Compare commits

...

No commits in common. 'c9' and 'i9' have entirely different histories.
c9 ... i9

@ -18,7 +18,6 @@ low tolerance to flooding attempts.
src/http/v2/ngx_http_v2.h | 2 ++
2 files changed, 17 insertions(+)
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 3611a2e..291677a 100644
--- a/src/http/v2/ngx_http_v2.c
@ -72,3 +71,6 @@ index 3492297..6a7aaa6 100644
ngx_uint_t priority_limit;
ngx_uint_t pushing;
--
2.31.1

@ -1,183 +0,0 @@
From f3bcc0bcfb6eda3f4874fe2531d546ba724c518c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 12 Jun 2024 12:49:28 +0200
Subject: [PATCH] Optimized chain link usage
Previously chain links could sometimes be dropped instead of being reused,
which could result in increased memory consumption during long requests.
---
src/core/ngx_output_chain.c | 10 ++++++++--
src/http/modules/ngx_http_grpc_module.c | 5 ++++-
.../modules/ngx_http_gunzip_filter_module.c | 18 ++++++++++++++----
src/http/modules/ngx_http_gzip_filter_module.c | 10 +++++++---
src/http/modules/ngx_http_ssi_filter_module.c | 8 ++++++--
src/http/modules/ngx_http_sub_filter_module.c | 8 ++++++--
6 files changed, 45 insertions(+), 14 deletions(-)
diff --git a/src/core/ngx_output_chain.c b/src/core/ngx_output_chain.c
index 5c3dbe8..4aa1b02 100644
--- a/src/core/ngx_output_chain.c
+++ b/src/core/ngx_output_chain.c
@@ -121,7 +121,10 @@ ngx_output_chain(ngx_output_chain_ctx_t *ctx, ngx_chain_t *in)
ngx_debug_point();
- ctx->in = ctx->in->next;
+ cl = ctx->in;
+ ctx->in = cl->next;
+
+ ngx_free_chain(ctx->pool, cl);
continue;
}
@@ -207,7 +210,10 @@ ngx_output_chain(ngx_output_chain_ctx_t *ctx, ngx_chain_t *in)
/* delete the completed buf from the ctx->in chain */
if (ngx_buf_size(ctx->in->buf) == 0) {
- ctx->in = ctx->in->next;
+ cl = ctx->in;
+ ctx->in = cl->next;
+
+ ngx_free_chain(ctx->pool, cl);
}
cl = ngx_alloc_chain_link(ctx->pool);
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
index 53bc547..9f13089 100644
--- a/src/http/modules/ngx_http_grpc_module.c
+++ b/src/http/modules/ngx_http_grpc_module.c
@@ -1230,7 +1230,7 @@ ngx_http_grpc_body_output_filter(void *data, ngx_chain_t *in)
ngx_buf_t *b;
ngx_int_t rc;
ngx_uint_t next, last;
- ngx_chain_t *cl, *out, **ll;
+ ngx_chain_t *cl, *out, *ln, **ll;
ngx_http_upstream_t *u;
ngx_http_grpc_ctx_t *ctx;
ngx_http_grpc_frame_t *f;
@@ -1458,7 +1458,10 @@ ngx_http_grpc_body_output_filter(void *data, ngx_chain_t *in)
last = 1;
}
+ ln = in;
in = in->next;
+
+ ngx_free_chain(r->pool, ln);
}
ctx->in = in;
diff --git a/src/http/modules/ngx_http_gunzip_filter_module.c b/src/http/modules/ngx_http_gunzip_filter_module.c
index c1341f5..5d170a1 100644
--- a/src/http/modules/ngx_http_gunzip_filter_module.c
+++ b/src/http/modules/ngx_http_gunzip_filter_module.c
@@ -333,6 +333,8 @@ static ngx_int_t
ngx_http_gunzip_filter_add_data(ngx_http_request_t *r,
ngx_http_gunzip_ctx_t *ctx)
{
+ ngx_chain_t *cl;
+
if (ctx->zstream.avail_in || ctx->flush != Z_NO_FLUSH || ctx->redo) {
return NGX_OK;
}
@@ -344,8 +346,11 @@ ngx_http_gunzip_filter_add_data(ngx_http_request_t *r,
return NGX_DECLINED;
}
- ctx->in_buf = ctx->in->buf;
- ctx->in = ctx->in->next;
+ cl = ctx->in;
+ ctx->in_buf = cl->buf;
+ ctx->in = cl->next;
+
+ ngx_free_chain(r->pool, cl);
ctx->zstream.next_in = ctx->in_buf->pos;
ctx->zstream.avail_in = ctx->in_buf->last - ctx->in_buf->pos;
@@ -374,6 +379,7 @@ static ngx_int_t
ngx_http_gunzip_filter_get_buf(ngx_http_request_t *r,
ngx_http_gunzip_ctx_t *ctx)
{
+ ngx_chain_t *cl;
ngx_http_gunzip_conf_t *conf;
if (ctx->zstream.avail_out) {
@@ -383,8 +389,12 @@ ngx_http_gunzip_filter_get_buf(ngx_http_request_t *r,
conf = ngx_http_get_module_loc_conf(r, ngx_http_gunzip_filter_module);
if (ctx->free) {
- ctx->out_buf = ctx->free->buf;
- ctx->free = ctx->free->next;
+
+ cl = ctx->free;
+ ctx->out_buf = cl->buf;
+ ctx->free = cl->next;
+
+ ngx_free_chain(r->pool, cl);
ctx->out_buf->flush = 0;
diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
index b8c5ccc..1d17a6d 100644
--- a/src/http/modules/ngx_http_gzip_filter_module.c
+++ b/src/http/modules/ngx_http_gzip_filter_module.c
@@ -978,10 +978,14 @@ static void
ngx_http_gzip_filter_free_copy_buf(ngx_http_request_t *r,
ngx_http_gzip_ctx_t *ctx)
{
- ngx_chain_t *cl;
+ ngx_chain_t *cl, *ln;
+
+ for (cl = ctx->copied; cl; /* void */) {
+ ln = cl;
+ cl = cl->next;
- for (cl = ctx->copied; cl; cl = cl->next) {
- ngx_pfree(r->pool, cl->buf->start);
+ ngx_pfree(r->pool, ln->buf->start);
+ ngx_free_chain(r->pool, ln);
}
ctx->copied = NULL;
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index 6737965..a55f6e5 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -455,9 +455,13 @@ ngx_http_ssi_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
while (ctx->in || ctx->buf) {
if (ctx->buf == NULL) {
- ctx->buf = ctx->in->buf;
- ctx->in = ctx->in->next;
+
+ cl = ctx->in;
+ ctx->buf = cl->buf;
+ ctx->in = cl->next;
ctx->pos = ctx->buf->pos;
+
+ ngx_free_chain(r->pool, cl);
}
if (ctx->state == ssi_start_state) {
diff --git a/src/http/modules/ngx_http_sub_filter_module.c b/src/http/modules/ngx_http_sub_filter_module.c
index 6d3de59..456bb27 100644
--- a/src/http/modules/ngx_http_sub_filter_module.c
+++ b/src/http/modules/ngx_http_sub_filter_module.c
@@ -335,9 +335,13 @@ ngx_http_sub_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
while (ctx->in || ctx->buf) {
if (ctx->buf == NULL) {
- ctx->buf = ctx->in->buf;
- ctx->in = ctx->in->next;
+
+ cl = ctx->in;
+ ctx->buf = cl->buf;
+ ctx->in = cl->next;
ctx->pos = ctx->buf->pos;
+
+ ngx_free_chain(r->pool, cl);
}
if (ctx->buf->flush || ctx->buf->recycled) {
--
2.44.0

@ -0,0 +1,25 @@
From 6a08ad4a381f8c2e6fcf1299fd19f6482a55d922 Mon Sep 17 00:00:00 2001
From: Dmitry Samoylik <Dmitriy.Samoylik@softline.com>
Date: Tue, 13 Aug 2024 14:13:16 +0300
Subject: [PATCH] change NGX_HTTP_AUTOINDEX_NAME_LEN
---
src/http/modules/ngx_http_autoindex_module.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/http/modules/ngx_http_autoindex_module.c b/src/http/modules/ngx_http_autoindex_module.c
index 082bcb5..097a765 100644
--- a/src/http/modules/ngx_http_autoindex_module.c
+++ b/src/http/modules/ngx_http_autoindex_module.c
@@ -52,7 +52,7 @@ typedef struct {
#define NGX_HTTP_AUTOINDEX_PREALLOCATE 50
-#define NGX_HTTP_AUTOINDEX_NAME_LEN 50
+#define NGX_HTTP_AUTOINDEX_NAME_LEN 250
static ngx_buf_t *ngx_http_autoindex_html(ngx_http_request_t *r,
--
2.43.5

@ -2,12 +2,12 @@
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>The page is not found</title>
<title>Страница не найдена</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">
/*<![CDATA[*/
body {
background-color: #fff;
background-color: #8ec07c;
color: #000;
font-size: 0.9em;
font-family: sans-serif,helvetica;
@ -15,19 +15,19 @@
padding: 0;
}
:link {
color: #c00;
color: #0B2335;
}
:visited {
color: #c00;
color: #0B2335;
}
a:hover {
color: #f50;
color: #0069DA;
}
h1 {
text-align: center;
margin: 0;
padding: 0.6em 2em 0.4em;
background-color: #900;
background-color: #1F3D48;
color: #fff;
font-weight: normal;
font-size: 1.75em;
@ -39,7 +39,7 @@
}
h2 {
text-align: center;
background-color: #900;
background-color: #1F3D48;
font-size: 1.1em;
font-weight: bold;
color: #fff;
@ -64,7 +64,7 @@
}
img {
border: 2px solid #fff;
border: 2px solid #FAF5F5;
padding: 2px;
margin: 2px;
}
@ -80,27 +80,27 @@
</head>
<body>
<h1><strong>nginx error!</strong></h1>
<h1><strong>nginx, ошибка!</strong></h1>
<div class="content">
<h3>The page you are looking for is not found.</h3>
<h3>Страница, которую вы ищете, не найдена.</h3>
<div class="alert">
<h2>Website Administrator</h2>
<h2>Администратор Web-сайта</h2>
<div class="content">
<p>Something has triggered missing webpage on your
website. This is the default 404 error page for
<strong>nginx</strong> that is distributed with
Red Hat Enterprise Linux. It is located
<p>Что-то привело к отсутствию веб-страницы на вашем
сайте. Это страница ошибки 404 по умолчанию для
<strong>nginx</strong> которая распространяется с
МСВСфера. Она находится
<tt>/usr/share/nginx/html/404.html</tt></p>
<p>You should customize this error page for your own
site or edit the <tt>error_page</tt> directive in
the <strong>nginx</strong> configuration file
<p>Вы должны настроить эту страницу ошибки для своего
сайта или отредактировать директиву <tt>error_page</tt> в
файле конфигурации <strong>nginx</strong>
<tt>/etc/nginx/nginx.conf</tt>.</p>
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
<p>Для получения информации о МСВСфера, пожалуйста посетите <a href="https://www.msvsphere-os.ru/">веб-сайт Инферит МСВСфера"</a>. Документация по МСВСфера <a href="https://docs.msvsphere-os.ru/">доступна на веб-сайте дистрибутива МСВСфера</a>.</p>
</div>
</div>
@ -110,10 +110,10 @@
src="nginx-logo.png"
alt="[ Powered by nginx ]"
width="121" height="32" /></a>
<a href="http://www.redhat.com/"><img
src="poweredby.png"
alt="[ Powered by Red Hat Enterprise Linux ]"
width="88" height="31" /></a>
<a href="https://www.msvsphere-os.ru/"><img
src="icons/poweredby.png"
alt="[ Powered by MSVSphere ]"
width="294" height="31" /></a>
</div>
</div>
</body>

@ -2,12 +2,12 @@
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>The page is temporarily unavailable</title>
<title>Страница временно недоступна</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">
/*<![CDATA[*/
body {
background-color: #fff;
background-color: #8ec07c;
color: #000;
font-size: 0.9em;
font-family: sans-serif,helvetica;
@ -15,19 +15,19 @@
padding: 0;
}
:link {
color: #c00;
color: #0B2335;
}
:visited {
color: #c00;
color: #0B2335;
}
a:hover {
color: #f50;
color: #0069DA;
}
h1 {
text-align: center;
margin: 0;
padding: 0.6em 2em 0.4em;
background-color: #900;
background-color: #1F3D48;
color: #fff;
font-weight: normal;
font-size: 1.75em;
@ -39,7 +39,7 @@
}
h2 {
text-align: center;
background-color: #900;
background-color: #1F3D48;
font-size: 1.1em;
font-weight: bold;
color: #fff;
@ -80,27 +80,27 @@
</head>
<body>
<h1><strong>nginx error!</strong></h1>
<h1><strong>nginx ошибка!</strong></h1>
<div class="content">
<h3>The page you are looking for is temporarily unavailable. Please try again later.</h3>
<h3>Страница, которую вы ищете, временно недоступна. Пожалуйста, повторите попытку позже.</h3>
<div class="alert">
<h2>Website Administrator</h2>
<h2>Администратор Web-сайта</h2>
<div class="content">
<p>Something has triggered missing webpage on your
website. This is the default error page for
<strong>nginx</strong> that is distributed with
Red Hat Enterprise Linux. It is located
<p>Что-то привело к отсутствию веб-страницы на вашем
сайте. Это страница ошибок по умолчанию для
<strong>nginx</strong>, которая распространяется с
МСВСфера. Она находится
<tt>/usr/share/nginx/html/50x.html</tt></p>
<p>You should customize this error page for your own
site or edit the <tt>error_page</tt> directive in
the <strong>nginx</strong> configuration file
<p>Вы должны настроить эту страницу ошибки для своего
сайта или отредактировать директиву <tt>error_page</tt> в
файле конфигурации <strong>nginx</strong>
<tt>/etc/nginx/nginx.conf</tt>.</p>
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
<p>Для получения информации о МСВСфера, пожалуйста посетите <a href="https://www.msvsphere-os.ru/">веб-сайт Инферит МСВСфера"</a>. Документация по МСВСфера <a href="https://docs.msvsphere-os.ru/">доступна на веб-сайте дистрибутива МСВСфера</a>.</p>
</div>
</div>
@ -110,10 +110,10 @@
src="nginx-logo.png"
alt="[ Powered by nginx ]"
width="121" height="32" /></a>
<a href="http://www.redhat.com/"><img
src="poweredby.png"
alt="[ Powered by Red Hat Enterprise Linux ]"
width="88" height="31" /></a>
<a href="https://www.msvsphere-os.ru/"><img
src="icons/poweredby.png"
alt="[ Powered by MSVSphere ]"
width="294" height="31" /></a>
</div>
</div>
</body>

@ -41,7 +41,7 @@
Name: nginx
Epoch: 1
Version: 1.20.1
Release: 16%{?dist}.1
Release: 14%{?dist}.1.inferit.1
Summary: A high performance web server and reverse proxy server
# BSD License (two clause)
@ -91,11 +91,10 @@ Patch5: 0006-Fix-ALPACA-security-issue.patch
# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2028781
Patch6: 0007-Enable-TLSv1.3-by-default.patch
# security patch - https://issues.redhat.com/browse/RHEL-12518
# security fix - https://issues.redhat.com/browse/RHEL-12516
Patch7: 0008-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch
# upstream patch - https://issues.redhat.com/browse/RHEL-40075
Patch8: 0009-Optimized-chain-link-usage.patch
Patch8: 0009-change-NGX_HTTP_AUTOINDEX_NAME_LEN.patch
BuildRequires: make
BuildRequires: gcc
@ -401,6 +400,9 @@ ln -s ../../doc/HTML/en-US \
%else
ln -s ../../testpage/index.html \
%{buildroot}%{_datadir}/nginx/html/index.html
pushd $RPM_BUILD_ROOT%{_datadir}/nginx/html/
ln -s ../../pixmaps/test-page-background.png .
popd
%endif
install -p -m 0644 %{SOURCE102} \
%{buildroot}%{_datadir}/nginx/html
@ -608,12 +610,26 @@ fi
%changelog
* Tue Jul 16 2024 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-16.1
- Resolves: RHEL-48791 - nginx worker processes memory leak
* Tue Aug 13 2024 Dmitry Samoylik <Dmitriy.Samoylik@softline.com> - 1:1.20.1-14.1.inferit.1
- change NGX_HTTP_AUTOINDEX_NAME_LEN
* Mon Oct 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-16
- Resolves: RHEL-12518 - nginx: HTTP/2: Multiple HTTP/2 enabled web servers are
vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
* Wed Oct 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-14.1.inferit
- Resolves: RHEL-12516 - nginx: HTTP/2: Multiple HTTP/2 enabled web
servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
* Wed Sep 13 2023 Arkady L. Shane <ashejn@msvsphere.ru> - 1:1.20.1-14.inferit.1
- Change urls from msvsphere.ru to msvsphere-os.ru
* Thu Jun 01 2023 Sergey Cherevko <s.cherevko@msvsphere.ru> - 1:1.20.1-14.inferit
- Rebuilt for MSVSphere 9.2
* Mon Apr 03 2023 Alexey Lyubimov <a.lyubimov@msvsphere.ru> - 1:1.20.1-13.inferit
- MSVSphere 9.1 changes, debranding and localization added.
- Symlinking test-page-background.png from system-logos-httpd package for
debranded index.html
* Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1.20.1-13
- Rebuilt for MSVSphere 9.1.
* Thu Nov 24 2022 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-14
- Resolves: #2086527 - Fix logrotate config and nginx log dir permissions

Loading…
Cancel
Save