Skip to content

Commit 452faf7

Browse files
GackoGacko
authored
NGINX: Bump to OpenResty v1.25.3.2. (#13531)
1 parent fb26877 commit 452faf7

7 files changed

+154
-34
lines changed

‎images/nginx/rootfs/build.sh

Lines changed: 33 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -24,85 +24,85 @@ export NGINX_VERSION=1.25.5
2424
export NDK_VERSION=v0.3.3
2525

2626
# Check for recent changes: https://github.com/openresty/set-misc-nginx-module/compare/v0.33...master
27-
export SETMISC_VERSION=796f5a3e518748eb29a93bd450324e0ad45b704e
27+
export SETMISC_VERSION=v0.33
2828

2929
# Check for recent changes: https://github.com/openresty/headers-more-nginx-module/compare/v0.37...master
3030
export MORE_HEADERS_VERSION=v0.37
3131

32-
# Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...atomx:master
32+
# Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...master
3333
export NGINX_DIGEST_AUTH=v1.0.0
3434

35-
# Check for recent changes: https://github.com/yaoweibin/ngx_http_substitutions_filter_module/compare/v0.6.4...master
35+
# Check for recent changes: https://github.com/yaoweibin/ngx_http_substitutions_filter_module/compare/e12e965ac1837ca709709f9a26f572a54d83430e...master
3636
export NGINX_SUBSTITUTIONS=e12e965ac1837ca709709f9a26f572a54d83430e
3737

38-
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.3...master
39-
export MODSECURITY_VERSION=v1.0.3
38+
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.4...master
39+
export MODSECURITY_VERSION=v1.0.4
4040

4141
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.14...v3/master
4242
export MODSECURITY_LIB_VERSION=v3.0.14
4343

44-
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v4.10.0...main
45-
export OWASP_MODSECURITY_CRS_VERSION=v4.10.0
44+
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v4.15.0...main
45+
export OWASP_MODSECURITY_CRS_VERSION=v4.15.0
4646

47-
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.26``...master
47+
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.26...master
4848
export LUA_NGX_VERSION=v0.10.26
4949

5050
# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/bea8a0c0de94cede71554f53818ac0267d675d63...master
5151
export LUA_STREAM_NGX_VERSION=bea8a0c0de94cede71554f53818ac0267d675d63
5252

53-
# Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/8aa93ead98ba2060d4efd594ae33a35d153589bf...master
54-
export LUA_UPSTREAM_VERSION=542be0893543a4e42d89f6dd85372972f5ff2a36
53+
# Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/v0.07...master
54+
export LUA_UPSTREAM_VERSION=v0.07
5555

56-
# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.13...openresty:master
56+
# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.13...master
5757
export LUA_CJSON_VERSION=2.1.0.13
5858

59-
# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/a607a41a8115fecfc05b5c283c81532a3d605425...master
60-
export GEOIP2_VERSION=a607a41a8115fecfc05b5c283c81532a3d605425
59+
# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/445df24ef3781e488cee3dfe8a1e111997fc1dfe...master
60+
export GEOIP2_VERSION=445df24ef3781e488cee3dfe8a1e111997fc1dfe
6161

62-
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20240314...v2.1-agentzh
63-
export LUAJIT_VERSION=v2.1-20240314
62+
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20231117.1...v2.1-agentzh
63+
export LUAJIT_VERSION=v2.1-20231117.1
6464

65-
# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/1cd4363c0a239afe4765ec607dcfbbb4e5900eea...master
66-
export LUA_RESTY_BALANCER=1cd4363c0a239afe4765ec607dcfbbb4e5900eea
65+
# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/v0.05...master
66+
export LUA_RESTY_BALANCER=v0.05
6767

68-
# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/99e7578465b40f36f596d099b82eab404f2b42ed...master
69-
export LUA_RESTY_CACHE=99e7578465b40f36f596d099b82eab404f2b42ed
68+
# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.13...master
69+
export LUA_RESTY_CACHE=v0.13
7070

71-
# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.27...master
71+
# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.28...master
7272
export LUA_RESTY_CORE=v0.1.28
7373

7474
# Check for recent changes: https://github.com/cloudflare/lua-resty-cookie/compare/f418d77082eaef48331302e84330488fdc810ef4...master
7575
export LUA_RESTY_COOKIE_VERSION=f418d77082eaef48331302e84330488fdc810ef4
7676

77-
# Check for recent changes: https://github.com/openresty/lua-resty-dns/compare/8bb53516e2933e61c317db740a9b7c2048847c2f...master
78-
export LUA_RESTY_DNS=8bb53516e2933e61c317db740a9b7c2048847c2f
77+
# Check for recent changes: https://github.com/openresty/lua-resty-dns/compare/v0.23...master
78+
export LUA_RESTY_DNS=v0.23
7979

80-
# Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.17.1...master
81-
export LUA_RESTY_HTTP=v0.17.1
80+
# Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.17.2...master
81+
export LUA_RESTY_HTTP=v0.17.2
8282

8383
# Check for recent changes: https://github.com/openresty/lua-resty-lock/compare/v0.09...master
84-
export LUA_RESTY_LOCK=405d0bf4cbfa74d742c6ed3158d442221e6212a9
84+
export LUA_RESTY_LOCK=v0.09
8585

8686
# Check for recent changes: https://github.com/openresty/lua-resty-upload/compare/v0.11...master
87-
export LUA_RESTY_UPLOAD_VERSION=979372cce011f3176af3c9aff53fd0e992c4bfd3
87+
export LUA_RESTY_UPLOAD_VERSION=v0.11
8888

8989
# Check for recent changes: https://github.com/openresty/lua-resty-string/compare/v0.15...master
90-
export LUA_RESTY_STRING_VERSION=6f1bc21d86daef804df3cc34d6427ef68da26844
90+
export LUA_RESTY_STRING_VERSION=v0.15
9191

9292
# Check for recent changes: https://github.com/openresty/lua-resty-memcached/compare/v0.17...master
93-
export LUA_RESTY_MEMCACHED_VERSION=2f02b68bf65fa2332cce070674a93a69a6c7239b
93+
export LUA_RESTY_MEMCACHED_VERSION=v0.17
9494

9595
# Check for recent changes: https://github.com/openresty/lua-resty-redis/compare/v0.30...master
96-
export LUA_RESTY_REDIS_VERSION=8641b9f1b6f75cca50c90cf8ca5c502ad8950aa8
96+
export LUA_RESTY_REDIS_VERSION=v0.30
9797

98-
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/v0.6.1...master
98+
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/3e93c53eb8c9884efe939ef070486a0e507cc5be...master
9999
export LUA_RESTY_IPMATCHER_VERSION=3e93c53eb8c9884efe939ef070486a0e507cc5be
100100

101101
# Check for recent changes: https://github.com/ElvinEfendi/lua-resty-global-throttle/compare/v0.2.0...main
102102
export LUA_RESTY_GLOBAL_THROTTLE_VERSION=v0.2.0
103103

104-
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.1.7...master
105-
export MIMALOC_VERSION=v2.1.7
104+
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.2.4...main
105+
export MIMALOC_VERSION=v2.2.4
106106

107107
# Check for recent changes: https://github.com/open-telemetry/opentelemetry-cpp/compare/v1.18.0...main
108108
export OPENTELEMETRY_CPP_VERSION=v1.18.0
@@ -326,8 +326,7 @@ git config --global --add core.compression -1
326326
cd "$BUILD_PATH"
327327
git clone --depth=100 https://github.com/google/ngx_brotli.git
328328
cd ngx_brotli
329-
# https://github.com/google/ngx_brotli/issues/156
330-
git reset --hard 63ca02abdcf79c9e788d2eedcc388d2335902e52
329+
git reset --hard a71f9312c2deb28875acc7bacfdd5695a111aa53
331330
git submodule init
332331
git submodule update
333332

‎images/nginx/rootfs/patches/28_nginx-1.25.3-CVE-2025-23419.patch

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
2+
index 013b7158e..a7a3ee5b0 100644
3+
--- a/src/http/ngx_http_request.c
4+
+++ b/src/http/ngx_http_request.c
5+
@@ -909,6 +909,26 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
6+
goto done;
7+
}
8+
9+
+ sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module);
10+
+
11+
+#if (defined TLS1_3_VERSION \
12+
+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
13+
+ /*
14+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
15+
+ * but servername being negotiated in every TLSv1.3 handshake
16+
+ * is only returned in OpenSSL 1.1.1+ as well
17+
+ */
18+
+ if (sscf->verify) {
19+
+ const char *hostname;
20+
+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
21+
+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
22+
+ c->ssl->handshake_rejected = 1;
23+
+ *ad = SSL_AD_ACCESS_DENIED;
24+
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
25+
+ }
26+
+ }
27+
+#endif
28+
+
29+
hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
30+
if (hc->ssl_servername == NULL) {
31+
goto error;
32+
@@ -922,8 +942,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
33+
34+
ngx_set_connection_log(c, clcf->error_log);
35+
36+
- sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
37+
-
38+
c->ssl->buffer_size = sscf->buffer_size;
39+
40+
if (sscf->ssl.ctx) {

‎images/nginx/rootfs/patches/28_nginx-1.25.3-upstream_timeout_fields.patch renamed to ‎images/nginx/rootfs/patches/29_nginx-1.25.3-upstream_timeout_fields.patch

File renamed without changes.

‎images/nginx/rootfs/patches/29_nginx-1.25.3-safe_resolver_ipv6_option.patch renamed to ‎images/nginx/rootfs/patches/30_nginx-1.25.3-safe_resolver_ipv6_option.patch

File renamed without changes.

‎images/nginx/rootfs/patches/30_nginx-1.25.3-socket_cloexec.patch renamed to ‎images/nginx/rootfs/patches/31_nginx-1.25.3-socket_cloexec.patch

File renamed without changes.

‎images/nginx/rootfs/patches/31_nginx-1.25.3-reuseport_close_unused_fds.patch renamed to ‎images/nginx/rootfs/patches/32_nginx-1.25.3-reuseport_close_unused_fds.patch

File renamed without changes.

‎images/nginx/rootfs/patches/33_nginx-1.25.3-proc_exit_handler.patch

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
commit 29cafd35fb2b7cff759fb4c9b84fa4600875321f
2+
Author: lijunlong <lijunlong@openresty.com>
3+
Date: Sun Apr 11 14:34:47 2021 +0800
4+
5+
feature: added a process exit callback point.
6+
7+
diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
8+
index d7479fa4..c421e43c 100644
9+
--- a/src/core/ngx_cycle.c
10+
+++ b/src/core/ngx_cycle.c
11+
@@ -255,6 +255,7 @@ ngx_init_cycle(ngx_cycle_t *old_cycle)
12+
}
13+
14+
15+
+ ngx_proc_exit_top_handler = ngx_proc_exit_def_handler;
16+
conf.ctx = cycle->conf_ctx;
17+
conf.cycle = cycle;
18+
conf.pool = pool;
19+
diff --git a/src/os/unix/ngx_process.c b/src/os/unix/ngx_process.c
20+
index 15680237..9d2e81c5 100644
21+
--- a/src/os/unix/ngx_process.c
22+
+++ b/src/os/unix/ngx_process.c
23+
@@ -34,6 +34,7 @@ ngx_int_t ngx_process_slot;
24+
ngx_socket_t ngx_channel;
25+
ngx_int_t ngx_last_process;
26+
ngx_process_t ngx_processes[NGX_MAX_PROCESSES];
27+
+ngx_proc_exit_pt ngx_proc_exit_top_handler;
28+
29+
30+
ngx_signal_t signals[] = {
31+
@@ -83,6 +84,13 @@ ngx_signal_t signals[] = {
32+
};
33+
34+
35+
+void
36+
+ngx_proc_exit_def_handler(ngx_pid_t pid)
37+
+{
38+
+ /* do nothing */
39+
+}
40+
+
41+
+
42+
ngx_pid_t
43+
ngx_spawn_process(ngx_cycle_t *cycle, ngx_spawn_proc_pt proc, void *data,
44+
char *name, ngx_int_t respawn)
45+
@@ -557,6 +565,7 @@ ngx_process_get_status(void)
46+
}
47+
48+
ngx_unlock_mutexes(pid);
49+
+ ngx_proc_exit_top_handler(pid);
50+
}
51+
}
52+
53+
diff --git a/src/os/unix/ngx_process.h b/src/os/unix/ngx_process.h
54+
index 3986639b..c5972541 100644
55+
--- a/src/os/unix/ngx_process.h
56+
+++ b/src/os/unix/ngx_process.h
57+
@@ -18,6 +18,8 @@ typedef pid_t ngx_pid_t;
58+
#define NGX_INVALID_PID -1
59+
60+
typedef void (*ngx_spawn_proc_pt) (ngx_cycle_t *cycle, void *data);
61+
+#define NGX_HAVE_PROC_EXIT 1
62+
+typedef void (*ngx_proc_exit_pt)(ngx_pid_t pid);
63+
64+
typedef struct {
65+
ngx_pid_t pid;
66+
@@ -66,6 +67,7 @@ ngx_pid_t ngx_spawn_process(ngx_cycle_t *cycle,
67+
ngx_pid_t ngx_execute(ngx_cycle_t *cycle, ngx_exec_ctx_t *ctx);
68+
ngx_int_t ngx_init_signals(ngx_log_t *log);
69+
void ngx_debug_point(void);
70+
+void ngx_proc_exit_def_handler(ngx_pid_t pid);
71+
72+
73+
#if (NGX_HAVE_SCHED_YIELD)
74+
@@ -85,6 +87,7 @@ extern ngx_socket_t ngx_channel;
75+
extern ngx_int_t ngx_process_slot;
76+
extern ngx_int_t ngx_last_process;
77+
extern ngx_process_t ngx_processes[NGX_MAX_PROCESSES];
78+
+extern ngx_proc_exit_pt ngx_proc_exit_top_handler;
79+
80+
81+
#endif /* _NGX_PROCESS_H_INCLUDED_ */

0 commit comments

Comments
 (0)