Hello community, here is the log from the commit of package nginx for openSUSE:Factory checked in at 2019-10-23 15:51:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/nginx (Old) and /work/SRC/openSUSE:Factory/.nginx.new.2352 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nginx" Wed Oct 23 15:51:47 2019 rev:40 rq:741950 version:1.17.4 Changes: -------- --- /work/SRC/openSUSE:Factory/nginx/nginx.changes 2019-08-15 12:29:45.550472422 +0200 +++ /work/SRC/openSUSE:Factory/.nginx.new.2352/nginx.changes 2019-10-23 15:51:47.918756110 +0200 @@ -1,0 +2,20 @@ +Mon Oct 21 22:27:00 UTC 2019 - Илья Индиго <[email protected]> + +- Update to 1.17.4 + * https://nginx.org/en/CHANGES + * Better detection of incorrect client behavior in HTTP/2. + * In handling of not fully read client request body when + returning errors in HTTP/2. + * The "worker_shutdown_timeout" directive might not work when + using HTTP/2. + * A segmentation fault might occur in a worker process when + using HTTP/2 and the "proxy_request_buffering" directive. + * The ECONNABORTED error log level was "crit" instead of + "error" on Windows when using SSL. + * nginx ignored extra data when using chunked transfer + encoding. + * nginx always returned the 500 error if the "return" directive + was used and an error occurred during reading client request body. + * In memory allocation error handling. + +------------------------------------------------------------------- Old: ---- nginx-1.17.3.tar.gz nginx-1.17.3.tar.gz.asc New: ---- nginx-1.17.4.tar.gz nginx-1.17.4.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ nginx.spec ++++++ --- /var/tmp/diff_new_pack.kc5NsL/_old 2019-10-23 15:51:49.690758025 +0200 +++ /var/tmp/diff_new_pack.kc5NsL/_new 2019-10-23 15:51:49.694758030 +0200 @@ -70,7 +70,7 @@ %define ngx_doc_dir %{_datadir}/doc/packages/%{name} # Name: nginx -Version: 1.17.3 +Version: 1.17.4 Release: 0 %define ngx_fancyindex_version 0.4.2 %define ngx_fancyindex_module_path ngx-fancyindex-%{ngx_fancyindex_version} ++++++ nginx-1.17.3.tar.gz -> nginx-1.17.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/CHANGES new/nginx-1.17.4/CHANGES --- old/nginx-1.17.3/CHANGES 2019-08-13 14:46:01.000000000 +0200 +++ new/nginx-1.17.4/CHANGES 2019-09-24 17:08:52.000000000 +0200 @@ -1,4 +1,29 @@ +Changes with nginx 1.17.4 24 Sep 2019 + + *) Change: better detection of incorrect client behavior in HTTP/2. + + *) Change: in handling of not fully read client request body when + returning errors in HTTP/2. + + *) Bugfix: the "worker_shutdown_timeout" directive might not work when + using HTTP/2. + + *) Bugfix: a segmentation fault might occur in a worker process when + using HTTP/2 and the "proxy_request_buffering" directive. + + *) Bugfix: the ECONNABORTED error log level was "crit" instead of + "error" on Windows when using SSL. + + *) Bugfix: nginx ignored extra data when using chunked transfer + encoding. + + *) Bugfix: nginx always returned the 500 error if the "return" directive + was used and an error occurred during reading client request body. + + *) Bugfix: in memory allocation error handling. + + Changes with nginx 1.17.3 13 Aug 2019 *) Security: when using HTTP/2 a client might cause excessive memory diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/CHANGES.ru new/nginx-1.17.4/CHANGES.ru --- old/nginx-1.17.3/CHANGES.ru 2019-08-13 14:46:00.000000000 +0200 +++ new/nginx-1.17.4/CHANGES.ru 2019-09-24 17:08:51.000000000 +0200 @@ -1,4 +1,31 @@ +Изменения в nginx 1.17.4 24.09.2019 + + *) Изменение: улучшено детектирование некорректного поведения клиентов в + HTTP/2. + + *) Изменение: в обработке непрочитанного тела запроса при возврате + ошибок в HTTP/2. + + *) Исправление: директива worker_shutdown_timeout могла не работать при + использовании HTTP/2. + + *) Исправление: при использовании HTTP/2 и директивы + proxy_request_buffering в рабочем процессе мог произойти segmentation + fault. + + *) Исправление: на Windows при использовании SSL уровень записи в лог + ошибки ECONNABORTED был "crit" вместо "error". + + *) Исправление: nginx игнорировал лишние данные при использовании + chunked transfer encoding. + + *) Исправление: если использовалась директива return и при чтении тела + запроса возникала ошибка, nginx всегда возвращал ошибку 500. + + *) Исправление: в обработке ошибок выделения памяти. + + Изменения в nginx 1.17.3 13.08.2019 *) Безопасность: при использовании HTTP/2 клиент мог вызвать чрезмерное diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/core/nginx.h new/nginx-1.17.4/src/core/nginx.h --- old/nginx-1.17.3/src/core/nginx.h 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/core/nginx.h 2019-09-24 17:08:48.000000000 +0200 @@ -9,8 +9,8 @@ #define _NGINX_H_INCLUDED_ -#define nginx_version 1017003 -#define NGINX_VERSION "1.17.3" +#define nginx_version 1017004 +#define NGINX_VERSION "1.17.4" #define NGINX_VER "nginx/" NGINX_VERSION #ifdef NGX_BUILD diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/core/ngx_resolver.c new/nginx-1.17.4/src/core/ngx_resolver.c --- old/nginx-1.17.3/src/core/ngx_resolver.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/core/ngx_resolver.c 2019-09-24 17:08:48.000000000 +0200 @@ -972,7 +972,8 @@ name = ngx_resolver_dup(r, rn->name, rn->nlen); if (name == NULL) { - goto failed; + ngx_resolver_free(r, ctx); + return NGX_ERROR; } ctx->name.len = rn->nlen; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/event/ngx_event_openssl.c new/nginx-1.17.4/src/event/ngx_event_openssl.c --- old/nginx-1.17.3/src/event/ngx_event_openssl.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/event/ngx_event_openssl.c 2019-09-24 17:08:48.000000000 +0200 @@ -2814,6 +2814,9 @@ if (sslerr == SSL_ERROR_SYSCALL) { if (err == NGX_ECONNRESET +#if (NGX_WIN32) + || err == NGX_ECONNABORTED +#endif || err == NGX_EPIPE || err == NGX_ENOTCONN || err == NGX_ETIMEDOUT diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/modules/ngx_http_ssl_module.c new/nginx-1.17.4/src/http/modules/ngx_http_ssl_module.c --- old/nginx-1.17.3/src/http/modules/ngx_http_ssl_module.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/modules/ngx_http_ssl_module.c 2019-09-24 17:08:48.000000000 +0200 @@ -777,7 +777,7 @@ if (conf->client_certificate.len == 0 && conf->verify != 3) { ngx_log_error(NGX_LOG_EMERG, cf->log, 0, - "no ssl_client_certificate for ssl_client_verify"); + "no ssl_client_certificate for ssl_verify_client"); return NGX_CONF_ERROR; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/ngx_http_core_module.c new/nginx-1.17.4/src/http/ngx_http_core_module.c --- old/nginx-1.17.3/src/http/ngx_http_core_module.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/ngx_http_core_module.c 2019-09-24 17:08:48.000000000 +0200 @@ -1660,8 +1660,10 @@ ngx_buf_t *b; ngx_chain_t out; - if (ngx_http_discard_request_body(r) != NGX_OK) { - return NGX_HTTP_INTERNAL_SERVER_ERROR; + rc = ngx_http_discard_request_body(r); + + if (rc != NGX_OK) { + return rc; } r->headers_out.status = status; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/ngx_http_parse.c new/nginx-1.17.4/src/http/ngx_http_parse.c --- old/nginx-1.17.3/src/http/ngx_http_parse.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/ngx_http_parse.c 2019-09-24 17:08:48.000000000 +0200 @@ -2268,6 +2268,9 @@ break; case LF: state = sw_chunk_start; + break; + default: + goto invalid; } break; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/v2/ngx_http_v2.c new/nginx-1.17.4/src/http/v2/ngx_http_v2.c --- old/nginx-1.17.3/src/http/v2/ngx_http_v2.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/v2/ngx_http_v2.c 2019-09-24 17:08:48.000000000 +0200 @@ -354,6 +354,11 @@ if (c->close) { c->close = 0; + if (c->error) { + ngx_http_v2_finalize_connection(h2c, 0); + return; + } + if (!h2c->goaway) { h2c->goaway = 1; @@ -419,6 +424,14 @@ } while (p != end); + h2c->total_bytes += n; + + if (h2c->total_bytes / 8 > h2c->payload_bytes + 1048576) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, "http2 flood detected"); + ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR); + return; + } + } while (rev->ready); if (ngx_handle_read_event(rev, 0) != NGX_OK) { @@ -505,13 +518,12 @@ ngx_http_core_loc_conf_t *clcf; c = h2c->connection; + wev = c->write; if (c->error) { - return NGX_ERROR; + goto error; } - wev = c->write; - if (!wev->ready) { return NGX_AGAIN; } @@ -947,6 +959,15 @@ return ngx_http_v2_state_skip_padded(h2c, pos, end); } + r = stream->request; + + if (r->reading_body && !r->request_body_no_buffering) { + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0, + "skipping http2 DATA frame"); + + return ngx_http_v2_state_skip_padded(h2c, pos, end); + } + size = end - pos; if (size >= h2c->state.length) { @@ -954,7 +975,7 @@ stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG; } - r = stream->request; + h2c->payload_bytes += size; if (r->request_body) { rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed); @@ -1100,20 +1121,19 @@ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR); } - h2c->last_sid = h2c->state.sid; - - h2c->state.pool = ngx_create_pool(1024, h2c->connection->log); - if (h2c->state.pool == NULL) { - return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); - } - if (depend == h2c->state.sid) { ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, "client sent HEADERS frame for stream %ui " "with incorrect dependency", h2c->state.sid); - status = NGX_HTTP_V2_PROTOCOL_ERROR; - goto rst_stream; + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR); + } + + h2c->last_sid = h2c->state.sid; + + h2c->state.pool = ngx_create_pool(1024, h2c->connection->log); + if (h2c->state.pool == NULL) { + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); } h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx, @@ -1842,28 +1862,7 @@ "client sent PRIORITY frame for stream %ui " "with incorrect dependency", h2c->state.sid); - node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 0); - - if (node && node->stream) { - if (ngx_http_v2_terminate_stream(h2c, node->stream, - NGX_HTTP_V2_PROTOCOL_ERROR) - == NGX_ERROR) - { - return ngx_http_v2_connection_error(h2c, - NGX_HTTP_V2_INTERNAL_ERROR); - } - - } else { - if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, - NGX_HTTP_V2_PROTOCOL_ERROR) - == NGX_ERROR) - { - return ngx_http_v2_connection_error(h2c, - NGX_HTTP_V2_INTERNAL_ERROR); - } - } - - return ngx_http_v2_state_complete(h2c, pos, end); + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR); } node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 1); @@ -2246,41 +2245,11 @@ h2c->state.sid, window); if (window == 0) { - if (h2c->state.sid == 0) { - ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, - "client sent WINDOW_UPDATE frame " - "with incorrect window increment 0"); - - return ngx_http_v2_connection_error(h2c, - NGX_HTTP_V2_PROTOCOL_ERROR); - } - ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, - "client sent WINDOW_UPDATE frame for stream %ui " - "with incorrect window increment 0", h2c->state.sid); - - node = ngx_http_v2_get_node_by_id(h2c, h2c->state.sid, 0); - - if (node && node->stream) { - if (ngx_http_v2_terminate_stream(h2c, node->stream, - NGX_HTTP_V2_PROTOCOL_ERROR) - == NGX_ERROR) - { - return ngx_http_v2_connection_error(h2c, - NGX_HTTP_V2_INTERNAL_ERROR); - } - - } else { - if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, - NGX_HTTP_V2_PROTOCOL_ERROR) - == NGX_ERROR) - { - return ngx_http_v2_connection_error(h2c, - NGX_HTTP_V2_INTERNAL_ERROR); - } - } + "client sent WINDOW_UPDATE frame " + "with incorrect window increment 0"); - return ngx_http_v2_state_complete(h2c, pos, end); + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_PROTOCOL_ERROR); } if (h2c->state.sid) { @@ -2954,9 +2923,9 @@ "requested control frame is too large: %uz", length); return NULL; } +#endif frame->length = length; -#endif buf->last = ngx_http_v2_write_len_and_type(buf->pos, length, type); @@ -2983,6 +2952,8 @@ frame->next = h2c->free_frames; h2c->free_frames = frame; + h2c->total_bytes += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length; + return NGX_OK; } @@ -3768,7 +3739,8 @@ static void ngx_http_v2_run_request(ngx_http_request_t *r) { - ngx_connection_t *fc; + ngx_connection_t *fc; + ngx_http_v2_connection_t *h2c; fc = r->connection; @@ -3800,6 +3772,10 @@ r->headers_in.chunked = 1; } + h2c = r->stream->connection; + + h2c->payload_bytes += r->request_length; + ngx_http_process_request(r); failed: @@ -4329,33 +4305,11 @@ } } else if (!stream->in_closed) { -#if 0 if (ngx_http_v2_send_rst_stream(h2c, node->id, NGX_HTTP_V2_NO_ERROR) != NGX_OK) { h2c->connection->error = 1; } -#else - /* - * At the time of writing at least the latest versions of Chrome - * do not properly handle RST_STREAM with NO_ERROR status. - * - * See: https://bugs.chromium.org/p/chromium/issues/detail?id=603182 - * - * As a workaround, the stream window is maximized before closing - * the stream. This allows a client to send up to 2 GB of data - * before getting blocked on flow control. - */ - - if (stream->recv_window < NGX_HTTP_V2_MAX_WINDOW - && ngx_http_v2_send_window_update(h2c, node->id, - NGX_HTTP_V2_MAX_WINDOW - - stream->recv_window) - != NGX_OK) - { - h2c->connection->error = 1; - } -#endif } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/v2/ngx_http_v2.h new/nginx-1.17.4/src/http/v2/ngx_http_v2.h --- old/nginx-1.17.3/src/http/v2/ngx_http_v2.h 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/v2/ngx_http_v2.h 2019-09-24 17:08:48.000000000 +0200 @@ -119,6 +119,9 @@ ngx_connection_t *connection; ngx_http_connection_t *http_connection; + off_t total_bytes; + off_t payload_bytes; + ngx_uint_t processing; ngx_uint_t frames; ngx_uint_t idle; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/http/v2/ngx_http_v2_filter_module.c new/nginx-1.17.4/src/http/v2/ngx_http_v2_filter_module.c --- old/nginx-1.17.3/src/http/v2/ngx_http_v2_filter_module.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/http/v2/ngx_http_v2_filter_module.c 2019-09-24 17:08:48.000000000 +0200 @@ -1877,6 +1877,8 @@ stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length; + h2c->payload_bytes += frame->length; + ngx_http_v2_handle_frame(stream, frame); ngx_http_v2_handle_stream(h2c, stream); @@ -1931,6 +1933,8 @@ stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length; + h2c->payload_bytes += frame->length; + ngx_http_v2_handle_frame(stream, frame); ngx_http_v2_handle_stream(h2c, stream); @@ -2024,6 +2028,8 @@ stream->request->header_size += NGX_HTTP_V2_FRAME_HEADER_SIZE; + h2c->payload_bytes += frame->length; + ngx_http_v2_handle_frame(stream, frame); ngx_http_v2_handle_stream(h2c, stream); @@ -2036,12 +2042,17 @@ ngx_http_v2_handle_frame(ngx_http_v2_stream_t *stream, ngx_http_v2_out_frame_t *frame) { - ngx_http_request_t *r; + ngx_http_request_t *r; + ngx_http_v2_connection_t *h2c; r = stream->request; r->connection->sent += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length; + h2c = stream->connection; + + h2c->total_bytes += NGX_HTTP_V2_FRAME_HEADER_SIZE + frame->length; + if (frame->fin) { stream->out_closed = 1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/mail/ngx_mail_ssl_module.c new/nginx-1.17.4/src/mail/ngx_mail_ssl_module.c --- old/nginx-1.17.3/src/mail/ngx_mail_ssl_module.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/mail/ngx_mail_ssl_module.c 2019-09-24 17:08:48.000000000 +0200 @@ -388,7 +388,7 @@ if (conf->client_certificate.len == 0 && conf->verify != 3) { ngx_log_error(NGX_LOG_EMERG, cf->log, 0, - "no ssl_client_certificate for ssl_client_verify"); + "no ssl_client_certificate for ssl_verify_client"); return NGX_CONF_ERROR; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nginx-1.17.3/src/stream/ngx_stream_ssl_module.c new/nginx-1.17.4/src/stream/ngx_stream_ssl_module.c --- old/nginx-1.17.3/src/stream/ngx_stream_ssl_module.c 2019-08-13 14:45:57.000000000 +0200 +++ new/nginx-1.17.4/src/stream/ngx_stream_ssl_module.c 2019-09-24 17:08:48.000000000 +0200 @@ -745,7 +745,7 @@ if (conf->client_certificate.len == 0 && conf->verify != 3) { ngx_log_error(NGX_LOG_EMERG, cf->log, 0, - "no ssl_client_certificate for ssl_client_verify"); + "no ssl_client_certificate for ssl_verify_client"); return NGX_CONF_ERROR; }
