i9c-beta-stream-1.22
changed/i9c-beta-stream-1.22/nginx-1.22.1-4.module+el9.3.0+19786+caab279e
MSVSphere Packaging Team
1 year ago
commit
c13eccd879
@ -0,0 +1,2 @@
|
|||||||
|
SOURCES/nginx-1.22.1.tar.gz
|
||||||
|
SOURCES/nginx-logo.png
|
||||||
@ -0,0 +1,2 @@
|
|||||||
|
45a89797f7c789287c7f663811efbbd19e84f154 SOURCES/nginx-1.22.1.tar.gz
|
||||||
|
e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
From 00cab63102084b89de0a3494a1d023c4b1d4982b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Felix Kaechele <felix@kaechele.ca>
|
||||||
|
Date: Sun, 7 Jun 2020 12:14:02 -0400
|
||||||
|
Subject: [PATCH 1/2] remove Werror in upstream build scripts
|
||||||
|
|
||||||
|
removes -Werror in upstream build scripts. -Werror conflicts with
|
||||||
|
-D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
|
||||||
|
|
||||||
|
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
|
||||||
|
---
|
||||||
|
auto/cc/gcc | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/auto/cc/gcc b/auto/cc/gcc
|
||||||
|
index a5c5c18..cdbbadb 100644
|
||||||
|
--- a/auto/cc/gcc
|
||||||
|
+++ b/auto/cc/gcc
|
||||||
|
@@ -166,7 +166,9 @@ esac
|
||||||
|
|
||||||
|
|
||||||
|
# stop on warning
|
||||||
|
-CFLAGS="$CFLAGS -Werror"
|
||||||
|
+# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx
|
||||||
|
+# to not compile.
|
||||||
|
+#CFLAGS="$CFLAGS -Werror"
|
||||||
|
|
||||||
|
# debug
|
||||||
|
CFLAGS="$CFLAGS -g"
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -0,0 +1,108 @@
|
|||||||
|
From 62470498cca9a209aa9904668c1949f5229123af Mon Sep 17 00:00:00 2001
|
||||||
|
From: Felix Kaechele <felix@kaechele.ca>
|
||||||
|
Date: Tue, 20 Apr 2021 21:28:18 -0400
|
||||||
|
Subject: [PATCH 2/2] fix PIDFile handling
|
||||||
|
|
||||||
|
Corresponding RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1869026
|
||||||
|
|
||||||
|
Rejected upstream: https://trac.nginx.org/nginx/ticket/1897
|
||||||
|
|
||||||
|
Taken from: https://git.launchpad.net/ubuntu/+source/nginx/tree/debian/patches/nginx-fix-pidfile.patch
|
||||||
|
|
||||||
|
From original patch:
|
||||||
|
Author: Tj <ubuntu@iam.tj>
|
||||||
|
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864
|
||||||
|
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365
|
||||||
|
iLast-Update: 2020-06-24
|
||||||
|
|
||||||
|
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
|
||||||
|
---
|
||||||
|
src/core/nginx.c | 24 +++++++++++++++++++++---
|
||||||
|
src/os/unix/ngx_daemon.c | 8 ++++++--
|
||||||
|
2 files changed, 27 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/core/nginx.c b/src/core/nginx.c
|
||||||
|
index 48a20e9..32c0afe 100644
|
||||||
|
--- a/src/core/nginx.c
|
||||||
|
+++ b/src/core/nginx.c
|
||||||
|
@@ -339,14 +339,21 @@ main(int argc, char *const *argv)
|
||||||
|
ngx_process = NGX_PROCESS_MASTER;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* tell-tale to detect if this is parent or child process */
|
||||||
|
+ ngx_int_t child_pid = NGX_BUSY;
|
||||||
|
+
|
||||||
|
#if !(NGX_WIN32)
|
||||||
|
|
||||||
|
if (ngx_init_signals(cycle->log) != NGX_OK) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* tell-tale that this code has been executed */
|
||||||
|
+ child_pid--;
|
||||||
|
+
|
||||||
|
if (!ngx_inherited && ccf->daemon) {
|
||||||
|
- if (ngx_daemon(cycle->log) != NGX_OK) {
|
||||||
|
+ child_pid = ngx_daemon(cycle->log);
|
||||||
|
+ if (child_pid == NGX_ERROR) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -359,8 +366,19 @@ main(int argc, char *const *argv)
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
- if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
|
||||||
|
- return 1;
|
||||||
|
+ /* If ngx_daemon() returned the child's PID in the parent process
|
||||||
|
+ * after the fork() set ngx_pid to the child_pid, which gets
|
||||||
|
+ * written to the PID file, then exit.
|
||||||
|
+ * For NGX_WIN32 always write the PID file
|
||||||
|
+ * For others, only write it from the parent process */
|
||||||
|
+ if (child_pid < NGX_OK || child_pid > NGX_OK) {
|
||||||
|
+ ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid;
|
||||||
|
+ if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (child_pid > NGX_OK) {
|
||||||
|
+ exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ngx_log_redirect_stderr(cycle) != NGX_OK) {
|
||||||
|
diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c
|
||||||
|
index 385c49b..3719854 100644
|
||||||
|
--- a/src/os/unix/ngx_daemon.c
|
||||||
|
+++ b/src/os/unix/ngx_daemon.c
|
||||||
|
@@ -7,14 +7,17 @@
|
||||||
|
|
||||||
|
#include <ngx_config.h>
|
||||||
|
#include <ngx_core.h>
|
||||||
|
+#include <unistd.h>
|
||||||
|
|
||||||
|
|
||||||
|
ngx_int_t
|
||||||
|
ngx_daemon(ngx_log_t *log)
|
||||||
|
{
|
||||||
|
int fd;
|
||||||
|
+ /* retain the return value for passing back to caller */
|
||||||
|
+ pid_t pid_child = fork();
|
||||||
|
|
||||||
|
- switch (fork()) {
|
||||||
|
+ switch (pid_child) {
|
||||||
|
case -1:
|
||||||
|
ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed");
|
||||||
|
return NGX_ERROR;
|
||||||
|
@@ -23,7 +26,8 @@ ngx_daemon(ngx_log_t *log)
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
- exit(0);
|
||||||
|
+ /* let caller do the exit() */
|
||||||
|
+ return pid_child;
|
||||||
|
}
|
||||||
|
|
||||||
|
ngx_parent = ngx_pid;
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -0,0 +1,88 @@
|
|||||||
|
From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lubos Uhliarik <luhliari@redhat.com>
|
||||||
|
Date: Fri, 30 Apr 2021 13:07:45 +0000
|
||||||
|
Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11)
|
||||||
|
|
||||||
|
---
|
||||||
|
src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++
|
||||||
|
1 file changed, 65 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index d762d6b..270b200 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
|
||||||
|
X509 *x509, *temp;
|
||||||
|
u_long n;
|
||||||
|
|
||||||
|
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
|
||||||
|
+
|
||||||
|
+#ifndef OPENSSL_NO_ENGINE
|
||||||
|
+
|
||||||
|
+ u_char *p, *last;
|
||||||
|
+ ENGINE *engine;
|
||||||
|
+
|
||||||
|
+ p = cert->data + sizeof("engine:") - 1;
|
||||||
|
+ last = (u_char *) ngx_strchr(p, ':');
|
||||||
|
+
|
||||||
|
+ if (last == NULL) {
|
||||||
|
+ *err = "invalid syntax";
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *last = '\0';
|
||||||
|
+
|
||||||
|
+ engine = ENGINE_by_id((char *) p);
|
||||||
|
+
|
||||||
|
+ if (engine == NULL) {
|
||||||
|
+ *err = "ENGINE_by_id() failed";
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (!ENGINE_init(engine)) {
|
||||||
|
+ *err = "ENGINE_init() failed";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *last++ = ':';
|
||||||
|
+
|
||||||
|
+ struct {
|
||||||
|
+ const char *cert_id;
|
||||||
|
+ X509 *cert;
|
||||||
|
+ } params = { (char *) last, NULL };
|
||||||
|
+
|
||||||
|
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) {
|
||||||
|
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+
|
||||||
|
+ /* set chain to null */
|
||||||
|
+
|
||||||
|
+ *chain = sk_X509_new_null();
|
||||||
|
+ if (*chain == NULL) {
|
||||||
|
+ *err = "sk_X509_new_null() failed";
|
||||||
|
+ X509_free(params.cert);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return params.cert;
|
||||||
|
+
|
||||||
|
+#else
|
||||||
|
+
|
||||||
|
+ *err = "loading \"engine:...\" certificate is not supported";
|
||||||
|
+ return NULL;
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
|
||||||
|
|
||||||
|
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
|
||||||
|
--
|
||||||
|
2.26.3
|
||||||
|
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
From 80c0ee172cceaef933ff5a451ec2a16213e03996 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||||
|
Date: Wed, 22 Sep 2021 15:55:39 +0200
|
||||||
|
Subject: [PATCH] Set proper compiler optimalization level (O2) for perl
|
||||||
|
module.
|
||||||
|
|
||||||
|
---
|
||||||
|
src/http/modules/perl/Makefile.PL | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL
|
||||||
|
index 7edadcb..2ebb7c4 100644
|
||||||
|
--- a/src/http/modules/perl/Makefile.PL
|
||||||
|
+++ b/src/http/modules/perl/Makefile.PL
|
||||||
|
@@ -14,7 +14,7 @@ WriteMakefile(
|
||||||
|
AUTHOR => 'Igor Sysoev',
|
||||||
|
|
||||||
|
CCFLAGS => "$ENV{NGX_PM_CFLAGS}",
|
||||||
|
- OPTIMIZE => '-O',
|
||||||
|
+ OPTIMIZE => '-O2',
|
||||||
|
|
||||||
|
LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}",
|
||||||
|
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||||
|
Date: Wed, 22 Sep 2021 16:12:58 +0200
|
||||||
|
Subject: [PATCH] Init openssl engine properly
|
||||||
|
|
||||||
|
---
|
||||||
|
src/event/ngx_event_openssl.c | 8 ++++++++
|
||||||
|
1 file changed, 8 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index 270b200..f813458 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (!ENGINE_init(engine)) {
|
||||||
|
+ *err = "ENGINE_init() failed";
|
||||||
|
+ ENGINE_free(engine);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
*last++ = ':';
|
||||||
|
|
||||||
|
pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
|
||||||
|
|
||||||
|
if (pkey == NULL) {
|
||||||
|
*err = "ENGINE_load_private_key() failed";
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
ENGINE_free(engine);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ ENGINE_finish(engine);
|
||||||
|
ENGINE_free(engine);
|
||||||
|
|
||||||
|
return pkey;
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -0,0 +1,173 @@
|
|||||||
|
From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||||
|
Date: Tue, 21 Jun 2022 13:55:04 +0200
|
||||||
|
Subject: [PATCH] Enable TLSv1.3 by default in nginx
|
||||||
|
|
||||||
|
---
|
||||||
|
src/event/ngx_event_openssl.c | 77 ++++++++++++++------------
|
||||||
|
src/event/ngx_event_openssl.h | 1 +
|
||||||
|
src/http/modules/ngx_http_ssl_module.c | 3 +-
|
||||||
|
src/mail/ngx_mail_ssl_module.c | 3 +-
|
||||||
|
src/stream/ngx_stream_ssl_module.c | 3 +-
|
||||||
|
5 files changed, 46 insertions(+), 41 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index f813458..2e6a6c0 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log)
|
||||||
|
ngx_int_t
|
||||||
|
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||||
|
{
|
||||||
|
+ ngx_uint_t prot = NGX_SSL_NO_PROT;
|
||||||
|
+
|
||||||
|
ssl->ctx = SSL_CTX_new(SSLv23_method());
|
||||||
|
|
||||||
|
if (ssl->ctx == NULL) {
|
||||||
|
@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||||
|
|
||||||
|
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
|
||||||
|
|
||||||
|
-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL
|
||||||
|
- /* only in 0.9.8m+ */
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx,
|
||||||
|
- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
- if (!(protocols & NGX_SSL_SSLv2)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
|
||||||
|
- }
|
||||||
|
- if (!(protocols & NGX_SSL_SSLv3)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
|
||||||
|
- }
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
|
||||||
|
- }
|
||||||
|
-#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_1)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||||
|
- }
|
||||||
|
+ if (protocols){
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_3
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_3) {
|
||||||
|
+ prot = TLS1_3_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
#ifdef SSL_OP_NO_TLSv1_2
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_2)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||||
|
- }
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_2) {
|
||||||
|
+ prot = TLS1_2_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
-#ifdef SSL_OP_NO_TLSv1_3
|
||||||
|
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||||
|
- if (!(protocols & NGX_SSL_TLSv1_3)) {
|
||||||
|
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||||
|
- }
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1_1) {
|
||||||
|
+ prot = TLS1_1_VERSION;
|
||||||
|
+ } else
|
||||||
|
#endif
|
||||||
|
+ if (protocols & NGX_SSL_TLSv1) {
|
||||||
|
+ prot = TLS1_VERSION;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (prot == NGX_SSL_NO_PROT) {
|
||||||
|
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||||
|
+ "No SSL protocols available [hint: ssl_protocols]");
|
||||||
|
+ return NGX_ERROR;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
-#ifdef SSL_CTX_set_min_proto_version
|
||||||
|
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||||
|
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
|
||||||
|
+ SSL_CTX_set_max_proto_version(ssl->ctx, prot);
|
||||||
|
+
|
||||||
|
+ /* Now, we have to scan for minimal protocol version,
|
||||||
|
+ *without allowing holes between min and max*/
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_3
|
||||||
|
+ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) {
|
||||||
|
+ prot = TLS1_2_VERSION;
|
||||||
|
+ }
|
||||||
|
#endif
|
||||||
|
|
||||||
|
-#ifdef TLS1_3_VERSION
|
||||||
|
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||||
|
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_1
|
||||||
|
+ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) {
|
||||||
|
+ prot = TLS1_1_VERSION;
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+#ifdef SSL_OP_NO_TLSv1_2
|
||||||
|
+ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) {
|
||||||
|
+ prot = TLS1_VERSION;
|
||||||
|
+ }
|
||||||
|
#endif
|
||||||
|
+ SSL_CTX_set_min_proto_version(ssl->ctx, prot);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
#ifdef SSL_OP_NO_COMPRESSION
|
||||||
|
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
|
||||||
|
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||||
|
index 329760d..5cee113 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.h
|
||||||
|
+++ b/src/event/ngx_event_openssl.h
|
||||||
|
@@ -152,6 +152,7 @@ typedef struct {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
+#define NGX_SSL_NO_PROT 0x0000
|
||||||
|
#define NGX_SSL_SSLv2 0x0002
|
||||||
|
#define NGX_SSL_SSLv3 0x0004
|
||||||
|
#define NGX_SSL_TLSv1 0x0008
|
||||||
|
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
index a47d696..94f30db 100644
|
||||||
|
--- a/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||||
|
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||||
|
+ 0)
|
||||||
|
|
||||||
|
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
|
||||||
|
NGX_SSL_BUFSIZE);
|
||||||
|
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
index 7eae83e..8328560 100644
|
||||||
|
--- a/src/mail/ngx_mail_ssl_module.c
|
||||||
|
+++ b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
prev->prefer_server_ciphers, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||||
|
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||||
|
+ 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||||
|
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||||
|
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
index d8c0471..cef590d 100644
|
||||||
|
--- a/src/stream/ngx_stream_ssl_module.c
|
||||||
|
+++ b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
prev->prefer_server_ciphers, 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||||
|
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||||
|
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||||
|
+ 0);
|
||||||
|
|
||||||
|
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||||
|
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -0,0 +1,754 @@
|
|||||||
|
diff --git a/contrib/vim/syntax/nginx.vim b/contrib/vim/syntax/nginx.vim
|
||||||
|
index 7d587fc..15b21e2 100644
|
||||||
|
--- a/contrib/vim/syntax/nginx.vim
|
||||||
|
+++ b/contrib/vim/syntax/nginx.vim
|
||||||
|
@@ -617,6 +617,7 @@ syn keyword ngxDirective contained ssl_ocsp
|
||||||
|
syn keyword ngxDirective contained ssl_ocsp_cache
|
||||||
|
syn keyword ngxDirective contained ssl_ocsp_responder
|
||||||
|
syn keyword ngxDirective contained ssl_password_file
|
||||||
|
+syn keyword ngxDirective contained ssl_pass_phrase_dialog
|
||||||
|
syn keyword ngxDirective contained ssl_prefer_server_ciphers
|
||||||
|
syn keyword ngxDirective contained ssl_preread
|
||||||
|
syn keyword ngxDirective contained ssl_protocols
|
||||||
|
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||||
|
index 104e8da..8cf777e 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.c
|
||||||
|
+++ b/src/event/ngx_event_openssl.c
|
||||||
|
@@ -9,9 +9,8 @@
|
||||||
|
#include <ngx_core.h>
|
||||||
|
#include <ngx_event.h>
|
||||||
|
|
||||||
|
-
|
||||||
|
#define NGX_SSL_PASSWORD_BUFFER_SIZE 4096
|
||||||
|
-
|
||||||
|
+#define NGX_PASS_PHRASE_ARG_MAX_LEN 255
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
ngx_uint_t engine; /* unsigned engine:1; */
|
||||||
|
@@ -20,8 +19,8 @@ typedef struct {
|
||||||
|
|
||||||
|
static X509 *ngx_ssl_load_certificate(ngx_pool_t *pool, char **err,
|
||||||
|
ngx_str_t *cert, STACK_OF(X509) **chain);
|
||||||
|
-static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||||
|
- ngx_str_t *key, ngx_array_t *passwords);
|
||||||
|
+static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool,
|
||||||
|
+ char **err, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||||
|
static int ngx_ssl_password_callback(char *buf, int size, int rwflag,
|
||||||
|
void *userdata);
|
||||||
|
static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
|
||||||
|
@@ -88,6 +87,12 @@ static time_t ngx_ssl_parse_time(
|
||||||
|
#endif
|
||||||
|
ASN1_TIME *asn1time, ngx_log_t *log);
|
||||||
|
|
||||||
|
+static int ngx_ssl_read_pstream(const char *cmd, char *buf,
|
||||||
|
+ ngx_int_t bufsize);
|
||||||
|
+
|
||||||
|
+static int ngx_ssl_pass_phrase_callback(char *buf, int bufsize,
|
||||||
|
+ int rwflag, void *u);
|
||||||
|
+
|
||||||
|
static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
|
||||||
|
static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
|
||||||
|
static void ngx_openssl_exit(ngx_cycle_t *cycle);
|
||||||
|
@@ -398,7 +403,7 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||||
|
|
||||||
|
ngx_int_t
|
||||||
|
ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||||
|
- ngx_array_t *keys, ngx_array_t *passwords)
|
||||||
|
+ ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||||
|
{
|
||||||
|
ngx_str_t *cert, *key;
|
||||||
|
ngx_uint_t i;
|
||||||
|
@@ -408,7 +413,7 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||||
|
|
||||||
|
for (i = 0; i < certs->nelts; i++) {
|
||||||
|
|
||||||
|
- if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords)
|
||||||
|
+ if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords, dlg)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_ERROR;
|
||||||
|
@@ -421,12 +426,13 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||||
|
|
||||||
|
ngx_int_t
|
||||||
|
ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
|
||||||
|
- ngx_str_t *key, ngx_array_t *passwords)
|
||||||
|
+ ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||||
|
{
|
||||||
|
char *err;
|
||||||
|
X509 *x509;
|
||||||
|
EVP_PKEY *pkey;
|
||||||
|
STACK_OF(X509) *chain;
|
||||||
|
+ EVP_PKEY *pubkey;
|
||||||
|
|
||||||
|
x509 = ngx_ssl_load_certificate(cf->pool, &err, cert, &chain);
|
||||||
|
if (x509 == NULL) {
|
||||||
|
@@ -516,8 +522,19 @@ ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
- pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords);
|
||||||
|
- if (pkey == NULL) {
|
||||||
|
+ pubkey = X509_get_pubkey(x509);
|
||||||
|
+ if (!pubkey){
|
||||||
|
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||||
|
+ "X509_get_pubkey() failed");
|
||||||
|
+ return NGX_ERROR;
|
||||||
|
+ }
|
||||||
|
+ dlg->cryptosystem = EVP_PKEY_get_base_id(pubkey);
|
||||||
|
+ EVP_PKEY_free(pubkey);
|
||||||
|
+
|
||||||
|
+ pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords, dlg);
|
||||||
|
+ if (ngx_test_config){
|
||||||
|
+ return NGX_OK;
|
||||||
|
+ } else if (pkey == NULL) {
|
||||||
|
if (err != NULL) {
|
||||||
|
ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||||
|
"cannot load certificate key \"%s\": %s",
|
||||||
|
@@ -587,7 +604,7 @@ ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool,
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
- pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords);
|
||||||
|
+ pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords, NULL);
|
||||||
|
if (pkey == NULL) {
|
||||||
|
if (err != NULL) {
|
||||||
|
ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
|
||||||
|
@@ -700,10 +717,81 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
|
||||||
|
return x509;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int
|
||||||
|
+ngx_ssl_read_pstream(const char *cmd, char *buf, ngx_int_t bufsize)
|
||||||
|
+{
|
||||||
|
+ FILE *fp;
|
||||||
|
+ ngx_int_t i;
|
||||||
|
+ char c;
|
||||||
|
+
|
||||||
|
+ fp = popen(cmd, "r");
|
||||||
|
+ if (fp == NULL) {
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ for (i = 0; (c = fgetc(fp)) != EOF &&
|
||||||
|
+ (i < bufsize - 1); i++) {
|
||||||
|
+
|
||||||
|
+ if (c == '\n' || c == '\r'){
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ buf[i] = c;
|
||||||
|
+ }
|
||||||
|
+ buf[i] = '\0';
|
||||||
|
+
|
||||||
|
+ pclose(fp);
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static int
|
||||||
|
+ngx_ssl_pass_phrase_callback(char *buf, int bufsize, int rwflag, void *u)
|
||||||
|
+{
|
||||||
|
+ u_char cmd[NGX_PASS_PHRASE_ARG_MAX_LEN + 1] = {0};
|
||||||
|
+ u_char *cmd_end;
|
||||||
|
+ ngx_ssl_ppdialog_conf_t *dlg = (ngx_ssl_ppdialog_conf_t *)u;
|
||||||
|
+ ngx_str_t *pass_phrase_dialog = dlg->data;
|
||||||
|
+ char cryptosystem[4] = {0};
|
||||||
|
+ int ret;
|
||||||
|
+
|
||||||
|
+ /* remove exec: str from pass_phrase_dialog */
|
||||||
|
+ pass_phrase_dialog->data = pass_phrase_dialog->data + 5;
|
||||||
|
+ pass_phrase_dialog->len = pass_phrase_dialog->len - 5;
|
||||||
|
+
|
||||||
|
+ switch (dlg->cryptosystem){
|
||||||
|
+ case EVP_PKEY_RSA:
|
||||||
|
+ strncpy(cryptosystem, "RSA", 4);
|
||||||
|
+ break;
|
||||||
|
+ case EVP_PKEY_DSA:
|
||||||
|
+ strncpy(cryptosystem, "DSA", 4);
|
||||||
|
+ break;
|
||||||
|
+ case EVP_PKEY_EC:
|
||||||
|
+ strncpy(cryptosystem, "EC", 3);
|
||||||
|
+ break;
|
||||||
|
+ case EVP_PKEY_DH:
|
||||||
|
+ strncpy(cryptosystem, "DH", 3);
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ strncpy(cryptosystem, "UNK", 4);
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ cmd_end = ngx_snprintf(cmd, NGX_PASS_PHRASE_ARG_MAX_LEN, "%V %V %s",
|
||||||
|
+ pass_phrase_dialog, dlg->server, cryptosystem);
|
||||||
|
+ *cmd_end = '\0';
|
||||||
|
+
|
||||||
|
+ ngx_log_stderr(0, "Executing external script: %s\n", cmd);
|
||||||
|
+
|
||||||
|
+ if ((ret = ngx_ssl_read_pstream((char *)cmd, buf, bufsize)) != 0){
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return strlen(buf);
|
||||||
|
+}
|
||||||
|
|
||||||
|
static EVP_PKEY *
|
||||||
|
-ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||||
|
- ngx_str_t *key, ngx_array_t *passwords)
|
||||||
|
+ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||||
|
{
|
||||||
|
BIO *bio;
|
||||||
|
EVP_PKEY *pkey;
|
||||||
|
@@ -791,11 +879,26 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||||
|
tries = 1;
|
||||||
|
pwd = NULL;
|
||||||
|
cb = NULL;
|
||||||
|
+
|
||||||
|
+ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */
|
||||||
|
+ if (dlg && ngx_strncasecmp(dlg->data->data, (u_char *)"exec:", 5) == 0){
|
||||||
|
+ pwd = (void *)dlg;
|
||||||
|
+ cb = ngx_ssl_pass_phrase_callback;
|
||||||
|
+ } else {
|
||||||
|
+ pwd = NULL;
|
||||||
|
+ cb = NULL;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
- for ( ;; ) {
|
||||||
|
+ /* skip decrypting private keys in config test phase to avoid
|
||||||
|
+ asking for pass phase twice */
|
||||||
|
+ if (ngx_test_config){
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
+ for ( ;; ) {
|
||||||
|
pkey = PEM_read_bio_PrivateKey(bio, NULL, cb, pwd);
|
||||||
|
+
|
||||||
|
if (pkey != NULL) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||||
|
index 860ea26..41f4501 100644
|
||||||
|
--- a/src/event/ngx_event_openssl.h
|
||||||
|
+++ b/src/event/ngx_event_openssl.h
|
||||||
|
@@ -74,9 +74,19 @@
|
||||||
|
#define ERR_peek_error_data(d, f) ERR_peek_error_line_data(NULL, NULL, d, f)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#define NGX_SSL_PASS_PHRASE_ARG_MAX_LEN 255
|
||||||
|
+#define NGX_SSL_PASS_PHRASE_DEFAULT_VAL "builtin"
|
||||||
|
+#define NGX_SSL_SERVER_NULL "undefined"
|
||||||
|
|
||||||
|
typedef struct ngx_ssl_ocsp_s ngx_ssl_ocsp_t;
|
||||||
|
|
||||||
|
+typedef struct ngx_ssl_ppdialog_conf_s ngx_ssl_ppdialog_conf_t;
|
||||||
|
+
|
||||||
|
+struct ngx_ssl_ppdialog_conf_s {
|
||||||
|
+ ngx_str_t *data;
|
||||||
|
+ ngx_str_t *server;
|
||||||
|
+ ngx_int_t cryptosystem;
|
||||||
|
+};
|
||||||
|
|
||||||
|
struct ngx_ssl_s {
|
||||||
|
SSL_CTX *ctx;
|
||||||
|
@@ -84,7 +94,6 @@ struct ngx_ssl_s {
|
||||||
|
size_t buffer_size;
|
||||||
|
};
|
||||||
|
|
||||||
|
-
|
||||||
|
struct ngx_ssl_connection_s {
|
||||||
|
ngx_ssl_conn_t *connection;
|
||||||
|
SSL_CTX *session_ctx;
|
||||||
|
@@ -184,9 +193,9 @@ ngx_int_t ngx_ssl_init(ngx_log_t *log);
|
||||||
|
ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data);
|
||||||
|
|
||||||
|
ngx_int_t ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl,
|
||||||
|
- ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords);
|
||||||
|
+ ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||||
|
ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
|
||||||
|
- ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
|
||||||
|
+ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||||
|
ngx_int_t ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool,
|
||||||
|
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
|
||||||
|
|
||||||
|
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
|
||||||
|
index dfe49c5..904263d 100644
|
||||||
|
--- a/src/http/modules/ngx_http_grpc_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_grpc_module.c
|
||||||
|
@@ -4983,7 +4983,7 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
|
||||||
|
if (ngx_ssl_certificate(cf, glcf->upstream.ssl,
|
||||||
|
&glcf->upstream.ssl_certificate->value,
|
||||||
|
&glcf->upstream.ssl_certificate_key->value,
|
||||||
|
- glcf->upstream.ssl_passwords)
|
||||||
|
+ glcf->upstream.ssl_passwords, NULL)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_ERROR;
|
||||||
|
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
|
||||||
|
index 9cc202c..2c938d7 100644
|
||||||
|
--- a/src/http/modules/ngx_http_proxy_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_proxy_module.c
|
||||||
|
@@ -5032,7 +5032,7 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
|
||||||
|
if (ngx_ssl_certificate(cf, plcf->upstream.ssl,
|
||||||
|
&plcf->upstream.ssl_certificate->value,
|
||||||
|
&plcf->upstream.ssl_certificate_key->value,
|
||||||
|
- plcf->upstream.ssl_passwords)
|
||||||
|
+ plcf->upstream.ssl_passwords, NULL)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_ERROR;
|
||||||
|
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
index 4c4a598..a147054 100644
|
||||||
|
--- a/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_ssl_module.c
|
||||||
|
@@ -17,8 +17,9 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
|
||||||
|
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||||
|
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||||
|
|
||||||
|
-#define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9"
|
||||||
|
+static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL);
|
||||||
|
|
||||||
|
+#define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9"
|
||||||
|
|
||||||
|
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
|
||||||
|
static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
|
||||||
|
@@ -53,6 +54,9 @@ static char *ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post,
|
||||||
|
|
||||||
|
static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf);
|
||||||
|
|
||||||
|
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||||
|
+ void *conf);
|
||||||
|
+
|
||||||
|
|
||||||
|
static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = {
|
||||||
|
{ ngx_string("SSLv2"), NGX_SSL_SSLv2 },
|
||||||
|
@@ -296,6 +300,13 @@ static ngx_command_t ngx_http_ssl_commands[] = {
|
||||||
|
offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
|
||||||
|
NULL },
|
||||||
|
|
||||||
|
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||||
|
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
|
||||||
|
+ ngx_conf_set_pass_phrase_dialog,
|
||||||
|
+ NGX_HTTP_SRV_CONF_OFFSET,
|
||||||
|
+ offsetof(ngx_http_ssl_srv_conf_t, pass_phrase_dialog),
|
||||||
|
+ NULL },
|
||||||
|
+
|
||||||
|
ngx_null_command
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -555,7 +566,7 @@ ngx_http_ssl_add_variables(ngx_conf_t *cf)
|
||||||
|
static void *
|
||||||
|
ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
|
||||||
|
{
|
||||||
|
- ngx_http_ssl_srv_conf_t *sscf;
|
||||||
|
+ ngx_http_ssl_srv_conf_t *sscf;
|
||||||
|
|
||||||
|
sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t));
|
||||||
|
if (sscf == NULL) {
|
||||||
|
@@ -577,6 +588,8 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
|
||||||
|
* sscf->ocsp_responder = { 0, NULL };
|
||||||
|
* sscf->stapling_file = { 0, NULL };
|
||||||
|
* sscf->stapling_responder = { 0, NULL };
|
||||||
|
+ * sscf->pass_phrase_dialog = NULL;
|
||||||
|
+ *
|
||||||
|
*/
|
||||||
|
|
||||||
|
sscf->enable = NGX_CONF_UNSET;
|
||||||
|
@@ -608,6 +621,8 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
{
|
||||||
|
ngx_http_ssl_srv_conf_t *prev = parent;
|
||||||
|
ngx_http_ssl_srv_conf_t *conf = child;
|
||||||
|
+ ngx_http_core_srv_conf_t *cscf;
|
||||||
|
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||||
|
|
||||||
|
ngx_pool_cleanup_t *cln;
|
||||||
|
|
||||||
|
@@ -674,6 +689,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
ngx_conf_merge_str_value(conf->stapling_responder,
|
||||||
|
prev->stapling_responder, "");
|
||||||
|
|
||||||
|
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||||
|
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
+
|
||||||
|
conf->ssl.log = cf->log;
|
||||||
|
|
||||||
|
if (conf->enable) {
|
||||||
|
@@ -736,6 +754,30 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
cln->handler = ngx_ssl_cleanup_ctx;
|
||||||
|
cln->data = &conf->ssl;
|
||||||
|
|
||||||
|
+ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */
|
||||||
|
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||||
|
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||||
|
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||||
|
+
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||||
|
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module);
|
||||||
|
+
|
||||||
|
+ dlg.data = &conf->pass_phrase_dialog;
|
||||||
|
+ if (cscf->server_name.len != 0) {
|
||||||
|
+ dlg.server = &cscf->server_name;
|
||||||
|
+ } else {
|
||||||
|
+ dlg.server = &ngx_ssl_server_null;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+
|
||||||
|
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
||||||
|
|
||||||
|
if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
|
||||||
|
@@ -786,7 +828,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
/* configure certificates */
|
||||||
|
|
||||||
|
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||||
|
- conf->certificate_keys, conf->passwords)
|
||||||
|
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_CONF_ERROR;
|
||||||
|
@@ -1335,3 +1377,31 @@ ngx_http_ssl_init(ngx_conf_t *cf)
|
||||||
|
|
||||||
|
return NGX_OK;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+static char *
|
||||||
|
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||||
|
+{
|
||||||
|
+ ngx_http_ssl_srv_conf_t *sscf = conf;
|
||||||
|
+ ngx_str_t *value;
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.data){
|
||||||
|
+ return "is duplicate";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ value = cf->args->elts;
|
||||||
|
+
|
||||||
|
+ sscf->pass_phrase_dialog = value[1];
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||||
|
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
|
||||||
|
index 7ab0f7e..2f83d75 100644
|
||||||
|
--- a/src/http/modules/ngx_http_ssl_module.h
|
||||||
|
+++ b/src/http/modules/ngx_http_ssl_module.h
|
||||||
|
@@ -67,6 +67,8 @@ typedef struct {
|
||||||
|
|
||||||
|
u_char *file;
|
||||||
|
ngx_uint_t line;
|
||||||
|
+
|
||||||
|
+ ngx_str_t pass_phrase_dialog;
|
||||||
|
} ngx_http_ssl_srv_conf_t;
|
||||||
|
|
||||||
|
|
||||||
|
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
|
||||||
|
index e4f721b..61efa99 100644
|
||||||
|
--- a/src/http/modules/ngx_http_uwsgi_module.c
|
||||||
|
+++ b/src/http/modules/ngx_http_uwsgi_module.c
|
||||||
|
@@ -2564,7 +2564,7 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf)
|
||||||
|
if (ngx_ssl_certificate(cf, uwcf->upstream.ssl,
|
||||||
|
&uwcf->upstream.ssl_certificate->value,
|
||||||
|
&uwcf->upstream.ssl_certificate_key->value,
|
||||||
|
- uwcf->upstream.ssl_passwords)
|
||||||
|
+ uwcf->upstream.ssl_passwords, NULL)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_ERROR;
|
||||||
|
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
index 28737ac..728181d 100644
|
||||||
|
--- a/src/mail/ngx_mail_ssl_module.c
|
||||||
|
+++ b/src/mail/ngx_mail_ssl_module.c
|
||||||
|
@@ -13,6 +13,7 @@
|
||||||
|
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||||
|
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||||
|
|
||||||
|
+static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL);
|
||||||
|
|
||||||
|
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
|
||||||
|
static int ngx_mail_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
|
||||||
|
@@ -35,6 +36,8 @@ static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||||
|
static char *ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post,
|
||||||
|
void *data);
|
||||||
|
|
||||||
|
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||||
|
+ void *conf);
|
||||||
|
|
||||||
|
static ngx_conf_enum_t ngx_mail_starttls_state[] = {
|
||||||
|
{ ngx_string("off"), NGX_MAIL_STARTTLS_OFF },
|
||||||
|
@@ -216,6 +219,13 @@ static ngx_command_t ngx_mail_ssl_commands[] = {
|
||||||
|
offsetof(ngx_mail_ssl_conf_t, conf_commands),
|
||||||
|
&ngx_mail_ssl_conf_command_post },
|
||||||
|
|
||||||
|
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||||
|
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
|
||||||
|
+ ngx_conf_set_pass_phrase_dialog,
|
||||||
|
+ NGX_MAIL_SRV_CONF_OFFSET,
|
||||||
|
+ offsetof(ngx_mail_ssl_conf_t, pass_phrase_dialog),
|
||||||
|
+ NULL },
|
||||||
|
+
|
||||||
|
ngx_null_command
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -345,6 +355,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
{
|
||||||
|
ngx_mail_ssl_conf_t *prev = parent;
|
||||||
|
ngx_mail_ssl_conf_t *conf = child;
|
||||||
|
+ ngx_mail_core_srv_conf_t *cscf;
|
||||||
|
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||||
|
|
||||||
|
char *mode;
|
||||||
|
ngx_pool_cleanup_t *cln;
|
||||||
|
@@ -388,6 +400,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
|
||||||
|
ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
|
||||||
|
|
||||||
|
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||||
|
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
|
||||||
|
conf->ssl.log = cf->log;
|
||||||
|
|
||||||
|
@@ -449,6 +463,29 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
cln->handler = ngx_ssl_cleanup_ctx;
|
||||||
|
cln->data = &conf->ssl;
|
||||||
|
|
||||||
|
+ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */
|
||||||
|
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||||
|
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||||
|
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||||
|
+
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||||
|
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ cscf = ngx_mail_conf_get_module_srv_conf(cf, ngx_mail_core_module);
|
||||||
|
+
|
||||||
|
+ dlg.data = &conf->pass_phrase_dialog;
|
||||||
|
+ if (cscf->server_name.len != 0) {
|
||||||
|
+ dlg.server = &cscf->server_name;
|
||||||
|
+ } else {
|
||||||
|
+ dlg.server = &ngx_ssl_server_null;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
|
||||||
|
SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_mail_ssl_alpn_select, NULL);
|
||||||
|
#endif
|
||||||
|
@@ -461,7 +498,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||||
|
- conf->certificate_keys, conf->passwords)
|
||||||
|
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_CONF_ERROR;
|
||||||
|
@@ -745,3 +782,32 @@ ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
|
||||||
|
return NGX_CONF_OK;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+static char *
|
||||||
|
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||||
|
+{
|
||||||
|
+ ngx_mail_ssl_conf_t *sscf = conf;
|
||||||
|
+ ngx_str_t *value;
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.data){
|
||||||
|
+ return "is duplicate";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ value = cf->args->elts;
|
||||||
|
+
|
||||||
|
+ sscf->pass_phrase_dialog = value[1];
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||||
|
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+
|
||||||
|
diff --git a/src/mail/ngx_mail_ssl_module.h b/src/mail/ngx_mail_ssl_module.h
|
||||||
|
index a0a6113..3d87d50 100644
|
||||||
|
--- a/src/mail/ngx_mail_ssl_module.h
|
||||||
|
+++ b/src/mail/ngx_mail_ssl_module.h
|
||||||
|
@@ -57,6 +57,8 @@ typedef struct {
|
||||||
|
|
||||||
|
u_char *file;
|
||||||
|
ngx_uint_t line;
|
||||||
|
+
|
||||||
|
+ ngx_str_t pass_phrase_dialog;
|
||||||
|
} ngx_mail_ssl_conf_t;
|
||||||
|
|
||||||
|
|
||||||
|
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
|
||||||
|
index ed275c0..1747aed 100644
|
||||||
|
--- a/src/stream/ngx_stream_proxy_module.c
|
||||||
|
+++ b/src/stream/ngx_stream_proxy_module.c
|
||||||
|
@@ -2305,7 +2305,7 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
|
||||||
|
if (ngx_ssl_certificate(cf, pscf->ssl,
|
||||||
|
&pscf->ssl_certificate->value,
|
||||||
|
&pscf->ssl_certificate_key->value,
|
||||||
|
- pscf->ssl_passwords)
|
||||||
|
+ pscf->ssl_passwords, NULL)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_ERROR;
|
||||||
|
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
index 1ba1825..ba70547 100644
|
||||||
|
--- a/src/stream/ngx_stream_ssl_module.c
|
||||||
|
+++ b/src/stream/ngx_stream_ssl_module.c
|
||||||
|
@@ -17,6 +17,8 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
|
||||||
|
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||||
|
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||||
|
|
||||||
|
+#define NGX_SSL_STREAM_NAME "NGX_STREAM_SSL_MODULE"
|
||||||
|
+static ngx_str_t ngx_ssl_stream_default_name = ngx_string(NGX_SSL_STREAM_NAME);
|
||||||
|
|
||||||
|
static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);
|
||||||
|
static ngx_int_t ngx_stream_ssl_init_connection(ngx_ssl_t *ssl,
|
||||||
|
@@ -57,6 +59,9 @@ static char *ngx_stream_ssl_alpn(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||||
|
static char *ngx_stream_ssl_conf_command_check(ngx_conf_t *cf, void *post,
|
||||||
|
void *data);
|
||||||
|
|
||||||
|
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||||
|
+ void *conf);
|
||||||
|
+
|
||||||
|
static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf);
|
||||||
|
|
||||||
|
|
||||||
|
@@ -226,6 +231,13 @@ static ngx_command_t ngx_stream_ssl_commands[] = {
|
||||||
|
0,
|
||||||
|
NULL },
|
||||||
|
|
||||||
|
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||||
|
+ NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
|
||||||
|
+ ngx_conf_set_pass_phrase_dialog,
|
||||||
|
+ NGX_STREAM_SRV_CONF_OFFSET,
|
||||||
|
+ offsetof(ngx_stream_ssl_conf_t, pass_phrase_dialog),
|
||||||
|
+ NULL },
|
||||||
|
+
|
||||||
|
ngx_null_command
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -690,6 +702,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
{
|
||||||
|
ngx_stream_ssl_conf_t *prev = parent;
|
||||||
|
ngx_stream_ssl_conf_t *conf = child;
|
||||||
|
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||||
|
|
||||||
|
ngx_pool_cleanup_t *cln;
|
||||||
|
|
||||||
|
@@ -732,6 +745,8 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
|
||||||
|
ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
|
||||||
|
|
||||||
|
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||||
|
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
|
||||||
|
conf->ssl.log = cf->log;
|
||||||
|
|
||||||
|
@@ -779,6 +794,23 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
cln->handler = ngx_ssl_cleanup_ctx;
|
||||||
|
cln->data = &conf->ssl;
|
||||||
|
|
||||||
|
+ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */
|
||||||
|
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||||
|
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||||
|
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||||
|
+
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||||
|
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ dlg.data = &conf->pass_phrase_dialog;
|
||||||
|
+ dlg.server = &ngx_ssl_stream_default_name;
|
||||||
|
+
|
||||||
|
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
||||||
|
SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
|
||||||
|
ngx_stream_ssl_servername);
|
||||||
|
@@ -823,7 +855,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||||
|
/* configure certificates */
|
||||||
|
|
||||||
|
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||||
|
- conf->certificate_keys, conf->passwords)
|
||||||
|
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||||
|
!= NGX_OK)
|
||||||
|
{
|
||||||
|
return NGX_CONF_ERROR;
|
||||||
|
@@ -1209,3 +1241,31 @@ ngx_stream_ssl_init(ngx_conf_t *cf)
|
||||||
|
|
||||||
|
return NGX_OK;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+static char *
|
||||||
|
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||||
|
+{
|
||||||
|
+ ngx_stream_ssl_conf_t *sscf = conf;
|
||||||
|
+ ngx_str_t *value;
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.data){
|
||||||
|
+ return "is duplicate";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ value = cf->args->elts;
|
||||||
|
+
|
||||||
|
+ sscf->pass_phrase_dialog = value[1];
|
||||||
|
+
|
||||||
|
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||||
|
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||||
|
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||||
|
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_ERROR;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return NGX_CONF_OK;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
diff --git a/src/stream/ngx_stream_ssl_module.h b/src/stream/ngx_stream_ssl_module.h
|
||||||
|
index e7c825e..d80daa4 100644
|
||||||
|
--- a/src/stream/ngx_stream_ssl_module.h
|
||||||
|
+++ b/src/stream/ngx_stream_ssl_module.h
|
||||||
|
@@ -56,6 +56,8 @@ typedef struct {
|
||||||
|
|
||||||
|
u_char *file;
|
||||||
|
ngx_uint_t line;
|
||||||
|
+
|
||||||
|
+ ngx_str_t pass_phrase_dialog;
|
||||||
|
} ngx_stream_ssl_conf_t;
|
||||||
|
|
||||||
|
|
||||||
@ -0,0 +1,120 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||||
|
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||||
|
<head>
|
||||||
|
<title>The page is not found</title>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||||
|
<style type="text/css">
|
||||||
|
/*<![CDATA[*/
|
||||||
|
body {
|
||||||
|
background-color: #fff;
|
||||||
|
color: #000;
|
||||||
|
font-size: 0.9em;
|
||||||
|
font-family: sans-serif,helvetica;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
:link {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
:visited {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
a:hover {
|
||||||
|
color: #f50;
|
||||||
|
}
|
||||||
|
h1 {
|
||||||
|
text-align: center;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.6em 2em 0.4em;
|
||||||
|
background-color: #900;
|
||||||
|
color: #fff;
|
||||||
|
font-weight: normal;
|
||||||
|
font-size: 1.75em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h1 strong {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.5em;
|
||||||
|
}
|
||||||
|
h2 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #900;
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-weight: bold;
|
||||||
|
color: #fff;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.5em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h3 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #ff0000;
|
||||||
|
padding: 0.5em;
|
||||||
|
color: #fff;
|
||||||
|
}
|
||||||
|
hr {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
.content {
|
||||||
|
padding: 1em 5em;
|
||||||
|
}
|
||||||
|
.alert {
|
||||||
|
border: 2px solid #000;
|
||||||
|
}
|
||||||
|
|
||||||
|
img {
|
||||||
|
border: 2px solid #fff;
|
||||||
|
padding: 2px;
|
||||||
|
margin: 2px;
|
||||||
|
}
|
||||||
|
a:hover img {
|
||||||
|
border: 2px solid #294172;
|
||||||
|
}
|
||||||
|
.logos {
|
||||||
|
margin: 1em;
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
/*]]>*/
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<h1><strong>nginx error!</strong></h1>
|
||||||
|
|
||||||
|
<div class="content">
|
||||||
|
|
||||||
|
<h3>The page you are looking for is not found.</h3>
|
||||||
|
|
||||||
|
<div class="alert">
|
||||||
|
<h2>Website Administrator</h2>
|
||||||
|
<div class="content">
|
||||||
|
<p>Something has triggered missing webpage on your
|
||||||
|
website. This is the default 404 error page for
|
||||||
|
<strong>nginx</strong> that is distributed with
|
||||||
|
Red Hat Enterprise Linux. It is located
|
||||||
|
<tt>/usr/share/nginx/html/404.html</tt></p>
|
||||||
|
|
||||||
|
<p>You should customize this error page for your own
|
||||||
|
site or edit the <tt>error_page</tt> directive in
|
||||||
|
the <strong>nginx</strong> configuration file
|
||||||
|
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||||
|
|
||||||
|
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="logos">
|
||||||
|
<a href="http://nginx.net/"><img
|
||||||
|
src="nginx-logo.png"
|
||||||
|
alt="[ Powered by nginx ]"
|
||||||
|
width="121" height="32" /></a>
|
||||||
|
<a href="http://www.redhat.com/"><img
|
||||||
|
src="poweredby.png"
|
||||||
|
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||||
|
width="88" height="31" /></a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,120 @@
|
|||||||
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||||
|
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||||
|
<head>
|
||||||
|
<title>The page is temporarily unavailable</title>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||||
|
<style type="text/css">
|
||||||
|
/*<![CDATA[*/
|
||||||
|
body {
|
||||||
|
background-color: #fff;
|
||||||
|
color: #000;
|
||||||
|
font-size: 0.9em;
|
||||||
|
font-family: sans-serif,helvetica;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
:link {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
:visited {
|
||||||
|
color: #c00;
|
||||||
|
}
|
||||||
|
a:hover {
|
||||||
|
color: #f50;
|
||||||
|
}
|
||||||
|
h1 {
|
||||||
|
text-align: center;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.6em 2em 0.4em;
|
||||||
|
background-color: #900;
|
||||||
|
color: #fff;
|
||||||
|
font-weight: normal;
|
||||||
|
font-size: 1.75em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h1 strong {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.5em;
|
||||||
|
}
|
||||||
|
h2 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #900;
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-weight: bold;
|
||||||
|
color: #fff;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0.5em;
|
||||||
|
border-bottom: 2px solid #000;
|
||||||
|
}
|
||||||
|
h3 {
|
||||||
|
text-align: center;
|
||||||
|
background-color: #ff0000;
|
||||||
|
padding: 0.5em;
|
||||||
|
color: #fff;
|
||||||
|
}
|
||||||
|
hr {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
.content {
|
||||||
|
padding: 1em 5em;
|
||||||
|
}
|
||||||
|
.alert {
|
||||||
|
border: 2px solid #000;
|
||||||
|
}
|
||||||
|
|
||||||
|
img {
|
||||||
|
border: 2px solid #fff;
|
||||||
|
padding: 2px;
|
||||||
|
margin: 2px;
|
||||||
|
}
|
||||||
|
a:hover img {
|
||||||
|
border: 2px solid #294172;
|
||||||
|
}
|
||||||
|
.logos {
|
||||||
|
margin: 1em;
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
/*]]>*/
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<h1><strong>nginx error!</strong></h1>
|
||||||
|
|
||||||
|
<div class="content">
|
||||||
|
|
||||||
|
<h3>The page you are looking for is temporarily unavailable. Please try again later.</h3>
|
||||||
|
|
||||||
|
<div class="alert">
|
||||||
|
<h2>Website Administrator</h2>
|
||||||
|
<div class="content">
|
||||||
|
<p>Something has triggered missing webpage on your
|
||||||
|
website. This is the default error page for
|
||||||
|
<strong>nginx</strong> that is distributed with
|
||||||
|
Red Hat Enterprise Linux. It is located
|
||||||
|
<tt>/usr/share/nginx/html/50x.html</tt></p>
|
||||||
|
|
||||||
|
<p>You should customize this error page for your own
|
||||||
|
site or edit the <tt>error_page</tt> directive in
|
||||||
|
the <strong>nginx</strong> configuration file
|
||||||
|
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||||
|
|
||||||
|
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="logos">
|
||||||
|
<a href="http://nginx.net/"><img
|
||||||
|
src="nginx-logo.png"
|
||||||
|
alt="[ Powered by nginx ]"
|
||||||
|
width="121" height="32" /></a>
|
||||||
|
<a href="http://www.redhat.com/"><img
|
||||||
|
src="poweredby.png"
|
||||||
|
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||||
|
width="88" height="31" /></a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
###############
|
||||||
|
Dynamic modules
|
||||||
|
###############
|
||||||
|
|
||||||
|
Dynamic modules are loaded using the "load_modules" directive. The RPM package
|
||||||
|
for each module has a '.conf' file in the /usr/share/nginx/modules directory.
|
||||||
|
The '.conf' file contains a single "load_modules" directive.
|
||||||
|
|
||||||
|
This means that whenever a new dynamic module is installed, it will
|
||||||
|
automatically be enabled and Nginx will be reloaded.
|
||||||
|
|
||||||
|
--------------------------------------------------------
|
||||||
|
Prevent dynamic modules from being enabled automatically
|
||||||
|
--------------------------------------------------------
|
||||||
|
|
||||||
|
You may want to avoid dynamic modules being enabled automatically. Simply
|
||||||
|
remove this line from the top of /etc/nginx/nginx.conf:
|
||||||
|
|
||||||
|
include /usr/share/nginx/modules/*.conf;
|
||||||
|
|
||||||
@ -0,0 +1,88 @@
|
|||||||
|
#############
|
||||||
|
Upgrade notes
|
||||||
|
#############
|
||||||
|
|
||||||
|
To resolve numerous security flaws, the nginx package was updated to 1.10.x.
|
||||||
|
|
||||||
|
You should review your configuration files in /etc/nginx to determine if there
|
||||||
|
are any incompatibilities. Below is a summary of the main incompatible changes.
|
||||||
|
Some nginx directives have been changed or removed, so you may need to modify
|
||||||
|
your configuration.
|
||||||
|
|
||||||
|
Please see upstream release notes for a complete list of new features,
|
||||||
|
bug fixes, and changes: http://nginx.org/en/CHANGES-1.10
|
||||||
|
One notable feature is support for HTTP/2.
|
||||||
|
|
||||||
|
Nginx gained support for dynamic modules. As part of this update, dynamic
|
||||||
|
modules have been split into subpackages. For the time being these are hard
|
||||||
|
dependencies to aid the upgrade path. When you install nginx, all of these
|
||||||
|
modules are installed and enabled by default:
|
||||||
|
- nginx-mod-http-geoip
|
||||||
|
- nginx-mod-http-image-filter
|
||||||
|
- nginx-mod-http-perl
|
||||||
|
- nginx-mod-http-xslt-filter
|
||||||
|
- nginx-mod-mail
|
||||||
|
- nginx-mod-stream
|
||||||
|
|
||||||
|
Changes with nginx 1.10.x
|
||||||
|
|
||||||
|
*) Change: non-idempotent requests (POST, LOCK, PATCH) are no longer
|
||||||
|
passed to the next server by default if a request has been sent to a
|
||||||
|
backend; the "non_idempotent" parameter of the "proxy_next_upstream"
|
||||||
|
directive explicitly allows retrying such requests.
|
||||||
|
|
||||||
|
*) Change: now the "output_buffers" directive uses two buffers by
|
||||||
|
default.
|
||||||
|
|
||||||
|
*) Change: now nginx limits subrequests recursion, not simultaneous
|
||||||
|
subrequests.
|
||||||
|
|
||||||
|
*) Change: now nginx checks the whole cache key when returning a
|
||||||
|
response from cache.
|
||||||
|
Thanks to Gena Makhomed and Sergey Brester.
|
||||||
|
|
||||||
|
*) Change: the "proxy_downstream_buffer" and "proxy_upstream_buffer"
|
||||||
|
directives of the stream module are replaced with the
|
||||||
|
"proxy_buffer_size" directive.
|
||||||
|
|
||||||
|
*) Change: duplicate "http", "mail", and "stream" blocks are now
|
||||||
|
disallowed.
|
||||||
|
|
||||||
|
*) Change: now SSLv3 protocol is disabled by default.
|
||||||
|
|
||||||
|
*) Change: some long deprecated directives are not supported anymore.
|
||||||
|
|
||||||
|
*) Change: obsolete aio and rtsig event methods have been removed.
|
||||||
|
|
||||||
|
Changes with nginx 1.8.x
|
||||||
|
|
||||||
|
*) Change: the "sendfile" parameter of the "aio" directive is
|
||||||
|
deprecated; now nginx automatically uses AIO to pre-load data for
|
||||||
|
sendfile if both "aio" and "sendfile" directives are used.
|
||||||
|
|
||||||
|
*) Change: now the "If-Modified-Since", "If-Range", etc. client request
|
||||||
|
header lines are passed to a backend while caching if nginx knows in
|
||||||
|
advance that the response will not be cached (e.g., when using
|
||||||
|
proxy_cache_min_uses).
|
||||||
|
|
||||||
|
*) Change: now after proxy_cache_lock_timeout nginx sends a request to a
|
||||||
|
backend with caching disabled; the new directives
|
||||||
|
"proxy_cache_lock_age", "fastcgi_cache_lock_age",
|
||||||
|
"scgi_cache_lock_age", and "uwsgi_cache_lock_age" specify a time
|
||||||
|
after which the lock will be released and another attempt to cache a
|
||||||
|
response will be made.
|
||||||
|
|
||||||
|
*) Change: the "log_format" directive can now be used only at http
|
||||||
|
level.
|
||||||
|
|
||||||
|
*) Change: now nginx takes into account the "Vary" header line in a
|
||||||
|
backend response while caching.
|
||||||
|
|
||||||
|
*) Change: the deprecated "limit_zone" directive is not supported
|
||||||
|
anymore.
|
||||||
|
|
||||||
|
*) Change: now the "stub_status" directive does not require a parameter.
|
||||||
|
|
||||||
|
*) Change: URI escaping now uses uppercase hexadecimal digits.
|
||||||
|
Thanks to Piotr Sikora.
|
||||||
|
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
%_nginx_abiversion @@NGINX_ABIVERSION@@
|
||||||
|
%_nginx_srcdir @@NGINX_SRCDIR@@
|
||||||
|
%_nginx_buildsrcdir nginx-src
|
||||||
|
%_nginx_modsrcdir ..
|
||||||
|
%_nginx_modbuilddir ../%{_vpath_builddir}
|
||||||
|
%nginx_moddir @@NGINX_MODDIR@@
|
||||||
|
%nginx_modconfdir @@NGINX_MODCONFDIR@@
|
||||||
|
|
||||||
|
%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
|
||||||
|
|
||||||
|
%nginx_modconfigure(:-:) \\\
|
||||||
|
%undefine _strict_symbol_defs_build \
|
||||||
|
cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
|
||||||
|
cd "%{_nginx_buildsrcdir}" \
|
||||||
|
nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
|
||||||
|
./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
|
||||||
|
--add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
|
||||||
|
cd -
|
||||||
|
|
||||||
|
%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} %{_make_verbose} modules
|
||||||
@ -0,0 +1,69 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQINBF4TqFoBEADNbls05thIAYVVKdMDRdtzGk7HXGqx60u/kh4BL9HskUpyYFTp
|
||||||
|
N07RJ1TyyusfD7I3skuGHvtQhqdTwHPDEPL5qrAnHps9XWUQrtU7hflcIKt43iDe
|
||||||
|
TvfVVhN0nPir2++C4qvNnrC/UCisyz00H/I9mobl2qzyKyLT8BnUBVuXDfOTlUCY
|
||||||
|
oF4z5BieOMvg1DZNKFDnK67ZuO4JXgtMlu4Q3tFd7qSWCWGuCuAGgn6eWFYMzCbB
|
||||||
|
rPyBYwb7xyycQzqmJiD7Qm9OeVHmZj5rG5hGM14MyTSUVJle0U+CJCF9lmfVuR/c
|
||||||
|
ySy7WmQgIg327x5Y5xa3pKZAvIAycnDabAk/08p59BG7UdAi2S7+2SicAH89/81V
|
||||||
|
g4BI4mZp+IuxaP+S+ckaRf1CUvRAJuLTqUeBSuOzjag+ibD6rqusuZ1MZqLxnXyu
|
||||||
|
gAztNDcmEFa/pqp5bgWbrlTF6zKt4cQf+a/JqFGatsfSzmrIyIZ6GEqgb8oXDDIt
|
||||||
|
Z1AqsTfp6ZBC1vITE9+b0zBw6qq/nGD0Iq47Vp1VxmlxmnoeR4ir8z/oSukPulLU
|
||||||
|
K3IqkmRNGEilINrtBt5jFbBlx8kwdCYvxEF6ymibBBqvwwv65jrrKheBQm+HrrVS
|
||||||
|
aMQmo4Qzj/h/ZLL9KENHibNwUypJnvwEvw0YkAyjICvoNzDUsM+92+B/ewARAQAB
|
||||||
|
tCFNYXhpbSBLb25vdmFsb3YgPG1heGltQG5naW54LmNvbT6JAlcEEwEKAEECGwMF
|
||||||
|
CwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQRB25JxPTv0v/PukQacXn+i9Ul3
|
||||||
|
1AUCXhgw1wUJBagi/QAKCRCcXn+i9Ul31LltD/40KNFPvDaORz35udrm0cyVIgbI
|
||||||
|
lq7Vswfo5JIr8MyJ+VKJFQ2n2JiQT8QbX52Sy5P80ktSAFqcT3vtWB7bI6RfJ8Jx
|
||||||
|
YM/w3XKnNMoUt7Q/cqZK5Ra/csmaCWqP4UVUvUBjHvly0MpnE1kxEDUglrcyVKjt
|
||||||
|
fxB/GXeUpKOELXG44zvW2CP9Mce0FbDxrh8iCai9MK+2oSt1aJV+gONLWscRgsc7
|
||||||
|
6q9/4KUXByt0qxScYPRQRIaxpIA8sCno21owcMOf8aQtun6Ytf+UIovl9DmK2pRm
|
||||||
|
Ifc2JruW1Jx2r7z955ZFNgTA380jEL85dWbgbHF/pYPlwcTCnaAf294kefjrX9DN
|
||||||
|
rejbZZ3Fh2QGs0tWW5+wncVWndq4jLQTeamUdzw5MPpOh+bZoHT+7z1PDGWe+PIn
|
||||||
|
DTbfaFYL7MsXwScMUsexKLOoDO6KKpZjcsw9/b5JsJmP73ZEj02BjRudapObiRxm
|
||||||
|
MtDl8Zmpg7ZUqMHEuUzyEyI5nSWu4njjrWJO0CnsjLpv2UxAbxDn1NGc/DoyxM1l
|
||||||
|
4SQv4AJuSLo1x7PTRb9V9HkWqxXf+yCkNpV9UjmlrH104gWL6sof6rX8Jo6k+Sz+
|
||||||
|
yyQHcVbrJ95Y3hQU7QMMnotzVbL7BRtWMtDYTp7q+gYbZ0s+YRXjaHcA5IuV65tM
|
||||||
|
tEPwGpOCofQ2avkdqIhdBBARCgAdFiEEZVBsAu/CUPG3o9aU7PDpCywXIIMFAl4T
|
||||||
|
qXUACgkQ7PDpCywXIIN5CQCgyNFrUBGlUvH9QlDSE/umzoyXW/UAn0ve2/HzpMVN
|
||||||
|
uPMAAgnHYE2R0eiEtCNNYXhpbSBLb25vdmFsb3YgPG1heGltQEZyZWVCU0Qub3Jn
|
||||||
|
PokCVAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBEHbknE9O/S/
|
||||||
|
8+6RBpxef6L1SXfUBQJeGDDXBQkFqCL9AAoJEJxef6L1SXfUJ/IQALtwaB7mlBUB
|
||||||
|
NdzqQRIZAVSnJZ2w6+Iul7Ax4gKrqWj6SvL/5jEdZm65D0kjxJIHq+dO+lJIMLzp
|
||||||
|
rBkfZ0kkxOPQ1rw/QR31qHLAibknrwIQQVtzFvVg4iW7IZefx6WGbJJC5IbjBUBf
|
||||||
|
HATqbXmMAcLILh9+t4q7Qvwi2b8ZIsC37cktthad7j4kvXqV5BJ4I+PoDT0CcW48
|
||||||
|
wgTfMwhib52pLMu3Ghk56kwHBtYSHUDrA4KWRzRHxQ+RoUXLIdtmMRbp8ztwBMJZ
|
||||||
|
+J/9TLrb3YHUidS3l2nE55l9dJZycCU2EOAhJMbFKbmfW/9we/Sm+vnoALGExepl
|
||||||
|
FgdGz2NTqPA4ha2y2rBC73TSkfM+4amIrr6kSbeofjQL/w5+fhxAvM5oXuzffPK9
|
||||||
|
8IR31d66JUTjeueobguzh9ApeHElmihimRJk0KP+NVAMNCIZmlMuOXHPwnCajcBh
|
||||||
|
Sh9kFGy6tPPPZYQOHSm5KvyjIJDfmkFfJ5ybazkmsGhZMzQs4ZHItC1jf0vYCqsr
|
||||||
|
d3eVEQesy5nDlSC2lWK84R+J+qTL82ZbCc/VZMniCBCC9xIvEOU9gtIH+58vF8dq
|
||||||
|
l/jTmGp2h1/kHlJfn0cnxKJDzn2IG16jqR7VdWQEO5hjEMaZdxhM1jPGRdkM82fB
|
||||||
|
Wwv8BLBpgBstyQlxJ/NNO5+dCtZYWRcviF0EEBEKAB0WIQRlUGwC78JQ8bej1pTs
|
||||||
|
8OkLLBcggwUCXhOpbwAKCRDs8OkLLBcgg/jfAKCO7DIiB2DGBfLCFftmyuZJN2A6
|
||||||
|
ZgCfV/cclX++mLyiyYqr2BXnrQk4NVG5Ag0EXhOoWgEQAOmkirptbymUR2JP9DrP
|
||||||
|
e7aELbUw4bcMx4/nQo1QyKxjDhUdgUui4OiqxmhMjT2IlgFvcYsMeLiYGa/EdBkd
|
||||||
|
Yq4DtEwc++2eybFQA1z6Hrk+sxdd8neN4azUa5sqVvUwenQ7UMPclSQJaE1nVGCZ
|
||||||
|
KKVyNsK36RJrE0JfdmE1zKZFWmTCTZ/D/hTCq+hjMpCV+VWFaz3h4S+XsZiBgLB4
|
||||||
|
+zmyHjyU6E+ecELvAHoXwMbAPiFzzms824Fc1BKHjnc8BBzfUVdIBGhxOVNHDSj3
|
||||||
|
oxPsiBnuvSlQMlGx0YNLw/tTfw+CFOot5o/KIq9svUp8W9mdj6kKaqBLNxpjHbhQ
|
||||||
|
yvVSK7O5uS62emMHkRwgu1tmP98d3bGlXRn+S+2MCuyqdFaK40B6vnkPnXpl5ggE
|
||||||
|
w8JoH11ahNeJ5tX8/JpX/0aQmapt7CKwcgELJap+Qp8i/MFXef7FK/nE0lFIL95o
|
||||||
|
l9uthd/beX6dz/EEw61lC17Opd3y0N+Dy+eJ0wbULdgKrblZ0PxsumLeICGLs7/P
|
||||||
|
O9/3nQHJRjmFaVG10t5bL/77gvQ4l7HcuLS1GGHh+RM6EsFuuiqI+aFcDFyRITli
|
||||||
|
g0QRq4y/C6nqhTWEyYriIi8Dq6JxXisklC1WvSIgPwq1/msmrbiKcJZFPoNtMVtO
|
||||||
|
dzL3naM5IWOa290R541GjkEVABEBAAGJAjwEGAEKACYCGwwWIQRB25JxPTv0v/Pu
|
||||||
|
kQacXn+i9Ul31AUCXhgw/QUJBagjIwAKCRCcXn+i9Ul31MQDEACeO6ZBLEWswuyU
|
||||||
|
RErntoHkY6wIkpfMiERjgfqbNkrdBgXg8dT7kPsXFEtv3ZccjPbsRecJaXdmwGab
|
||||||
|
mp9MUDYG3SiqgFNriJTv2WECzgYKrZQg38JVwfl7OHPaV2fwZvG56a4qKpIZ3wIg
|
||||||
|
4acfEPkHQ2ygpKnEJD4IsEK225PtYq5lmNfntvDhbuTPh2vY8T9w0udGCzp4JS60
|
||||||
|
zLeGGat+52PislEtrSa2B7zSMzGmOqDidaDbEfzdzL+IteZHWDGmYNQ8yICIv6Wj
|
||||||
|
A80k7uhzDWJf5RMQSNybBykrlWSooaVrBWHgDky5ldAQjDtVrMkBpzglH8FQ44i+
|
||||||
|
la9caRDfw0Lfxg52vV4eXtpSHAYx3cFREEW9xpTOwOE7Qg0JyHAkUKNb8DJgyehC
|
||||||
|
BjSeeiMFiZX1plyYFrUAB8dVXi9Z7kqOjTpfYU6kAxDXzQhlqqgYRwoFJQcsQ1Ll
|
||||||
|
jKptAs6glmDx8dJcjUrK/eH24GGg46eGv2wxY4+sItXfLQ2oeU4uh/vORjvgeeNp
|
||||||
|
er4z5KLuKxwgpaobavtRZmZSZdGrdC93Si27dpSRiWYn1csoTxG0zZhUVFFW68I4
|
||||||
|
I5PIdJwblvxayVKdg0aVW/RwDsOLH0twVxwnOPSjLPEB2IwGnlX6rN38cRnibPXM
|
||||||
|
yh4LsaVRdhbFe9aNd/O5iNgDcQtCUg==
|
||||||
|
=/pFc
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
@ -0,0 +1,33 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: GnuPG v1.4.11 (FreeBSD)
|
||||||
|
|
||||||
|
mQENBE7SKu8BCADQo6x4ZQfAcPlJMLmL8zBEBUS6GyKMMMDtrTh3Yaq481HB54oR
|
||||||
|
0cpKL05Ff9upjrIzLD5TJUCzYYM9GQOhguDUP8+ZU9JpSz3yO2TvH7WBbUZ8FADf
|
||||||
|
hblmmUBLNgOWgLo3W+FYhl3mz1GFS2Fvid6Tfn02L8CBAj7jxbjL1Qj/OA/WmLLc
|
||||||
|
m6BMTqI7IBlYW2vyIOIHasISGiAwZfp0ucMeXXvTtt14LGa8qXVcFnJTdwbf03AS
|
||||||
|
ljhYrQnKnpl3VpDAoQt8C68YCwjaNJW59hKqWB+XeIJ9CW98+EOAxLAFszSyGanp
|
||||||
|
rCqPd0numj9TIddjcRkTA/ZbmCWK+xjpVBGXABEBAAG0IU1heGltIERvdW5pbiA8
|
||||||
|
bWRvdW5pbkBtZG91bmluLnJ1PokBOAQTAQIAIgUCTtIq7wIbAwYLCQgHAwIGFQgC
|
||||||
|
CQoLBBYCAwECHgECF4AACgkQUgqZk6HAUvj+iwf/b4FS6zVzJ5T0v1vcQGD4ZzXe
|
||||||
|
D5xMC4BJW414wVMU15rfX7aCdtoCYBNiApPxEd7SwiyxWRhRA9bikUq87JEgmnyV
|
||||||
|
0iYbHZvCvc1jOkx4WR7E45t1Mi29KBoPaFXA9X5adZkYcOQLDxa2Z8m6LGXnlF6N
|
||||||
|
tJkxQ8APrjZsdrbDvo3HxU9muPcq49ydzhgwfLwpUs11LYkwB0An9WRPuv3jporZ
|
||||||
|
/XgI6RfPMZ5NIx+FRRCjn6DnfHboY9rNF6NzrOReJRBhXCi6I+KkHHEnMoyg8XET
|
||||||
|
9lVkfHTOl81aIZqrAloX3/00TkYWyM2zO9oYpOg6eUFCX/Lw4MJZsTcT5EKVxIhG
|
||||||
|
BBARAgAGBQJO01Y/AAoJEOzw6QssFyCDVyQAn3qwTZlcZgyyzWu9Cs8gJ0CXREaS
|
||||||
|
AJ92QjGLT9DijTcbB+q9OS/nl16Z/IhGBBARAgAGBQJO02JDAAoJEKk3YTmlJMU+
|
||||||
|
P64AnjCKEXFelSVMtgefJk3+vpyt3QX1AKCH9M3MbTWPeDUL+MpULlfdyfvjj7kB
|
||||||
|
DQRO0irvAQgA0LjCc8S6oZzjiap2MjRNhRFA5BYjXZRZBdKF2VP74avt2/RELq8G
|
||||||
|
W0n7JWmKn6vvrXabEGLyfkCngAhTq9tJ/K7LPx/bmlO5+jboO/1inH2BTtLiHjAX
|
||||||
|
vicXZk3oaZt2Sotx5mMI3yzpFQRVqZXsi0LpUTPJEh3oS8IdYRjslQh1A7P5hfCZ
|
||||||
|
wtzwb/hKm8upODe/ITUMuXeWfLuQj/uEU6wMzmfMHb+jlYMWtb+v98aJa2FODeKP
|
||||||
|
mWCXLa7bliXp1SSeBOEfIgEAmjM6QGlDx5sZhr2Ss2xSPRdZ8DqD7oiRVzmstX1Y
|
||||||
|
oxEzC0yXfaefC7SgM0nMnaTvYEOYJ9CH3wARAQABiQEfBBgBAgAJBQJO0irvAhsM
|
||||||
|
AAoJEFIKmZOhwFL4844H/jo8icCcS6eOWvnen7lg0FcCo1fIm4wW3tEmkQdchSHE
|
||||||
|
CJDq7pgTloN65pwB5tBoT47cyYNZA9eTfJVgRc74q5cexKOYrMC3KuAqWbwqXhkV
|
||||||
|
s0nkWxnOIidTHSXvBZfDFA4Idwte94Thrzf8Pn8UESudTiqrWoCBXk2UyVsl03gJ
|
||||||
|
blSJAeJGYPPeo+Yj6m63OWe2+/S2VTgmbPS/RObn0Aeg7yuff0n5+ytEt2KL51gO
|
||||||
|
QE2uIxTCawHr12PsllPkbqPk/PagIttfEJqn9b0CrqPC3HREePb2aMJ/Ctw/76CO
|
||||||
|
wn0mtXeIXLCTvBmznXfaMKllsqbsy2nCJ2P2uJjOntw=
|
||||||
|
=Tavt
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQHEBAABCAAuFiEEE8gqY7YDV2FW4wpOoOqYG2aw2WcFAmNPwgkQHGsucGF2bG92
|
||||||
|
QGY1LmNvbQAKCRCg6pgbZrDZZ521C/9stdPkXnyO46ZOHEBK0UhPXPLcLaeUPOj3
|
||||||
|
LZz0mS1pLeQrWVJcSzjn4x1VA1Mo24wJ2PDHVLDlz+wrGDWj+YQh0Pzt81AV/VWl
|
||||||
|
gDfbJ9ROfaXNUBMPWwKH5fxlocYYyYM3SlN/nwx5EDR8uB0mnSUPS+TV8SxW+252
|
||||||
|
IfGv8xtX4diEowVCCpkvqDkbEwWy4GQia1KHd0krfvi6Aha3NNNRkjyPUNrf42A5
|
||||||
|
lmqxp1PwKnb6IYEkoYYtehKARuFjY9d5rsaQSXzNXYnRqQYOzSB42wcxJCu/Lw2S
|
||||||
|
MfzY0b5j6PdVziBXQr/Bk8ge7sVT30oKD+LnKKL/CWHnFveykOAuvuihsD4VS1iB
|
||||||
|
1Ns2Pjdofzw7+OzlVWJ4SBlm6HPCXBSfg15jkXinDdU/lKT6Gv0n4Y4i3GWkdFKe
|
||||||
|
JuuDcvhM2dAl8PV9YrlaVK/1InHNb7jsksKLZ0MxOEj05QSOWT5kOAbQCRfKAc8/
|
||||||
|
S8kd48v9BSgC+PZjS6AG3+sM2YjwQvo=
|
||||||
|
=Ww/y
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
exec /bin/systemd-ask-password "Enter TLS private key passphrase for $1 ($2) : "
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
[ ! -f /run/nginx.pid ] && exit 1
|
||||||
|
echo "Start new nginx master..."
|
||||||
|
/bin/systemctl kill --signal=SIGUSR2 nginx.service
|
||||||
|
sleep 5
|
||||||
|
[ ! -f /run/nginx.pid.oldbin ] && sleep 10
|
||||||
|
if [ ! -f /run/nginx.pid.oldbin ]; then
|
||||||
|
echo "Failed to start new nginx master."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "Stop old nginx master gracefully..."
|
||||||
|
oldpid=`/usr/bin/cat /run/nginx.pid.oldbin 2>/dev/null`
|
||||||
|
/bin/kill -s QUIT $oldpid 2>/dev/null
|
||||||
|
sleep 5
|
||||||
|
[ -f /run/nginx.pid.oldbin ] && sleep 10
|
||||||
|
if [ -f /run/nginx.pid.oldbin ]; then
|
||||||
|
echo "Failed to stop old nginx master."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
@ -0,0 +1,151 @@
|
|||||||
|
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
|
||||||
|
.\"
|
||||||
|
.\" Standard preamble:
|
||||||
|
.\" ========================================================================
|
||||||
|
.de Sp \" Vertical space (when we can't use .PP)
|
||||||
|
.if t .sp .5v
|
||||||
|
.if n .sp
|
||||||
|
..
|
||||||
|
.de Vb \" Begin verbatim text
|
||||||
|
.ft CW
|
||||||
|
.nf
|
||||||
|
.ne \\$1
|
||||||
|
..
|
||||||
|
.de Ve \" End verbatim text
|
||||||
|
.ft R
|
||||||
|
.fi
|
||||||
|
..
|
||||||
|
.\" Set up some character translations and predefined strings. \*(-- will
|
||||||
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
||||||
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
||||||
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
||||||
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
||||||
|
.\" nothing in troff, for use with C<>.
|
||||||
|
.tr \(*W-
|
||||||
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
||||||
|
.ie n \{\
|
||||||
|
. ds -- \(*W-
|
||||||
|
. ds PI pi
|
||||||
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
||||||
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
||||||
|
. ds L" ""
|
||||||
|
. ds R" ""
|
||||||
|
. ds C` ""
|
||||||
|
. ds C' ""
|
||||||
|
'br\}
|
||||||
|
.el\{\
|
||||||
|
. ds -- \|\(em\|
|
||||||
|
. ds PI \(*p
|
||||||
|
. ds L" ``
|
||||||
|
. ds R" ''
|
||||||
|
'br\}
|
||||||
|
.\"
|
||||||
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
||||||
|
.ie \n(.g .ds Aq \(aq
|
||||||
|
.el .ds Aq '
|
||||||
|
.\"
|
||||||
|
.\" If the F register is turned on, we'll generate index entries on stderr for
|
||||||
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
||||||
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
||||||
|
.\" output yourself in some meaningful fashion.
|
||||||
|
.ie \nF \{\
|
||||||
|
. de IX
|
||||||
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
||||||
|
..
|
||||||
|
. nr % 0
|
||||||
|
. rr F
|
||||||
|
.\}
|
||||||
|
.el \{\
|
||||||
|
. de IX
|
||||||
|
..
|
||||||
|
.\}
|
||||||
|
.\"
|
||||||
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
||||||
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
||||||
|
. \" fudge factors for nroff and troff
|
||||||
|
.if n \{\
|
||||||
|
. ds #H 0
|
||||||
|
. ds #V .8m
|
||||||
|
. ds #F .3m
|
||||||
|
. ds #[ \f1
|
||||||
|
. ds #] \fP
|
||||||
|
.\}
|
||||||
|
.if t \{\
|
||||||
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
||||||
|
. ds #V .6m
|
||||||
|
. ds #F 0
|
||||||
|
. ds #[ \&
|
||||||
|
. ds #] \&
|
||||||
|
.\}
|
||||||
|
. \" simple accents for nroff and troff
|
||||||
|
.if n \{\
|
||||||
|
. ds ' \&
|
||||||
|
. ds ` \&
|
||||||
|
. ds ^ \&
|
||||||
|
. ds , \&
|
||||||
|
. ds ~ ~
|
||||||
|
. ds /
|
||||||
|
.\}
|
||||||
|
.if t \{\
|
||||||
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
||||||
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
||||||
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
||||||
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
||||||
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
||||||
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
||||||
|
.\}
|
||||||
|
. \" troff and (daisy-wheel) nroff accents
|
||||||
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
||||||
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
||||||
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
||||||
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
||||||
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
||||||
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
||||||
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
||||||
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
||||||
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
||||||
|
. \" corrections for vroff
|
||||||
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
||||||
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
||||||
|
. \" for low resolution devices (crt and lpr)
|
||||||
|
.if \n(.H>23 .if \n(.V>19 \
|
||||||
|
\{\
|
||||||
|
. ds : e
|
||||||
|
. ds 8 ss
|
||||||
|
. ds o a
|
||||||
|
. ds d- d\h'-1'\(ga
|
||||||
|
. ds D- D\h'-1'\(hy
|
||||||
|
. ds th \o'bp'
|
||||||
|
. ds Th \o'LP'
|
||||||
|
. ds ae ae
|
||||||
|
. ds Ae AE
|
||||||
|
.\}
|
||||||
|
.rm #[ #] #H #V #F C
|
||||||
|
.\" ========================================================================
|
||||||
|
.\"
|
||||||
|
.IX Title "NGINX-UPGRADE 8"
|
||||||
|
.TH NGINX-UPGRADE 8 "2012-10-28" " " " "
|
||||||
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
||||||
|
.\" way too many mistakes in technical documents.
|
||||||
|
.if n .ad l
|
||||||
|
.nh
|
||||||
|
.SH "NAME"
|
||||||
|
nginx\-upgrade \- tool to upgrade nginx without any downtime
|
||||||
|
.SH "SYNOPSIS"
|
||||||
|
.IX Header "SYNOPSIS"
|
||||||
|
\&\fInginx-upgrade\fR
|
||||||
|
.SH "DESCRIPTION"
|
||||||
|
.IX Header "DESCRIPTION"
|
||||||
|
This downstream shell script updates nginx without any downtime. After
|
||||||
|
upgrading nginx via the package manager, running this script will create
|
||||||
|
a new nginx master. This master takes over all new requests. The old
|
||||||
|
masters and workers are then gracefully shutdown without breaking any
|
||||||
|
existing connections.
|
||||||
|
.PP
|
||||||
|
For further information, see: <http://nginx.org/en/docs/control.html>
|
||||||
|
.SH "BUGS"
|
||||||
|
.IX Header "BUGS"
|
||||||
|
If you find any bugs, please send an email to the author.
|
||||||
|
.SH "AUTHOR"
|
||||||
|
.IX Header "AUTHOR"
|
||||||
|
Jamie Nguyen <jamielinux@fedoraproject.org>
|
||||||
@ -0,0 +1,83 @@
|
|||||||
|
# For more information on configuration, see:
|
||||||
|
# * Official English Documentation: http://nginx.org/en/docs/
|
||||||
|
# * Official Russian Documentation: http://nginx.org/ru/docs/
|
||||||
|
|
||||||
|
user nginx;
|
||||||
|
worker_processes auto;
|
||||||
|
error_log /var/log/nginx/error.log notice;
|
||||||
|
pid /run/nginx.pid;
|
||||||
|
|
||||||
|
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
|
||||||
|
include /usr/share/nginx/modules/*.conf;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
sendfile on;
|
||||||
|
tcp_nopush on;
|
||||||
|
keepalive_timeout 65;
|
||||||
|
types_hash_max_size 4096;
|
||||||
|
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
# Load modular configuration files from the /etc/nginx/conf.d directory.
|
||||||
|
# See http://nginx.org/en/docs/ngx_core_module.html#include
|
||||||
|
# for more information.
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name _;
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
|
||||||
|
# Load configuration files for the default server block.
|
||||||
|
include /etc/nginx/default.d/*.conf;
|
||||||
|
|
||||||
|
error_page 404 /404.html;
|
||||||
|
location = /404.html {
|
||||||
|
}
|
||||||
|
|
||||||
|
error_page 500 502 503 504 /50x.html;
|
||||||
|
location = /50x.html {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Settings for a TLS enabled server.
|
||||||
|
#
|
||||||
|
# server {
|
||||||
|
# listen 443 ssl http2;
|
||||||
|
# listen [::]:443 ssl http2;
|
||||||
|
# server_name _;
|
||||||
|
# root /usr/share/nginx/html;
|
||||||
|
#
|
||||||
|
# ssl_certificate "/etc/pki/nginx/server.crt";
|
||||||
|
# ssl_certificate_key "/etc/pki/nginx/private/server.key";
|
||||||
|
# ssl_session_cache shared:SSL:1m;
|
||||||
|
# ssl_session_timeout 10m;
|
||||||
|
# ssl_ciphers PROFILE=SYSTEM;
|
||||||
|
# ssl_prefer_server_ciphers on;
|
||||||
|
#
|
||||||
|
# # Load configuration files for the default server block.
|
||||||
|
# include /etc/nginx/default.d/*.conf;
|
||||||
|
#
|
||||||
|
# error_page 404 /404.html;
|
||||||
|
# location = /404.html {
|
||||||
|
# }
|
||||||
|
#
|
||||||
|
# error_page 500 502 503 504 /50x.html;
|
||||||
|
# location = /50x.html {
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
/var/log/nginx/*.log {
|
||||||
|
create 0640 nginx root
|
||||||
|
daily
|
||||||
|
rotate 10
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
compress
|
||||||
|
delaycompress
|
||||||
|
sharedscripts
|
||||||
|
postrotate
|
||||||
|
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true
|
||||||
|
endscript
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,22 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=The nginx HTTP and reverse proxy server
|
||||||
|
After=network-online.target remote-fs.target nss-lookup.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=forking
|
||||||
|
PIDFile=/run/nginx.pid
|
||||||
|
# Nginx will fail to start if /run/nginx.pid already exists but has the wrong
|
||||||
|
# SELinux context. This might happen when running `nginx -t` from the cmdline.
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1268621
|
||||||
|
ExecStartPre=/usr/bin/rm -f /run/nginx.pid
|
||||||
|
ExecStartPre=/usr/sbin/nginx -t
|
||||||
|
ExecStart=/usr/sbin/nginx
|
||||||
|
ExecReload=/usr/sbin/nginx -s reload
|
||||||
|
KillSignal=SIGQUIT
|
||||||
|
TimeoutStopSec=5
|
||||||
|
KillMode=mixed
|
||||||
|
PrivateTmp=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
%__nginxmods_requires() %{lua:
|
||||||
|
-- Match buildroot paths of the form
|
||||||
|
-- /PATH/OF/BUILDROOT/usr/lib/nginx/modules/ and
|
||||||
|
-- /PATH/OF/BUILDROOT/usr/lib64/nginx/modules/
|
||||||
|
-- generating a line of the form:
|
||||||
|
-- nginx(abi) = VERSION
|
||||||
|
local path = rpm.expand("%1")
|
||||||
|
if path:match("/usr/lib%d*/nginx/modules/.*") then
|
||||||
|
local requires = "nginx(abi) = " .. rpm.expand("%{_nginx_abiversion}")
|
||||||
|
print(requires)
|
||||||
|
end
|
||||||
|
}
|
||||||
|
|
||||||
|
%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
Version: GnuPG v1.4.11 (FreeBSD)
|
||||||
|
|
||||||
|
mQENBE5E4vkBCADPkWWzk7W5cXOqeZ1ULNSj8nt5azbYjfQ8OyR2AaDW8J7oazYH
|
||||||
|
reIHKid5uZVJxwr1uLoMloGiYTdy4XYIF2WcOfDnjNGumrAT0Nd4Kdax/pHr5Pdp
|
||||||
|
jFsO4BkHyWk/5/zDCijyoGYLBR6I8hqn+WDuLG/sTtVuTWkUeOlfxb2eZdLyZ3oP
|
||||||
|
5T5FXtWTpKvr2y7RGshmS6EJnjiVvvErdbNItFXghqvBBaFOJaS2PRBEO9RfKpti
|
||||||
|
i+eS/cmlrm+Tjv44EPfQyLtAmCQ8uqfL50uIKEp6/dsC/OVJ6JlJOYl4j90DX7vB
|
||||||
|
TJaOyUm4s+BLF2BK+Ow8+s+B6jQ5noa/o16NABEBAAG0IFNlcmdleSBCdWRuZXZp
|
||||||
|
dGNoIDxzYkBuZ2lueC5jb20+iQE+BBMBAgAoBQJOROQ6AhsDBQkJZgGABgsJCAcD
|
||||||
|
AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCmT9Wxets5qEQgB/43Mxmiy7DjXEbxIYkC
|
||||||
|
9xPC4kf1X+bHkJ9BtAgaYDQewjtQ7vS98TKJBibm3l4egmBjFWjCpL8845n966+u
|
||||||
|
XDqrDWJtOPUXvSEQNXGlijDGSxxpdK2dxDOKIOC8nIlZq/Xz/Uqjb2ZrszmYK2LD
|
||||||
|
IHI1mN9HdI6aTt41QbtG0nkaPPgv3MEvxSMVCzVddroyPXvf/ErT4OSYU+dqJhH+
|
||||||
|
SBIezuF0suzH/siCksbSBZHIst5rggpjsZvijP5YFH/hpEsR+tKXo9EFk49xn9Ou
|
||||||
|
WdmpOEs7CKDbTApkh9XN/Pk5nJQ/HIDuW8pkgzf2wxNWlMSYw6xnozDkeIqpJcDD
|
||||||
|
4niqiEYEEBECAAYFAk5OYocACgkQ7PDpCywXIIMKtQCfaAl2rvbEImu6MnDR32KG
|
||||||
|
HTDH2TEAoNeWrSlavyFzbSQka53E9Gs6gF63tCBTZXJnZXkgQnVkbmV2aXRjaCA8
|
||||||
|
c2JAd2FlbWUubmV0PokBQQQTAQIAKwIbAwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYC
|
||||||
|
AwECHgECF4AFAk5OR38CGQEACgkQpk/VsXrbOagPmAf/QmIEDkkiovc1MgQ81lh4
|
||||||
|
eeHfvtptb+U4GVCu07DQUR9kEtN6Jqi65gKb95fEztI14PpX+euiWrc/RlnsxWc0
|
||||||
|
jYF0UmyacWLN6oHPoxlCK5+7zyoz5UTNrYGkTfWfcNtTU509CEZRClBNjMZOTZjP
|
||||||
|
QhdR+Ce6tngRcQvMGNaLjJkKuY7vPh6FjT5oqxpnEIRTsWq6bUaeCXm7j9x0as1Z
|
||||||
|
w1E5D5it3Ug3VlAe58jFJmRgatOsWznKuNoLRjQ2Chp2ce+dLgXriuJMrvEsn5S4
|
||||||
|
dImUGL5DVYWDVZNG+r85XnOhMfKG308pZby1uzFvD+j3P6yMj1tpaCAAi5lUkHh6
|
||||||
|
bIhGBBARAgAGBQJOTmJ/AAoJEOzw6QssFyCDH50AoMyJPvPDTYXK5KHOlPYPZQ5M
|
||||||
|
OuCAAJ9zQ/3hKedm3xCLGl4Y6hjxJNlUTbkBDQROROL5AQgAuGIfx9aVOOXVdj8b
|
||||||
|
XvjBQt+UkBURYGACHFQ69w71Aupsg9pZ7FgwgVKxnoNlmRag8sInjQbs3M/lS0sB
|
||||||
|
dg75zZ7Ph7aPev8RAqdtX5+xxvujv1cmkFBExFuC5Wp/Yfzk/lPWZR4vXZrTpRiF
|
||||||
|
PLMlRu0CEJFqoqPPygGFar02Q7rO+da35pxAuYrOWGM7MNr8H/vk13+GiqniBQCa
|
||||||
|
uSoWwZQzaEdG5VGgm/vAwPzO+Cbam3r+Hs7OieykAy8fv+B+qhHn8Vc/520iGvdO
|
||||||
|
IAKpxl6oZrkbNL/wozOOLZni7iWl30C43ujxPiGRlg/YotHmhlnMic85QKyakXCS
|
||||||
|
WXI/JQARAQABiQElBBgBAgAPBQJOROL5AhsMBQkJZgGAAAoJEKZP1bF62zmoGCwH
|
||||||
|
/2a6zlu4Jwmv21vuroaAzECV8gp1luBeagn23EgMMukYhkbwLtL/0twAHmZlkpzl
|
||||||
|
atfq/EH2PgOasl2biJixqp7o9V7Uw6PS5JoY+1IrLEurG+FU2TN/Ysp12al4Z0Hh
|
||||||
|
p4yBRSEikISO9gkeUThixDPX1PjCpx8G/ZYqk+8jRCcDgWsUc/WV3VGPht68oDd7
|
||||||
|
56/hfQYc/V3eJmm5WYLVGV7Q69tGtp6D09SpoeqCD2K77auEBRVJ4jaT4B2/EfSb
|
||||||
|
x6y7Dy4Oxm8TBOQ2EZw2vEixKxtEt86/oBtLUkqVockPq/Ek9AL+KzT6VR1xU+Cm
|
||||||
|
CoHAyoqJeb/xLBwuKWg0/4U=
|
||||||
|
=iFlP
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
@ -0,0 +1,147 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQGNBFrwMiUBDADo56OlDknN+ReCMP+8CN1biK5izmGd755TxktHLI9nAP8ociIq
|
||||||
|
Hjrps22pBtAIQ6eZpwCFBys2mR/441rOgZW+O6uqBYrttbxTMvE43EmKYGuFCmuR
|
||||||
|
u0JGMPuqnzF3Y+6uoKzqMzazSrZIBWsBKAkNYTw8+yPlxGgffhBp1ueME7Lskglh
|
||||||
|
EV9gmrEM0QlWod7wSQvyruExPm5INx3MG63Xfvc0bPiWUOGKyMb7kXA5VgnWuzmS
|
||||||
|
BCMm17+A32vMyxhYcvSEgUayQjGghI1uPDSqBQBMEFTgSK2wWzvAXf/M45nxKBgQ
|
||||||
|
IEDmvoC8RM9JTtUr7RE/E1mjsuefF2vYYYsWBstRFGAlUV1/lPNNibu3NqbCug6b
|
||||||
|
1IWJuV1DX9T9/f81GZJrsPgYYKC6Ai8C1B0NGWjos7/GzgEFENQgf5duOhFPadQz
|
||||||
|
QbRxBoId4Fe/Uwe2HxI8ESCQMwsq8bowcCn6XRA2EYkAt17Kab6LH6tTP54XG9TL
|
||||||
|
bV7bAhyrvZAk1lUAEQEAAbQjS29uc3RhbnRpbiBQYXZsb3YgPGsucGF2bG92QGY1
|
||||||
|
LmNvbT6JAdcEEwEIAEECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AWIQQT
|
||||||
|
yCpjtgNXYVbjCk6g6pgbZrDZZwUCYoTfvAUJEPqvFwAKCRCg6pgbZrDZZxFYDADK
|
||||||
|
R02XgC+AoyrqMwBNXC8Y6aiilEsyppsgj+KwZcGKDYN488gEmff+/KIEdtglw3I3
|
||||||
|
tCMbo+FzFjHveeVCb0qrIMerWJg+o4YrxxqlQ9Q1InpduKLrIuGae0J1ybITS8+v
|
||||||
|
iYAmwzy1Wb2CDDuCnhCR/QDfOE1CvRILVqIKezC0tRrBTEvRO84m6YMBtJ1DP75Z
|
||||||
|
2cTNyjPos9+uxi4JcMKrMUBwZKya+z5i+Uxd66wuPj9KmggNG1x+bqMWmpTrSKUn
|
||||||
|
gbLabFUth+uWumpj3/7HBT8Ov7rPgzY/vn3Fn5mKdLQm+kRwSX9/FbtHAE3Qsm+f
|
||||||
|
6WW8CZ4XzL9ONfhQYwO2Jrq4HzgYloZkL+1Zs61X+zeEyr4o/mzt5DHbQRsD1UzQ
|
||||||
|
gnh7t3YdSAy6gBqevjPWkQlq9e8eoFRydN/htwjS7dleikOsYktSnTIKlRXAWGCm
|
||||||
|
jkRpQyZYuuPcWcGRt/0MVewRJmLemH6O+NviqhgGRePO9QR0R+yfdCwewPJEDk6J
|
||||||
|
AjMEEAEKAB0WIQTWeGzjA9mpAimY3GzIRk1UmvdcCgUCYoeH1wAKCRDIRk1Umvdc
|
||||||
|
Cqa9EAC8Li+w/sRwiu39vNUBogWiAKj3mlfS9lEdmPWx/MSzWtik+IlI931flFWI
|
||||||
|
GL3OWC0ZXVV9G3WXQmVUqMtW2Eachy1DOSwAh4nRn03udfeMG79DUJBvMpAKTSua
|
||||||
|
cVr2tRCFXQcx+6hmkZaANGjalzVu8tEcWfOiT19LS1QM+PH36adQCtRD+wwLgvVq
|
||||||
|
qVowo6yO6jdhCATakRWO9uqeQXvdhJ7n5A3/Hg4QKtbb5vbz6QTPOs1+prICBdfF
|
||||||
|
rVEdLx9BeZGVVoWeJNzbv9ZciC+8YYo/HOTbkccJSJ+G/FeHvshYL9Saxrsl1nUX
|
||||||
|
yNCHBdrUyxPfZMgPWD2k431uplUVCwV5MOaQR4KU8AO3lcKVs02viw4smo0mWa6O
|
||||||
|
pnMIHQ/cWgNxB5/66ch3r7YqosBi8KWHMVBejD+tOv/Y1Ey7v0mF7nBdIclbQz8t
|
||||||
|
6PlKN8cOggqWjczPo1BtwPxiAkI8Y4VyhOk4ncZnluY1CtM2rQipLfcVFC/z3UGh
|
||||||
|
ZuZ9WIi31ns8Va+msHyIaQx51PB0hSmL+AkDjUuB5APO9zFE2tGV9elbmant6f5c
|
||||||
|
k4F65i19kDcfPe397FjqgyCdIduEDDtoaSS+a6oUgffHgXMXhtP2hI9zQ6c8Bnnd
|
||||||
|
f10HDxakJEcNEz7m8i7VZ0xb+UsOej2rSgdyTIW+an9t8NF9eIkBMwQQAQgAHRYh
|
||||||
|
BHM4lzBp7T9EP00336ZP1bF62zmoBQJii0M3AAoJEKZP1bF62zmoEZYIAIK8SaCJ
|
||||||
|
KT/0NtCyzmFdjX6v+H+EYjEUJCx1QPsHt35Qglco24L/X9hnPJF9P6MY3S3PDLyd
|
||||||
|
9JsmD+mujgsShqYFME/GzSScYy5Mzm5FM0xXs9UJ51YL+frKknenN5eIr7WVjXnh
|
||||||
|
g0fKn2ZqXlZ/MozHKjKQhhzl9SN6b8eDbi1SFHS/FC7C4Tymnrkhi2KAvpEtUyvg
|
||||||
|
mRSCU5Hrqh6wvi1bCpZ4+vXzQG20CT2cxa1YmgJIDhBqKiWGLyEY2hMCoRKsx5CI
|
||||||
|
UVllc83Hrpk182DDOoVVhxFpStYD/4CNCP46oSeOtjv6EPLIIug25rsjBHPHPfMf
|
||||||
|
p64DcAoKkk6cuFWJAjMEEAEKAB0WIQRB25JxPTv0v/PukQacXn+i9Ul31AUCYoeM
|
||||||
|
ZQAKCRCcXn+i9Ul31EVUD/kB3lxEMDKFg/lFpSBxm1nxplmOCp5Nq9F8Rs9KDsbR
|
||||||
|
Rc4zKL+2PLkgfxh/Nk5+9zjclUjFMBzYS0vEEml7f1R6ceG1a9r7HrdkO581Mvwe
|
||||||
|
x90qVkMMKsShqIcuLzOK0LpvTobBlQpZCBImsNaEVHnmMR3hCz5OmUsGjxNgym87
|
||||||
|
+ovRJKCZRbbJ36w+COf/jVEkczm+7OrG5BeTTPwWjoIkqs6dajYikfZI79J7FZ2C
|
||||||
|
pWpWeIgJA5emc3sAZWi0KTxlPZ9K4ff3iuV+Xf2PyuRC3iZlOuO66RJ/sl441ebN
|
||||||
|
ckn1Ngu3s48PyMjgD3VG8WDh4RCqBtLpMQJc60wboq9gPMhyyd5eyTYMI90HAEg9
|
||||||
|
pYGsw6Wk8NpUmBzbSzqSOOdN/SvAXkJmQVGKEzgvDLEsmTeddsjE6U+KUS+8Y69k
|
||||||
|
Dc3sRIR3p5cKoPgZuK2mgbiXvF+TyVGODsyUUCygCGBNN8vsDDw4gpTuOhUm1nMP
|
||||||
|
3jagHWz2NnMRo00x2nayjffjpMHCKSoNy+UTBKhVLffeZ8df6fCD9SAK+UavPVFW
|
||||||
|
kMKhd+gofhrIbnca9ZL4K+CdyD1d0sxWNtoiDGi9HSnTwXhyGujv2QnNpBxCUZTD
|
||||||
|
nvOEUSNFP/9N+tkAAGiAvk5L5ZuwHRppvnv6t6JEbM7ryRBwWHwgWHConwiFWImN
|
||||||
|
XYkCMwQQAQoAHRYhBC6ZFqS4exJw9J8ez+sX9nTHmkCiBQJii1dOAAoJEOsX9nTH
|
||||||
|
mkCiKu4P/0+je/GsBE69YVAwEFBrrfhEJtVUY8GSYM8WeFoq20SX8SqwltGLFB5R
|
||||||
|
kbZGgPLe0lJrgXzL01GqjU1tnXPbtI7LEq1FKiTkcKVdne140oX1XJuxmFWBcldG
|
||||||
|
1IetinhJt5EkaYc6nyk9iWgCz9n5YDq9Lr/9jLhFQAgawuicwAfuB13MGbJZYm/Z
|
||||||
|
5eSdxnivXbrGAYR2TI6/kcf0JLGR03fKbrEM8uBnfZNkKZELyYrBCj4FYODT++Sx
|
||||||
|
pDyrNr2/FlierISJrs272JT7ICg7Knjh6X7BSzsgK7JxyG2UtJKK7qJXYEqMtYhH
|
||||||
|
U1tdh4Ru6zSd4DklgrFHwuUNlTm8f1gPQ4I46p2RCQy2HMnA9WhJ8kwE2JOAj83y
|
||||||
|
87f9hDwjmn8Pf/iksXGRFQcfDqkOIUf2EnyBvxrzS57Dfvk6WCaH+OLKn1jMyxL8
|
||||||
|
BekCyk7L7wrMJI4yH51jyJySScGBg1CM0fYqLFWU/I+jw9bHROdCOK2LBajkAYgx
|
||||||
|
/eLG9WtS4etlNmpsxhSOi48wxa6kIOnD2rJGvQMALxhWJlVBEOMumv96qNCQCzHd
|
||||||
|
6NRLBWBva4qlKM5RlZreeVyArFtTiUmnp6RST4FrMpVgmhoeyos6P6GIG6QVPS2b
|
||||||
|
4dSRbeKmJFb15kZN8eYP4/BW7DMBzkFwtkRFDV5f/4W6CU6UIGzViQEcBBABCAAG
|
||||||
|
BQJii68XAAoJEFIKmZOhwFL4HY0IAKejouSXBCQWJmpdsA9TV2WVdMspUZHDGRAH
|
||||||
|
epQetm0+eX5Jh62ktuAZG+KCZ0bMdd8FJd6+RRpftUGhDibu9IFfyIK1v8jrChTU
|
||||||
|
/EwK8cPgLn4KveTgC58UrKt4NMpqcETUCrXHVwZzYK/sGZxxKVHhmnQJtfsvg7FV
|
||||||
|
7Ia9ohiUy1/rz9UlwLPUGmrDnSemSR9w1B3XeNN8SmTHQ5gpZt/rvsII0wMhvS7p
|
||||||
|
TXDpK5YNAqItC+7ZDaU1T21xeZx9OGSt/T2ETXb0rjIJAhKiSShqbiRonZHrxOcg
|
||||||
|
p0vSM1IAsgfnRihHu9YZ3Vj5ntegHh4fWdcTSZUx0n/YggArsyG0JEtvbnN0YW50
|
||||||
|
aW4gUGF2bG92IDx0aHJlc2hAbmdpbnguY29tPokB1AQTAQgAPgIbAwULCQgHAwUV
|
||||||
|
CgkICwUWAwIBAAIeAQIXgBYhBBPIKmO2A1dhVuMKTqDqmBtmsNlnBQJihN+8BQkQ
|
||||||
|
+q8XAAoJEKDqmBtmsNlncQ0L/0Yk1QejO06gWwV1J2eK9LmjbMofy2ujZBgW1IGt
|
||||||
|
/goo5R4PzC8lBBcsBtsKyN0Rsh7QdLrtKKLQrE/gpwMTMdKhJTdP/c5tUY3EwgId
|
||||||
|
BMYVaxArZQiWlPgSnoKuKydnn6Rb+Qtrhvb9pjn5XlGd/VSbAXZe8YTj6B8qjUa2
|
||||||
|
YY+IreyB6wkPN/ytV5vcocbS7mzXaibGPVT35e0Pl1Be+xbJkbTmJTSJCSPwyHm9
|
||||||
|
t2Vuq4e/c3fMwhOUbBjfssspR103vo91XO5sY+v2aQJOctNrv4ZpHMrwBH7MeqDI
|
||||||
|
SCWg9PICUv0ewHzAEGB+K0v342rVAzVNEctwM3Jic7fEJYsItdw+Zk4r8NYqACoR
|
||||||
|
CdSUEHqhP0DbYoWdthpUwD1J5ryWyKTCpTL4wNhKEMcNaiHH3qorSssyMHMFRPoX
|
||||||
|
Kw9Pcay+Uo8NXc2KKxhEHTbQts0jYUNcq0yuWHoNQ4vhKkf9CHBrb/vS22vfEJyd
|
||||||
|
6FX6ZRYK56A3EFAV8hK0BvZAw4kCMwQQAQoAHRYhBNZ4bOMD2akCKZjcbMhGTVSa
|
||||||
|
91wKBQJih4fSAAoJEMhGTVSa91wKipoQAI3wkWd8HLQ0w4IFA6W3/igrZTut9sV+
|
||||||
|
K5Veb61zCbJn6I2aO3ldSClMWpJfvG1OPKyaA6o4QfWt7KV9of8tu68k1rTrKKYe
|
||||||
|
qXe/0KNp9nzEwVmLASG2U6onwaCehGocvhWc9tE6MF2Gi+l+OufqsMzmx7gkdwE+
|
||||||
|
4d/VpY/i+eZzqNi1WWNUR45mrItvw84enGW2u4JOaFdSOE2PAbSTUOlcLxfC9yCo
|
||||||
|
lxAkCsy+CsXM8WKlIDH8GpWh/mWyqjoAhZhrlGhdABjygqFAOrDhIaecc8eSOcD3
|
||||||
|
6MQvhj/y1kh0Fe0rMCSdxUWtSjv+Sw5g1IG6GxhsqFxunxfGDpdbaLnyTQWahDfi
|
||||||
|
5OsOFl6JbPFiTaF9Xqz+8r0hiwusT4AJvM5M+q18f5dNCeqVKmuAn3BVBw4RdG62
|
||||||
|
WXt4q6uE5rDI513dR8t84dTgOr9+tHKh5TJqw46aI+kMe36z7FPXBgDsGSkNtM4J
|
||||||
|
BYdZzxSoJCfsGCjlfapkLHrvI+S7AP2952WfYy36uuxBiuTp3vCghvKkXZUeN2kh
|
||||||
|
P++0Zo4OjZGOllhab1X5xZGO8AjWeei4pq66Ys94Veidw5VRi/eWyvB3OhfCq9fb
|
||||||
|
qZIKUfbgTu0y7vOEWWY9wQml12gpxQfkcI72NTiNMCH268WZoXYQJp0+NZtxjsHQ
|
||||||
|
PdhNxQOaJPqziQEzBBABCAAdFiEEcziXMGntP0Q/TTffpk/VsXrbOagFAmKLQzAA
|
||||||
|
CgkQpk/VsXrbOairRggArvsikhDrA1d/x1BXnzOxE2sznq/d84QCKMSQpavrzXHF
|
||||||
|
LQF/qIB+ePA4bmzwvTxQup7yTLK3mQDl0rejXEQMnXHvgfH73c6l6TdAwsoLmrpt
|
||||||
|
oGNzfzJsbiKD2hJT9jJVnipuqqOA7hPT73TA5KM4GzPupFTadB57lDxzzcRfALXi
|
||||||
|
t5Qa6A83tLelQXLOWP6IdyPjraa/kva5jYsMavZU0xWTx9nPeGCwqAnqdEN4Hp8K
|
||||||
|
WKYn9EzkBOL6pPB7GyG/G20ocTCv/ZCJMkamAxjprUovu9BUEg5fCcHrSBtsgGE0
|
||||||
|
doPfqyOb4tCofZ8aXZYIu3+BEcNO0e5la+eW0YYYPIkCMwQQAQoAHRYhBEHbknE9
|
||||||
|
O/S/8+6RBpxef6L1SXfUBQJih4xhAAoJEJxef6L1SXfUb8AQAML5vwKOTw6Bn0tA
|
||||||
|
1ypo6DmlJUWalGgEkFheUC02s+BT+bL/fMsiXd6dBHHl/93bVBQBL/AjVBVv7viQ
|
||||||
|
kfQLLk7iQmEQ/mljvImGkA/W+vyHKDue6n79Ccjfx/ECQB4Y8mmFhOqhDjEC6oR6
|
||||||
|
ny77QbqmzvjkhfncD26cJq+qRGnE7EwuQI49bR1deQGxr5apqx5XRbf+GPnXlPTc
|
||||||
|
nKxctRsw6PLOjFoyGhBnvC/rEzBUx+wE7jK+bY1TSdW8x91LA/SseWqsmEFzbZRt
|
||||||
|
KKaHE9wD2DB9UvdBAjXdBZvKQ35zSJRWQByODztI9ZcaOWopK3UtIhG/eNIaJGcD
|
||||||
|
9h3SaeVE8PcUkvZqhLtQf49KlUBc8/g6Nj1wqcBbHDXjbwzt9Qoh6uFyjMkbG3NP
|
||||||
|
BXn7cT8888fJ9Oi53XjjZEVKA88AdcqWpUZtyElNwGtj8IvJ0R9SMKR/7KIYPFWm
|
||||||
|
R04Uok+oj0wQABHkcLmYMUd8psw6aQWG7oybfgPokRChExigLWrCJbYd00banL18
|
||||||
|
W6RxOQzceiKeZ5sZ5Y+yjQIrKxXKSLl42s8zol05TPScnBn+SAWigG4eEEJhT2by
|
||||||
|
2WqbhCG9snN9/YMlY8MffOFnD05ps40CSdSCsRgcmaqxgjy75h/z5LYO4HnHwPdY
|
||||||
|
p2ysNzlruScewHvijYJhEKxo17lBiQIzBBABCgAdFiEELpkWpLh7EnD0nx7P6xf2
|
||||||
|
dMeaQKIFAmKLV00ACgkQ6xf2dMeaQKLLQg//etbDTflbm+HbxI/YyNQhyQfk7icE
|
||||||
|
ytLL+wT9zDW9iq3AMdaPZwT690CsJhr7yzqjk0AGoMyuPfntvcvYb1mPTObXHMzh
|
||||||
|
Rh7+tViPixkJd3hnjSrPBEOkpAghk6xWMx1wldZ9x5XyJ0yC+toBkSaB/KIQeRG2
|
||||||
|
8/jHtxIQKvPGL28gUjdzW+jopSA4x6gSZAgQLyfsjoUHcMrRJXrwWcmSe8faD8qX
|
||||||
|
XD4z4hN3wQg6olSuaxLM7OoNgbiEjKaL1LaX/xzvC0lGs9o2JBfNFDrng9Y/fZ4o
|
||||||
|
9aGqx7AZey+4wTKjXqbdEqfDiHfzHxkLBunPxSjJAploOcuvhNOQAY7tv19/mYY1
|
||||||
|
UoILY9ninCrXthe9ZqhaXxhRhqYhzrE8svF+R01I/U+N4985AnDKRkJ944pZfeh1
|
||||||
|
wYzEZOPXWvvTsiBLbgi9LuAzoFjA4WJsJBp4AP/U7DtsuhMTmxyBJa+zg8PHj1Ew
|
||||||
|
jBYYuE++ulsilS+76sQawT5KbszpYmEDJiQUuEJkujPQ+hGzuuocoqHrM/IcoAoy
|
||||||
|
i5I/JMAYRqCQfGMFjirmVj3c01jgsOYl7ZgchtCBJfG8V6rlYdTq2FTdaLYdleZC
|
||||||
|
kS7N4jtm+6/KEsf6ukeGNEMbsxTSPHq4RL13eSitRd9Ms+ukSZFFgE0rEiztcdxQ
|
||||||
|
h1PeaEVaxHaSSWiJARwEEAEIAAYFAmKLrxcACgkQUgqZk6HAUvihvAgAk1ETByL3
|
||||||
|
FZtIlk8scREfwzyqyXuSYWdJ5ED61fKnpcfwGKsOkd+4MwHOSgvxPdnLhBEsMkNq
|
||||||
|
sV82EqX7lTIGoFBLTeW8ZGAxmt/88j3z6mnm33lSTreeVwsQ+B9ZKVAv4E/liDVm
|
||||||
|
6iq9aYJni4FUoFjFhtgsvJUNs3oX0gaEXdaCqzIDysU2m01vOPx0HTeI95+HdlJW
|
||||||
|
Iwwh/cp+YuclHppI+b0OQKJwLQDVyudzX0JYTWvgE/NCS6/rP8fjaqtFMWwL0tZl
|
||||||
|
3JJAoLSAuhPyc+V2LkRVoETQGF9nRil2zSyy77Stfm2fRGstnQGOrNTud06el68/
|
||||||
|
hYfWcCqooHNiMrkBjQRa8DInAQwA2Rk7UdUgpCWl+BMz9B9eKj0XtsNEciXHHKnS
|
||||||
|
FYaSNCWNwib/FsiMfcPFh7xwUTof7e7HBFkvv0QEMCEp7R1MVNBfMiGtG1ICFIt9
|
||||||
|
nByznPsRk4VvbY/prK4DZy2AmlwhNcT2pQO3AascgsCWdf6G+wcwnHg9tWCp0Xs9
|
||||||
|
BNXuppmcRrpP4M1PPRIVeG1jeVXvuSHO2HjqPSXP5DhGgSGN7uLOhiLTnPINd186
|
||||||
|
vf6tqRdqYw3g0W1ImEjGXHeNQfnieIWdU3X4C8KTEPsV3lvtmSAQCoge0CyKfz4c
|
||||||
|
ORi4j8Edp8JpDQlbAThe529+R3eKUw7I/3ESxJBdqzLE/ItWvAcbGEserLDFrg9J
|
||||||
|
1ojiKhsw3TVcDk+HIDzVakMz6HTd4ExSijMqTehzgKSVHDL+l2jc0f4VSecI+xwC
|
||||||
|
3/kNsNTBpiPoUYtXBbJllHgQAakREkSKQBas02eqRu8SlQ3yEn87zTtNW8L7xpe7
|
||||||
|
ZVtxwUgp40PUrsb8uMDJG7ZP5rhLABEBAAGJAbwEGAEIACYCGwwWIQQTyCpjtgNX
|
||||||
|
YVbjCk6g6pgbZrDZZwUCYoTfwQUJEPqvGgAKCRCg6pgbZrDZZ3oEDAC1J3BVwlkX
|
||||||
|
+eoo8VsXAYxMXm8kIaTqOn/tHMOYepK+cWUdHaeCH3N8LigwN4Ve2LtzLBqN3WRA
|
||||||
|
xFNy0DIzdBfA7QdcAoDLnB2FNrWTmwvC9nXkCogFfSCq7c+1oFHdn7M/VZNU4o0n
|
||||||
|
hVOnqM8NLGcgzX3K3hr+WLYUgNQ9G6x0N9VU43tqVwJhvNv4pyiRpRdLlmhOEf35
|
||||||
|
a/sWE1dttSKdrBhyzTbptw4dXr4lUpvlswWs+dLpSPPhWAuifORv/amWh3bxIxYE
|
||||||
|
qE4o5NI/PQLJvJJLsJvMIIjpKlAGBJg5h3WCiIAkl7H+BesOUIIg8ava5ZUyjlFd
|
||||||
|
szBMaBosZvRgFAlfnYhSGqzhip6PvXfK1YokNv7kqw43c0f1SmtSXZR43SRv/4vp
|
||||||
|
XG7IqtTuqgSwn1qDJgr4yfs8QQykO/jG+cz7X+5OKSAulWi9OoqLyDWlsm3WccPI
|
||||||
|
cJfbm71P+I/ha7ESVQfOxC92fQ7HQAboj7NhecJ4RLqjzrWSHmPGClI=
|
||||||
|
=t1B0
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue