
.logos {
|
||||||
|
margin: 1em;
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
/*]]>*/
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<h1><strong>nginx error!</strong></h1>
|
||||||
|
|
||||||
|
<div class="content">
|
||||||
|
|
||||||
|
<h3>The page you are looking for is not found.</h3>
|
||||||
|
|
||||||
|
<div class="alert">
|
||||||
|
<h2>Website Administrator</h2>
|
||||||
|
<div class="content">
|
||||||
|
<p>Something has triggered missing webpage on your
|
||||||
|
website. This is the default 404 error page for
|
||||||
|
<strong>nginx</strong> that is distributed with
|
||||||
|
Red Hat Enterprise Linux. It is located
|
||||||
|
<tt>/usr/share/nginx/html/404.html</tt></p>
|
||||||
|
|
||||||
|
<p>You should customize this error page for your own
|
||||||
|
site or edit the <tt>error_page</tt> directive in
|
||||||
|
the <strong>nginx</strong> configuration file
|
||||||
|
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||||
|
|
||||||
|
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="logos">
|
||||||
|
<a href="http://nginx.net/"><img
|
||||||
|
src="nginx-logo.png"
|
||||||
|
alt="[ Powered by nginx ]"
|
||||||
|
width="121" height="32" /></a>
|
||||||
|
<a href="http://www.redhat.com/"><img
|
||||||
|
src="poweredby.png"
|
||||||
|
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||||
|
width="88" height="31" /></a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,120 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||||
|
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||||
|
<head>
|
||||||
|
<title>The page is temporarily unavailable</title>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||||
|
<style type="text/css">
|
||||||
|
/*<![CDATA[*/
|
||||||
|
body {
|
||||||
|
background-color: #fff;
|
||||||
|
color: #000;
|
||||||
|
font-size: 0.9em;
|
||||||
|
font-family: sans-serif,helvetica;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
:link {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
:visited {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
a:hover {
|
||||||
|
color: #f50;
|
||||||
|
}
|
||||||
|
h1 {
|
||||||
|
text-align: center;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.6em 2em 0.4em;
|
||||||
|
background-color: #900;
|
||||||
|
color: #fff;
|
||||||
|
font-weight: normal;
|
||||||
|
font-size: 1.75em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h1 strong {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.5em;
|
||||||
|
}
|
||||||
|
h2 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #900;
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-weight: bold;
|
||||||
|
color: #fff;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.5em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h3 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #ff0000;
|
||||||
|
padding: 0.5em;
|
||||||
|
color: #fff;
|
||||||
|
}
|
||||||
|
hr {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
.content {
|
||||||
|
padding: 1em 5em;
|
||||||
|
}
|
||||||
|
.alert {
|
||||||
|
border: 2px solid #000;
|
||||||
|
}
|
||||||
|
|
||||||
|
img {
|
||||||
|
border: 2px solid #fff;
|
||||||
|
padding: 2px;
|
||||||
|
margin: 2px;
|
||||||
|
}
|
||||||
|
a:hover img {
|
||||||
|
border: 2px solid #294172;
|
||||||
|
}
|
||||||
|
.logos {
|
||||||
|
margin: 1em;
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
/*]]>*/
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<h1><strong>nginx error!</strong></h1>
|
||||||
|
|
||||||
|
<div class="content">
|
||||||
|
|
||||||
|
<h3>The page you are looking for is temporarily unavailable. Please try again later.</h3>
|
||||||
|
|
||||||
|
<div class="alert">
|
||||||
|
<h2>Website Administrator</h2>
|
||||||
|
<div class="content">
|
||||||
|
<p>Something has triggered missing webpage on your
|
||||||
|
website. This is the default error page for
|
||||||
|
<strong>nginx</strong> that is distributed with
|
||||||
|
Red Hat Enterprise Linux. It is located
|
||||||
|
<tt>/usr/share/nginx/html/50x.html</tt></p>
|
||||||
|
|
||||||
|
<p>You should customize this error page for your own
|
||||||
|
site or edit the <tt>error_page</tt> directive in
|
||||||
|
the <strong>nginx</strong> configuration file
|
||||||
|
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||||
|
|
||||||
|
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="logos">
|
||||||
|
<a href="http://nginx.net/"><img
|
||||||
|
src="nginx-logo.png"
|
||||||
|
alt="[ Powered by nginx ]"
|
||||||
|
width="121" height="32" /></a>
|
||||||
|
<a href="http://www.redhat.com/"><img
|
||||||
|
src="poweredby.png"
|
||||||
|
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||||
|
width="88" height="31" /></a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
###############
|
||||||
|
Dynamic modules
|
||||||
|
###############
|
||||||
|
|
||||||
|
Dynamic modules are loaded using the "load_modules" directive. The RPM package
|
||||||
|
for each module has a '.conf' file in the /usr/share/nginx/modules directory.
|
||||||
|
The '.conf' file contains a single "load_modules" directive.
|
||||||
|
|
||||||
|
This means that whenever a new dynamic module is installed, it will
|
||||||
|
automatically be enabled and Nginx will be reloaded.
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
Prevent dynamic modules from being enabled automatically
|
||||||
|
--------------------------------------------------------
|
||||||
|
|
||||||
|
You may want to avoid dynamic modules being enabled automatically. Simply
|
||||||
|
remove this line from the top of /etc/nginx/nginx.conf:
|
||||||
|
|
||||||
|
include /usr/share/nginx/modules/*.conf;
|
||||||
|
|
||||||
@ -0,0 +1,88 @@
|
|||||||
|
#############
|
||||||
|
Upgrade notes
|
||||||
|
#############
|
||||||
|
|
||||||
|
To resolve numerous security flaws, the nginx package was updated to 1.10.x.
|
||||||
|
|
||||||
|
You should review your configuration files in /etc/nginx to determine if there
|
||||||
|
are any incompatibilities. Below is a summary of the main incompatible changes.
|
||||||
|
Some nginx directives have been changed or removed, so you may need to modify
|
||||||
|
your configuration.
|
||||||
|
|
||||||
|
Please see upstream release notes for a complete list of new features,
|
||||||
|
bug fixes, and changes: http://nginx.org/en/CHANGES-1.10
|
||||||
|
One notable feature is support for HTTP/2.
|
||||||
|
|
||||||
|
Nginx gained support for dynamic modules. As part of this update, dynamic
|
||||||
|
modules have been split into subpackages. For the time being these are hard
|
||||||
|
dependencies to aid the upgrade path. When you install nginx, all of these
|
||||||
|
modules are installed and enabled by default:
|
||||||
|
- nginx-mod-http-geoip
|
||||||
|
- nginx-mod-http-image-filter
|
||||||
|
- nginx-mod-http-perl
|
||||||
|
- nginx-mod-http-xslt-filter
|
||||||
|
- nginx-mod-mail
|
||||||
|
- nginx-mod-stream
|
||||||
|
|
||||||
|
Changes with nginx 1.10.x
|
||||||
|
|
||||||
|
*) Change: non-idempotent requests (POST, LOCK, PATCH) are no longer
|
||||||
|
passed to the next server by default if a request has been sent to a
|
||||||
|
backend; the "non_idempotent" parameter of the "proxy_next_upstream"
|
||||||
|
directive explicitly allows retrying such requests.
|
||||||
|
|
||||||
|
*) Change: now the "output_buffers" directive uses two buffers by
|
||||||
|
default.
|
||||||
|
|
||||||
|
*) Change: now nginx limits subrequests recursion, not simultaneous
|
||||||
|
subrequests.
|
||||||
|
|
||||||
|
*) Change: now nginx checks the whole cache key when returning a
|
||||||
|
response from cache.
|
||||||
|
Thanks to Gena Makhomed and Sergey Brester.
|
||||||
|
|
||||||
|
*) Change: the "proxy_downstream_buffer" and "proxy_upstream_buffer"
|
||||||
|
directives of the stream module are replaced with the
|
||||||
|
"proxy_buffer_size" directive.
|
||||||
|
|
||||||
|
*) Change: duplicate "http", "mail", and "stream" blocks are now
|
||||||
|
disallowed.
|
||||||
|
|
||||||
|
*) Change: now SSLv3 protocol is disabled by default.
|
||||||
|
|
||||||
|
*) Change: some long deprecated directives are not supported anymore.
|
||||||
|
|
||||||
|
*) Change: obsolete aio and rtsig event methods have been removed.
|
||||||
|
|
||||||
|
Changes with nginx 1.8.x
|
||||||
|
|
||||||
|
*) Change: the "sendfile" parameter of the "aio" directive is
|
||||||
|
deprecated; now nginx automatically uses AIO to pre-load data for
|
||||||
|
sendfile if both "aio" and "sendfile" directives are used.
|
||||||
|
|
||||||
|
*) Change: now the "If-Modified-Since", "If-Range", etc. client request
|
||||||
|
header lines are passed to a backend while caching if nginx knows in
|
||||||
|
advance that the response will not be cached (e.g., when using
|
||||||
|
proxy_cache_min_uses).
|
||||||
|
|
||||||
|
*) Change: now after proxy_cache_lock_timeout nginx sends a request to a
|
||||||
|
backend with caching disabled; the new directives
|
||||||
|
"proxy_cache_lock_age", "fastcgi_cache_lock_age",
|
||||||
|
"scgi_cache_lock_age", and "uwsgi_cache_lock_age" specify a time
|
||||||
|
after which the lock will be released and another attempt to cache a
|
||||||
|
response will be made.
|
||||||
|
|
||||||
|
*) Change: the "log_format" directive can now be used only at http
|
||||||
|
level.
|
||||||
|
|
||||||
|
*) Change: now nginx takes into account the "Vary" header line in a
|
||||||
|
backend response while caching.
|
||||||
|
|
||||||
|
*) Change: the deprecated "limit_zone" directive is not supported
|
||||||
|
anymore.
|
||||||
|
|
||||||
|
*) Change: now the "stub_status" directive does not require a parameter.
|
||||||
|
|
||||||
|
*) Change: URI escaping now uses uppercase hexadecimal digits.
|
||||||
|
Thanks to Piotr Sikora.
|
||||||
|
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
%_nginx_abiversion @@NGINX_ABIVERSION@@
|
||||||
|
%_nginx_srcdir @@NGINX_SRCDIR@@
|
||||||
|
%_nginx_buildsrcdir nginx-src
|
||||||
|
%_nginx_modsrcdir ..
|
||||||
|
%_nginx_modbuilddir ../%{_vpath_builddir}
|
||||||
|
%nginx_moddir @@NGINX_MODDIR@@
|
||||||
|
%nginx_modconfdir @@NGINX_MODCONFDIR@@
|
||||||
|
|
||||||
|
%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
|
||||||
|
|
||||||
|
%nginx_modconfigure(:-:) \\\
|
||||||
|
%undefine _strict_symbol_defs_build \
|
||||||
|
cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
|
||||||
|
cd "%{_nginx_buildsrcdir}" \
|
||||||
|
nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
|
||||||
|
./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
|
||||||
|
--add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
|
||||||
|
cd -
|
||||||
|
|
||||||
|
%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
|
||||||
|
index aee7a58..bcceecb 100644
|
||||||
|
--- a/src/core/ngx_cycle.c
|
||||||
|
+++ b/src/core/ngx_cycle.c
|
||||||
|
@@ -1108,7 +1108,7 @@ ngx_reopen_files(ngx_cycle_t *cycle, ngx_uid_t user)
|
||||||
|
}
|
||||||
|
|
||||||
|
fd = ngx_open_file(file[i].name.data, NGX_FILE_APPEND,
|
||||||
|
- NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS);
|
||||||
|
+ NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS | 0220);
|
||||||
|
|
||||||
|
ngx_log_debug3(NGX_LOG_DEBUG_EVENT, cycle->log, 0,
|
||||||
|
"reopen file \"%s\", old:%d new:%d",
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL
|
||||||
|
index 7edadcb..2ebb7c4 100644
|
||||||
|
--- a/src/http/modules/perl/Makefile.PL
|
||||||
|
+++ b/src/http/modules/perl/Makefile.PL
|
||||||
|
@@ -14,7 +14,7 @@ WriteMakefile(
|
||||||
|
AUTHOR => 'Igor Sysoev',
|
||||||
|
|
||||||
|
CCFLAGS => "$ENV{NGX_PM_CFLAGS}",
|
||||||
|
- OPTIMIZE => '-O',
|
||||||
|
+ OPTIMIZE => '-O2',
|
||||||
|
|
||||||
|
LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}",
|
||||||
|
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index 7be4fb4..ab3865a 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -727,16 +727,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (!ENGINE_init(engine)) {
|
||||||
|
+ *err = "ENGINE_init() failed";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
*last++ = ':';
|
||||||
|
|
||||||
|
pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
|
||||||
|
|
||||||
|
if (pkey == NULL) {
|
||||||
|
*err = "ENGINE_load_private_key() failed";
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
ENGINE_free(engine);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
ENGINE_free(engine);
|
||||||
|
|
||||||
|
return pkey;
|
||||||
@ -0,0 +1,76 @@
|
|||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index 0a2f260..606b6e2 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -616,6 +616,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
|
||||||
|
X509 *x509, *temp;
|
||||||
|
u_long n;
|
||||||
|
|
||||||
|
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
|
||||||
|
+
|
||||||
|
+#ifndef OPENSSL_NO_ENGINE
|
||||||
|
+
|
||||||
|
+ u_char *p, *last;
|
||||||
|
+ ENGINE *engine;
|
||||||
|
+
|
||||||
|
+ p = cert->data + sizeof("engine:") - 1;
|
||||||
|
+ last = (u_char *) ngx_strchr(p, ':');
|
||||||
|
+
|
||||||
|
+ if (last == NULL) {
|
||||||
|
+ *err = "invalid syntax";
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *last = '\0';
|
||||||
|
+
|
||||||
|
+ engine = ENGINE_by_id((char *) p);
|
||||||
|
+
|
||||||
|
+ if (engine == NULL) {
|
||||||
|
+ *err = "ENGINE_by_id() failed";
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (!ENGINE_init(engine)) {
|
||||||
|
+ *err = "ENGINE_init() failed";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *last++ = ':';
|
||||||
|
+
|
||||||
|
+ struct {
|
||||||
|
+ const char *cert_id;
|
||||||
|
+ X509 *cert;
|
||||||
|
+ } params = { (char *) last, NULL };
|
||||||
|
+
|
||||||
|
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) {
|
||||||
|
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+
|
||||||
|
+ /* set chain to null */
|
||||||
|
+
|
||||||
|
+ *chain = sk_X509_new_null();
|
||||||
|
+ if (*chain == NULL) {
|
||||||
|
+ *err = "sk_X509_new_null() failed";
|
||||||
|
+ X509_free(params.cert);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return params.cert;
|
||||||
|
+
|
||||||
|
+#else
|
||||||
|
+
|
||||||
|
+ *err = "loading \"engine:...\" certificate is not supported";
|
||||||
|
+ return NULL;
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
|
||||||
|
|
||||||
|
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
From b6aa9504cdfb6391d895dcbddc87b9260ea6968c Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||||
|
Date: Wed, 11 Oct 2023 09:59:23 +0200
|
||||||
|
Subject: [PATCH] CVE-2023-44487 - HTTP/2: per-iteration stream handling limit.
|
||||||
|
|
||||||
|
To ensure that attempts to flood servers with many streams are detected
|
||||||
|
early, a limit of no more than 2 * max_concurrent_streams new streams per one
|
||||||
|
event loop iteration was introduced. This limit is applied even if
|
||||||
|
max_concurrent_streams is not yet reached - for example, if corresponding
|
||||||
|
streams are handled synchronously or reset.
|
||||||
|
|
||||||
|
Further, refused streams are now limited to maximum of max_concurrent_streams
|
||||||
|
and 100, similarly to priority_limit initial value, providing some tolerance
|
||||||
|
to clients trying to open several streams at the connection start, yet
|
||||||
|
low tolerance to flooding attempts.
|
||||||
|
---
|
||||||
|
src/http/v2/ngx_http_v2.c | 15 +++++++++++++++
|
||||||
|
src/http/v2/ngx_http_v2.h | 2 ++
|
||||||
|
2 files changed, 17 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
|
||||||
|
index 0e45a7b..253718f 100644
|
||||||
|
--- a/src/http/v2/ngx_http_v2.c
|
||||||
|
+++ b/src/http/v2/ngx_http_v2.c
|
||||||
|
@@ -361,6 +361,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
|
||||||
|
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
|
||||||
|
|
||||||
|
h2c->blocked = 1;
|
||||||
|
+ h2c->new_streams = 0;
|
||||||
|
|
||||||
|
if (c->close) {
|
||||||
|
c->close = 0;
|
||||||
|
@@ -1321,6 +1322,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||||
|
goto rst_stream;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
|
||||||
|
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||||
|
+ "client sent too many streams at once");
|
||||||
|
+
|
||||||
|
+ status = NGX_HTTP_V2_REFUSED_STREAM;
|
||||||
|
+ goto rst_stream;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!h2c->settings_ack
|
||||||
|
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
|
||||||
|
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
|
||||||
|
@@ -1386,6 +1395,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||||
|
|
||||||
|
rst_stream:
|
||||||
|
|
||||||
|
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
|
||||||
|
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||||
|
+ "client sent too many refused streams");
|
||||||
|
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
|
||||||
|
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
|
||||||
|
}
|
||||||
|
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
|
||||||
|
index 70ee287..7593f1c 100644
|
||||||
|
--- a/src/http/v2/ngx_http_v2.h
|
||||||
|
+++ b/src/http/v2/ngx_http_v2.h
|
||||||
|
@@ -124,6 +124,8 @@ struct ngx_http_v2_connection_s {
|
||||||
|
ngx_uint_t processing;
|
||||||
|
ngx_uint_t frames;
|
||||||
|
ngx_uint_t idle;
|
||||||
|
+ ngx_uint_t new_streams;
|
||||||
|
+ ngx_uint_t refused_streams;
|
||||||
|
ngx_uint_t priority_limit;
|
||||||
|
|
||||||
|
ngx_uint_t pushing;
|
||||||
@ -0,0 +1,163 @@
|
|||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index 894a134..0ccd439 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -261,6 +261,8 @@ ngx_ssl_init(ngx_log_t *log)
|
||||||
|
ngx_int_t
|
||||||
|
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||||
|
{
|
||||||
|
+ ngx_uint_t prot = NGX_SSL_NO_PROT;
|
||||||
|
+
|
||||||
|
ssl->ctx = SSL_CTX_new(SSLv23_method());
|
||||||
|
|
||||||
|
if (ssl->ctx == NULL) {
|
||||||
|
@@ -320,49 +322,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||||
|
|
||||||
|
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
|
||||||
|
|
||||||
|
-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL
|
||||||
|
- /* only in 0.9.8m+ */
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx,
|
||||||
|
- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
- if (!(protocols & NGX_SSL_SSLv2)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
|
||||||
|
- }
|
||||||
|
- if (!(protocols & NGX_SSL_SSLv3)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
|
||||||
|
- }
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
|
||||||
|
- }
|
||||||
|
-#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_1)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||||
|
- }
|
||||||
|
+ if (protocols){
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_3
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_3) {
|
||||||
|
+ prot = TLS1_3_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
#ifdef SSL_OP_NO_TLSv1_2
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_2)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||||
|
- }
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_2) {
|
||||||
|
+ prot = TLS1_2_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
-#ifdef SSL_OP_NO_TLSv1_3
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_3)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||||
|
- }
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_1) {
|
||||||
|
+ prot = TLS1_1_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1) {
|
||||||
|
+ prot = TLS1_VERSION;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (prot == NGX_SSL_NO_PROT) {
|
||||||
|
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||||
|
+ "No SSL protocols available [hint: ssl_protocols]");
|
||||||
|
+ return NGX_ERROR;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
-#ifdef SSL_CTX_set_min_proto_version
|
||||||
|
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||||
|
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
|
||||||
|
+ SSL_CTX_set_max_proto_version(ssl->ctx, prot);
|
||||||
|
+
|
||||||
|
+ /* Now, we have to scan for minimal protocol version,
|
||||||
|
+ *without allowing holes between min and max*/
|
||||||
|
+#if SSL_OP_NO_TLSv1_3
|
||||||
|
+ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) {
|
||||||
|
+ prot = TLS1_2_VERSION;
|
||||||
|
+ }
|
||||||
|
#endif
|
||||||
|
|
||||||
|
-#ifdef TLS1_3_VERSION
|
||||||
|
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||||
|
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
+ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) {
|
||||||
|
+ prot = TLS1_1_VERSION;
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_2
|
||||||
|
+ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) {
|
||||||
|
+ prot = TLS1_VERSION;
|
||||||
|
+ }
|
||||||
|
#endif
|
||||||
|
+ SSL_CTX_set_min_proto_version(ssl->ctx, prot);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
#ifdef SSL_OP_NO_COMPRESSION
|
||||||
|
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
|
||||||
|
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||||
|
index 860ea26..7759e1a 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.h
|
||||||
|
+++ b/src/event/ngx_event_openssl.h
|
||||||
|
@@ -166,6 +166,7 @@ typedef struct {
|
||||||
|
} ngx_ssl_session_cache_t;
|
||||||
|
|
||||||
|
|
||||||
|
+#define NGX_SSL_NO_PROT 0x0000
|
||||||
|
#define NGX_SSL_SSLv2 0x0002
|
||||||
|
#define NGX_SSL_SSLv3 0x0004
|
||||||
|
#define NGX_SSL_TLSv1 0x0008
|
||||||
|
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
index 4c4a598..f1fae50 100644
|
||||||
|
--- a/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
@@ -631,10 +631,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
ngx_conf_merge_value(conf->early_data, prev->early_data, 0);
|
||||||
|
ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
|
||||||
|
|
||||||
|
- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET
|
||||||
|
- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
|
||||||
|
- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
|
||||||
|
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
|
||||||
|
NGX_SSL_BUFSIZE);
|
||||||
|
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
index 28737ac..01a04c8 100644
|
||||||
|
--- a/src/mail/ngx_mail_ssl_module.c
|
||||||
|
+++ b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
@@ -359,10 +359,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
ngx_conf_merge_value(conf->prefer_server_ciphers,
|
||||||
|
prev->prefer_server_ciphers, 0);
|
||||||
|
|
||||||
|
- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET
|
||||||
|
- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
|
||||||
|
- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
|
||||||
|
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||||
|
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||||
|
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
index 1ba1825..c692884 100644
|
||||||
|
--- a/src/stream/ngx_stream_ssl_module.c
|
||||||
|
+++ b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
@@ -702,10 +702,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
ngx_conf_merge_value(conf->prefer_server_ciphers,
|
||||||
|
prev->prefer_server_ciphers, 0);
|
||||||
|
|
||||||
|
- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET
|
||||||
|
- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
|
||||||
|
- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
|
||||||
|
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||||
|
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
--- auto/cc/gcc.orig 2007-03-22 08:34:53.000000000 -0600
|
||||||
|
+++ auto/cc/gcc 2007-03-22 08:58:47.000000000 -0600
|
||||||
|
@@ -172,7 +172,9 @@
|
||||||
|
|
||||||
|
|
||||||
|
# stop on warning
|
||||||
|
-CFLAGS="$CFLAGS -Werror"
|
||||||
|
+# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx
|
||||||
|
+# to not compile.
|
||||||
|
+#CFLAGS="$CFLAGS -Werror"
|
||||||
|
|
||||||
|
# debug
|
||||||
|
CFLAGS="$CFLAGS -g"
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
[ ! -f /run/nginx.pid ] && exit 1
|
||||||
|
echo "Start new nginx master..."
|
||||||
|
/bin/systemctl kill --signal=SIGUSR2 nginx.service
|
||||||
|
sleep 5
|
||||||
|
[ ! -f /run/nginx.pid.oldbin ] && sleep 10
|
||||||
|
if [ ! -f /run/nginx.pid.oldbin ]; then
|
||||||
|
echo "Failed to start new nginx master."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "Stop old nginx master gracefully..."
|
||||||
|
oldpid=`/usr/bin/cat /run/nginx.pid.oldbin 2>/dev/null`
|
||||||
|
/bin/kill -s QUIT $oldpid 2>/dev/null
|
||||||
|
sleep 5
|
||||||
|
[ -f /run/nginx.pid.oldbin ] && sleep 10
|
||||||
|
if [ -f /run/nginx.pid.oldbin ]; then
|
||||||
|
echo "Failed to stop old nginx master."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
@ -0,0 +1,151 @@
|
|||||||
|
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
|
||||||
|
.\"
|
||||||
|
.\" Standard preamble:
|
||||||
|
.\" ========================================================================
|
||||||
|
.de Sp \" Vertical space (when we can't use .PP)
|
||||||
|
.if t .sp .5v
|
||||||
|
.if n .sp
|
||||||
|
..
|
||||||
|
.de Vb \" Begin verbatim text
|
||||||
|
.ft CW
|
||||||
|
.nf
|
||||||
|
.ne \\$1
|
||||||
|
..
|
||||||
|
.de Ve \" End verbatim text
|
||||||
|
.ft R
|
||||||
|
.fi
|
||||||
|
..
|
||||||
|
.\" Set up some character translations and predefined strings. \*(-- will
|
||||||
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
||||||
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
||||||
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
||||||
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
||||||
|
.\" nothing in troff, for use with C<>.
|
||||||
|
.tr \(*W-
|
||||||
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
||||||
|
.ie n \{\
|
||||||
|
. ds -- \(*W-
|
||||||
|
. ds PI pi
|
||||||
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
||||||
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
||||||
|
. ds L" ""
|
||||||
|
. ds R" ""
|
||||||
|
. ds C` ""
|
||||||
|
. ds C' ""
|
||||||
|
'br\}
|
||||||
|
.el\{\
|
||||||
|
. ds -- \|\(em\|
|
||||||
|
. ds PI \(*p
|
||||||
|
. ds L" ``
|
||||||
|
. ds R" ''
|
||||||
|
'br\}
|
||||||
|
.\"
|
||||||
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
||||||
|
.ie \n(.g .ds Aq \(aq
|
||||||
|
.el .ds Aq '
|
||||||
|
.\"
|
||||||
|
.\" If the F register is turned on, we'll generate index entries on stderr for
|
||||||
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
||||||
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
||||||
|
.\" output yourself in some meaningful fashion.
|
||||||
|
.ie \nF \{\
|
||||||
|
. de IX
|
||||||
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
||||||
|
..
|
||||||
|
. nr % 0
|
||||||
|
. rr F
|
||||||
|
.\}
|
||||||
|
.el \{\
|
||||||
|
. de IX
|
||||||
|
..
|
||||||
|
.\}
|
||||||
|
.\"
|
||||||
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
||||||
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
||||||
|
. \" fudge factors for nroff and troff
|
||||||
|
.if n \{\
|
||||||
|
. ds #H 0
|
||||||
|
. ds #V .8m
|
||||||
|
. ds #F .3m
|
||||||
|
. ds #[ \f1
|
||||||
|
. ds #] \fP
|
||||||
|
.\}
|
||||||
|
.if t \{\
|
||||||
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
||||||
|
. ds #V .6m
|
||||||
|
. ds #F 0
|
||||||
|
. ds #[ \&
|
||||||
|
. ds #] \&
|
||||||
|
.\}
|
||||||
|
. \" simple accents for nroff and troff
|
||||||
|
.if n \{\
|
||||||
|
. ds ' \&
|
||||||
|
. ds ` \&
|
||||||
|
. ds ^ \&
|
||||||
|
. ds , \&
|
||||||
|
. ds ~ ~
|
||||||
|
. ds /
|
||||||
|
.\}
|
||||||
|
.if t \{\
|
||||||
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
||||||
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
||||||
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
||||||
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
||||||
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
||||||
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
||||||
|
.\}
|
||||||
|
. \" troff and (daisy-wheel) nroff accents
|
||||||
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
||||||
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
||||||
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
||||||
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
||||||
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
||||||
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
||||||
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
||||||
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
||||||
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
||||||
|
. \" corrections for vroff
|
||||||
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
||||||
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
||||||
|
. \" for low resolution devices (crt and lpr)
|
||||||
|
.if \n(.H>23 .if \n(.V>19 \
|
||||||
|
\{\
|
||||||
|
. ds : e
|
||||||
|
. ds 8 ss
|
||||||
|
. ds o a
|
||||||
|
. ds d- d\h'-1'\(ga
|
||||||
|
. ds D- D\h'-1'\(hy
|
||||||
|
. ds th \o'bp'
|
||||||
|
. ds Th \o'LP'
|
||||||
|
. ds ae ae
|
||||||
|
. ds Ae AE
|
||||||
|
.\}
|
||||||
|
.rm #[ #] #H #V #F C
|
||||||
|
.\" ========================================================================
|
||||||
|
.\"
|
||||||
|
.IX Title "NGINX-UPGRADE 8"
|
||||||
|
.TH NGINX-UPGRADE 8 "2012-10-28" " " " "
|
||||||
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
||||||
|
.\" way too many mistakes in technical documents.
|
||||||
|
.if n .ad l
|
||||||
|
.nh
|
||||||
|
.SH "NAME"
|
||||||
|
nginx\-upgrade \- tool to upgrade nginx without any downtime
|
||||||
|
.SH "SYNOPSIS"
|
||||||
|
.IX Header "SYNOPSIS"
|
||||||
|
\&\fInginx-upgrade\fR
|
||||||
|
.SH "DESCRIPTION"
|
||||||
|
.IX Header "DESCRIPTION"
|
||||||
|
This downstream shell script updates nginx without any downtime. After
|
||||||
|
upgrading nginx via the package manager, running this script will create
|
||||||
|
a new nginx master. This master takes over all new requests. The old
|
||||||
|
masters and workers are then gracefully shutdown without breaking any
|
||||||
|
existing connections.
|
||||||
|
.PP
|
||||||
|
For further information, see: <http://nginx.org/en/docs/control.html>
|
||||||
|
.SH "BUGS"
|
||||||
|
.IX Header "BUGS"
|
||||||
|
If you find any bugs, please send an email to the author.
|
||||||
|
.SH "AUTHOR"
|
||||||
|
.IX Header "AUTHOR"
|
||||||
|
Jamie Nguyen <jamielinux@fedoraproject.org>
|
||||||
@ -0,0 +1,83 @@
|
|||||||
|
# For more information on configuration, see:
|
||||||
|
# * Official English Documentation: http://nginx.org/en/docs/
|
||||||
|
# * Official Russian Documentation: http://nginx.org/ru/docs/
|
||||||
|
|
||||||
|
user nginx;
|
||||||
|
worker_processes auto;
|
||||||
|
error_log /var/log/nginx/error.log notice;
|
||||||
|
pid /run/nginx.pid;
|
||||||
|
|
||||||
|
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
|
||||||
|
include /usr/share/nginx/modules/*.conf;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
sendfile on;
|
||||||
|
tcp_nopush on;
|
||||||
|
keepalive_timeout 65;
|
||||||
|
types_hash_max_size 4096;
|
||||||
|
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
# Load modular configuration files from the /etc/nginx/conf.d directory.
|
||||||
|
# See http://nginx.org/en/docs/ngx_core_module.html#include
|
||||||
|
# for more information.
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name _;
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
|
||||||
|
# Load configuration files for the default server block.
|
||||||
|
include /etc/nginx/default.d/*.conf;
|
||||||
|
|
||||||
|
error_page 404 /404.html;
|
||||||
|
location = /404.html {
|
||||||
|
}
|
||||||
|
|
||||||
|
error_page 500 502 503 504 /50x.html;
|
||||||
|
location = /50x.html {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Settings for a TLS enabled server.
|
||||||
|
#
|
||||||
|
# server {
|
||||||
|
# listen 443 ssl http2;
|
||||||
|
# listen [::]:443 ssl http2;
|
||||||
|
# server_name _;
|
||||||
|
# root /usr/share/nginx/html;
|
||||||
|
#
|
||||||
|
# ssl_certificate "/etc/pki/nginx/server.crt";
|
||||||
|
# ssl_certificate_key "/etc/pki/nginx/private/server.key";
|
||||||
|
# ssl_session_cache shared:SSL:1m;
|
||||||
|
# ssl_session_timeout 10m;
|
||||||
|
# ssl_ciphers PROFILE=SYSTEM;
|
||||||
|
# ssl_prefer_server_ciphers on;
|
||||||
|
#
|
||||||
|
# # Load configuration files for the default server block.
|
||||||
|
# include /etc/nginx/default.d/*.conf;
|
||||||
|
#
|
||||||
|
# error_page 404 /404.html;
|
||||||
|
# location = /404.html {
|
||||||
|
# }
|
||||||
|
#
|
||||||
|
# error_page 500 502 503 504 /50x.html;
|
||||||
|
# location = /50x.html {
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
/var/log/nginx/*.log {
|
||||||
|
create 0640 nginx root
|
||||||
|
daily
|
||||||
|
rotate 10
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
compress
|
||||||
|
delaycompress
|
||||||
|
sharedscripts
|
||||||
|
postrotate
|
||||||
|
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true
|
||||||
|
endscript
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,22 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=The nginx HTTP and reverse proxy server
|
||||||
|
After=network-online.target remote-fs.target nss-lookup.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
PIDFile=/run/nginx.pid
|
||||||
|
# Nginx will fail to start if /run/nginx.pid already exists but has the wrong
|
||||||
|
# SELinux context. This might happen when running `nginx -t` from the cmdline.
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1268621
|
||||||
|
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
|
||||||
|
ExecStartPre=/usr/sbin/nginx -t
|
||||||
|
ExecStart=/usr/sbin/nginx
|
||||||
|
ExecReload=/usr/sbin/nginx -s reload
|
||||||
|
KillSignal=SIGQUIT
|
||||||
|
TimeoutStopSec=5
|
||||||
|
KillMode=mixed
|
||||||
|
PrivateTmp=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@ -0,0 +1,2 @@
|
|||||||
|
%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req
|
||||||
|
%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$
|
||||||
@ -0,0 +1,6 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# Generate Requires: nginx(abi) = VERSION
|
||||||
|
echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')"
|
||||||
|
|
||||||
|
exit 0
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue